Overview
Security is Core 2 (220-1202) domain 2.0 and carries 28% of that exam across eleven objectives. It covers physical and logical security measures, Windows security settings (Defender, firewall, account types, NTFS and share permissions, UAC, BitLocker, EFS, Active Directory basics), wireless protocols and authentication (WPA2, WPA3, RADIUS, TACACS+, Kerberos, MFA), malware types and tools, social engineering attacks and vulnerabilities, the SOHO malware removal procedure, workstation hardening, mobile device security, data destruction, SOHO router and Wi-Fi settings, and browser security.
The domain expects an entry-level technician to apply controls correctly rather than design security programs. It draws on Core 2 domain 1.0 for the tools that implement these settings, and on Core 1 Networking for the ports and Wi-Fi concepts behind router and firewall configuration.
How it's tested
Questions describe a threat, symptom or requirement and ask for the BEST control, the correct order of steps, or the attack type. Read for clues about ownership, data sensitivity, media type and what the user experienced. Performance-based items may ask you to order the malware removal steps or configure a SOHO router or Windows security setting.
-
Name the attack
A short story describes an email, call, visitor or network behavior, and you identify phishing, vishing, tailgating, evil twin, on-path or another named attack.
-
Choose the control
A risk is described and you pick the measure that addresses it most directly, such as BitLocker for a lost laptop or MFA for stolen passwords.
-
Order the procedure
A malware or hardening scenario asks what to do FIRST or NEXT, testing the official removal sequence and safe practice.
A technician confirms a home user's PC shows malware symptoms and has quarantined it from the network. The question asks what to do next before remediation. On Windows Home, System Restore should be disabled so infected restore points are removed and cannot reinfect the system. Running the scan first is tempting, but the procedure places disabling System Restore before remediation.
Objectives 11
Official objectives from the CompTIA outline, in outline order.
2.1 Summarize various security measures and their purposesPhysical security, physical access controls and logical security concepts.
- What it means
- Covers physical security (bollards, access control vestibules, badge readers, video surveillance, alarm systems, motion sensors, door and equipment locks, guards, fences), physical access security (key fobs, smart cards, mobile digital keys, keys, biometrics such as retina, fingerprint, palm print, facial and voice recognition, magnetometers, lighting) and logical security (least privilege, Zero Trust, ACLs, MFA via email, hardware token, authenticator app, SMS, voice call or TOTP and one-time passwords, SAML, SSO, just-in-time access, privileged access management, MDM, DLP, IAM and directory services).
- What to understand
- An access control vestibule forces one person at a time through two doors to stop tailgating. Least privilege grants only the access a role needs, and Zero Trust verifies every request regardless of network location. MFA combines different factor types, such as something you know and something you have; two passwords are still a single factor.
- How it shows up
- A data center wants to stop tailgating, or a company wants to limit admin rights to short windows, and you choose the vestibule or just-in-time access.
- Common confusion
- Counting a password plus a security question as MFA. Both are something you know, so it is single-factor.
2.2 Given a scenario, configure and apply basic Microsoft Windows OS security settingsDefender, firewall, accounts, sign-in options, permissions, UAC, encryption and Active Directory tasks.
- What it means
- Covers Microsoft Defender Antivirus, Windows Defender Firewall, user and group types (standard, administrator, guest, power users), sign-in options (username and password, PIN, fingerprint, facial recognition, passwordless and Windows Hello, SSO), NTFS versus share permissions, file and folder attributes and inheritance, run as administrator, User Account Control, BitLocker and BitLocker To Go, Encrypting File System, and Active Directory tasks such as joining a domain, assigning logon scripts, home folders, Group Policy, security groups, organizational units and folder redirection.
- What to understand
- When a user accesses a shared folder over the network, Windows applies both share and NTFS permissions and the more restrictive result wins; locally only NTFS applies. BitLocker encrypts whole volumes and uses the TPM, BitLocker To Go encrypts removable drives, and EFS encrypts individual files tied to a user account. UAC prompts before elevation even for administrators.
- How it shows up
- A user has NTFS Modify but share Read on a folder and cannot save files over the network, and you explain the effective permission.
- Common confusion
- Assuming the most permissive permission wins. Between share and NTFS, the most restrictive applies.
2.3 Compare and contrast wireless security protocols and authentication methodsWPA2, WPA3, TKIP, AES, RADIUS, TACACS+, Kerberos and MFA.
- What it means
- Covers wireless protocols (WPA2, WPA3), encryption (TKIP, AES) and authentication methods (RADIUS, TACACS+, Kerberos, multifactor).
- What to understand
- WPA3 replaces the pre-shared key handshake with Simultaneous Authentication of Equals, which resists offline password guessing. AES is the current encryption; TKIP is deprecated. RADIUS centralizes authentication for Wi-Fi and VPN and is often used with WPA2 or WPA3 Enterprise; TACACS+ separates authentication, authorization and accounting and is common for network device administration. Kerberos issues tickets in Windows domains and depends on synchronized clocks.
- How it shows up
- An office wants each employee to use their own credentials on Wi-Fi rather than a shared password, and you choose Enterprise mode with RADIUS.
- Common confusion
- Treating TKIP as a secure option because it appears in router menus. It is a legacy protocol that should be avoided.
2.4 Summarize types of malware and tools/methods for detection, removal, and preventionMalware types and the tools and practices that address them.
- What it means
- Covers malware types (trojans, rootkits, viruses, spyware, ransomware, keyloggers, boot sector viruses, cryptominers, stalkerware, fileless malware, adware, potentially unwanted programs) and tools and methods (recovery console, endpoint detection and response, managed detection and response, extended detection and response, email security gateways, software firewalls, user education on anti-phishing, OS reinstallation).
- What to understand
- Ransomware encrypts data for payment, so offline backups are the recovery path. Rootkits hide at a deep level and may survive normal scans, often requiring offline scanning or reinstallation. Fileless malware lives in memory and abuses legitimate tools such as PowerShell, which signature antivirus can miss and EDR is designed to detect through behavior.
- How it shows up
- Files are suddenly renamed and unreadable with a payment note, or a system hides processes from Task Manager, and you name the malware and response.
- Common confusion
- Confusing a virus and a worm-like trojan. A virus attaches to files and needs user action to spread; a trojan disguises itself as legitimate software.
2.5 Compare and contrast common social engineering attacks, threats, and vulnerabilitiesPhishing variants, physical social engineering, technical attacks and vulnerabilities.
- What it means
- Covers social engineering (phishing, vishing, smishing, QR code phishing, spear phishing, whaling, shoulder surfing, tailgating, impersonation, dumpster diving), threats (denial of service, distributed denial of service, evil twin, zero-day attack, spoofing, on-path attack, brute-force attack, dictionary attack, insider threat, SQL injection, cross-site scripting, business email compromise, supply chain attack) and vulnerabilities (non-compliant systems, unpatched systems, unprotected systems lacking antivirus or firewall, end-of-life OS, BYOD).
- What to understand
- Phishing is by email, vishing by voice, smishing by text, and QR code phishing hides a malicious link in a code. Spear phishing targets specific people; whaling targets executives. An evil twin is a rogue access point mimicking a legitimate SSID. Business email compromise uses a compromised or spoofed executive or vendor mailbox to request payments or data.
- How it shows up
- A finance clerk receives a request from the CEO's real but compromised mailbox to change a supplier's bank details, and you name the attack.
- Common confusion
- Mixing up tailgating and shoulder surfing. Tailgating is following someone through a secured door; shoulder surfing is watching their screen or keypad.
2.6 Given a scenario, implement procedures for basic small office/home office (SOHO) malware removalThe ordered malware removal procedure.
- What it means
- Covers the ordered steps: investigate and verify malware symptoms, quarantine infected systems, disable System Restore in Windows Home, remediate infected systems (update anti-malware software, scan and remove using safe mode or a preinstallation environment, reimage or reinstall if needed), schedule scans and run updates, enable System Restore and create a restore point in Windows Home, and educate the end user.
- What to understand
- The order protects the network and prevents reinfection: isolate first, remove infected restore points before cleaning, update definitions before scanning, and only re-enable System Restore after the system is clean so the new restore point is trustworthy. Education closes the loop by addressing how the infection started.
- How it shows up
- A partial sequence is given and you choose the next step, or steps are presented for ordering in a performance-based item.
- Common confusion
- Scanning before quarantining or before updating definitions. Isolation comes first, and scanning with old definitions may miss the threat.
2.7 Given a scenario, apply workstation security options and hardening techniquesEncryption, password policy, end-user practices, account and service restrictions.
- What it means
- Covers data-at-rest encryption, password considerations (length, character types, uniqueness, complexity, expiration), BIOS/UEFI passwords, end-user best practices (screensaver locks, logging off when not in use, securing PII and passwords, using password managers), account management (restricting user permissions, restricting login times, disabling guest account, failed attempts lockout, timeout and screen lock, account expiration dates), changing default administrator credentials, disabling AutoRun and AutoPlay, and disabling unused services.
- What to understand
- Hardening reduces attack surface: disable what is not used, limit accounts to what they need, and lock sessions automatically. Account lockout after failed attempts slows brute-force guessing, while expiration dates automatically disable temporary or contractor accounts. Disabling AutoRun prevents removable media from launching code automatically.
- How it shows up
- A contractor's access must end automatically, or a kiosk keeps being misused after hours, and you choose account expiration or login time restrictions.
- Common confusion
- Assuming a BIOS/UEFI password protects data on a removed drive. It does not; data-at-rest encryption does.
2.8 Given a scenario, apply common methods for securing mobile devicesEncryption, screen locks, profiles, patching, endpoint security, remote wipe and MDM.
- What it means
- Covers hardening techniques (device encryption, screen locks using facial recognition, PIN, fingerprint or pattern, configuration profiles), patch management (OS and application updates), endpoint security software (antivirus, anti-malware, content filtering), locator applications, remote wipes, remote backup applications, failed login attempt restrictions, and policies and procedures for MDM and BYOD versus corporate-owned devices.
- What to understand
- Configuration profiles enforce passcode rules, Wi-Fi, VPN and restrictions consistently. Remote wipe protects data on lost devices but requires the device to be enrolled and reachable. Failed-attempt limits can erase or lock the device after repeated wrong PINs. BYOD policies should separate corporate data so it can be wiped without touching personal content.
- How it shows up
- A sales rep loses a phone containing customer data, and you choose remote wipe or locate based on what the scenario states.
- Common confusion
- Expecting remote wipe to work on a device that was never enrolled in MDM or set up with a locator service.
2.9 Compare and contrast common data destruction and disposal methodsPhysical destruction, recycling and reuse, outsourcing, and regulatory requirements.
- What it means
- Covers physical destruction of hard drives (drilling, shredding, degaussing, incineration), recycling or repurposing best practices (erasing and wiping, low-level formatting, standard formatting), outsourcing to third-party vendors with certification of destruction or recycling, and regulatory and environmental requirements.
- What to understand
- Degaussing destroys data on magnetic media such as hard drives and tapes but does nothing to SSDs or flash. A standard format usually leaves data recoverable, so drives to be reused need a secure wipe. When a vendor destroys media, obtain a certificate of destruction as proof for audits.
- How it shows up
- A company is disposing of SSDs containing regulated data, or donating PCs, and you choose physical destruction, secure wipe or certification.
- Common confusion
- Choosing degaussing for SSDs. SSDs store data in flash cells unaffected by magnetic fields.
2.10 Given a scenario, apply security settings on SOHO wireless and wired networksRouter settings, wireless settings and firewall settings for small offices.
- What it means
- Covers router settings (change default passwords, IP filtering, firmware updates, content filtering, physical placement and secure locations, Universal Plug and Play, screened subnet, configuring secure management access), wireless settings (changing the SSID, disabling SSID broadcast, encryption settings, configuring guest access) and firewall settings (disabling unused ports, port forwarding and mapping).
- What to understand
- Change default admin credentials and update firmware first, since defaults and known flaws are the easiest attacks. Disable UPnP so devices cannot open ports automatically. Port forwarding exposes a single internal service, whereas a screened subnet places public-facing hosts in a separate zone. Hiding the SSID only deters casual users; strong encryption is the real protection.
- How it shows up
- A home office needs a security camera reachable from the internet, or a guest network for visitors, and you choose port forwarding or guest isolation.
- Common confusion
- Treating disabling SSID broadcast as strong security. The SSID is still visible in client traffic to anyone with a wireless analyzer.
2.11 Given a scenario, configure relevant security settings in a browserTrusted downloads, patching, extensions, password managers, certificates and privacy settings.
- What it means
- Covers browser download and installation considerations (trusted sources, hashing, untrusted sources), browser patching, extensions and plug-ins from trusted and untrusted sources, password managers, secure connections and valid certificates, and settings such as pop-up blockers, clearing browsing data and cache, private browsing mode, sign-in and data synchronization, ad blockers, proxy and secure DNS.
- What to understand
- Comparing a download's hash with the publisher's published value confirms it was not altered. Certificate warnings mean the site's identity cannot be verified and should not be bypassed for sensitive sites. Private browsing stops local history storage but does not hide activity from the network or websites. Secure DNS encrypts name lookups.
- How it shows up
- A user downloads a utility from a mirror site, or sees a certificate warning on a banking page, and you choose hash verification or stopping.
- Common confusion
- Believing private browsing makes the user anonymous online. It only limits what is stored on the local device.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Malware removal order
Investigate and verify symptoms, quarantine, disable System Restore (Windows Home), remediate, schedule scans and run updates, enable System Restore and create a restore point (Windows Home), educate the user.
- Remember
- Quarantine comes before cleaning, and System Restore is re-enabled only after the system is clean.
- Tested as
- FIRST and NEXT questions and ordering simulations.
- Trap
- Running the scan before isolating the system or before updating definitions.
-
Share vs. NTFS permissions
Share permissions apply to network access; NTFS permissions apply locally and over the network.
- Remember
- Over the network, the more restrictive of the two combined results applies.
- Tested as
- A user can edit files locally but not over the network, or the reverse.
- Trap
- Assuming the most permissive permission wins.
-
BitLocker, BitLocker To Go and EFS
BitLocker encrypts full volumes, BitLocker To Go encrypts removable drives, EFS encrypts individual files for a user.
- Remember
- BitLocker typically uses the TPM and requires a Pro or higher edition to manage.
- Tested as
- Lost laptop and removable media scenarios.
- Trap
- Choosing EFS to protect an entire stolen laptop.
-
WPA3 and SAE
WPA3 Personal uses Simultaneous Authentication of Equals in place of WPA2's pre-shared key handshake.
- Remember
- SAE resists offline dictionary attacks against captured handshakes.
- Tested as
- Choosing the strongest wireless security setting.
- Trap
- Selecting WPA2 with TKIP for compatibility when AES or WPA3 is available.
-
RADIUS vs. TACACS+
Both are centralized AAA protocols; RADIUS is common for network access such as Wi-Fi and VPN, TACACS+ for administering network devices.
- Remember
- TACACS+ separates authentication, authorization and accounting and encrypts the full payload; RADIUS encrypts only the password.
- Tested as
- Enterprise Wi-Fi and device administration scenarios.
- Trap
- Choosing Kerberos for Wi-Fi authentication.
-
Kerberos
Ticket-based authentication used by Active Directory domains.
- Remember
- It requires synchronized clocks; significant time drift breaks domain logons.
- Tested as
- Domain sign-in failures with clock differences.
- Trap
- Overlooking time synchronization as the cause.
-
Multifactor authentication
Combining factors from different categories: something you know, have, are, or somewhere you are.
- Remember
- Two items from the same category are not MFA.
- Tested as
- Strengthening sign-in after credential theft.
- Trap
- Calling a password and PIN two-factor.
-
Ransomware
Malware that encrypts or locks data and demands payment.
- Remember
- Isolated, offline or immutable backups are the reliable recovery method.
- Tested as
- Files renamed and unreadable with a ransom note.
- Trap
- Relying on synced cloud folders that also received the encrypted files.
-
Rootkit
Malware that hides itself and other processes at a low level of the OS or boot process.
- Remember
- Offline scanning from a preinstallation environment or reimaging is often needed.
- Tested as
- Malware that is invisible to normal tools.
- Trap
- Trusting a clean scan from within the infected OS.
-
Evil twin
A rogue access point that imitates a legitimate SSID to capture traffic or credentials.
- Remember
- Users connect because the name looks familiar; WPA3 Enterprise with certificate validation and user awareness help.
- Tested as
- Wireless attack identification.
- Trap
- Calling it a denial-of-service attack.
-
Business email compromise
Fraud using a compromised or spoofed executive or vendor mailbox to request payments or sensitive data.
- Remember
- Verify payment or bank detail changes through a separate, known channel.
- Tested as
- Finance-related social engineering scenarios.
- Trap
- Labeling it generic phishing when the message comes from a real internal account.
-
Degaussing
Erasing magnetic media with a strong magnetic field.
- Remember
- It works on hard drives and tapes, renders the drive unusable, and does not affect SSDs or flash.
- Tested as
- Disposal method selection.
- Trap
- Choosing it for solid-state storage.
-
Certificate of destruction
Documentation from a disposal vendor proving media was destroyed.
- Remember
- It provides the audit evidence for regulated data disposal.
- Tested as
- Outsourced destruction scenarios.
- Trap
- Accepting vendor destruction without documentation.
-
UPnP and port forwarding
UPnP lets devices open router ports automatically; port forwarding manually maps an external port to an internal host.
- Remember
- Disable UPnP and forward only the specific port a service needs.
- Tested as
- SOHO router hardening and remote access to a device.
- Trap
- Placing a device in the screened subnet when a single forwarded port suffices, or leaving UPnP on.
-
Hash verification
Computing a file's hash and comparing it with the publisher's published value.
- Remember
- A matching hash shows the file was not altered in transit or on a mirror.
- Tested as
- Safe download scenarios.
- Trap
- Trusting a download because the site uses HTTPS.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Phishing vs. vishing vs. smishing vs. spear phishing vs. whaling
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Phishing | Fraudulent messages, usually email, sent broadly. | Mass, untargeted. | Using it to describe a targeted attack on one executive. |
| Vishing | Phishing by voice call. | Phone channel. | Confusing it with smishing. |
| Smishing | Phishing by SMS text message. | Text channel. | Calling a QR code lure smishing when it is QR code phishing. |
| Spear phishing | Targeted at specific individuals using personal details. | Researched and personalized. | Missing the targeting clue. |
| Whaling | Spear phishing aimed at senior executives. | High-value target. | Labeling it generic spear phishing when the target is the CEO or CFO. |
Degaussing vs. secure wipe vs. standard format vs. physical destruction
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Degaussing | Magnetic erasure. | Magnetic media only; drive not reusable. | Using it on SSDs. |
| Secure wipe | Overwriting or sanitizing so data cannot be recovered. | Allows the drive to be reused or donated. | Substituting a quick format. |
| Standard format | Creates a new filesystem structure. | Data is often recoverable. | Treating it as sanitization. |
| Physical destruction | Shredding, drilling or incineration. | Strongest assurance; media destroyed. | Skipping the certificate of destruction when outsourced. |
WPA2 vs. WPA3, Personal vs. Enterprise
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| WPA2 Personal | Shared passphrase with AES. | Vulnerable to offline guessing of weak passphrases. | Choosing TKIP mode. |
| WPA3 Personal | Shared passphrase with SAE. | Resists offline dictionary attacks. | Assuming old devices all support it. |
| Enterprise (WPA2 or WPA3) | Per-user credentials checked by a RADIUS server. | Individual accounts and revocation. | Choosing Personal mode where each employee must log in individually. |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Scan before isolation
- What candidates pick
- Run a full anti-malware scan as soon as symptoms are confirmed.
- Why it looks right
- Removing the malware feels like the urgent priority.
- Why it's wrong
- The procedure quarantines the system first to stop spread, then disables System Restore on Windows Home, then remediates with updated definitions.
Clue to watch for The question asks for the step immediately after verifying symptoms.
-
Most permissive permission
- What candidates pick
- The user has Full Control because NTFS grants it, even though the share grants Read.
- Why it looks right
- NTFS seems like the real file permission.
- Why it's wrong
- Over the network, share and NTFS permissions combine and the more restrictive applies, so the user has Read.
Clue to watch for Access is through a mapped drive or UNC path rather than locally.
-
Degauss the SSDs
- What candidates pick
- Degauss laptops' SSDs before disposal.
- Why it looks right
- Degaussing is a recognized destruction method.
- Why it's wrong
- SSDs store data in flash memory unaffected by magnetism; use secure erase or physical shredding.
Clue to watch for The media is SSD, NVMe or flash.
-
Hiding the SSID as security
- What candidates pick
- Disable SSID broadcast to stop unauthorized users.
- Why it looks right
- If they cannot see it, they cannot join.
- Why it's wrong
- The SSID is still exposed in client traffic; strong WPA3 or WPA2-AES encryption and a strong passphrase are the real controls.
Clue to watch for The goal is preventing unauthorized access rather than reducing clutter.
-
Technical fix for a human attack
- What candidates pick
- Install a new firewall after an employee gave a caller their password.
- Why it looks right
- Firewalls are a standard security answer.
- Why it's wrong
- The attack was vishing; reset the credentials, enable MFA and provide user education.
Clue to watch for The compromise came through a call, email, text or visitor.
-
Personal mode for individual accountability
- What candidates pick
- WPA3 Personal with a long passphrase so each employee can be tracked.
- Why it looks right
- WPA3 is the newest protocol.
- Why it's wrong
- Personal mode shares one passphrase; individual credentials and revocation require Enterprise mode with RADIUS.
Clue to watch for Requirements to log individual users or revoke one person's access.
-
BIOS password for data protection
- What candidates pick
- Set a BIOS/UEFI password to protect data if a laptop is stolen.
- Why it looks right
- It stops the laptop from booting.
- Why it's wrong
- A thief can remove the drive and read it elsewhere; full-disk encryption such as BitLocker protects the data.
Clue to watch for The concern is data confidentiality after loss or theft.
Answer framework
Use these steps to choose the right control or action in an A+ security scenario.
- Identify what is being attacked or protected: a person, a device, data at rest, a wireless network or a browser session.
- Name the threat precisely from the clues, such as the delivery channel for social engineering or the symptom for malware.
- Choose the control that addresses that specific threat at its source, such as encryption for theft, MFA for stolen passwords, or education for social engineering.
- Respect procedure order for malware and incidents: verify, isolate, disable System Restore on Home, remediate, update, re-enable, then educate.
- Match the control to ownership, media and edition constraints, such as BYOD selective wipe, SSD-appropriate destruction, or BitLocker requiring Pro.
Practice question
Want more like this? The CompTIA A+ practice test has questions for every domain.
Checklist
0 of 14
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Start with objective 2.6 and memorize the malware removal procedure word for word, because ordering questions are common and unforgiving. Then study 2.2 at a Windows Pro machine or virtual machine: set share and NTFS permissions and test access over the network, toggle UAC, and review BitLocker options. Practice calculating effective permissions until it is automatic.
Next, cover 2.4 and 2.5 together with a table of malware types and attacks, each with its defining clue. Then group 2.3 and 2.10 as wireless and SOHO network security, using your own router's admin page to find default credential, firmware, UPnP, guest network and port forwarding settings. Candidates often underestimate 2.9; know which methods work on HDDs versus SSDs and when certification is needed.
Finish with 2.1, 2.7, 2.8 and 2.11, which reward concise definitions tied to scenarios. Afterwards, move to Core 2 domain 3.0, where objectives 3.3 and 3.4 test the symptoms of the threats covered here, and review Core 2 objective 4.6 on incident response. Use timed practice and review each miss by naming the clue you overlooked.
FAQ
How much of Core 2 is Security?
Security is 28% of Core 2 (220-1202), tied with Operating Systems as the largest Core 2 domain, with eleven objectives.
Do I have to memorize the malware removal steps in order?
Yes. Objective 2.6 is a scenario objective about the procedure, and questions often ask for the FIRST or NEXT step or present the steps for ordering.
How do share and NTFS permissions combine?
For network access, Windows evaluates both and the more restrictive effective permission wins. For local access only NTFS permissions apply.
What is the difference between RADIUS and TACACS+?
Both centralize authentication. RADIUS is typically used for network access such as Wi-Fi and VPN; TACACS+ is typically used to control administrator access to network devices and separates authentication, authorization and accounting.
Why does degaussing not work on SSDs?
SSDs store data as electrical charge in flash cells rather than magnetic domains. Use the drive's secure erase function for reuse or physical destruction for disposal.
How deep is the security knowledge required?
A+ expects an entry-level technician to apply and configure common controls and recognize threats. Designing security architecture is outside its scope.
How does this domain relate to other A+ domains?
It uses tools from Operating Systems, network concepts from Core 1 Networking, and its threats reappear as symptoms in Software Troubleshooting and as procedures in Operational Procedures.
Other IT Fundamentals & Hardware certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 7 knowledge
You have covered security measures, Windows security settings, wireless authentication, malware and social engineering, the removal procedure, hardening and data destruction. Check whether you can pick the right control and step order in timed security scenarios.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the CompTIA A+ AI tutor Get any concept explained your way