Overview
Software Troubleshooting is Core 2 (220-1202) domain 3.0 and carries 23% of that exam across four objectives: troubleshooting common Windows OS issues, common mobile OS and application issues, mobile OS and application security issues, and PC security issues. Windows symptoms include stop screens, degraded performance, boot failures, services not starting, low memory warnings, USB controller resource warnings, a missing OS, slow profile loads and time drift. Mobile and security symptoms include apps that will not install or update, battery drain, autorotation failures, sideloaded or spoofed apps, excess data use, fake security warnings, browser redirection and certificate warnings.
Candidates must match each symptom to the most likely cause and the least disruptive effective fix. This domain applies the tools from Core 2 domain 1.0 and the threat knowledge from Core 2 domain 2.0, using the same structured reasoning as Core 1's troubleshooting domain.
How it's tested
Questions give a user's description or an error and ask for the most likely cause, the BEST next step, or which tool to use. The answer is normally the least disruptive action that addresses the specific symptom. Security-flavored items describe behavior that indicates malware or a malicious app, and you must recognize it before choosing a fix.
-
Symptom to targeted fix
A Windows symptom such as a slow profile load, a service that fails to start or a USB resource warning points to a specific remedy rather than a general reinstall.
-
Least disruptive first
Several fixes would work, and you pick the one that preserves data and time, such as restarting a service or rolling back an update before reimaging.
-
Spot the compromise
Mobile or PC behavior such as high data use, redirected searches or fake warnings is recognized as a security issue, leading to malware-focused remediation.
A user's laptop started showing stop screens right after a graphics driver update yesterday. Reimaging would work but destroys local changes. Running sfc checks system files, which the driver update did not touch. The timing points to the new driver, so rolling it back in Device Manager or booting to Safe Mode to remove it is the targeted, least disruptive fix.
Objectives 4
Official objectives from the CompTIA outline, in outline order.
3.1 Given a scenario, troubleshoot common Windows OS issuesStop errors, performance, boot, services, crashes, memory, USB resources, profiles and time drift.
- What it means
- Covers symptoms such as blue screen of death (BSOD), degraded performance, boot issues, frequent shutdowns, services not starting, applications crashing, low memory warnings, USB controller resource warnings, system instability, no OS found, slow profile load and time drift. Typical fixes to know include rebooting, restarting services, uninstalling, reinstalling or updating applications, adding resources, updating drivers, verifying requirements, sfc, repairing Windows, restoring, reimaging, rolling back updates and rebuilding Windows profiles.
- What to understand
- Link the symptom to its likely layer: a stop screen after a driver or update suggests rolling it back; slow login with a corrupted or bloated profile suggests rebuilding the profile; USB resource warnings mean too many devices share one controller; time drift breaks Kerberos sign-in and certificates, so check time sync and the CMOS battery. Use Event Viewer, Safe Mode, System Restore and Startup Repair before reimaging.
- How it shows up
- A user gets a stop screen after an update, or a PC reports no OS found after a USB stick was left in, and you choose the targeted fix.
- Common confusion
- Reaching for a reimage as the first fix. It is effective but the most disruptive option and is usually the last resort.
3.2 Given a scenario, troubleshoot common mobile OS and application issuesApp launch, crash, update and install failures, battery, reboots, connectivity and rotation.
- What it means
- Covers applications that fail to launch, fail to close or crash, fail to update or fail to install, slow response, OS update failures, battery life issues, random reboots, connectivity issues with Bluetooth, Wi-Fi and NFC, and screens that do not autorotate.
- What to understand
- Typical fixes escalate gently: force stop the app, clear its cache or data, update or reinstall it, check storage space and OS compatibility, restart the device, then reset network settings or the device as a last resort. Battery drain often traces to a specific app or high screen brightness, and autorotation failures are often just a rotation lock setting.
- How it shows up
- An app will not install or update, or a phone's screen stays in portrait, and you choose storage, compatibility or the rotation lock.
- Common confusion
- Factory resetting for a single app problem. Clearing the app's cache or reinstalling it addresses the app without wiping the device.
3.3 Given a scenario, troubleshoot common mobile OS and application security issuesSecurity risk sources and the symptoms of a compromised mobile device.
- What it means
- Covers security concerns (application source and unofficial app stores, sideloaded Android package files, developer mode, rooting or jailbreaking, bootleg or malicious applications, application spoofing) and common symptoms (high network traffic, sluggish response time, data-usage limit notifications, limited or no internet connectivity, a high number of ads, fake security warnings, unexpected application behavior, leaked personal files or data).
- What to understand
- Rooting and jailbreaking remove the OS's built-in protections and often break MDM compliance. Sideloaded or spoofed apps can carry spyware that sends data in the background, showing up as unexplained data usage or battery drain. The response is to remove the suspicious app, run mobile security tools, update the OS, and reset the device if the compromise persists.
- How it shows up
- A phone suddenly hits its data cap and shows pop-up warnings after a user installed an app from a link, and you identify the malicious app.
- Common confusion
- Treating unexplained high data use as a carrier billing problem. On a recently changed device, it is a strong sign of malware or a rogue app.
3.4 Given a scenario, troubleshoot common personal computer (PC) security issuesDesktop and browser symptoms that indicate compromise.
- What it means
- Covers common symptoms such as inability to access the network, desktop alerts, false alerts regarding antivirus protection, altered system or personal files (missing, renamed or inaccessible files), unwanted notifications within the OS, OS update failures, and browser-related symptoms (random or frequent pop-ups, certificate warnings, redirection, degraded browser performance).
- What to understand
- Fake antivirus alerts are scareware trying to make users install malware or pay. Redirected searches and new toolbars point to a malicious extension or changed DNS or proxy settings. Renamed or encrypted files suggest ransomware, and failing updates can mean malware is blocking defenses. Confirm the symptoms, then follow the SOHO malware removal procedure.
- How it shows up
- A browser keeps sending searches to an unfamiliar site, or Windows Update suddenly fails along with antivirus updates, and you identify the compromise and response.
- Common confusion
- Clearing the browser cache to fix redirection. Redirection usually comes from a malicious extension, hijacked settings or altered DNS or hosts files, which clearing the cache does not remove.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Least disruptive effective fix
The exam's preferred answer is the smallest action that addresses the specific cause, escalating only if it fails.
- Remember
- Restart, restart the service, update or roll back, repair, restore, then reimage, in roughly that order.
- Tested as
- Most BEST and NEXT questions in this domain.
- Trap
- Choosing reimage or factory reset as the first step.
-
Rollback after updates
Uninstalling a recent Windows update or rolling back a driver to the previous version.
- Remember
- When a problem starts right after an update, rolling back that change is the targeted fix.
- Tested as
- Stop screens or instability after patching.
- Trap
- Running sfc when the cause is a new driver.
-
Safe Mode
Starts Windows with minimal drivers and services.
- Remember
- If the problem disappears in Safe Mode, a third-party driver, service or startup app is the likely cause.
- Tested as
- Isolating causes of crashes or boot loops.
- Trap
- Assuming Safe Mode itself fixes the problem.
-
Rebuilding a Windows profile
Creating a new user profile and migrating data when the existing profile is corrupted.
- Remember
- Slow or failed profile loads, or temporary profile messages, point to this fix.
- Tested as
- Slow profile load scenarios.
- Trap
- Reinstalling Windows for a single-user problem.
-
USB controller resource warnings
Windows warns that a USB controller has run out of resources when too many devices or endpoints are attached.
- Remember
- Move devices to ports on another controller or reduce devices on the hub.
- Tested as
- A newly added USB device triggers a warning.
- Trap
- Replacing the device or reinstalling drivers.
-
Time drift
The system clock gradually becomes inaccurate.
- Remember
- Drift breaks Kerberos domain logons and certificate validation; check NTP synchronization and the CMOS battery.
- Tested as
- Domain login failures or certificate errors on one PC.
- Trap
- Resetting the user's password.
-
No OS found
Firmware cannot find a bootable operating system.
- Remember
- Check for a USB drive or disc in the boot path and the boot order before repairing the boot loader.
- Tested as
- Boot failure first-step questions.
- Trap
- Reinstalling Windows immediately.
-
Clear cache vs. clear data
On mobile devices, clearing cache removes temporary files; clearing data resets the app to a fresh state.
- Remember
- Clear cache first; clear data removes app settings and possibly local content.
- Tested as
- App crash and misbehavior questions.
- Trap
- Factory resetting the device for one app.
-
Rooting and jailbreaking
Removing manufacturer restrictions to gain full control of Android or iOS.
- Remember
- They bypass security controls, enable unvetted apps, and typically violate corporate MDM policy.
- Tested as
- Mobile security risk scenarios.
- Trap
- Viewing them as harmless customization.
-
Sideloading and app spoofing
Installing apps from outside official stores, or apps that imitate legitimate ones.
- Remember
- These are leading sources of mobile malware; install only from trusted stores.
- Tested as
- Compromise after installing an app from a link.
- Trap
- Assuming any app with a familiar name is legitimate.
-
Fake security warnings
Scareware pop-ups claiming infection to push a download or payment.
- Remember
- Legitimate antivirus alerts come from the installed product, not a browser page demanding action.
- Tested as
- PC and mobile security symptom questions.
- Trap
- Following the pop-up's instructions to clean the system.
-
Browser redirection
Searches or pages are sent to unintended sites.
- Remember
- Check extensions, browser proxy and DNS settings and the hosts file, then scan for malware.
- Tested as
- Browser-related security symptoms.
- Trap
- Only clearing browsing history.
-
Certificate warnings
The browser cannot validate a site's certificate.
- Remember
- On many sites at once, suspect the system clock or interception; on one site, suspect that site.
- Tested as
- Diagnosing certificate errors.
- Trap
- Telling users to click through the warning.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
System Restore vs. Startup Repair vs. reset or reimage
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| System Restore | Rolls system files, drivers and registry back to a restore point. | Keeps personal files; undoes recent system changes. | Expecting it to recover deleted documents. |
| Startup Repair | Automated repair of boot problems from the recovery environment. | Targets files and settings needed to start Windows. | Using it for application crashes after login. |
| Reset or reimage | Reinstalls Windows or applies a standard image. | Most thorough; removes apps and possibly data. | Choosing it before less disruptive fixes. |
Performance problem vs. compromise on mobile
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Performance problem | Slowness or battery drain from heavy apps, low storage or settings. | Explained by usage and resolved by updates, freeing storage or adjusting settings. | Missing a security cause when symptoms began with a new app. |
| Compromise | Malicious or spoofed app activity. | Unexplained data use, ads, fake warnings or leaked data, often after sideloading. | Treating it as a carrier or hardware issue. |
Clear cache vs. clear data vs. factory reset
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Clear cache | Removes an app's temporary files. | Keeps settings and accounts. | Expecting it to reset a corrupted configuration. |
| Clear data | Returns one app to its freshly installed state. | Removes the app's settings and local data. | Doing it without confirming data is backed up or synced. |
| Factory reset | Erases the whole device to defaults. | Last resort; removes all data and apps. | Using it for a single app issue. |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Reimage first
- What candidates pick
- Reimage a PC that started crashing after a single application update.
- Why it looks right
- Reimaging reliably removes the problem.
- Why it's wrong
- It destroys local changes and takes time; rolling back or reinstalling the application addresses the cause directly.
Clue to watch for A specific recent change preceded the problem.
-
Password reset for time drift
- What candidates pick
- Reset the user's domain password when sign-in fails only on one PC whose clock is minutes off.
- Why it looks right
- Sign-in failures usually mean credentials.
- Why it's wrong
- Kerberos rejects authentication when clocks differ too much; resync time and check the CMOS battery.
Clue to watch for The clock is wrong, or certificate errors accompany the sign-in failure.
-
Factory reset for one app
- What candidates pick
- Factory reset a phone because one banking app crashes on launch.
- Why it looks right
- A reset fixes nearly all software problems.
- Why it's wrong
- Force stopping, clearing cache, updating or reinstalling the app is far less disruptive and usually sufficient.
Clue to watch for Only one app is affected.
-
Carrier blamed for data spikes
- What candidates pick
- Contact the carrier when a phone suddenly exceeds its data cap after a new app install.
- Why it looks right
- Data billing is the carrier's domain.
- Why it's wrong
- Unexplained data use after installing an app suggests a malicious app sending data; investigate and remove it.
Clue to watch for The spike follows a sideloaded or unfamiliar app.
-
Following the scareware
- What candidates pick
- Download the cleaner that a browser pop-up says will remove detected viruses.
- Why it looks right
- The pop-up claims a real threat.
- Why it's wrong
- Fake antivirus alerts are themselves the attack; close the browser, scan with trusted tools and follow the malware removal procedure.
Clue to watch for The warning appears in a web page rather than from the installed security product.
-
Cache clear for redirection
- What candidates pick
- Clear cookies and cache when searches keep landing on an unknown site.
- Why it looks right
- Browser problems are often solved by clearing data.
- Why it's wrong
- Redirection usually comes from a malicious extension, changed proxy or DNS settings, or a modified hosts file.
Clue to watch for Redirection persists across sessions and sometimes across browsers.
-
Replacing hardware for a USB warning
- What candidates pick
- Replace a new webcam that triggers a USB controller resource warning.
- Why it looks right
- The warning appears when the device is connected.
- Why it's wrong
- The controller has run out of resources; connecting the device to a port on another controller fixes it.
Clue to watch for Several USB devices are connected through one hub or set of ports.
Answer framework
Use this approach for Windows, mobile and security software problems.
- Pin down the exact symptom and what changed just before it, such as an update, new app, new device or new network.
- Decide whether the symptom is a functional fault or a sign of compromise, looking for data spikes, pop-ups, redirection or altered files.
- For functional faults, apply the targeted fix first, such as restarting a service, rolling back the change, clearing an app's cache or rebuilding a profile.
- For compromise, follow the malware removal procedure: isolate, remediate with updated tools, and remove the risky app, extension or setting at its source.
- Escalate to repair, restore, reimage or factory reset only when targeted fixes fail, after backing up data.
Practice question
Want more like this? The CompTIA A+ practice test has questions for every domain.
Checklist
0 of 12
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Begin with objective 3.1, the largest. For each Windows symptom, write the likely cause, the evidence you would check (Event Viewer, Task Manager, Device Manager, boot order), and the least disruptive fix. Practice in a Windows virtual machine: boot into Safe Mode, use System Restore, roll back a driver, restart a stopped service, and create a new local profile.
Next, cover 3.2 by working through app problems on your own phone: force stop, clear cache, check storage, check for OS and app updates, and find the rotation lock. Then study 3.3 and 3.4 together as the security half of the domain. Build a list of symptoms that signal compromise and the source of each, such as sideloaded apps, malicious extensions, hijacked DNS or proxy settings, and scareware. Candidates often underestimate these two objectives because the symptoms look like ordinary slowness.
Afterwards, revisit Core 2 objective 2.6 (malware removal) to link symptoms to the response procedure, and Core 2 domain 1.0 for the tools. Finish with timed scenario practice, and for every miss ask whether you chose a fix that was too disruptive or missed a security clue.
FAQ
How much of Core 2 is Software Troubleshooting?
Software Troubleshooting is 23% of Core 2 (220-1202), with four objectives, so each objective covers a large share of questions.
What is the usual best answer for Windows problems?
The least disruptive fix that targets the cause. If a problem began after an update or driver change, rolling it back is usually best; reimaging is a last resort.
How do I recognize a compromised phone in a question?
Look for unexplained high data use, battery drain, excessive ads, fake security warnings or leaked data, especially after the user sideloaded an app, rooted or jailbroke the device, or enabled developer mode.
Why does time drift appear in the Windows objectives?
An inaccurate clock breaks Kerberos authentication and certificate validation, so a PC with time drift may fail domain sign-ins or show certificate warnings. Check NTP sync and the CMOS battery.
What causes browser redirection?
Most often a malicious or unwanted extension, altered proxy or DNS settings, or a modified hosts file. Remove the cause and scan for malware rather than only clearing cache.
What question styles appear in this domain?
Symptom-based scenarios asking for the most likely cause or the BEST next step, and sometimes simulations of Windows tools or recovery options.
How does this domain connect to the rest of A+?
It applies the tools from Operating Systems and the threats from Security, and it uses the same troubleshooting reasoning as Core 1's Hardware and Network Troubleshooting domain.
Other IT Fundamentals & Hardware certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 8 knowledge
You have covered Windows stop errors, boot and profile problems, mobile app issues and the symptoms of compromised phones and PCs. Check whether you can choose the most appropriate fix in timed scenarios.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the CompTIA A+ AI tutor Get any concept explained your way