Incident response is the documented process for identifying, containing, and recovering from a security incident while preserving evidence and following the chain of custody. A+ Core 2 covers it alongside handling regulated data such as PII and PCI.
NTFS (New Technology File System) is the default file system for modern Windows, supporting file-level permissions, encryption, compression, and journaling.
Share permissions control access to a folder over the network, and A+ Core 2 requires understanding how they combine with NTFS permissions.
BitLocker is the Windows full-disk encryption feature that protects data if a device is lost or stolen, often using the TPM.
User Account Control (UAC) is a Windows security feature that prompts for consent or credentials before allowing changes that require administrative privileges.
Malware is malicious software such as viruses, ransomware, trojans, rootkits, spyware, and keyloggers.
The malware removal process is CompTIA's seven-step best practice: identify and research symptoms, quarantine the system, disable System Restore, remediate, schedule scans and updates, re-enable System Restore, and educate the user.
Social engineering is a category of attack that manipulates people into revealing information or granting access, including phishing, tailgating, shoulder surfing, and impersonation.
Multi-factor authentication (MFA) is a security control that requires two or more independent factors — something you know, have, or are — to verify identity.
The principle of least privilege is the practice of granting users and processes only the access they need to do their job.
Group Policy is a Windows management feature that centrally enforces configuration and security settings across users and computers in a domain.
Change management is the operational practice of reviewing, approving, documenting, and communicating changes to reduce risk and downtime.
A backup is a copy of data kept so it can be restored after loss, corruption, or ransomware.
Incident response is the documented process for identifying, containing, and recovering from a security incident while preserving evidence and following the chain of custody.