🖥️ Stuff Every IT Tech Should Know: Training Guide

Port basics and remote access

A port is a number that helps a computer send traffic to the right service. The IANA registry keeps the official assignments, and techs use the common ones every day. Secure Shell (SSH) uses TCP port 22, while Telnet uses 23 and Remote Desktop uses 3389. These are all remote access tools, so it is easy to mix them up.

Remote Desktop Protocol (RDP) lets you control a Windows computer from another machine. It listens on port 3389 by default. File sharing between Windows computers uses Server Message Block (SMB) on port 445, so file access and remote control use different ports.

Network Time Protocol (NTP) keeps clocks in sync and uses port 123. DNS uses port 53, not 123, so keep the two services apart.

Email and DNS services

SMTP is the protocol for sending and relaying email, and it uses port 25. POP3 and IMAP are for retrieving or reading mail, not sending. POP3 uses port 110 and IMAP uses 143. Remembering who sends versus who reads prevents mix-ups.

POP3 pulls mail down to your device using port 110, while IMAP is designed for reading mail that stays on the server and uses port 143.

DNS answers name lookups on port 53, over both UDP and TCP. It turns a name like example.com into an address. Port 67 belongs to the DHCP server, not DNS, so do not confuse the two.

Windows file sharing and network services

DHCP servers listen on port 67. DHCP clients use port 68. This old Bootstrap Protocol pairing assigns addresses automatically, and techs should know both ends.

SMB is the protocol Windows uses for file sharing, and it runs on port 445. The same exam list also names older NetBIOS ports 137 to 139, but modern SMB uses 445.

RDP uses port 3389, SSH uses 22 and SMB uses 445. These three are on the A+ Core 1 port list, so they are worth memorizing as a set.

TCP and UDP

TCP sets up a connection with a three-way handshake. Because steps two and three can be combined in one message, it is called a three-way handshake. After setup, TCP provides a reliable, in-order, byte-stream service.

UDP is transaction oriented and does not guarantee delivery or duplicate protection. That makes it light and fast, which suits live voice and DNS lookups. Use TCP when you need reliable delivery.

Port numbers apply to both TCP and UDP, but a service often uses one or both. The IANA registry lists SSH on port 22 for TCP, UDP and SCTP. Knowing the transport helps when you read packet captures.

IPv4 and IPv6 addresses

RFC 1918 reserves three private IPv4 blocks: 10/8, 172.16/12 and 192.168/16. The 172 block stops at 172.31.255.255, and the 192 block must be 192.168.x.x. These addresses are for private networks and do not route on the public internet.

When a PC cannot reach a DHCP server, it can give itself an address in the 169.254.x.x range. Windows calls this APIPA, and it only allows talking to neighbors on the same link. This is a sign that DHCP failed.

IPv6 increases the address size from 32 bits to 128 bits. The larger size supports more levels of addressing hierarchy and far more addresses. A full IPv6 address is much longer than an IPv4 address.

DNS records and email policies

An A record maps a name to an IPv4 address, and an AAAA record maps a name to an IPv6 address. Because IPv6 addresses are four times as long, the AAAA name is a memory hint.

An MX record tells other servers where to deliver email for a domain. A CNAME makes one name an alias for another, such as www.example.com pointing to example.com. These two record types are used for different jobs.

A TXT record can hold text such as SPF policy. SPF tells receivers which servers may send mail for the domain, helping fight spoofed email. DMARC works with SPF and DKIM and publishes domain-level policies for handling suspicious email.

DHCP and wireless services

When a device needs an address, it first broadcasts a DHCPDISCOVER message to locate servers. A server answers with DHCPOFFER, the client asks with DHCPREQUEST, and the server confirms with DHCPACK.

A DHCP reservation ties an IP address to one specific client, so that device always gets the same address. An exclusion keeps addresses out of the pool, and a lease is the time an address may be used.

Wi-Fi 7 adds 320 MHz wide channels in the 6 GHz band, which provide twice the throughput of Wi-Fi 6. The older 2.4 GHz and 5 GHz bands are not where these very wide channels live.

The early 802.11a standard defined a higher speed physical layer in the 5 GHz band. IEEE titles 802.11b and 802.11g in the 2.4 GHz band. So 802.11a is the one to remember for 5 GHz.

Network commands and call quality

In Microsoft Teams, high jitter makes a speaker's voice sound robotic. Jitter is the average change in delay between successive packets. Microsoft flags average jitter above 30 ms as poor audio quality.

ipconfig /flushdns clears the Windows DNS client resolver cache. If a cached DNS answer is wrong or stale, flushing forces the next lookup to ask the DNS server again.

tracert shows each router hop on the path to a destination. pathping adds latency and packet loss information per hop, so it helps find which router is losing packets or adding delay.

netstat -o adds the process ID, or PID, to each active connection. With the PID you can look up which application opened a suspicious connection in Task Manager. netstat -a shows all active connections and listening ports.

nslookup lets you query DNS servers directly. If a name fails to resolve here, DNS is a likely culprit, and you can use the help subcommand inside nslookup to see options.

Windows 11 requirements and lifecycle

Windows 11 requires Trusted Platform Module version 2.0. The firmware must also be UEFI and Secure Boot capable. TPM 1.2 does not meet the requirement.

Windows 11 also requires at least 4 GB of memory and 64 GB of storage. These minimums appear together with the TPM and UEFI requirements in Microsoft's published list.

Windows 10 reached end of support on October 14, 2025. After that, Microsoft stopped free technical assistance, feature updates and security updates. Only devices in Extended Security Updates still get security fixes.

GUID Partition Table, or GPT, was introduced as part of the UEFI initiative. It is more flexible than the older MBR partition scheme, though Windows limits a GPT disk to 128 partitions.

Windows security features

User Account Control prompts the user to approve or deny a change that needs administrator permission. This limits what malicious code can do silently. UAC is on by default.

BitLocker encrypts an entire drive volume and works best with a TPM. The operating system drive must be formatted with NTFS. A separate unencrypted system drive holds boot files.

BitLocker To Go protects removable drives like USB flash drives, SD cards and external disks. A password or smart card unlocks the drive, even on another computer. It can encrypt NTFS, FAT16, FAT32 or exFAT.

Encrypting File System, or EFS, encrypts individual files and folders on NTFS volumes. Unlike BitLocker, it works at the file level, not the whole volume. It helps if a laptop with sensitive files is lost or stolen.

Windows Hello lets you sign in with biometric data or a PIN instead of a password. It is phish-resistant and can also sign you in to supported websites with FIDO or WebAuthn.

Windows Home editions cannot act as Remote Desktop hosts for incoming connections. Pro, Enterprise, Education and Server editions can host incoming Remote Desktop. Home can still be used as a client to connect to other systems.

Core commands and MMC tools

sfc /scannow scans protected system files and repairs damaged ones. You must be an administrator. sfc /verifyonly scans without making repairs.

chkdsk checks a volume for logical and physical file system errors. It is different from sfc, which checks operating system files rather than disk structure.

gpupdate applies new or changed Group Policy settings right away. Add /force to reapply every setting. gpresult /r shows which policies actually applied to a user and computer.

robocopy /mir mirrors a directory tree, copying files and purging extras at the destination. Because it deletes files that do not exist at the source, use it carefully.

eventvwr.msc opens Event Viewer to read system and application logs. lusrmgr.msc opens Local Users and Groups to manage local accounts and groups on a single PC.

PowerShell execution policy controls when PowerShell loads configuration files and runs scripts. On Windows clients the effective default policy is Restricted, which allows single commands but no scripts.

Recovery and system state

System Restore reverts system settings to a previous point in time. It can undo a bad driver or software change without affecting personal files. Windows can create restore points automatically during big events like software installs or updates.

Safe Mode starts Windows with a limited set of files and drivers. If a problem does not happen in safe mode, default settings and basic drivers are not the cause. Safe Mode with Networking adds network drivers and services.

Windows shows a blue screen stop error when it detects a condition that compromises safe operation. It halts rather than risk damage. On preview releases the stop screen can be green.

RAID and storage interfaces

RAID 1 mirrors data by writing identical data to each member disk. If one drive fails, the array can keep running on a surviving disk. Red Hat says RAID 1 offers the highest redundancy of all RAID types.

RAID 0 stripes data for speed but provides no redundancy. High I/O speed at low cost is the goal, but one failed drive loses the array. RAID 0 is performance only.

RAID 6 uses a parity scheme that can recover from the loss of any two drives in the array. RAID 5 spreads parity across drives but is built to survive one failure, and RAID 0 has no redundancy at all.

NVMe solid-state drives talk to the computer over PCI Express, or PCIe. NVMe was designed for fast flash storage with high bandwidth and low latency, unlike older SATA drives.

S.M.A.R.T. stands for Self-Monitoring, Analysis and Reporting Technology. It watches drive health and warns before a failure. If a drive health check warns the disk is about to fail, back up the data right away.

macOS backup and storage

Time Machine automatically backs up a Mac to an external drive and keeps hourly, daily and weekly backups. It needs a storage device set up as the backup disk. Time Machine also saves local snapshots.

FileVault encrypts the startup disk so a thief cannot decrypt or access data without entering the login password. Keep the recovery key somewhere other than with the Mac.

Disk Utility's First Aid feature checks and repairs a Mac volume. Run First Aid on each volume and container, then on the storage device itself. If it says the disk is about to fail, back up and replace it.

APFS is the default file system for Mac computers using macOS 10.13 or later. It is designed for flash and SSD storage and adds encryption, space sharing and snapshots.

To force quit an unresponsive Mac app, choose Apple menu, then Force Quit, select the app and click Force Quit. You may lose unsaved changes. The keyboard shortcut Option-Command-Esc also opens the Force Quit window.

Spotlight search opens with Command-Space bar. It quickly finds apps, files, emails and messages. Mission Control lets you create extra desktops called Spaces to organize windows.

Linux file and command essentials

chmod changes a file's permission bits, which control who can read, write and run it. chown changes the file's owner and group instead. chmod accepts either a symbolic mode or an octal number.

df reports free and used space on mounted file systems. du estimates the space used by files and directories. If no file name is given to df, it shows space on all mounted file systems.

The /etc/shadow file contains password information and optional aging information for Linux accounts. It must not be readable by regular users if password security is to be maintained.

The /etc/fstab file describes the filesystems the system can mount. Order matters because fsck, mount and umount read the file in sequence. Each filesystem gets its own line.

sudo lets a permitted user run a command as the superuser or another user. It checks a security policy to decide who may run which commands. Using it only when needed keeps everyday work in a normal account.

fsck checks and optionally repairs a Linux filesystem. It can take a device name, a mount point, or a label. fsck normally checks filesystems on different physical disks in parallel to save time.

Phishing and authentication

A common phishing warning sign is an urgent demand to act now or face a penalty. Phishers rush you into clicking, paying or sharing information. If the message looks like it comes from a real company, contact the company using a number or site you already know.

A hardware security key is an example of the authentication factor 'something you have'. Multi-factor authentication combines different factor types: something you know, have or are. A PIN or password is something you know, and a biometric is something you are.

Least privilege means users should get only the minimum access needed to do their job. It reduces damage from mistakes or stolen accounts. NIST also applies least privilege to processes acting on behalf of users.

On a personal BYOD phone, mobile application management, or MAM, manages only the work apps and their data, not the rest of the phone. It is typical for personal devices. Full device MDM manages the whole device instead.

Face ID with a single enrolled appearance has a false match rate of less than 1 in 1,000,000, according to Apple. It also allows only five unsuccessful match attempts before a passcode is required.

Malware and network attacks

A rootkit changes normal host functions in a hidden way. It often gives an attacker secret control at the most privileged level, and because it hides so well, the recommended fix can be reinstalling the operating system.

A Trojan appears to be useful software but hides a malicious function. It tricks users into running it. Trojans can evade security by exploiting the legitimate authorizations of the user running them.

A denial-of-service attack prevents authorized access or delays time-critical work. A distributed denial-of-service, or DDoS, uses many hosts to perform the attack at once, so blocking one address does not help.

WPA3-Personal gives stronger protection against password guessing attempts on home networks. WEP and WPA2 with TKIP are older, weaker options. WPA3 is required for all Wi-Fi CERTIFIED devices.

Device and physical safety

Before opening a PC to repair it, disconnect power. This lowers the chance of electric shock and damage to components. ESD straps, ESD mats and antistatic bags prevent electrostatic discharge.

A laptop battery that is swollen should not be used. Stop using it and replace it. Dell says to discontinue use and let a swollen battery drain by unplugging the AC adapter, then replace and dispose of it properly.

A worn-out lithium-ion laptop battery should go to a battery recycler or hazardous waste site, never in household garbage or recycling bins. Tape the terminals or place batteries in separate plastic bags.

A rollback plan describes how to undo a change if it fails. It is part of change management, along with scope, risk analysis and change board approvals.

Incident response and evidence

Chain of custody documents every person who handled evidence, with date and time. It tracks the movement of evidence from collection to analysis, recording why it moved. This is important in incident response and forensics.

When a disk utility warns the disk is about to fail, back up the data and replace the disk. This connects to S.M.A.R.T. warnings, which also signal impending failure. The first priority is preserving data.

Do not use a damaged battery and do not place it in normal garbage. These habits reduce fire risk. Ask a qualified professional or recycler when handling large or damaged batteries.

Cloud service models

Rapid elasticity means cloud capacity can scale out and back in as demand changes. NIST lists it as one of five essential characteristics. Resource pooling is about sharing, and measured service is about metering.

SaaS lets you use a provider's application, such as web-based email, running on their cloud. You do not manage servers or the operating system. IaaS and PaaS hand you more of the stack.

IaaS gives you virtual processing, storage and networks so you can run your own operating systems. The provider still controls the underlying infrastructure.

Containers on one host all share the host's kernel. A virtual machine runs a complete operating system with its own kernel. Containers are lighter but offer less isolation than VMs.

Virtualization

A Type 1 hypervisor runs directly on the hardware with no host OS. This is also called bare metal virtualization. A Type 2 hypervisor runs on top of a host OS, which NIST calls hosted virtualization.

A bare metal hypervisor can even be built into the computer's firmware. Type 2 hypervisors run like an application on a regular operating system.

Because containers share the kernel, they are isolated processes but not separate machines. Microsoft says VMs provide stronger isolation, while containers give lightweight isolation. Use VMs when you need full OS separation.

Hardware and peripherals

Micron lists DDR5 memory data rates starting at 4800 MT/s and reaching as high as 8800 MT/s. DDR4 runs from 600 to 3200 MT/s. DDR5 also runs at 1.1 volts compared with 1.2 volts for DDR4.

Micron lists on-die ECC as a new DDR5 chip feature, while DDR4 has none. On-die ECC checks and scrubs errors inside the chip to strengthen reliability.

USB 3.2 identifies three transfer rates: 5, 10 and 20 Gbps. The 20 Gbps rate uses two lanes of 10 Gbps. USB4 can reach 80 Gbps over 80 Gbps certified cables that use USB Type-C.

Intel lists Thunderbolt 4 minimum required bandwidth at 40 Gbps. Thunderbolt 5 doubles that minimum to 80 Gbps. Thunderbolt 4 uses the USB Type-C connector.

In a laser printer, the fuser bonds the toner to the paper with heat and pressure. Before that, the drum transfers toner to paper after an image is projected onto the drum.

An eSIM is a digital SIM activated without a physical card. It lets you activate a carrier plan without waiting for a card or swapping cards. Android Help says Mac computers cannot tether with Android over a USB cable, though Wi-Fi and Bluetooth tethering still work.

A+ exam and structured troubleshooting

The CompTIA A+ Core 1 exam, code 220-1201, has a passing score of 675 on a scale from 100 to 900. It has a maximum of 90 questions and a 90 minute time limit.

Hardware and Network Troubleshooting is the largest Core 1 domain at 28 percent. Hardware is 25 percent and Networking is 23 percent. Virtualization and Cloud Computing is the smallest at 11 percent.

CompTIA's troubleshooting methodology starts with identifying the problem. Next come a theory of probable cause, testing the theory, a plan of action, verifying functionality and documenting findings.

The A+ Core 1 exam includes multiple-choice and performance-based questions. Studying the exact objectives helps you know which tasks to practice in a lab.