Security

Security on the A+ rests on defense in depth: no single control is trusted to hold, so you stack independent layers, and each one limits the damage when the layer before it fails. This domain splits that idea into two jobs. Encryption & Access Control (access control, for short) decides who and what may reach the system, its data, and its network, and encrypts the data at rest so a drive taken out of the machine gives up nothing. Malware Defense keeps hostile code out and removes it cleanly when it slips in anyway. The classic exam trap is picking the answer that merely works over the one that fails safe: a lone strong password instead of multifactor authentication (MFA), an administrator account for everyday work instead of a standard one, or WPA2 left in place when WPA3 is available. Name the job a scenario targets, then choose the option that assumes the least trust.

Read this page as a map, then follow the two subtopics in order. Encryption & Access Control is the preventive half: it encrypts data at rest with full-disk encryption (FDE) so a stolen drive is useless, gives every account only the access its job needs (least privilege) through standard users, User Account Control (UAC), and NTFS file permissions, proves identity with strong authentication and MFA, and locks down wireless with WPA3 (the current Wi-Fi Protected Access standard) or WPA2-AES. Malware Defense is the resilience half: it teaches you to name a malware family by how it spreads and what it does, to prevent infection with real-time protection and prompt patching, and, when something does get in, to work the fixed ten-step removal order that objective 2.6 of the 220-1202 exam objectives publishes and to recognize the infections that need a reimage instead of an in-place clean. These two halves are how this guide divides the domain rather than a complete inventory of its objectives; security material a reader meets in another context is taught with that context and cross-linked, among others the symptom-by-symptom repair of an already-infected machine, which lives on Software troubleshooting's Security Issue Remediation page. Each subtopic carries the mechanisms, the numbers, and the traps; this overview only shows how the two halves fit together.

Across both halves the exam rewards the same instinct: choose the most restrictive, most current option that still meets the requirement. That means least privilege over convenience, the strongest available cipher over a weaker one that still connects, MFA over a password alone, and the prescribed procedure over improvisation. An explicit Deny always beats an Allow, and when a malware question hands you a sequence, the fixed order is the answer rather than the most aggressive single step. You rarely need to memorize an exception; the strict, low-trust default is correct far more often than not, and each subtopic shows where the genuine exceptions live.