Study Hub / CompTIA A+ (220-1201 & 220-1202) / 1102 · Domain 2.0
CompTIA A+ (220-1202) Domain 2.0: Security — Explained
Domain 2.0 is security from the technician's chair: recognizing threats, removing malware properly, configuring Windows security features, and locking down small networks. Practical defense, not theory.
Threats: know the enemy
- Malware types — virus (needs a host file + human action), worm (self-propagating), trojan (disguised as legitimate), ransomware (encrypts for payment), spyware/keylogger (steals silently), rootkit (hides at system level).
- Social engineering — phishing (fraudulent messages), spear phishing (targeted), whaling (executives), vishing (voice), smishing (SMS), pretexting (invented scenario), tailgating (following through doors). The human is the attack surface.
- Password attacks — brute force (try everything), dictionary (try likely words), credential stuffing (reused passwords from other breaches). The defense: long unique passwords + MFA.
- Wireless and physical — evil twin (fake AP), shoulder surfing, dumpster diving. Security is also looking over your shoulder — literally.
Malware removal: the procedure
There's a right order — skipping steps is how "cleaned" systems get reinfected:
- Investigate and verify — confirm symptoms, identify the malware. Don't nuke from orbit on a hunch.
- Quarantine — disconnect from the network (contain the spread, cut C2).
- Disable System Restore — malware hides in restore points; a restore would resurrect it.
- Remediate — Safe Mode scan with updated anti-malware, remove/quarantine findings; manual removal if needed.
- Schedule scans and updates — ensure protection is current and automatic.
- Re-enable System Restore and create a restore point — clean baseline going forward.
- Educate the user — the infection vector (phishing link? bad download?) must close, or it recurs.
Windows security and SOHO hardening
- Built-in defenses — Windows Defender (antivirus/antimalware, on by default), Windows Firewall (per-network profiles: domain/private/public), SmartScreen (reputation checks on downloads), BitLocker (full-disk encryption), EFS (per-file encryption).
- UAC — User Account Control: privilege separation prompts. Don't disable it to stop the popups — the popups are the protection.
- Authentication — strong passwords, MFA wherever offered, screen locks with short timeouts, disable the Guest account, rename/disable default admin where policy says so.
- SOHO router hardening — change default admin credentials, WPA2/WPA3 with a strong passphrase, disable WPS, update firmware, disable remote management, guest network for visitors and IoT.
- Data destruction — wipe (overwrite, software), degauss (magnetic destruction — kills the drive too), physical destruction (shred/crush). Delete ≠ gone; format ≠ gone. Match the method to the data's sensitivity.
The must-memorize table: malware types
How each spreads and what it does.
| Malware | Spreads by | Does |
|---|---|---|
| Virus | Host file + human action | Infects files, needs execution |
| Worm | Self-propagating (network) | Spreads alone, fast |
| Trojan | Disguised as legitimate software | Opens backdoors, steals |
| Ransomware | Phishing, exploits, RDP | Encrypts data, demands payment |
| Spyware / keylogger | Bundled software, trojans | Steals silently |
| Rootkit | Deep system compromise | Hides at OS level |
Try it: 4 sample questions
Sample questions to check your understanding of this domain. Answers and full reasoning are tucked under each one.
1. A PC shows ransomware warnings demanding payment. What are the correct first two steps?
- A. A. Pay immediately, then scan
- B. B. Quarantine (disconnect from network) and investigate — never pay; contain first, then follow the removal procedure
- C. C. Delete the warning popups
- D. D. Run System Restore immediately
Show answer & reasoning
B. Disconnect first (stop spread + cut command-and-control), then work the procedure. Paying funds crime and rarely restores data; System Restore (D) is disabled during remediation (malware hides in restore points) and re-enabled after. Contain, then clean.
2. Why must System Restore be disabled during malware remediation?
- A. A. It slows down the scan
- B. B. Malware can hide in restore points — restoring would reinfect the "cleaned" system
- C. C. It deletes user files
- D. D. It conflicts with Safe Mode
Show answer & reasoning
B. Restore points snapshot system state including the infection. Clean the system, then a user (or an automated restore) rolls back to a snapshot containing the malware — instant reinfection. Disable during cleanup, re-enable after, create a fresh clean restore point.
3. A technician finds a SOHO router still using the factory admin password and WPS enabled. What are the two fixes and why?
- A. A. None needed — factory settings are secure
- B. B. Change the admin credentials (factory passwords are public knowledge) and disable WPS (its PIN is brute-forceable)
- C. C. Hide the SSID — that's sufficient
- D. D. Buy a new router
Show answer & reasoning
B. Default credentials are published in manuals attackers already have — changing them is step zero. WPS's PIN mechanism is cryptographically weak and brute-forceable regardless of your WPA2 passphrase. Hidden SSIDs (C) are trivially discoverable — obscurity, not security.
4. An employee receives an email that looks like it's from the CEO asking for gift cards urgently. What is this attack, and what's the defense?
- A. A. A worm — run antivirus
- B. B. Spear phishing / CEO fraud (a pretexting variant) — verify through a separate channel; train users to distrust urgency + unusual requests
- C. C. Ransomware — disconnect the PC
- D. D. A brute-force attack — change passwords
Show answer & reasoning
B. Targeted fraudulent email impersonating an authority figure = spear phishing (whaling when it's executives). The defense is process: verify via a known-good channel (call the CEO's known number), never the reply button. Urgency is the weapon — slowing down is the shield.
This was one domain. The simulator drills all 9.
This free preview covered 1102: Security (2.0, 26%). Not covered here: 1101: Hardware (3.0, 25%); 1101: Hardware & Network Troubleshooting (5.0, 28%); 1102: Software Troubleshooting (3.0, 21%). The three troubleshooting and hardware domains — the most scenario-heavy A+ material — stay in the paid guide and practice bank. The ByteBar Practice Exam Simulator drills every domain with 1,000 exam-style questions — $9.99 one-time unlocks all 28 exams. Prefer to read? The full A+ Study Guide is in the ByteBar shop on Etsy.
Practice Exam Simulator — $9.99 one-time, all 28 exams Full Study Guides on Etsy