How hard is A+ Core 2? Moderately hard for an entry-level exam, and hard in a different way from Core 1. The 220-1202 asks less about what a part is and more about what you do next: which Windows tool to open, which step of a procedure comes first, which of two permission rules wins. You get a maximum of 90 questions in 90 minutes, and you need 700 on a scale of 100 to 900 to pass, a higher bar than Core 1's 675.
People who find it hardest tend to be the ones who expect it to be the "soft" half of A+. Security and Operating Systems are 28% each, so more than half the exam is about Windows, macOS, Linux and protecting them. If you want the full picture of the exam first, read what CompTIA A+ Core 2 is. This post stays on difficulty.
How hard is A+ Core 2 compared with Core 1?
Core 1 is wide: hundreds of small hardware and networking facts that blur into each other. We covered that in how hard is A+ Core 1. Core 2 is narrower in topic count but heavier on judgment: 36 objectives across four domains, with Software Troubleshooting at 23% and Operational Procedures at 21% behind the two 28% domains.
The recall is still there. You will need to know that chmod 755 gives the owner full access and everyone else read and execute, or that SSH runs on port 22 and RDP on 3389. But a large share of the questions hand you a situation and ask for the best action, where two answers would both work and only one matches how CompTIA wants a technician to behave.
Neither half is objectively harder. A hardware builder usually finds Core 1 easier and Core 2 slippery. Someone who has worked a help desk often finds the reverse. If you are deciding which to sit first, A+ Core 1 vs Core 2 covers the order. CompTIA lets you take them in any order, as long as both come from the same exam version.
What does the 700 passing score actually mean?
Less than it seems to. The 700 is a scaled score on a range of 100 to 900, and CompTIA does not publish how raw answers convert to it. So 700 is not 70% of questions, and 700 versus Core 1's 675 does not tell you Core 2 needs exactly 25 more points of correct answers. The scales are set separately for each exam.
What you can take from it: the two cores are scored independently, nothing carries over from one to the other, and you need both for the credential. CompTIA does not publish a pass rate for 220-1202 either, so any figure you see online did not come from CompTIA.
The practical target is to be competent in all four domains. A strong Operating Systems result will not reliably rescue a weak Security result when the two carry equal weight.
Why do three operating systems trip people up?
Most candidates use one operating system every day. Core 2 tests Windows 10 and Windows 11 in depth, plus macOS and Linux client tools. Each brings its own trap.
Windows: the exam asks by file name. Our book's Exam Tip for objective 1.4 is blunt about it: the exam tests by executable name, not friendly name. You may use "System Configuration" every week and still miss a question that calls it msconfig.exe. The pairs that get confused are predictable: msconfig.exe controls how Windows boots, while msinfo32.exe only reports what the machine has. diskmgmt.msc changes partitions, and dfrgui.exe optimizes files on a partition that already exists.
Windows editions: the feature decides, not the office size. A scenario describing "a small five-person office" tempts you toward Home. If even one person needs to join a domain, use BitLocker, run gpedit.msc or accept incoming Remote Desktop connections, Home is the wrong answer.
macOS: one tool, one job. Time Machine backs up, FileVault encrypts the disk, Keychain stores credentials, Disk Utility's First Aid repairs disks. The questions are easy once the mappings are fixed and guesswork if they are not.
Linux: the small swaps. apt belongs to the Debian and Ubuntu family, dnf to RHEL and Fedora. /etc/passwd lists accounts, while /etc/shadow holds the password hashes. Getting either pair backwards is a cheap way to lose a point.
The fix is the same for all three: open the tools. Type each .msc and .exe into the Run box at least once. If you have no Mac or Linux machine, a free Linux virtual machine covers the command side.
Where does order matter more than knowledge?
This is the part of Core 2 that surprises people most. Several objectives are procedures, and the exam tests the sequence, not just the steps.
The clearest example is SOHO malware removal, objective 2.6. Investigate and verify the symptoms first, then quarantine the machine, then disable System Restore in Windows Home, then remediate. Near the end you re-enable System Restore and create a fresh restore point, and educating the user is always last. Every step makes sense on its own. The difficulty is that the wrong answers are the right steps in the wrong place.
Here is a question from the practice bank in our book:
A technician is performing SOHO malware removal on a Windows Home machine. The technician has quarantined the infected system. Which step should come IMMEDIATELY before the technician begins active remediation of the infected files, and why?
A. Educate the end user, so they understand what not to do during the cleanup
B. Update the anti-malware definitions, so the scan catches newer threats
C. Disable System Restore, to prevent infected restore points from reintroducing the malware
D. Enable System Restore and create a clean restore point as a safety net before remediation
The answer is C. Restore points can hold copies of the malware, so you clear them out before cleaning, or a later rollback could bring the infection back. Answer D is the trap. A restore point as a safety net sounds responsible, and later in the procedure it is exactly right. Created now, it would preserve the infected state.
Backups produce the same kind of question. Incremental backups capture changes since the last backup of any type, so they are the fastest to run and the slowest to restore. Differential backups capture changes since the last full backup, so a restore needs only the full set plus the latest differential. A question that weighs the two schemes and asks for the faster restore from fewer sets wants differential, even though incremental sounds more efficient.
Which Core 2 rules feel backwards?
A handful of Security rules contradict intuition, and the exam leans on them. These come from the Exam Tip and Common Pitfall callouts in our book:
-
Share permission Full Control, NTFS permission Read, accessed over the network. The effective permission is Read. Over the network, the more restrictive of the two applies. Locally, only NTFS counts.
-
A Deny and an Allow from two different groups. Deny wins.
-
Wiping an SSD before disposal. Degaussing is wrong. It works on magnetic media such as spinning drives and tape, not on flash.
-
A quick-formatted drive. It is not clean. The data blocks are still there and recoverable.
-
Hiding the SSID. The exam counts WPA3 encryption as the control, and a hidden SSID as no control at all.
-
Private browsing mode. It only stops local history being saved, so it does nothing to harden the browser.
-
What WPA3 actually adds. SAE, the new handshake. AES was already in WPA2.
Notice that several of these are things people do at home and believe are safe. That is why they make good distractors. Learn the rule and the reason together, because the exam often rewords the scenario so that memorizing the answer alone does not help.
Why does Software Troubleshooting punish the big fix?
All four Software Troubleshooting objectives are written as "given a scenario": Windows problems, mobile OS and app problems, mobile security problems, and PC security problems. At 23% of the exam, that is a lot of questions where the answer is an action.
The pattern the book flags again and again is least-destructive first. A Windows machine with random crashes calls for Event Viewer, a driver rollback, sfc /scannow or chkdsk, long before a reinstall. A mobile app that will not open calls for force stop, then clear cache, then clear data, then reinstall, and only after all of that a factory reset. Experienced users often jump to the fix that always works. The exam treats that as the wrong answer when a smaller step was available.
The other trap here is reading symptoms as a cluster. Browser redirects plus certificate warnings plus an unfamiliar toolbar is a hijack, and the response is the malware-removal procedure, not clearing the cache. A phone with high data use, fast battery drain and unexpected ads after installing an app "from a link" points to a malicious sideloaded app. The Core 2 practice questions walkthrough works through more items like these.
Is Operational Procedures the easy 21%?
It looks easy, which is the problem. Documentation, change management, safety, communication, licensing, scripting, remote access and AI basics read like common sense, so candidates skim them. Then the questions turn out to have specific answers that common sense does not always reach.
A few examples. An emergency change still needs documentation, completed afterward. A change without a rollback plan counts as a procedural failure even if the change works. An ESD wrist strap is the wrong thing to wear near a power supply or CRT that may hold a charge. With an irate customer, the answer is to acknowledge, ask open questions and restate, never to correct them.
The new AI objective, 4.10, follows the same pattern. Its questions tend to be about behavior rather than theory: verify AI output before acting on it, and never paste private or regulated data into a public tool.
What preparation actually lowers the difficulty?
Split your preparation into three habits. First, use the tools: the Run box, a command prompt, a Linux terminal, the macOS utilities if you can reach a Mac. Second, write procedures out from memory until the order is automatic, starting with malware removal and backup types. Third, practice with scenario questions and read the explanations for the wrong answers, because that is where Core 2's traps live.
Track results by domain, not overall. Operating Systems and Security carry 28% each, so a gap in either matters more than a gap in Operational Procedures. The A+ Core 2 study plan maps the weeks to the weights, and A+ Core 2 domains explained covers every objective in plain English.
If you want each objective's trap named before you meet it on the exam, the CompTIA A+ Core 2 220-1202 Study Guide gives all 36 objectives their own short chapter, each with an Exam Tip and a Common Pitfall, which is where most of the examples above come from.
FAQ
What percentage do I need to pass A+ Core 2?
CompTIA does not state the pass mark as a percentage. The passing score is 700 on a scaled range of 100 to 900, and the conversion from raw answers to that scale is not published. Prepare to be solid in every domain rather than aiming at a number of correct answers.
Do I really need to know macOS and Linux for Core 2?
Yes. Objectives 1.8 and 1.9 cover macOS and Linux client features and tools, inside the 28% Operating Systems domain. You do not need deep administration skills, but you should know what each main tool does and the common Linux commands, permissions and package managers.
Does CompTIA publish a pass rate for A+ Core 2?
No. CompTIA does not publish a pass rate for 220-1202, so any figure you see online did not come from CompTIA. Judge your readiness by your own practice results, domain by domain.
Preparing for 220-1202? The CompTIA A+ Core 2 220-1202 Study Guide gives each of the 36 Core 2 objectives a short chapter with Exam Tips, Common Pitfalls and Key Takeaways, plus worked performance-based drills and 152 practice questions with every answer and distractor explained.
Simply Certified is an independent publisher. A+ and CompTIA are trademarks of CompTIA, Inc. Our books are independent study material and are not affiliated with, endorsed by, or sponsored by CompTIA.