A+ Core 2 cram sheet and exam-day checklist

Security and malware response: contain risk without destroying recoverability

For suspected malware, the safest sequence begins with scope and containment. Determine whether the device is still communicating, what account is involved, whether sensitive data or credentials are at risk, and whether the incident process requires preserving volatile evidence. Disconnecting a system can reduce harm, but powering it off may destroy memory evidence; the right choice depends on impact, evidence needs, and organizational procedure.

After containment, remove persistence and recover from a trusted state. That can involve malware removal, credential reset, patching, restoring known-good data, rebuilding, or replacing a compromised image. The key distinction is that symptom removal is not automatically eradication. If persistence, stolen credentials, or the exploited weakness remains, the problem can recur immediately.

Endpoint security also includes ordinary support decisions: least privilege, account lifecycle, encryption, screen locks, secure wireless configuration, browser hygiene, application permissions, removable media controls, backups, and secure disposal. On exam scenarios, ask which control addresses the stated risk rather than choosing the strongest-sounding control in the abstract.

Core 2 final-review drill: classify misses by layer and procedure

For each missed practice question, write the failing layer first: application, account, policy, service, operating system, storage, network, security control, or procedure. Then write the evidence that should confirm the layer. This prevents a common mistake—selecting a repair action because it is familiar rather than because the scenario supports it.

Next, label the action as diagnostic, containment, corrective, recovery, verification, or documentation. If the question asks for the next step, make sure your selected action belongs to the current phase. Resetting a system before collecting obvious evidence or declaring success before testing the original workflow are sequencing errors even when the eventual fix is technically valid.

Use the final study session to rehearse safe support decisions. Practice explaining when to back up before repair, when to escalate privileges, when to isolate a host, when to roll back a change, when to preserve evidence, and how to verify recovery. Those patterns transfer across operating systems and are more durable than memorizing one interface.

Use the qualifiers and constraints before reaching for a memorized answer.

• Read the command word first: FIRST, NEXT, BEST, MOST likely, and LEAST change the decision you are being asked to make.
• Identify the objective and the constraint before evaluating products or commands. Several answers may be technically possible while only one fits the scope, evidence, safety, availability, or least-privilege requirement.
• When two options seem correct, prefer the one that creates useful evidence, preserves reversibility, reduces unnecessary impact, and addresses the stated layer of the problem.
• Do not use a practice percentage as a pass prediction. Treat missed or guessed questions as pointers to weak concepts and decision patterns, then verify the current objectives with the certification owner.
• For performance-based thinking, practice the workflow rather than memorizing a screenshot: establish state, choose a safe action, interpret the result, and verify that the original requirement is now satisfied.

Use this cram sheet after full study and hands-on practice. CompTIA's current certification page and objectives remain the authority when any exam fact changes.