The A+ Core 2 practice questions worth your time read like help desk tickets. A user reports something, the stem adds one or two details that look like background, and the four answers are all real tools or real procedures. Most of the time, one of those background details is what eliminates the wrong answers. Learning to spot it is most of the skill.
Here are five original 220-1202 questions, at least one from each of the four domains, with two from Security because it shares the top weight with Operating Systems. Each one has the answer, the detail in the stem that decides it, and a short case against every wrong option. Commit to a letter before you read the answer. For the format itself, what CompTIA A+ Core 2 is covers it: a maximum of 90 questions in 90 minutes, with a passing score of 700 on a scale of 100 to 900.
Where do these five questions sit on the exam?
Core 2 has four domains. The weights are CompTIA's, from the V15 objectives document. The objective numbers point to where each question lives.
| Question | Domain | Domain weight | Objective |
|---|---|---|---|
| 1. The clean boot | 1.0 Operating Systems | 28% | 1.4 |
| 2. The shared laptop | 2.0 Security | 28% | 2.2 |
| 3. Nothing on the disk | 2.0 Security | 28% | 2.4 |
| 4. The second sign-in | 3.0 Software Troubleshooting | 23% | 3.4 |
| 5. RDP from home | 4.0 Operational Procedures | 21% | 4.9 |
Read the full map in A+ Core 2 domains explained. Five questions are a sample, and the score report will not care which ones felt easy.
Ticket 1: the PC that freezes after every sign-in
A user's Windows 11 desktop has started freezing a minute or two after sign-in. It runs fine in Safe Mode. The user installed two utilities last week, and you suspect a third-party service that came with one of them. You want Windows to start normally with only Microsoft services running, so you can bring the others back in batches and find the culprit. What should you do?
A. Open Event Viewer, filter the System log, and disable the services it flags
B. Open System Configuration (msconfig.exe), check "Hide all Microsoft services" on the Services tab, disable everything still listed, and restart
C. Open Device Manager, disable every non-Microsoft device, and restart
D. Open Registry Editor and delete the third-party service keys under HKLM\SYSTEM\CurrentControlSet\Services
Answer: B. The stem asks for a reversible test, and that is what a clean boot in System Configuration gives you. Hiding the Microsoft services leaves only the third-party ones on screen, so you can switch them all off, confirm the freeze stops, then turn them back on a few at a time until it returns.
Why the others fail:
A is a reasonable place to look for evidence, but Event Viewer only reports. It has no way to switch a service off for a test boot.
C goes after the wrong layer. Device Manager disables hardware and its drivers, and nothing in the ticket points at a device.
D might technically stop the service from loading, but deleting registry keys cannot be undone without a backup, and you would be guessing which key matters. When a safe, reversible tool does the job, the destructive one is the wrong answer.
Ticket 2: two users, one laptop, two kinds of encryption
Two employees share a Windows 11 Pro laptop, each with their own domain account. The operating system drive is protected with BitLocker. One employee has also encrypted a folder of payroll spreadsheets with EFS. With the laptop booted and running, the second employee signs in and browses to the payroll folder. Which statement is accurate?
A. BitLocker keeps the second employee out of the files, and EFS adds nothing on a volume that is already encrypted
B. EFS keeps the second employee out of the files, and BitLocker mainly protects the data if the drive is read offline, for example after it is pulled from the laptop
C. Both BitLocker and EFS protect the files from the second employee at the same time
D. Neither protects the files, because BitLocker already decrypted access to the drive at boot
Answer: B. The key phrase is "booted and running." BitLocker encrypts the whole volume, but once Windows has started and the volume is accessible, every signed-in user reads the drive normally. EFS works per file and is tied to the account that encrypted it, so the second employee cannot open the spreadsheets.
Why the others fail:
A reverses the two roles. On a running machine, EFS is the layer that separates one user from another.
C sounds safe because it credits both tools. BitLocker does nothing to separate two users on a booted system, so "both" is wrong.
D is half right about BitLocker and wrong about EFS. EFS does not depend on BitLocker's state at all.
Ticket 3: malware that never touches the disk
A security review finds that attackers ran code in memory on several workstations, using PowerShell and WMI. Nothing was written to disk. The anti-malware on those machines is signature-based, fully up to date, and raised no alerts. Which tool is most appropriate for detecting this kind of activity?
A. An email security gateway
B. Endpoint detection and response (EDR)
C. A software firewall
D. Anti-malware with current definitions
Answer: B. Two details decide it: no files on disk, and up-to-date signatures that saw nothing. Signature scanning needs something to match, so the answer has to be a tool that watches behavior. EDR monitors what processes do on the endpoint, such as PowerShell spawning unusual network connections, and flags patterns rather than files.
Why the others fail:
A filters mail at the edge of the network. It might stop the attachment that started the attack, but it cannot see what runs in a workstation's memory.
C can limit which programs connect out, which may interrupt the attacker, but a firewall detects connections. It does not analyze process behavior.
D is ruled out by the stem itself. The definitions were already current and found nothing, because there was no file to scan. When a stem tells you something was already tried, that option is usually there to catch skimmers.
Ticket 4: the certificate warning and the second sign-in
This morning a user browsed to the company's HR portal and saw a certificate warning. She clicked "Advanced" and continued. The portal looked normal, but it asked her to enter her username and password again, even though she had not signed out. What is the most concerning explanation, and what should you do first?
A. The portal's certificate expired overnight; ask the web team to renew it and have the user change her password when convenient
B. She may have reached a spoofed or intercepted copy of the portal; treat her credentials as compromised, change them from a known-clean device, isolate the workstation, and check the certificate issuer, DNS settings and browser extensions
C. The browser's certificate cache is stale; clear the cache and have the user sign in again
D. A recent Windows update is causing extra sign-in prompts on HTTPS sites; install the pending patch
Answer: B. Neither symptom alone proves much. Together they describe a credential-harvesting page: a certificate the browser did not trust, followed by a request for a password the real portal had no reason to ask for. She typed the password, so it has to be treated as stolen, and the change has to happen on a machine you trust.
Why the others fail:
A explains the warning and ignores the sign-in prompt. An expired certificate does not make a site ask you to log in again. "When convenient" is also far too relaxed for credentials that may already be in someone else's hands.
C misunderstands certificate checks. The browser validates the certificate the server presents on each connection, and clearing cached data does not change what it was shown.
D invents a cause. Nothing in the stem mentions an update, and an update bug would not explain an untrusted certificate on one internal site.
Ticket 5: the IT team wants RDP from home
Company policy says no remote access service may be exposed directly to the public internet. The IT team asks for Remote Desktop access to internal Windows servers from their home computers. Which design meets the policy?
A. Allow RDP on TCP port 3389 through the firewall and require strong passwords
B. Require technicians to connect to the corporate VPN first, then use RDP to reach the servers through the tunnel
C. Move RDP to a non-standard port so internet scanners will not find it
D. Use VNC instead of RDP, since VNC encrypts its sessions by default
Answer: B. Read the policy sentence as the question. With the VPN in front, the only thing facing the internet is the VPN endpoint, which adds its own authentication. RDP stays reachable only from inside the tunnel, so the policy is met and the team still gets its access.
Why the others fail:
A still puts RDP on the open internet, which is exactly what the policy forbids. Strong passwords make brute-force attempts harder, but they do not change the exposure.
C is security through obscurity. A port scan finds RDP on any port, and the service is still public.
D rests on a shaky claim. Encryption in VNC depends on the product and its settings, and classic VNC sessions are commonly tunneled through SSH or a VPN to protect them. Even with encryption on, a VNC server facing the internet breaks the same rule.
Why do Core 2 distractors feel so plausible?
Core 1 questions often turn on a spec: which cable, which connector, which wireless standard. Core 2 leans harder on scope, sequence and policy. Look back at the five wrong-answer sets and you will see three repeating moves.
The first is the right tool at the wrong moment. Event Viewer, current definitions and an expired certificate are all real things a technician checks. Each one answers a question the stem did not ask, or one the stem already answered.
The second is the destructive shortcut. Deleting registry keys works in the way a sledgehammer works. The exam consistently prefers the reversible, documented path when one exists, and it treats "first" and "most appropriate" as instructions to pick the least drastic step that solves the problem.
The third is the half answer. Option A in ticket 4 and option D in ticket 2 each get one part right. If an option explains one symptom and skips the other, it is almost never the answer.
Our view: half answers are most tempting in Security questions, because so many security responses have two parts, such as containing a problem and then fixing it. When you review a Security miss, check whether you picked an option that did only one of the two.
What should you do after these five A+ Core 2 practice questions?
Five items teach a way of reading. They cannot show you which objectives you are weak on. That takes a larger bank, worked in domain-sized pieces after you study each domain, with every miss written down next to the stem detail you overlooked.
The CompTIA A+ Core 2 220-1202 Study Guide includes 152 practice questions grouped by domain, and each one explains both the correct answer and why every distractor is wrong, in the same style as this post. The A+ Core 2 study plan shows where those banks fit in your weeks, and how hard A+ Core 2 is explains what the 700 passing score means when you are judging whether you are ready.
FAQ
Are these real A+ Core 2 exam questions?
No. All five were written for this post from the 220-1202 objectives and the chapters of our study guide. They test the same skills as the exam, but none is a recalled exam item. Treat any source claiming to sell real exam questions as one to avoid.
How many performance-based questions are on A+ Core 2?
CompTIA does not publish a count, and it does not say where they fall in the exam. It lists the question types as multiple-choice (single and multiple response), drag-and-drop, and performance-based. Prepare every "Given a scenario" objective as if it could appear as a hands-on task.
Which domain should I practice most for Core 2?
Operating Systems and Security carry 28% each, so together they are more than half the exam. Software Troubleshooting is 23% and Operational Procedures is 21%. Start with the two big domains, but do not skip the smaller ones: 21% is still a large share of a 90-question exam.
Should I memorize the answers to practice questions?
No. Memorize why each wrong option fails. A repeated question scores well because you recognize it, and the real exam will not repeat it. The reasoning is what carries over to a question you have never seen.
Want more Core 2 questions explained this way? The CompTIA A+ Core 2 220-1202 Study Guide gives each of the 36 Core 2 objectives a short chapter of its own, and adds 152 practice questions with every answer and distractor explained, plus worked performance-based drills.
Simply Certified is an independent publisher. A+ and CompTIA are trademarks of CompTIA, Inc. Our books are independent study material and are not affiliated with, endorsed by, or sponsored by CompTIA.