Chapter 2

Security

CompTIA A+ Core 2 (220-1202) Study GuideBased on the CompTIA A+ 220-1202 exam objectives

It's 8:47 on a Tuesday morning, and your phone won't stop buzzing. The office manager at a small accounting firm — one of your best clients — is calling, texting, and emailing all at once. Every computer in the office is showing the same red screen: "Your files have been encrypted. Send 2 Bitcoin to this address within 72 hours or your data will be deleted permanently."

This is ransomware. And by the end of this chapter, you'll know exactly what happened, how it probably got in, what to do first, what never to do, and how it could have been prevented. Security is 26% of the A+ Core 2 exam — the single biggest domain — because in the real world, this is the part of the job that keeps people up at night.

Security on the A+ isn't about becoming a penetration tester. CompTIA wants to know you can recognize threats, protect systems, respond to incidents correctly, and follow proper procedures. Let's build that from the ground up.

2.1 Malware: Know Your Enemy

Malware — malicious software — comes in flavors, and CompTIA loves testing whether you can tell them apart. Each type behaves differently, spreads differently, and matters differently. Learn them as characters in a story, not as vocabulary words.

The Virus: The Hitchhiker

A virus attaches itself to a legitimate file or program and needs a human to run it. Think of it like a hitchhiker — it can't move on its own; someone has to pick it up. You open an infected Word document, the macro runs, and now the virus is replicating into other files on your system.

The Worm: The Self-Driver

A worm is the virus's ambitious cousin — it spreads on its own, no human help needed. Worms exploit network vulnerabilities to copy themselves from machine to machine. The infamous WannaCry ransomware of 2017 spread as a worm across 150+ countries in a single day, exploiting an unpatched Windows vulnerability (EternalBlue). One unpatched machine on a network, and a worm can own the whole subnet by lunch.

The Trojan: The Gift Horse

Named for the Trojan Horse of Greek myth, a trojan disguises itself as something useful — a free game, a "system optimizer," a pirated copy of Photoshop. The user installs it willingly. But hidden inside is malicious code. Unlike viruses, trojans don't replicate themselves; unlike worms, they don't spread on their own. They just sit there, doing their dirty work quietly.

The classic trojan payload is a backdoor — a secret entry point that lets an attacker connect to the machine whenever they want, bypassing normal authentication.

Ransomware: The Kidnapper

Ransomware encrypts the victim's files and demands payment for the decryption key. Modern ransomware (like the attack in our opening story) often follows a double-extortion model: first they steal your data, then they encrypt it — so even if you have backups, they threaten to publish the stolen data unless you pay.

Spyware and the Keylogger: The Peeping Toms

Spyware secretly monitors what you do — browsing habits, personal information — usually to serve ads or steal data. A keylogger is a specific type of spyware that records every keystroke, capturing passwords, credit card numbers, and messages. Keyloggers can be software (installed as malware) or hardware (a tiny device plugged between the keyboard and the computer — which is why physical security matters too).

The RAT: The Puppet Master

A Remote Access Trojan gives an attacker full remote control of the machine — they can see the screen, move the mouse, turn on the webcam, and steal files, all while the victim has no idea. RATs are often delivered as trojans: the victim installs "free antivirus software" that's actually a RAT.

The Rootkit: The Invisible Man

A rootkit buries itself deep in the operating system — sometimes at the kernel level or even in firmware — and its whole purpose is to hide. It conceals files, processes, and registry entries so that neither the user nor antivirus software can see the malware it's protecting. Rootkits are why "my antivirus says the system is clean but it's clearly infected" is a real scenario.

The Logic Bomb: The Sleeper Agent

A logic bomb is malicious code that sits dormant until a specific trigger — a date, a user logging in, a file being deleted. The most famous real-world pattern: a disgruntled IT employee plants a logic bomb set to trigger if their user account is ever disabled. They're fired on Friday; on Monday, the servers wipe themselves.

The Backdoor: The Spare Key

A backdoor is any method of bypassing normal authentication. It can be planted by malware, but it can also be left behind by a developer "for testing" and forgotten — or deliberately installed by an insider. Backdoors are both a malware type and a general security concept.

Malware Comparison: The Lineup

Malware Removal: The Seven Steps

When you find malware, don't just start deleting things. CompTIA has a specific removal procedure, and the order matters:

1. Investigate and verify the symptoms. Don't assume — confirm it's actually malware and not a failing hard drive or a misbehaving update.
2. Quarantine the infected system. Disconnect it from the network (but don't power it off yet — you might lose volatile evidence, and some malware triggers on shutdown).
3. Disable System Restore (Windows). Malware loves hiding in restore points; if you clean the system but leave infected restore points, the malware comes right back the next time someone uses System Restore.

1. Remediate the infected system. Run anti-malware scans in Safe Mode, use reputable removal tools, delete the malicious files, repair the damage.
2. Schedule scans and updates. Make sure antivirus definitions are current and automatic updates are on.
3. Re-enable System Restore and create a restore point. Now that the system is clean, capture that clean state.
4. Educate the end user. Explain what happened and how to avoid it next time — the human is usually the entry point.

Scenario: The Case of the Sluggish Laptop

Maria from accounting calls: her laptop is "so slow it's unusable," pop-ups appear even when the browser is closed, and her homepage changed itself to a search site she's never heard of. Walk through it:

• Symptoms verified (Step 1): slowness + unwanted pop-ups + hijacked homepage = classic adware/spyware infection, possibly with a browser hijacker.
• Quarantine (Step 2): disconnect from the office network — this thing might be phoning home or spreading.
• Disable System Restore (Step 3): before scanning, so the malware can't resurrect from a restore point.
• Remediate (Step 4): boot into Safe Mode with Networking, run a full Defender scan plus a second-opinion scanner like Malwarebytes. Remove the browser hijacker extension, reset the browser.
• Updates (Step 5): check that Windows Update and Defender definitions are current — the infection probably came through an unpatched vulnerability or a phishing click.
• Restore point (Step 6): re-enable System Restore, create a clean restore point.
• Educate (Step 7): ask Maria what she clicked recently. Turns out she installed a "free PDF converter" from a pop-up ad. Show her how to spot these, and why the company has an approved software list.

2.2 Social Engineering: Hacking the Human

Here's an uncomfortable truth that CompTIA wants every technician to internalize: the most effective hacking tool isn't malware — it's a convincing lie. Social engineering is the manipulation of people into breaking security procedures, and it works because humans are helpful, trusting, and busy.

No firewall in the world stops an employee from handing their password to someone who sounds like the IT director.

Phishing: Casting a Wide Net

Phishing is the mass-market version — fraudulent emails (or messages) sent to thousands of people, impersonating banks, delivery companies, or IT departments. The goal is always the same: get the victim to click a link, open an attachment, or enter credentials on a fake site.

Red flags CompTIA expects you to recognize:

• Urgency and threats ("Your account will be suspended in 24 hours!")
• Generic greetings ("Dear valued customer" instead of your name)
• Mismatched sender addresses (support@micorsoft-secure.com — note the typo)
• Suspicious links (hover to reveal the real URL — it won't match the displayed text)
• Unexpected attachments, especially Office documents with macros or .zip files
• Requests for credentials or payment — legitimate companies don't ask for passwords by email

Spear Phishing: The Targeted Harpoon

Spear phishing is phishing aimed at a specific person or organization, using personal details to seem legitimate. Instead of "Dear customer," it's "Hi Jennifer, following up on the Q3 budget spreadsheet you shared with David last Thursday..." — details scraped from LinkedIn, company websites, or previous breaches.

Because it's personalized, spear phishing is far more convincing and far more dangerous. The defense is the same (verify through a separate channel), but the detection is harder.

Whaling: Hunting the Big Fish

Whaling is spear phishing aimed at senior executives — the "whales." A typical whaling email impersonates the CEO: "Hi, I'm in back-to-back meetings. I need you to wire $47,000 to this vendor immediately. Don't call — just handle it." It preys on authority and urgency. Finance departments are the usual targets.

Vishing and Smishing: Voice and Text

• Vishing (voice phishing): fraudulent phone calls. "This is the IRS, you owe back taxes, pay now or face arrest." Or the "tech support" scam: "We've detected a virus on your computer, give us remote access." CompTIA loves the fake tech-support call scenario.
• Smishing (SMS phishing): fraudulent text messages. "Your package couldn't be delivered, click here to reschedule." The link leads to a credential-stealing site or installs malware.

Pharming: Poisoning the Well

Pharming is sneakier — it redirects users to fake websites even when they type the correct address. This works by corrupting DNS (poisoning the DNS cache or compromising a DNS server), so victim types "mybank.com" and lands on an identical-looking fake. Unlike phishing, the victim did everything right.

Other Social Engineering Tricks

Scenario: The "CEO" Email

It's 4:55 PM on a Friday. Priya in accounts payable gets an email from "James Whitfield, CEO" (j.whitfield@company-secure.com — the real domain is company.com). It says he's closing a deal, needs a $38,500 wire to a new vendor today, and "please don't call, I'm in negotiations."

Walk through the correct response:

1. Stop. Urgency + secrecy + money = every red flag at once.
2. Verify through a separate channel. Call the CEO on his known number, or walk to his office. Do not reply to the email or use any contact info in the email.
3. Check the details. The sender domain is wrong (company-secure.com vs company.com). The real CEO would never ask to bypass verification.
4. Report it. Forward to IT/security, then delete. This is whaling — and the attacker probably researched the company org chart first.

The one rule that defeats all social engineering: verify requests through an independent channel before acting. Every time.

2.3 Windows Security: The Built-In Arsenal

Windows ships with a full security toolkit, and CompTIA expects you to know each piece — what it does, when to use it, and how the pieces fit together. Most users have never opened half of these. You will.

Windows Defender (Microsoft Defender Antivirus)

Defender is Windows' built-in antimalware — real-time protection, scheduled scans, cloud-delivered threat intelligence, and (in enterprise) integration with Defender for Endpoint. It's genuinely good now; the days of "uninstall Defender and install something real" are over.

Key points for the exam:

• Real-time protection should stay on. If malware disabled it, that's itself a symptom of infection.
• Definitions update through Windows Update — an out-of-date Defender is barely better than none.
• Full scan vs. quick scan: quick scans check common malware locations; full scans check everything (slow but thorough). After a suspected infection, run a full scan.
• Offline scan: reboots into a minimal environment to catch rootkits and persistent malware that hide while Windows is running. This is the exam's answer for "malware that survives normal scans."

Windows Firewall (Defender Firewall)

The firewall controls which network traffic is allowed in and out, based on rules. Windows maintains three profiles:

Firewall rules can allow or block by program, port, or protocol, inbound or outbound. When an application "can't connect" and everything else works, check whether the firewall is blocking it before you start reinstalling things.

User Account Control (UAC)

UAC is the prompt that dims the screen and asks "Do you want to allow this app to make changes?" It's Windows enforcing least privilege — even administrators run with standard-user permissions until they explicitly elevate.

Why it matters: most malware needs administrative rights to install itself deeply. UAC puts a human checkpoint in front of every elevation. Users who reflexively click "Yes" defeat it — which is why user education (always the last step) matters.

BitLocker: Full-Disk Encryption

BitLocker encrypts the entire drive — every file, the OS itself, everything. If someone steals the laptop, they get an encrypted brick. Without the key, the data is unreadable.

Critical exam facts:

• BitLocker needs a TPM (Trusted Platform Module) chip for the most seamless setup, though it can work with a USB startup key or password as an alternative.
• The recovery key is everything. If BitLocker locks the drive (after hardware changes, TPM issues, or too many wrong PINs), only the 48-digit recovery key unlocks it. No key = no data. Ever.
• Store recovery keys in Active Directory, a secure USB drive, or the user's Microsoft account — not on a sticky note on the laptop.

EFS: File-Level Encryption

The Encrypting File System encrypts individual files and folders rather than the whole drive. Right-click → Properties → Advanced → "Encrypt contents to secure data." Useful when you want to protect specific sensitive files on an otherwise unencrypted drive.

Scenario: The Stolen Laptop

A sales rep's laptop is stolen from his car. It contained customer lists, pricing sheets, and his saved browser passwords. Two questions: how bad is this, and what would have prevented it?

• Without BitLocker: catastrophic. The thief can pull the drive, connect it to another machine, and read everything — Windows login passwords are trivially bypassed with physical access. Every customer record is exposed.
• With BitLocker: the drive is encrypted. The thief has a very expensive paperweight. The data is safe (though the hardware is still gone).
• After the theft: remotely wipe if MDM is enrolled, change all passwords that were saved in the browser, notify affected customers per breach-notification obligations, and file a report.

The lesson CompTIA wants: encryption protects data at rest. Access controls protect data from network attackers; encryption protects it when the device itself is in enemy hands.

2.4 Authentication: Proving You Are Who You Claim

Authentication answers one question: are you really who you say you are? CompTIA organizes authentication into factors — and the exam is obsessed with counting them.

The Three Factors

Multifactor authentication (MFA) means using two or more different factors. Password + SMS code = MFA (knowledge + ownership). Password + security question = NOT MFA (both knowledge — that's just two of the same factor).

Password Best Practices

CompTIA's current guidance (aligned with NIST):

• Length beats complexity. A long passphrase ("correct horse battery staple") is stronger and more memorable than "P@ssw0rd!" — and users won't write it on a sticky note.
• No forced rotation unless compromise is suspected. Forcing changes every 90 days just produces "Winter2026!" → "Spring2027!"
• Screen locks after inactivity. A strong password means nothing if the logged-in workstation sits unattended.
• Password managers are the exam-approved answer for "how should users handle dozens of passwords."

Biometrics and Smart Cards

• Biometrics (inherence factor): fingerprints, facial recognition, iris scans. Convenient and hard to forget — but you can't change your fingerprint if it's compromised, and biometric data needs secure storage. On the exam, biometrics are the go-to example of the inherence factor.
• Smart cards: credit-card-sized chips (ownership factor) often combined with a PIN (knowledge) — that's MFA in a single login. Common in government and enterprise. If a question mentions a card + PIN for building or system access, think smart card.

Scenario: The Shared Workstation

A medical clinic has one front-desk computer shared by six receptionists, all logging in as "FrontDesk" with the password taped under the keyboard. Audit this:

• Shared accounts destroy accountability. When something goes wrong, you can't tell who did it. Every user needs their own account.
• The password location defeats the entire purpose. This is a physical security failure as much as a password failure.
• The fix: individual accounts, MFA where possible (a fingerprint reader is cheap and staff won't forget their fingers), automatic screen lock after 2–3 minutes, and remove that sticky note. In a medical setting, this isn't just best practice — it's a compliance obligation.

2.5 Wireless Security: Locking Down the Airwaves

Wireless networks broadcast into the parking lot. Encryption is what keeps the neighbors (and attackers) out of your traffic.

The Encryption Generations

WPA2/WPA3 come in two flavors:

• Personal (PSK): one shared passphrase for everyone. Fine for home and small offices. The weakness: everyone shares the same key, and a departing employee still knows it.
• Enterprise: each user authenticates individually, usually against a RADIUS server. No shared passphrase — each person has their own credentials, and access can be revoked per-user.

RADIUS: Centralized Authentication

RADIUS (Remote Authentication Dial-In User Service) is the server that checks wireless (and VPN) login credentials against a central directory like Active Directory. When a user joins the corporate Wi-Fi, the access point asks the RADIUS server "is this person legit?" — one place to disable access when someone leaves, instead of changing a shared password on 200 devices.

Wireless Hardening Checklist

Beyond encryption, the exam expects these:

• Change default credentials on the access point (admin/admin is the first thing attackers try)
• Disable WPS — the push-button setup feature has well-known vulnerabilities
• Use a strong PSK (long, random) for Personal mode
• Guest network isolation — visitors get internet, not access to your file server
• Firmware updates on access points, like everything else

Note what isn't on the list: hiding the SSID and MAC filtering. These are sometimes mentioned as options, but they're trivially bypassed (the SSID is broadcast in probe responses; MAC addresses are easily spoofed). CompTIA considers them not real security — know them only to recognize them as insufficient.

2.6 Physical Security: The Forgotten Layer

The fanciest encryption in the world doesn't help if someone walks out with the server. Physical security controls:

• Badge readers / smart cards for door access — who goes where, logged
• Biometric locks for high-security areas (server rooms)
• Security cameras and guards — deterrence and evidence
• Cable locks for laptops in shared spaces
• Privacy screens — defeat shoulder surfing in open offices
• Secure disposal — locked shred bins, not open recycling (remember dumpster diving)
• Server room controls: locked doors, no windows or reinforced glass, fire suppression, environmental monitoring

2.7 Incident Response: When Things Go Wrong

Sooner or later, prevention fails. Incident response is the disciplined procedure for handling security events — and CompTIA tests the order of operations relentlessly. The procedure:

1. Identify. Detect and determine what happened. Is this actually a security incident, or a false alarm? Gather initial facts.
2. Contain. Stop the bleeding — isolate affected systems from the network so the incident can't spread. Don't destroy evidence yet.
3. Eradicate. Remove the cause — delete the malware, close the vulnerability, revoke the compromised credentials.
4. Recover. Restore systems to normal operation — rebuild from known-good images, restore from clean backups, verify everything works.
5. Lessons learned. Document what happened, what worked, what didn't, and update procedures so it doesn't happen again.

Scenario: Ransomware at the Accounting Firm

Back to our opening story — the red screens, the Bitcoin demand, the panicking office manager. Here's the correct response, step by step:

• Identify (Step 1): Confirm it's ransomware, not a prank. Check: are files actually encrypted (renamed extensions, ransom notes in folders)? Which machines are affected? Is it still spreading?
• Contain (Step 2): Immediately disconnect affected machines from the network — pull Ethernet cables, disable Wi-Fi. If the ransomware is still encrypting network shares, every second counts. Do NOT turn the machines off yet if forensic analysis is planned (memory contains evidence), but isolation from the network is non-negotiable.
• First, do no harm: Do NOT pay the ransom. Do NOT try to "fix" encrypted files with random decryption tools (they can cause further damage). Do NOT delete the ransom notes — they're evidence.
• Eradicate (Step 3): Once contained, identify the entry point (almost always phishing — find the email). Remove the malware from all affected systems, ideally by wiping and rebuilding from known-good images rather than trying to "clean" an encrypted system.
• Recover (Step 4): Restore data from backups — after verifying the backups are clean and the entry point is closed. This is why tested, offline backups are the single best ransomware defense: the 3-2-1 rule (3 copies, 2 different media, 1 offsite/offline).
• Lessons learned (Step 5): How did it get in? (The phishing email.) Why did it spread? (Flat network, no segmentation.) Why was the impact so bad? (Backups were on a network share the ransomware could reach.) Fix all three: email filtering and training, network segmentation, offline immutable backups.

Chain of Custody and Documentation

If an incident might involve legal action — data theft, employee misconduct, anything that could end up in court — chain of custody matters: a documented record of who handled evidence, when, and what they did with it. Break the chain (let an undocumented person poke at the compromised drive), and the evidence may be inadmissible.

Practical rules:

• Document everything as you go — timestamps, actions taken, systems touched.
• Don't alter evidence. Image drives before analyzing them; work from the copy.
• Report to the right people — your incident response plan says who (IT security, management, legal, and in some cases law enforcement or regulators). Don't freelance.

2.8 Data Destruction: Gone Means Gone

When hardware is retired, the data on it doesn't retire too — unless you make sure of it. CompTIA distinguishes three levels:

Scenario: The Office Upgrade

A company replaces 40 workstations. The old ones go to three places: 20 stay in the company as spares, 10 are donated to a school, 10 are scrapped. What's the correct handling?

• 20 spares (internal reuse): wipe with a proper disk-wiping tool (multiple overwrite passes). Data is unrecoverable by normal means, drives stay usable.
• 10 donations (leaving the organization): wipe thoroughly — and for any drive that held sensitive data (HR, finance), physically destroy instead of donating the drive. When in doubt, destroy.
• 10 scrapped: physical destruction for drives that held sensitive data; at minimum, degaussing for HDDs (never for SSDs).

And document the whole chain — which serial numbers were wiped, which were destroyed, who did it, when. Asset disposal without documentation is an audit failure waiting to happen.

---

End-of-Chapter Test