What the 220-1102 actually feels like on exam day

I took 220-1102 expecting a softer follow-up to Core 1. It is not softer. It is more scenario-heavy, more wording-sensitive, and much more likely to punish shallow memorization. The exam is up to 90 questions in 90 minutes, and CompTIA mixes standard multiple choice with PBQs at the front. Those PBQs are where time disappears.

A practical timing plan for this exam is:

Expect 2 to 5 PBQs.
If a PBQ looks like it needs deep clicking around, flag it and move on after a quick read.
For the rest of the exam, your realistic pace is about one minute per question, but many troubleshooting questions take longer because they hide the real issue in the middle of the prompt.
Leave yourself 15-20 minutes at the end for PBQs and flagged scenario questions.

CompTIA’s interface lets you flag and return, so use that. On Core 2, that matters more than on many exams because the PBQs often involve simulated ticket handling, workstation setup, or matching security controls to a situation. Those are solvable, but not worth burning 8 minutes on before you’ve banked easier points.

One more format-specific thing: CompTIA likes “best” and “first” wording. On 220-1102, that changes the answer a lot. A Windows issue might have three technically valid fixes, but only one fits the most efficient help desk action, the least invasive security response, or the next step in the troubleshooting methodology.

Where the points really are: study by domain weight, not by comfort

The weighting matters a lot on this exam. Operating Systems is the biggest chunk, followed by Security, then Software Troubleshooting, and then Operational Procedures. If you are spreading your time evenly across all four, you are studying inefficiently.

The rough priority order should be:

Operating Systems
Security
Software Troubleshooting
Operational Procedures

For Operating Systems, focus heavily on:

Windows editions and features: Home vs Pro matters more than people expect. Questions love to test what requires Pro or higher, like domain join, Group Policy-related management, BitLocker support context, Remote Desktop host capability, Hyper-V support, and administrative features.
Windows tools: Know what each tool is for, not just its name. CompTIA asks in a very job-role way: which tool would a technician use to do X? That means you need to distinguish msconfig, services.msc, taskmgr, eventvwr, devmgmt.msc, diskmgmt.msc, compmgmt.msc, gpedit.msc, regedit, sfc, chkdsk, bootrec, diskpart, netstat, ipconfig, and taskkill.
Windows settings paths: not every question names the exact utility. You may get a symptom and need to know the setting lives under System Properties, Device Manager, Network & Internet, or Apps & Features.
macOS and Linux basics: enough to identify commands, package management style, permissions, and file system concepts. Core 2 is still Windows-heavy, but people lose easy points here because they ignore the non-Windows content.

For Security, prioritize:

Malware types and the correct remediation order
Authentication concepts like MFA, biometrics, SSO, least privilege, and account policies
Physical security controls versus logical controls
Wireless and workstation hardening
Social engineering scenarios, especially where the question asks for the attack type, not the defense

For Software Troubleshooting, focus on symptom-to-fix mapping. CompTIA likes concrete symptoms: slow boot, app crashes, BSOD, browser redirects, mobile battery drain, no email sync, encrypted files after infection, and boot loops.

For Operational Procedures, don’t treat it as fluff. It’s the source of a lot of “I knew the tech but picked the wrong process” mistakes. You need to know:

The CompTIA troubleshooting methodology in order
Change management basics
Backup types and retention ideas
Safety and environmental controls
Documentation, ticket notes, and escalation boundaries
Scripting basics and when automation is appropriate

The Windows-heavy part that trips people up

This exam loves Windows because it reflects real support work, but the trick is that the questions are rarely simple definition checks. They are usually framed as “a user can’t do X after Y happened” and then you have to identify the right administrative tool, edition limitation, startup mode, or command.

The biggest gotcha area is startup and recovery. Be clear on the difference between:

Safe Mode
Safe Mode with Networking
Last Known Good concepts versus modern Windows recovery expectations
System Restore versus System Image
Startup Repair versus command-line boot repair

If a question mentions boot records or boot configuration corruption, think of commands like:

bootrec /fixmbr
bootrec /fixboot
bootrec /rebuildbcd

If it mentions corrupted protected system files after an improper shutdown or malware cleanup, think:

sfc /scannow

If it mentions disk integrity or bad sectors, think:

chkdsk

CompTIA also likes to blur Task Manager, Resource Monitor, and Performance Monitor. My shortcut was:

Task Manager: immediate app/process/user/startup control
Resource Monitor: deeper live resource usage by process
Performance Monitor: counters, long-term performance analysis

Another repeat trap is Windows version capability. If the scenario says a user wants to join a corporate domain from a personal machine and the machine runs Windows Home, the answer is often not a network fix at all. It is that the edition does not support the feature. Same idea with Remote Desktop: client access versus hosting the session is a favorite distinction.

Also spend time on command-line utilities because Core 2 uses them as technician shorthand. A few pairings worth drilling:

gpupdate for applying Group Policy refresh
net use for mapping network drives
ping versus tracert versus nslookup
shutdown options for restart behavior
format, diskpart, and mkfs-style concepts in cross-platform questions

For macOS and Linux, know enough to avoid dumb misses:

macOS: Time Machine, Spotlight, keychain, Force Quit, Activity Monitor, APFS basics, .dmg
Linux: ls, pwd, cd, mv, cp, rm, chmod, chown, sudo, package managers, and permission notation

CompTIA does not usually go deep on Linux administration in Core 2, but it absolutely expects you to identify the right command or permission concept.

Security questions: the trap is choosing a tool instead of the right response

The Security domain on 220-1102 is full of answers that sound technical enough to be attractive but are not the right first move. CompTIA often wants the answer that fits policy, containment, and least privilege, not the flashiest remediation.

Malware remediation is one of the most tested patterns. Know the best-practice sequence cold:

Identify the malware symptoms
Quarantine the infected systems
Disable System Restore in the remediation context where appropriate
Remediate/update anti-malware tools
Scan and remove
Schedule scans and run updates
Re-enable System Restore and create a restore point if applicable
Educate the user

CompTIA may not list that sequence exactly, but it often builds questions around the order. If one answer jumps straight to restoring data or reconnecting the system to the network before containment, that is usually wrong.

You also need clean distinctions between attack types:

Phishing: broad deceptive messaging
Spear phishing: targeted
Whaling: targeted at executives
Vishing: voice-based
Smishing: SMS-based
Shoulder surfing, tailgating, impersonation, hoaxes, dumpster diving

The exam likes workplace scenarios where the user reports an interaction and you identify the attack. The trick is that the prompt may include extra details about malware or account lockouts, but the real tested concept is the social engineering method.

Another area people underprepare is workstation hardening. Be able to choose among:

Strong password and lockout policies
Standard user accounts instead of local admin
Drive encryption
Screen locks and timeout settings
Disable unnecessary services and autorun
Patch management
Endpoint protection

When the question asks for the best way to prevent recurrence, the answer is often a policy or privilege control, not just “install antivirus.”

Wireless security gotchas still show up. Know the practical ranking:

WPA3 is preferred when available
WPA2-AES is still common and acceptable in many scenarios
Avoid weak legacy choices like WEP

If the question is about a small office or home office user connecting insecurely, CompTIA may mix in distractions like MAC filtering or SSID hiding. Those are not the strongest primary controls.

Software troubleshooting: memorize symptom clusters, not isolated facts

This domain is where the exam feels most like actual support. The questions are usually symptom-driven, and the wrong answers are often fixes for a different symptom that sounds similar.

For PC issues, build quick symptom clusters:

Slow performance after startup: too many startup apps, insufficient resources, malware, disk issues
BSOD: driver problems, hardware issues, bad updates, memory faults
Application crashes after update: compatibility, rollback, reinstall, patch issue
No boot after malware cleanup: damaged boot files, startup repair, bootrec tools
System freezes only in one app: app-level issue before OS-wide issue

For mobile device troubleshooting, don’t just study features; study failure patterns. Core 2 likes:

Battery drains quickly after installing a new app
Mobile device not receiving corporate email due to account config or security policy
No cellular data but Wi-Fi works
Screen rotation, touch response, or app permissions issues
VPN or authentication failures on mobile clients

A common trap is assuming every mobile issue is hardware. On this exam, it is often settings, permissions, sync, or network profile.

For printer/application/browser style software symptoms, the exam may blend old-school support with modern software causes. Browser pop-ups, redirects, certificate warnings, and slow browsing are often there to test whether you recognize:

Malware or adware
Bad proxy settings
DNS issues
Browser cache/extensions
Certificate/date-time mismatch

The key pattern on 220-1102 is that troubleshooting questions usually reward the lowest-impact corrective action that matches the symptom. If a browser issue can be solved by checking proxy settings or disabling a malicious extension, a full OS reinstall is obviously too much, but even a full profile rebuild may be too much if the symptom points to one setting.

Operational procedures is where CompTIA hides easy-to-miss points

This domain looks less technical, so people skim it. That is a mistake. Core 2 uses operations questions to test whether you think like a support technician in a managed environment rather than a hobbyist fixing your own PC.

The troubleshooting methodology matters exactly because CompTIA will give you a technically possible action that is out of order. Know the flow well enough to spot when an answer skips validation, jumps to implementation too early, or ignores establishing a theory.

The exam also likes documentation quality questions. Good ticket notes are:

Specific
Action-oriented
Reproducible
Free of guesswork and blame

If the options include vague notes like “fixed issue” versus something like “Removed malicious browser extension, reset proxy settings, updated endpoint signatures, verified normal browsing,” pick the documented, auditable answer.

Backups are another small but recurring area. Know the practical differences among:

Full
Incremental
Differential
Synthetic full
Snapshots where relevant in virtualization contexts

CompTIA may ask from a restore-time angle, not a backup-time angle. That’s where people miss it. Incrementals are efficient to create, but restoring can require the last full plus every incremental after it.

You should also know when to escalate. If a question involves policy violations, repeated security incidents, suspected data exfiltration, or something outside technician authority, the best answer is often escalate according to procedure, not “fix it quietly.”

Scripting and remote access basics can appear in this domain too. You do not need to be a developer, but know the purpose of simple scripting types and safe use cases for automation. Understand why a technician would use a script for repetitive tasks and why scripts should be tested and documented.

PBQs on 220-1102: how to approach the ones CompTIA likes

The PBQs on this exam tend to mirror help desk tasks rather than deep infrastructure builds. Expect things like:

Matching security controls to a scenario
Configuring workstation settings for a business requirement
Identifying the right remediation steps for malware or OS issues
Sorting troubleshooting actions into the proper order
Working through a simulated ticket or user complaint

The mistake people make is trying to solve the PBQ as if they are in a real production desktop with infinite time. Don’t. Treat PBQs like structured scoring opportunities. Usually each screen element maps to a specific objective.

My PBQ process for Core 2 was:

First, identify whether it is testing Windows admin knowledge, security policy, or troubleshooting order
Fill in the parts you know instantly
Look for labels, tabs, or panels that correspond directly to exam objectives
If one subsection is unclear, leave it and finish the obvious sections first

On simulation-style items, CompTIA often includes more clickable elements than you need. That is intentional. If the scenario is about securing a workstation, you probably do not need to explore every menu. Focus on the controls tied to the requirement: account type, encryption, update settings, screen lock, wireless security, remote access, or malware protection.

For ordering PBQs, remember Core 2 usually wants the support workflow answer, not just the technically possible answer. Example: isolate an infected device before broad remediation. Or verify the issue and identify changes before applying a fix.

The last week: what I would review again for 220-1102

If I had only a final week to tighten up for comptia-220-1102, I would not reread everything. I would do a highly selective pass over the topics that show up disproportionately and produce the most second-guessing.

Use this review list:

Windows editions: Home vs Pro feature differences
Administrative tools: what each one is actually used for
Startup and recovery utilities: Safe Mode, System Restore, recovery environment, boot repair commands
Command-line tools: especially the ones tied to support tasks rather than networking alone
Malware remediation order
Social engineering attack identification
Authentication and access control: MFA, permissions, least privilege, lockout, biometrics, SSO
Mobile troubleshooting symptoms
Backup types and restore implications
Troubleshooting methodology order
Ticketing/documentation quality

I would also do at least one session where I answer only scenario questions on:

A Windows machine that won’t boot after an update or infection
A user who cannot join a company environment due to edition or policy limitations
A browser/device behaving oddly due to malware, proxy, permissions, or profile settings
A phone or tablet failing to sync, connect securely, or maintain battery life

Since there are 689 practice questions on Truekia, use them surgically instead of randomly. Break them into objective-based sets. If you miss a question about gpupdate, BitLocker, domain join, phishing type, or incremental backups, don’t just mark it wrong and move on. Add it to a short “Core 2 gotchas” sheet. This exam repeats patterns. Your goal in the final week is to remove pattern-based misses.

A few blunt warnings before you sit the exam

Three things on 220-1102 are easier to underestimate than they should be.

First, Windows familiarity is not the same as Windows exam readiness. Plenty of people use Windows every day and still miss questions about edition limitations, startup tools, or which utility is most appropriate.

Second, security on this exam is procedural. If you think like a power user instead of a managed-environment technician, you will choose answers that are too aggressive, too broad, or out of policy order.

Third, Operational Procedures is not filler. It is where CompTIA checks whether you can function in an actual support role. If you skip documentation, escalation, and change-process material, you will lose points in questions that look easy at first glance.

The exam is passable if you study the way CompTIA writes: symptom first, environment second, best technician action third. For Core 2 specifically, that means drilling Windows tools, security response order, policy-aware troubleshooting, and the difference between a valid fix and the best fix.