Overview
Operational Procedures is Core 2 (220-1202) domain 4.0 and carries 21% of that exam across ten objectives. It covers ticketing and asset management, documentation types and SLAs, change management procedures, workstation backup and recovery (full, incremental, differential, synthetic full, rotation schemes and the 3-2-1 rule), safety procedures including ESD and lifting, environmental controls and disposal, incident response basics and licensing and policy concepts, communication and professionalism, scripting basics, remote access technologies (RDP, VPN, VNC, SSH, RMM, SPICE, WinRM), and basic concepts related to artificial intelligence.
The domain exists because technical skill is only part of a support role; the rest is working safely, documenting, protecting data and dealing with people. It wraps around every other A+ domain: changes, backups and tickets accompany each repair, and remote access is how much of today's support is delivered.
How it's tested
Questions are mostly scenarios about process and judgment: what to do first when finding prohibited content, which backup set is needed for a restore, which document defines a service commitment, or which remote tool fits a platform. The correct answer usually follows the documented process and protects data, safety and the customer relationship.
-
Follow the process
A change, incident or ticket scenario asks for the next step, and the answer respects approvals, documentation, chain of custody or escalation.
-
Calculate the restore
A backup schedule and a failure day are given, and you determine which backup sets must be restored or which scheme meets the requirement.
-
Professional and safe conduct
A customer interaction, safety hazard or privacy situation is described, and you choose the professional, safe or compliant response.
A company runs a full backup every Sunday and differential backups Monday through Saturday. The server fails Thursday morning before that day's backup. Because each differential holds all changes since the last full backup, only Sunday's full and Wednesday's differential are needed. With incrementals instead, the restore would need Sunday's full plus Monday, Tuesday and Wednesday incrementals in order.
Objectives 10
Official objectives from the CompTIA outline, in outline order.
4.1 Given a scenario, implement best practices associated with documentation and support systems information managementTicketing, asset management and support documentation.
- What it means
- Covers ticketing systems (user and device information, description of issues, categories, severity, escalation levels, clear and concise written communication including problem description, progress notes and problem resolution), asset management (inventory lists, configuration management database, asset tags and IDs, procurement and life cycle, warranty and licensing, assigned users) and document types (incident reports, standard operating procedures, onboarding and offboarding checklists, service-level agreements, knowledge base articles).
- What to understand
- A good ticket lets someone else pick up the work: who, what device, what happened, what was tried and what fixed it. A CMDB records configuration items and their relationships, which helps assess the impact of changes. SLAs define response and resolution commitments, and knowledge base articles turn solved tickets into reusable fixes.
- How it shows up
- A technician must hand off a ticket, or a manager needs to know which systems a server change affects, and you choose ticket notes or the CMDB.
- Common confusion
- Confusing an SLA with an SOP. An SLA is a commitment about service levels to a customer; an SOP is internal step-by-step instructions.
4.2 Given a scenario, apply change management proceduresDocumented processes, change requests, approvals, testing and rollback.
- What it means
- Covers documented business processes (rollback plan, backup plan, sandbox testing, responsible staff member), change management elements (request forms, purpose of the change, scope, change type such as standard, normal or emergency, date and time, change freeze and maintenance windows, affected systems and impact, risk analysis and risk level, change board approvals, implementation, peer review, end-user acceptance).
- What to understand
- Changes are requested, assessed for risk and impact, approved, tested, scheduled in a maintenance window and implemented with a rollback plan ready. Standard changes are pre-approved and low risk, normal changes go through review, and emergency changes are expedited but still documented. A change freeze blocks non-emergency changes during critical business periods.
- How it shows up
- A technician wants to patch a server during business hours without approval, or a change fails mid-implementation, and you choose the approval process or rollback plan.
- Common confusion
- Treating emergency changes as exempt from documentation. They are fast-tracked, but they are still recorded and reviewed.
4.3 Given a scenario, implement workstation backup and recovery methodsBackup types, recovery options, testing and rotation schemes.
- What it means
- Covers backup types (full, incremental, differential, synthetic full), recovery (in-place or overwrite, alternative location), backup testing frequency, and backup rotation schemes (onsite and offsite, grandfather-father-son, 3-2-1 backup rule).
- What to understand
- Incremental backups capture changes since the last backup of any type, so they are fast to make but restores need the full plus every incremental since. Differential backups capture changes since the last full, so restores need only the full plus the latest differential. A synthetic full is built from existing backups without rereading the source. The 3-2-1 rule means three copies, on two types of media, with one offsite.
- How it shows up
- A restore needs the minimum number of backup sets, or an office wants protection from a building fire, and you choose differential or offsite rotation.
- Common confusion
- Swapping incremental and differential. Incrementals are smallest per run but slowest to restore; differentials grow daily but restore with two sets.
4.4 Given a scenario, use common safety proceduresESD, grounding, component handling, cable management and personal safety.
- What it means
- Covers electrostatic discharge straps and mats, equipment grounding, proper electrical fire safety and power handling, proper component handling and storage including antistatic bags, cable management, compliance with government regulations, and personal safety (disconnect power before repairing, lifting techniques, fire safety, safety goggles, air filtration masks).
- What to understand
- Disconnect power before opening equipment, and never open power supplies or CRTs because capacitors can hold dangerous charge. Use an ESD strap attached to a ground point and store components in antistatic bags. Lift with your legs and keep the load close; get help for heavy equipment. Electrical fires require an extinguisher rated for electrical equipment, never water.
- How it shows up
- A technician must replace RAM in a dry office, or move a heavy UPS, and you choose ESD protection or proper lifting and help.
- Common confusion
- Wearing an ESD strap while working on high-voltage components. ESD straps protect components; for live high-voltage work, they can create a path through the body and should not be used.
4.5 Summarize environmental impacts and local environment controlsSafety data sheets, disposal, temperature, humidity, ventilation and power protection.
- What it means
- Covers material safety data sheets for handling and disposal of batteries, toner and other devices, temperature, humidity-level awareness and proper ventilation, location and equipment placement, dust cleanup, and power surges, under-voltage events and power losses with uninterruptible power supplies and surge suppressors.
- What to understand
- Check the safety data sheet for handling, spill and disposal instructions for chemicals such as toner and batteries, and dispose of them under local regulations rather than in general waste. Low humidity raises ESD risk; high humidity risks condensation. A UPS supplies battery power through outages and sags, while a surge suppressor only clamps spikes.
- How it shows up
- A toner cartridge leaks, or a server must stay up through brief outages, and you choose the safety data sheet or a UPS.
- Common confusion
- Assuming a surge suppressor keeps equipment running in a blackout. Only a UPS provides power when the mains fail.
4.6 Explain the importance of prohibited content/activity and privacy, licensing, and policy conceptsIncident response, licensing, regulated data and policy documents.
- What it means
- Covers incident response (chain of custody, informing management and law enforcement as necessary, copying a drive for data integrity and preservation, documenting the incident, order of volatility), licensing, digital rights management and EULAs (valid licenses, perpetual licenses, personal versus corporate use, open-source licenses), regulated data (credit card payment information, PII, PHI, government-issued information), data retention requirements, non-disclosure agreements including mutual NDAs, and acceptable use policies.
- What to understand
- When a technician discovers prohibited content, stop, do not alter or delete anything, document it, preserve the evidence, and report it to the appropriate manager following policy. Chain of custody records every handoff so evidence remains admissible. Order of volatility means collecting the most short-lived data, such as RAM, before more persistent data like disk contents.
- How it shows up
- A technician finds illegal material on a user's laptop during a repair, and you choose the correct first response.
- Common confusion
- Deleting or confronting the user about prohibited content. The technician should preserve and report, not remediate or investigate personally.
4.7 Given a scenario, use proper communication techniques and professionalismProfessional conduct, language, listening, difficult customers and confidentiality.
- What it means
- Covers professional appearance and attire, proper language without jargon or acronyms, maintaining a positive attitude, actively listening and taking notes, cultural sensitivity and proper titles, punctuality, avoiding distractions such as personal calls and social media, dealing with difficult customers or situations, setting and meeting expectations, follow-up, and handling confidential and private materials.
- What to understand
- Listen without interrupting, restate the problem to confirm understanding, and avoid arguing or being dismissive. Offer options and a realistic timeline, then follow up after resolution. Treat any personal data or documents you encounter as confidential, and do not use a customer's equipment or information for anything outside the repair.
- How it shows up
- A frustrated user is shouting about lost work, or a technician runs late, and you choose the professional response.
- Common confusion
- Thinking the most technically efficient response is the best. The exam favors the answer that respects the customer, sets expectations and keeps communication clear.
4.8 Explain the basics of scriptingScript file types, common uses and risks.
- What it means
- Covers script file types (.bat, .ps1, .vbs, .sh, .js, .py), use cases (basic automation, restarting machines, remapping network drives, installing applications, automated backups, gathering information and data, initiating updates) and other considerations (unintentionally introducing malware, inadvertently changing system settings, browser or system crashes due to mishandling of resources).
- What to understand
- Batch (.bat) runs in the Windows command interpreter, PowerShell (.ps1) is the modern Windows automation shell, VBScript (.vbs) is legacy Windows scripting, shell scripts (.sh) run on Linux and macOS, JavaScript (.js) runs in browsers or runtimes, and Python (.py) is cross-platform. Test scripts in a safe environment and use trusted sources, because a script runs with the rights of whoever launches it.
- How it shows up
- An administrator wants to map drives at sign-in or automate a task on Linux, and you choose the script type.
- Common confusion
- Choosing a .sh script for a Windows-only task. Shell scripts run in Unix-like shells; Windows tasks typically use .ps1 or .bat.
4.9 Given a scenario, use remote access technologiesRDP, VPN, VNC, SSH, RMM, SPICE, WinRM and third-party tools, with security considerations.
- What it means
- Covers methods (RDP, VPN, virtual network computing, SSH, remote monitoring and management, Simple Protocol for Independent Computing Environments, Windows Remote Management) and third-party tools (screen-sharing software, video-conferencing software, file transfer software, desktop management software), plus security considerations of each.
- What to understand
- RDP gives full graphical sessions to Windows hosts; VNC shares a screen across platforms; SSH gives encrypted command-line access, typically to Linux and network devices; WinRM allows remote PowerShell management of Windows; SPICE provides remote display for virtual machines; RMM lets managed service providers monitor and patch many endpoints. Never expose RDP directly to the internet; put it behind a VPN or gateway with MFA.
- How it shows up
- A technician needs encrypted command-line access to a Linux server, or to manage many clients' endpoints, and you choose SSH or RMM.
- Common confusion
- Treating a VPN as a remote control tool. A VPN provides a secure network connection; you still need RDP, SSH or similar to control a host.
4.10 Explain basic concepts related to artificial intelligence (AI)AI integration, usage policy, limitations and private vs. public AI.
- What it means
- Covers application integration, policy (appropriate use, plagiarism), limitations (bias, hallucinations, accuracy) and private versus public AI (data security, data source, data privacy).
- What to understand
- Public AI services may retain or learn from what users submit, so confidential, regulated or customer data should only go into approved private or enterprise AI tools. AI output can be confidently wrong (hallucination) or reflect bias in its training data, so verify it before acting. Organizations set acceptable-use policies covering what may be submitted and how AI-generated content is attributed.
- How it shows up
- A technician wants to paste customer logs into a public chatbot, or a user presents AI-generated text as their own work, and you identify the privacy or policy issue.
- Common confusion
- Assuming AI output is accurate because it sounds authoritative. Hallucinations are fluent but false, so outputs need verification.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Full, incremental and differential backups
Full copies everything; incremental copies changes since the last backup of any type; differential copies changes since the last full.
- Remember
- Restore with incrementals needs the full plus every incremental in order; restore with differentials needs the full plus the latest differential.
- Tested as
- Restore-set calculation questions.
- Trap
- Thinking differential restores need every differential.
-
Synthetic full backup
A full backup assembled from a previous full and later incrementals on the backup system, without rereading the source.
- Remember
- It reduces load on production systems while keeping restores simple.
- Tested as
- Backup type identification.
- Trap
- Thinking it is just another name for a differential.
-
3-2-1 backup rule
Keep three copies of data on two different media types with one copy offsite.
- Remember
- The offsite copy protects against site-wide events such as fire, flood or ransomware.
- Tested as
- Designing a resilient backup strategy.
- Trap
- Keeping all copies in the same building.
-
Grandfather-father-son rotation
A rotation using daily (son), weekly (father) and monthly (grandfather) backup sets.
- Remember
- It provides long retention with a manageable number of media.
- Tested as
- Rotation scheme questions.
- Trap
- Confusing it with the 3-2-1 rule, which addresses copies and locations.
-
Change types
Standard (pre-approved, low risk), normal (assessed and approved by the change board), emergency (expedited for urgent issues).
- Remember
- All changes are documented, and all need a rollback plan.
- Tested as
- Change management scenarios.
- Trap
- Skipping approval for a normal change because it seems simple.
-
Rollback plan
Documented steps to return to the previous state if a change fails.
- Remember
- It is prepared before implementation, along with a backup.
- Tested as
- A change causes problems mid-implementation.
- Trap
- Troubleshooting forward indefinitely instead of rolling back.
-
Chain of custody
A documented record of who handled evidence, when and why.
- Remember
- Gaps in the chain can make evidence unusable.
- Tested as
- Incident response and prohibited content questions.
- Trap
- Handing a device to someone without documenting the transfer.
-
Order of volatility
Collect evidence from the most volatile sources first, such as CPU cache and RAM, before disk and archival media.
- Remember
- Powering off a system destroys RAM contents.
- Tested as
- Evidence collection sequencing.
- Trap
- Shutting down the machine before capturing memory.
-
Prohibited content response
Stop work, preserve evidence, document and report to the appropriate authority under policy.
- Remember
- Do not delete, copy for personal use, or confront the user.
- Tested as
- First-response questions.
- Trap
- Deleting the content to protect the company.
-
ESD protection
Antistatic straps, mats and bags that equalize charge and protect sensitive components.
- Remember
- Connect the strap to a ground point and handle components by their edges.
- Tested as
- Safety and component handling scenarios.
- Trap
- Using a strap while working inside a power supply.
-
UPS vs. surge suppressor
A UPS supplies battery power during outages and sags; a surge suppressor only diverts voltage spikes.
- Remember
- Systems that must keep running or shut down gracefully need a UPS.
- Tested as
- Power protection choices.
- Trap
- Expecting a surge suppressor to bridge an outage.
-
Safety data sheet
Documentation listing hazards, handling, spill response and disposal for a product.
- Remember
- Consult it before handling or disposing of toner, batteries and chemicals.
- Tested as
- Spills and disposal scenarios.
- Trap
- Throwing toner or batteries in general waste.
-
Remote access tools
RDP for Windows GUI sessions, SSH for encrypted command lines, VNC for cross-platform screen sharing, WinRM for remote PowerShell, RMM for managing many endpoints, SPICE for VM displays.
- Remember
- Protect remote access with VPN or gateways, MFA and least privilege.
- Tested as
- Choosing a tool for a platform or task.
- Trap
- Exposing RDP directly to the internet.
-
Public vs. private AI
Public AI services are open to anyone and may retain inputs; private AI is controlled by the organization.
- Remember
- Do not submit confidential or regulated data to public AI unless policy explicitly allows it.
- Tested as
- AI policy and privacy questions.
- Trap
- Pasting customer data into a public chatbot to speed up troubleshooting.
-
AI hallucination and bias
Hallucination is confident but false output; bias is systematic skew inherited from training data.
- Remember
- Verify AI-generated answers, commands and summaries before relying on them.
- Tested as
- AI limitation questions.
- Trap
- Running an AI-suggested command without checking it.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Full vs. incremental vs. differential vs. synthetic full
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Full | Copies all selected data. | Slowest to create, simplest to restore. | Running it daily when the window is too short. |
| Incremental | Copies changes since the last backup of any type. | Fastest to create; restore needs full plus every incremental. | Missing one incremental breaks the chain. |
| Differential | Copies changes since the last full. | Grows each day; restore needs full plus latest differential. | Thinking it resets after each differential. |
| Synthetic full | Full backup built from existing backups. | No extra load on the source system. | Confusing it with a differential. |
RDP vs. SSH vs. VNC vs. RMM vs. VPN
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| RDP | Graphical remote session to Windows (TCP 3389). | Full desktop control of Windows hosts. | Exposing it directly to the internet. |
| SSH | Encrypted command-line access (TCP 22). | Standard for Linux servers and network devices. | Choosing Telnet instead. |
| VNC | Cross-platform screen sharing. | Works across operating systems; security depends on configuration. | Assuming it is encrypted by default. |
| RMM | Platform for monitoring, patching and remote control of many endpoints. | Scale for managed service providers. | Ignoring the risk that a compromised RMM reaches every client. |
| VPN | Encrypted tunnel into a private network. | Provides network access, not remote control. | Expecting it to show the remote desktop. |
SLA vs. SOP vs. knowledge base article
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| SLA | Agreement defining service levels such as response and resolution times. | An external or internal commitment. | Treating it as a how-to procedure. |
| SOP | Step-by-step internal procedure for a routine task. | Ensures consistency in how work is done. | Confusing it with a policy statement. |
| Knowledge base article | Documented solution to a known issue. | Reusable fix for technicians or users. | Not updating it after finding a new resolution. |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Every differential in the restore
- What candidates pick
- Restore the full plus every differential since Sunday.
- Why it looks right
- It mirrors the incremental restore pattern.
- Why it's wrong
- Each differential already contains all changes since the full, so only the latest differential is needed.
Clue to watch for The schedule uses differentials, not incrementals.
-
Cleaning up prohibited content
- What candidates pick
- Delete the illegal files and finish the repair.
- Why it looks right
- It removes the problem from company equipment.
- Why it's wrong
- Deleting destroys evidence; stop, preserve, document and report according to policy with chain of custody.
Clue to watch for The technician discovers content that violates law or policy during routine work.
-
Quick fix without approval
- What candidates pick
- Apply a server patch immediately during business hours because it seems low risk.
- Why it looks right
- Fixing quickly appears helpful.
- Why it's wrong
- Normal changes need risk analysis, approval and a scheduled maintenance window with a rollback plan.
Clue to watch for The change is not pre-approved and affects shared systems.
-
Surge suppressor for outages
- What candidates pick
- A surge suppressor so the network closet keeps running during brief power losses.
- Why it looks right
- It is labeled as power protection.
- Why it's wrong
- A surge suppressor provides no power during an outage; a UPS supplies battery power and time to shut down gracefully.
Clue to watch for The requirement mentions outages, brownouts or graceful shutdown.
-
Public AI for sensitive data
- What candidates pick
- Paste a customer's error logs, including account details, into a public chatbot to diagnose faster.
- Why it looks right
- AI tools can speed up troubleshooting.
- Why it's wrong
- Public AI may retain submitted data, exposing confidential information; use approved private AI or remove sensitive data per policy.
Clue to watch for The data includes PII, credentials or customer information.
-
VPN as remote control
- What candidates pick
- Use a VPN to view and control a user's desktop.
- Why it looks right
- VPNs are associated with remote work.
- Why it's wrong
- A VPN only provides secure network access; screen control needs RDP, VNC, a screen-sharing tool or RMM.
Clue to watch for The technician must see or operate the user's screen.
-
Technical efficiency over professionalism
- What candidates pick
- Take a personal call while a long update runs at the customer's desk.
- Why it looks right
- The technician is just waiting.
- Why it's wrong
- Professional conduct means avoiding personal distractions while on a customer's time and premises.
Clue to watch for The question asks about professionalism or customer service.
Answer framework
Use these steps for procedure, safety and professionalism questions in Operational Procedures.
- Identify which process applies: ticketing, change management, backup and recovery, safety, incident response, communication or remote access.
- Choose the step that protects people and data first, such as disconnecting power, preserving evidence, or backing up before a change.
- Follow the documented order for that process, including approval before implementation, chain of custody for evidence, and verification after recovery.
- Match tools and backup types to stated constraints like restore speed, offsite needs, platform or the number of endpoints, and eliminate options that ignore one of them.
- Prefer the answer that is professional, compliant with policy and regulations, and documented in the ticket or knowledge base.
Practice question
Want more like this? The CompTIA A+ practice test has questions for every domain.
Checklist
0 of 14
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Start with objective 4.3, because backup restore calculations are precise and easy to practice. Draw a week on paper, mark full, incremental and differential runs, and work out restore sets for failures on different days. Then cover 4.2 and 4.1 together, since change management and documentation share vocabulary such as rollback plan, CMDB and SLA.
Next, study 4.6 carefully. Candidates underestimate it, yet chain of custody, order of volatility, licensing and regulated data generate many precise questions. Pair it with 4.10, the new AI objective, focusing on public versus private AI, hallucinations, bias and acceptable use. Then review 4.4 and 4.5 as a safety block: ESD, lifting, fire safety, safety data sheets, UPS and surge protection.
Finish with 4.7, 4.8 and 4.9. For communication, learn the expected professional response patterns. For scripting, match each extension to its platform. For remote access, map each tool to its platform and use case. Afterwards, take a full-length Core 2 practice exam, since this domain's procedures appear inside questions from every other Core 2 domain.
FAQ
How much of Core 2 is Operational Procedures?
Operational Procedures is 21% of Core 2 (220-1202), with ten objectives covering documentation, change management, backups, safety, environment, policy, communication, scripting, remote access and AI.
Is AI really on the A+ exam?
Yes. Core 2 V15 added objective 4.10, covering AI integration, appropriate-use policy, limitations such as bias and hallucinations, and private versus public AI with data privacy concerns.
Do I need to write scripts for A+?
No. Objective 4.8 asks you to explain scripting basics: recognize file types, know common use cases, and understand the risks of running scripts.
What is the fastest way to remember incremental versus differential?
Incremental backs up what changed since the last backup, so restores need every link in the chain. Differential backs up what changed since the last full, so restores need just two sets.
What should a technician do on finding prohibited content?
Stop, avoid altering anything, document what was found, preserve the device and evidence, and report it through the proper channel as defined by policy, maintaining chain of custody.
Which remote access tool should I choose for a Linux server?
SSH is the standard for encrypted command-line access to Linux. Use VNC if a graphical session is required, and protect access with a VPN or gateway and strong authentication.
How does this domain relate to the other A+ domains?
Its procedures surround every technical task: backing up before changes, documenting repairs, following safety rules during hardware work, and using remote access to support users across both cores.
Other IT Fundamentals & Hardware certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 9 knowledge
You have covered documentation, change management, backups, safety, policy and incident response, communication, scripting, remote access and AI basics. Check whether you can apply these procedures in timed Core 2 scenarios.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the CompTIA A+ AI tutor Get any concept explained your way