Security and Troubleshooting

Week of 2026-10-27 · Download .docx

Objectives

Identify and differentiate between the four primary malware types: virus, worm, trojan, and ransomware.
Apply the CompTIA A+ seven-step troubleshooting methodology to hardware and software scenarios.
Use Device Manager and Event Viewer to diagnose hardware and software issues in Windows.
Explain ESD risk and describe the correct protective measures during component repair.
Identify physical and logical security controls for protecting IT infrastructure.

Key terms

Malware: Malicious software — any program designed to damage, disrupt, or gain unauthorized access to a computer system or its data.
Virus: Malware that attaches itself to a legitimate executable file and replicates when that file is run by a user — requires human execution to spread.
Worm: Self-replicating malware that spreads autonomously across network connections without requiring a user to execute a file — exploits network vulnerabilities.
Trojan: Malware that disguises itself as legitimate or desirable software to trick a user into running it; does not self-replicate.
Ransomware: Malware that uses encryption to lock victim files and demands payment (typically cryptocurrency) for the decryption key.
Phishing: A social engineering attack using fraudulent emails or websites impersonating trusted entities to steal credentials or install malware.
ESD: Electrostatic Discharge — the sudden transfer of static electricity between objects at different electrical potentials; can permanently destroy electronic components.
Anti-static wrist strap: A grounding device worn on the wrist that connects the technician to the chassis ground, equalizing electrical potential and preventing ESD damage.
POST: Power-On Self-Test — the BIOS/UEFI diagnostic routine that checks CPU, RAM, storage, and video output on every boot before handing control to the OS boot loader.
Safe Mode: A Windows diagnostic startup mode that loads only minimal drivers and disables third-party services, used to isolate driver and software conflicts.
Device Manager: Windows utility (devmgmt.msc) that displays all detected hardware, shows driver status (yellow exclamation = error, red X = disabled), and manages device drivers.
Event Viewer: Windows logging tool (eventvwr.msc) that records System, Application, and Security events for post-incident diagnosis.
Mantrap: A physical security entry control using two interlocking doors with a holding area between them, allowing only one person to pass at a time to prevent tailgating.

The concept

Security and troubleshooting are two of the highest-weighted domains on the CompTIA A+ Core 2 exam (220-1202). This module covers the malware taxonomy, the structured troubleshooting process, essential Windows diagnostic tools, ESD prevention, and the physical and logical security controls that protect IT infrastructure.

**Malware Types**

Four malware categories appear consistently on A+ exams. A virus requires a host file — it attaches to an executable and activates when a user runs the infected program. A worm is autonomous: it scans networks for vulnerable hosts and copies itself without any user interaction. A trojan presents as useful software (a game, a utility, a pirated application) to trick a user into installing it; once installed, it creates backdoors or downloads additional malware. Ransomware is the most damaging financially — it uses asymmetric encryption to lock the victim's files and demands cryptocurrency payment for the decryption key. Backups are the primary defense against ransomware.

**The A+ Troubleshooting Methodology**

CompTIA defines a seven-step methodology that transforms chaotic problem-solving into a repeatable, documentable process. Step 1: Identify the problem — ask the user what happened, what changed, and what the symptoms are. Step 2: Establish a theory — form a hypothesis about the most probable cause based on the evidence. Step 3: Test the theory — verify or disprove the hypothesis with a targeted test (swap a cable, boot Safe Mode, check Device Manager). Step 4: Establish a plan — design a fix that addresses the root cause without creating new problems. Step 5: Implement — apply the fix. Step 6: Verify — confirm the problem is resolved and check for side effects. Step 7: Document — record the problem, cause, and solution in a ticket or knowledge base.

**Windows Diagnostic Tools**

Device Manager (devmgmt.msc) lists every hardware device Windows detects and signals driver issues with visual indicators. A yellow exclamation mark means the driver is present but has an error. A red X means the device is disabled. Right-clicking a device shows options to update, roll back, or uninstall the driver.

Event Viewer (eventvwr.msc) records events in three primary channels: System logs OS and driver events; Application logs software errors; Security logs logon attempts and policy changes. Event ID numbers (such as 41 for unexpected shutdown or 1001 for application crashes) allow rapid identification of recurring issues.

**ESD and Physical Security**

Electrostatic discharge is invisible and silent but can instantly destroy a CPU, NIC, or RAM stick. Static builds on the human body during normal movement; touching an ungrounded component discharges thousands of volts through microscopic circuits. The solution is an anti-static wrist strap that grounds the technician to the chassis, equalizing potential. Always work on an anti-static mat, avoid carpeted floors, and never touch component traces.

Physical security for servers layers multiple controls: cable locks prevent theft of portable devices; badge access restricts entry to authorized personnel; biometric readers add authentication; and mantrap entry systems prevent tailgating by allowing only one person through at a time. These physical controls complement but cannot be replaced by logical controls such as firewalls and antivirus software.

Worked examples

Example 1: Applying the troubleshooting methodology: A user reports their laptop will not connect to Wi-Fi. Step 1 (Identify): the user says it worked this morning; no software was installed; no physical changes were made. The Wi-Fi icon shows a red X. Step 2 (Theory): most probable causes are a disabled Wi-Fi adapter, a missing driver update, or a disabled wireless service. Step 3 (Test): open Device Manager — the Wi-Fi adapter shows a yellow exclamation mark. The theory is confirmed: a driver issue. Step 4 (Plan): update or reinstall the Wi-Fi driver. Step 5 (Implement): right-click the adapter → Update driver → Search automatically. Driver installs. Step 6 (Verify): the Wi-Fi connects successfully. Step 7 (Document): log the incident, device, driver version, and resolution.

Example 2: Identifying malware type from behavior: A company's shared drive is suddenly inaccessible — every file shows an unfamiliar extension and a ransom note appears on screen demanding payment in Bitcoin. Identify the malware type by behavior: files are encrypted (not deleted), the attacker demands payment for decryption, no user action was required after the initial infection vector. This is ransomware. Response steps: 1. Isolate affected systems from the network immediately. 2. Notify IT security and management. 3. Do not pay the ransom — recovery from clean backups is the correct procedure. 4. Identify the infection vector (phishing email, unpatched vulnerability) and remediate. 5. Restore from the last clean backup and verify integrity before reconnecting.

Common mistakes

Confusing virus and worm propagation. A virus needs a user to run an infected file. A worm spreads on its own via network vulnerabilities. On the A+ exam, 'without user interaction' is the key phrase that identifies a worm.
Skipping the Identify step and jumping to fixes. Implementing a fix without fully identifying the problem often masks symptoms without addressing the root cause, leading to recurring incidents. Always complete step 1 before step 2.
Treating Safe Mode as the solution rather than the diagnostic tool. Safe Mode reveals whether a problem is caused by a third-party driver or service — it is not itself the fix. Once the cause is identified in Safe Mode, the actual fix is applied and tested in normal startup mode.
Confusing phishing with spoofing. Phishing is the attack (fake email designed to steal credentials). Spoofing is a technique used within phishing (forging the sender address). On the exam, if the question describes a fake email seeking credentials, the answer is phishing, not spoofing.
Believing a firewall protects against physical theft. Firewalls, antivirus, and VPNs are logical security controls — they protect data in transit or at rest electronically. Cable locks, mantraps, and badge-access systems are physical controls. Both layers are required; neither replaces the other.

Self-check

Try each question before reading the answer. Answers at the bottom of this page.

1. A malware sample spreads across a network to unpatched machines with no user interaction. Which malware type is this?

Virus
Trojan
Worm
Adware

2. A technician is about to reseat RAM in a customer's PC. Which action should they take first to prevent ESD damage?

Put on rubber gloves
Attach an anti-static wrist strap connected to chassis ground
Place the RAM in a plastic bag
Turn off the monitor

3. Which step of the A+ troubleshooting methodology immediately follows 'Establish a theory'?

Implement the fix
Test the theory
Document findings
Identify the problem

4. A Windows PC boots but a device shows a yellow exclamation mark in Device Manager. What does this indicate?

The device is disabled
The device driver has an error
The device is not recognized
The device is functioning normally

5. Which physical security control prevents tailgating into a secured server room?

Firewall
Antivirus
VPN
Mantrap

Self-check answers

1. C — A worm self-replicates autonomously across network connections without requiring a user to execute an infected file — 'without user interaction' is its defining characteristic.
2. B — An anti-static wrist strap grounded to the chassis equalizes the technician's electrical potential with the equipment, preventing damaging electrostatic discharge during component handling.
3. B — After establishing a theory (step 2), the technician tests it (step 3) to verify or disprove the hypothesis before committing to a plan or making any changes.
4. B — A yellow exclamation mark in Device Manager indicates the device is recognized by Windows but the driver has an error — the device may not function correctly until the driver is updated, rolled back, or reinstalled.
5. D — A mantrap uses two interlocking doors so only one person can pass at a time, preventing an unauthorized person from following an authorized person through a secured entry point.

Canvas is the official record. This companion enhances the PGCC curriculum; it does not replace it. Last name and class year only. Students with a 504 plan or IEP: your accommodations apply.

↑ Back to top