Troubleshooting Security Issues. This is the skill that separates a helpdesk rookie from a trusted IT professional who can keep a company's data safe. When something goes wrong — a virus infects a computer, a user can't log in, or sensitive files get deleted — you need a repeatable process to find the root cause and fix it fast, which is exactly what the 220-1202 exam expects you to know.
Jump to a section
A simple way to picture Troubleshooting Security Issues
Have you ever left your house in a rush and realised halfway down the street that you aren't sure if you locked the front door?
That nagging feeling is exactly what keeps IT security professionals up at night. In your home, an unlocked door invites anyone to walk in and take your TV, laptop, or family photo albums. In a company's computer network, an unsecured setting, a weak password, or a missing software update is like leaving that front door wide open. A 'security issue' is any problem that creates that opening — a vulnerability that an attacker can exploit.
Troubleshooting these issues works like a home security check. You start by walking around your house (scanning the network) to see which doors and windows are unlocked. You check if the lock on the back door is broken (a software bug) or if you left a window cracked open (a misconfigured setting). Then you fix each problem: you replace the broken lock (apply a patch), close and latch the window (change the configuration), and install a deadbolt (enable multi-factor authentication). Finally, you test everything by trying to open each door again (run a vulnerability scan) to make sure the fixes actually work. A good troubleshooter doesn't just slam the door shut — they figure out why it was left open in the first place so it never happens again.
Security troubleshooting is a systematic process for identifying, analysing, and resolving problems that threaten the confidentiality, integrity, or availability of data and systems. Let's break down what those three terms mean, because they form the foundation of every security concept you'll encounter.
Confidentiality means that only authorised people can see the data. Integrity means the data hasn't been tampered with or corrupted. Availability means the data and systems are accessible when they're needed. A security issue is any event that threatens one or more of these three goals. For example, a ransomware attack encrypts your files (breaks confidentiality and integrity) and then holds them hostage (breaks availability).
The CompTIA troubleshooting methodology gives you a structured way to tackle any problem, including security issues. It has seven steps: identify the problem, establish a theory of probable cause, test the theory, establish a plan of action, implement the solution, verify full system functionality, and document findings. Let's apply this to a real security scenario.
First, you identify the problem. A user reports that their computer is running extremely slowly and they can't open any of their files. You ask questions: When did this start? Did you click any unusual links recently? You also gather information from system logs and error messages.
Second, you establish a theory of probable cause. Based on the symptoms — slow performance, inaccessible files — your top theory is a ransomware infection. Other possibilities include a failing hard drive or a corrupted operating system, but ransomware is the most likely given the file access issue.
Third, you test your theory. You run an antivirus scan, check the file extensions of the locked files (ransomware often appends a new extension like .encrypted), and look for a ransom note in the user's directories. If you find the note and see that files have been renamed, your theory is confirmed.
Fourth, you establish a plan of action. For a ransomware infection, the immediate step is to isolate the infected computer from the network by disconnecting the ethernet cable or disabling Wi-Fi. This prevents the ransomware from spreading to other devices. The plan then includes wiping the hard drive and restoring from a clean backup.
Fifth, you implement the solution. You disconnect the computer, perform a full system restore from a backup that was taken before the infection occurred, and then update the antivirus definitions and run a full scan to ensure no remnants remain.
Sixth, you verify full system functionality. You check that all the user's files are accessible and that the computer is running normally. You also confirm that the backup restore didn't break any applications or user profiles.
Seventh, you document findings. You write down what happened, what caused it (the user clicked a phishing link), what you did to fix it, and any recommendations to prevent it from happening again (like additional phishing awareness training).
Common security issues you'll troubleshoot include:
Malware infections (viruses, worms, ransomware, spyware)
Unauthorised access (someone logging in with stolen credentials)
Denial of service (a system being overwhelmed with traffic)
Misconfigured permissions (users having access to files they shouldn't)
Weak or default passwords
Outdated software with known vulnerabilities
Physical security breaches (someone stealing a laptop)
Each of these issues requires you to follow the same structured approach. The tools you'll use include antivirus software, system logs, network monitoring tools, password managers, and backup solutions. The key is to never guess — always gather evidence before acting, because a rushed fix can make the problem worse. For instance, if you immediately reboot a ransomware-infected computer, you might trigger the encryption of additional files. Taking a systematic approach ensures you solve the problem correctly the first time.
Identify the Problem
Gather information from the affected user and system logs. Ask questions like 'What were you doing when the issue started?' and 'Have you clicked any unusual links or opened attachments recently?' This step clarifies the symptoms and scope of the security issue.
Establish a Theory of Probable Cause
Based on the symptoms, list possible causes from most to least likely. For example, slow performance and locked files suggest ransomware, not a failing hard drive. Prioritise the most common and dangerous causes first.
Test the Theory
Run diagnostic tools like antivirus scans, check file extensions, and verify network connections to confirm whether your top theory is correct. Do not skip this step — acting on an untested theory can make the problem worse.
Establish a Plan of Action
Decide the exact steps you will take to resolve the issue, including any escalation procedures. For a malware infection, the plan might include disconnecting from the network, running a scan, and restoring from backup. Get approval if the plan involves downtime.
Implement the Solution
Execute the plan step by step. For security issues, this often involves isolating the system, removing malware, resetting passwords, or restoring data. Document each action as you go so you can track what worked.
Verify Full System Functionality
Confirm that the original problem is resolved and that no new issues were introduced. Log in as the user, open files, run applications, and test network connectivity. Security fixes can break legitimate functionality, so verify everything works.
Document Findings
Write down the problem, the root cause, the steps taken, and any preventive measures implemented. This documentation helps with future incidents and is required for compliance in regulated industries.
Imagine you are the only IT person at a small accounting firm with 50 employees. It's Monday morning, and you get an urgent call from the receptionist: 'Every file on my computer has turned into a weird .locked file and there's a message saying I have to pay $500 in Bitcoin to get them back.' This is your ransomware scenario.
Here is exactly what an IT professional does step by step.
First, you confirm the scope of the issue. You ask the receptionist to stay calm and not touch the computer. Then you check with other employees to see if they're experiencing the same problem. You discover that three other people in the same department also have locked files. Now you know it's not an isolated incident — it's spreading through the network.
Second, you isolate the infected systems. You walk to each affected desk and physically unplug the ethernet cable. If you have remote management tools, you disable the network adapters from your workstation. This stops the ransomware from communicating with its command-and-control server and prevents it from encrypting more files on shared drives.
Third, you determine the infection vector. You check the email logs and find that all four affected users received a phishing email yesterday afternoon with an attachment called 'Invoice_Statement.pdf.exe'. The receptionist clicked on it because it looked like it came from a trusted vendor. This is the most common entry point for ransomware.
Fourth, you notify management. You send a clear, non-technical message to the office manager: 'We have a ransomware incident affecting four computers. I've isolated them from the network. We will need to restore from backups. No sensitive data has been exfiltrated, but payroll files on one computer may be affected.' This keeps leadership informed without causing panic.
Fifth, you begin the recovery process. You check your backup system. Because the firm follows a 3-2-1 backup strategy (three copies of data, on two different media types, with one copy offsite), you have a clean backup from last night stored in the cloud. You use a bootable USB drive to wipe each infected computer's hard drive, reinstall the operating system, and then restore the user's files from the cloud backup. This takes about four hours per computer.
Sixth, you verify functionality. For each restored computer, you log in as the user, open several files, print a test document, and access the accounting software. You confirm that everything works.
Seventh, you harden the environment to prevent a repeat. Based on what you learned — the phishing email got through because the company didn't have email filtering — you implement a new email security gateway that blocks executable attachments. You change the company's password policy to require multi-factor authentication for all email accounts. You schedule a mandatory 30-minute security awareness training session for all employees next week.
Finally, you document everything. You create an incident report that includes the timeline, the root cause, the steps taken, and the changes made. You store this document in a secure location so that if it happens again, you or another IT person can quickly reference the solution.
This entire process — from discovery to documentation — is the real-world practice of troubleshooting security issues. It's not glamorous, but it's essential. Every IT professional who has dealt with ransomware will tell you that having a clear, repeatable process is the difference between a one-hour recovery and a week-long disaster.
The 220-1202 exam tests your ability to apply the CompTIA troubleshooting methodology specifically to security scenarios. You will not be asked to just list the seven steps — you will be given a real-world description of a problem and asked to select the correct next step, the most likely cause, or the best solution.
Here are the specific concepts the exam loves to test:
The difference between troubleshooting steps: they often give you a scenario where the technician skips a step, and you must identify which step was missed. For example, 'A technician sees a ransomware note on a user's screen and immediately reboots the computer. What step did they skip?' The answer is isolating the system from the network.
Malware types: ransomware, spyware, adware, rootkit, Trojan, virus, worm. You need to know the symptoms of each. A common trap is describing a worm (self-replicating across a network) but calling it a virus. Remember: worms spread without user action; viruses need a host file.
Phishing variants: spear phishing (targeted at a specific person), whaling (targeted at executives), vishing (voice phishing over the phone), smishing (SMS text phishing). The exam loves to give you an email that addresses the CEO by name and says 'urgent wire transfer needed' — that's whaling.
Social engineering techniques: pretexting (creating a fake scenario to get information), baiting (leaving a malware-infected USB drive in the parking lot), tailgating (following an authorised person into a secure area).
Permission issues: The exam will test NTFS permissions vs share permissions. The effective permission is the most restrictive of the two. They also love to test 'take ownership' — if a user can't access a file even though they have Full Control, they likely need to take ownership first.
Password security: Default passwords (always change them), password complexity requirements, password expiration, and account lockout policies.
Physical security: Locking workstations (Windows+L), using privacy screens, securing laptops with cable locks, and properly disposing of old computers (data destruction methods like wiping, degaussing, or physical destruction).
Common exam traps include:
Choosing 'reboot the computer' as the first step in a malware incident — this is almost always wrong because it can cause more damage or alert the attacker.
Confusing a denial of service attack with a system crash — DoS is caused by overwhelming traffic, not a hardware failure.
Thinking that antivirus software can remove all malware — rootkits and some ransomware often require a full system restore from backup.
Assuming that two-factor authentication prevents all unauthorized access — it doesn't prevent a user from willingly giving their code to a phishing site.
Overlooking documentation — the exam often includes a question about what should be done after the problem is resolved, and 'document the findings' is almost always the correct answer.
To pass, memorise the seven-step troubleshooting process in order. Practise applying it to each security issue you study. If you can walk through a ransomware attack, a phishing email, and a permission error using the same seven-step framework, you will be ready for any scenario the exam throws at you.
The seven-step CompTIA troubleshooting methodology is the standard framework for resolving any security issue, from malware infections to permission errors.
Always isolate an infected system from the network before doing anything else to prevent the malware from spreading.
Phishing is the most common attack vector for organisations, and the exam expects you to recognise its variants: spear phishing, whaling, vishing, and smishing.
Effective permission in Windows is the most restrictive of NTFS permissions and share permissions when both are applied to the same resource.
Documentation is the final and mandatory step in every troubleshooting process — the exam will test that you do not skip it.
Security issues are always prioritised based on the CIA triad: confidentiality, integrity, and availability — in that order.
These come up on the exam all the time. Here's how to tell them apart.
Virus
Requires a host file to execute
Needs user action to spread (e.g., opening an attachment)
Can be removed by antivirus software without network isolation
Worm
Self-contained executable that does not need a host
Spreads automatically across networks without user interaction
Often spreads so fast that isolating the network is the only containment method
Phishing
Sent en masse to thousands of recipients
Generic content like 'Dear Customer'
Low success rate because it's easy to spot
Spear Phishing
Targeted at a specific individual or small group
Personalised content using the victim's name, job title, or company
Higher success rate because it appears legitimate
NTFS Permission
Applies to users logged in locally or over the network
More granular (e.g., Read, Write, Modify, Full Control)
Effective permission is the combination of all NTFS permissions
Share Permission
Only applies to users accessing the resource over the network
Fewer options (Read, Change, Full Control)
Effective permission is the most restrictive of NTFS and share permissions combined
Ransomware
Encrypts files and demands payment for decryption
Usually spreads through phishing emails or exploit kits
Goal is financial extortion
Trojan
Disguises itself as legitimate software to trick users into installing it
Often used to create backdoors for remote access
Goal is usually data theft or creating a botnet, not direct extortion
Pretexting
Attacker creates a fabricated scenario to obtain information
Relies on impersonation (e.g., pretending to be IT support)
Often done over the phone or via email
Baiting
Attacker offers something enticing to lure the victim (e.g., a free USB drive)
Relies on physical media or digital downloads promising free content
Often involves leaving malware-infected devices in public places
Mistake
Antivirus software can detect and remove all types of malware, including rootkits and ransomware.
Correct
Antivirus software can detect many types of malware, but rootkits are designed to hide from antivirus and some advanced ransomware variants can only be removed by wiping the system and restoring from a clean backup.
People see antivirus as a magic bullet because it successfully removes simple viruses, so they assume it works on everything. The exam wants you to understand that antivirus has limitations.
Mistake
If a user gets a phishing email, the first step is to click 'Report Spam' in their email client.
Correct
The correct first step in an IT security context is to instruct the user not to click anything in the email and to forward it to the IT team or security operations for analysis.
Users are trained by their email client to use the 'Report Spam' button, but in a corporate environment, the IT team needs the actual email headers and content to analyse the threat and block the sender.
Mistake
Two-factor authentication means you are completely secure from account takeovers.
Correct
Two-factor authentication dramatically improves security, but it can still be bypassed by sophisticated phishing attacks that capture the one-time code in real time (man-in-the-middle attacks) or by SIM swapping attacks on SMS-based codes.
Marketing often presents 2FA as an impenetrable shield, so beginners believe it is absolute. The exam tests that you recognise its limitations.
Mistake
When a computer has a virus, you should immediately reboot it to stop the virus from running.
Correct
Rebooting an infected computer can make the problem worse because some malware triggers destructive actions on shutdown or reboot, and it may also destroy forensic evidence needed to identify the infection source.
The natural instinct is to 'turn it off and on again', which works for many non-security issues. This misconception persists because people don't realise that malware developers specifically anticipate this behaviour.
Mistake
A strong password is all you need to protect your online accounts.
Correct
A strong password is important, but it is not sufficient. You also need multi-factor authentication, regular password rotation, and awareness of phishing attacks that can steal even the strongest password.
Security awareness campaigns focus heavily on password complexity, which leads people to believe that 'long and complex' equals 'secure'. The exam emphasises defence in depth, meaning multiple layers of security.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Immediately isolate the infected computer from the network by unplugging the ethernet cable or disabling Wi-Fi. This prevents the ransomware from spreading to other systems and buying you time to assess the damage.
Look for symptoms like unusual pop-ups, unexpected file name changes, slow performance combined with high network activity, or users reporting that they can't access files they normally can. Security issues often affect multiple systems and involve unauthorised changes.
A virus attaches itself to a legitimate program and requires user action (like opening a file) to spread. A worm is a standalone program that self-replicates across a network without any user action, making it much faster to spread.
Yes. The exam frequently presents a scenario where a technician skips a step, and you must identify which step was missed. You need to know the correct sequence: identify, theory, test, plan, implement, verify, document.
Spear phishing is a targeted attack where the email is personalised for a specific individual using information gathered from social media or public records. Regular phishing is a mass email sent to thousands of people hoping someone clicks.
Rebooting may trigger the malware's destructive payload, encrypt files that were not yet encrypted, or destroy forensic evidence. Always isolate the system first, then use proper removal tools or restore from a clean backup.
You've finished Troubleshooting Security Issues. Continue through the 220-1202 study guide to build a complete picture of the exam.
Done with this chapter?