A+ Core 2 Security Domain: What 28% of the Exam Covers

The domain at help desk depth

Security and Operating Systems are each 28% of Core 2, so together they are more than half the exam blueprint. Security+ covers some of the same words at a deeper level. A+ stays with the person at the desk: which setting to change, which step comes next, which attack the user just described. Read every security stem as "what would a support technician do here?"

All eleven objectives and the action each one tests

NTFS versus share permissions from 2.2 has its own page, NTFS vs share permissions, because it produces the most calculation-style questions in the domain.

Wireless: protocols and authentication

A detail that separates RADIUS from TACACS+ beyond transport: RFC 2865 hides only the user's password with an MD5-based method, while RFC 8907 applies its protection, which it calls obfuscation, to the TACACS+ packet body and warns not to rely on it without a secured network.

SOHO router checklist (2.10)

Use it as a scenario checklist: if a question describes a small office router with one of these left at its default, that is the answer. To see how a simulation's goal narrows this list to the settings that matter, work through the router example in the A+ PBQ guide.

1. Change the default admin credentials. CISA notes that default router logins can be found publicly.
2. Update the firmware. CISA: "Routine updates will protect you against known vulnerabilities."
3. Set encryption to WPA3 Personal or WPA2 with AES.
4. Change the default SSID. CISA says a default SSID can point an attacker to known vulnerabilities for that router model. Disabling SSID broadcast, also on the A+ list, only hides the name from casual scanning. It does not encrypt anything.
5. Turn off UPnP after the devices that needed it are set up, as CISA recommends.
6. Secure management access. Disable remote administration over the internet unless it is required.
7. Create guest access for visitors and devices that need only internet access.
8. Review firewall rules. Disable unused ports and keep port forwarding to the minimum. A screened subnet holds anything that must be reachable from outside.
9. Use IP and content filtering where the office needs them, and place the router where strangers cannot reach its reset button.

Windows settings and hardening, the short version

• UAC and account type. Users work as standard users and elevate with "Run as administrator" only when needed. UAC is the prompt that makes elevation visible.
• BitLocker, BitLocker To Go, and EFS. BitLocker encrypts entire volumes. Microsoft's documentation describes it as protecting data on lost or stolen devices. BitLocker To Go covers removable drives. EFS encrypts individual files and folders for a user account.
• Sign-in options. Windows Hello, PIN, fingerprint, and facial recognition are listed alongside username and password and SSO.
• Workstation habits from 2.7. Screen saver locks, logging off, password managers, and protecting PII and passwords are all exam-relevant end-user practices, not just policy.

Data destruction: match the method to the medium

Physical destruction (drilling, shredding, incineration) suits drives that leave the organization's control. Degaussing uses a strong magnetic field, so it is meant for magnetic media such as hard drives and tape, not for SSDs. For reuse inside the organization, erasing or wiping is appropriate. A quick format only rebuilds the file system structures, so the old data can still be recovered. When a vendor does the work, get a certificate of destruction or recycling.

Browser security

Download browsers and extensions only from trusted sources, and verify a download's hash when the publisher provides one. Treat a certificate warning on a familiar site as a symptom, not an obstacle to click past. Private browsing stops local history from being saved but does not hide activity from the network. Pop-up blockers, ad blockers, clearing the cache and browsing data, proxy settings, and secure DNS are all on the 2.11 list, as is turning extensions, plug-ins, and features on or off.

Where Security+ takes over

If the security objectives here are the part of Core 2 you enjoy, Security+ goes further into controls, architecture, and security operations. The A+ vs Security+ guide covers which to take first. For Windows tools that support these settings, see the Windows tools guide.

Pick any five rows from the objective table and say the help desk action out loud, then practice A+ Core 2 security questions with Passy →. For a focused run on one weak spot, retest only the rows you missed before you move on.