Social engineering attacks: what Security+ tests and why

What does social engineering actually attack?

Social engineering attacks the human, not the hardware. Instead of cracking encryption or exploiting a software bug, the attacker manipulates a person into handing over access, money, or information they were supposed to protect. The firewall never sees it coming, because nothing about the request looks like an attack.

CompTIA places this squarely in Domain 2.0, Threats, Vulnerabilities, and Mitigations, which carries 22 percent of the SY0-701 exam and is the second-largest domain behind Security Operations. Objective 2.2 lists social engineering under human vectors and names specific techniques on purpose. The exam expects you to tell them apart, because the right defense changes depending on which attack you are looking at. Scenario questions and performance-based items love this domain, since one detail in the story usually points to a single technique and a single correct response.

It matters well beyond the test. Social engineering mostly targets confidentiality and integrity, the first two legs of the CIA triad, and it is the attack a working help desk sees most often. If you are still mapping out your path, the Security+ certification overview shows where this topic fits in the wider blueprint.

The principles that make people click

Every social engineering attack leans on predictable human wiring. Security+ expects you to recognize the psychological levers, because naming the lever is often faster and more reliable than spotting a flawless fake.

These are the classic social-engineering principles you will need to recognize in exam scenarios. You will see them used alone and, more often, stacked together inside a single message:

None of these require a single line of malware. That is the whole point. The attacker is programming the person, not the computer, and a message can carry three or four of these levers at once.

• Authority. The message claims to come from someone you are wired to obey: a CEO, the IRS, a police officer, or the IT department.
• Urgency and scarcity. Act now or lose the account, the refund, or the deal. Pressure shrinks the careful thinking that would catch the trick.
• Social proof, or consensus. Everyone on your team already approved this, so going along with it feels safe and normal.
• Familiarity and liking. The attacker seems friendly, name-drops a real coworker, or wears the logo of a brand you already trust.
• Intimidation. Threats of a fine, a lost job, or an angry manager push you past your own doubt.
• Trust. The slow version: build rapport over days or weeks until the eventual request feels routine.

The phishing family: email, voice, and text

Phishing is the mass-market version of social engineering: a fake message that fishes for credentials, money, or a malicious click. The exam wants the variations, which differ mainly by target and by channel.

Keep these straight, because a scenario question often hinges on one small detail:

The channel changes the clue, not the core play. An urgent text and an urgent call are the same trick running on different phones, and business email compromise is the version that costs companies the most because it never trips a virus scanner.

• Phishing. Generic messages blasted to thousands of inboxes, hoping a small percentage bite.
• Spear phishing. A tailored message aimed at one person or team, using real names and details so it reads as legitimate.
• Whaling. Spear phishing aimed at a big fish, usually an executive whose access and authority make the payoff large.
• Vishing. Voice phishing over a phone call, often a fake help desk, bank, or vendor working you in real time.
• Smishing. Phishing by SMS text, usually a short link and a manufactured deadline.
• Business email compromise, or BEC. A spoofed or hijacked executive account asks finance to wire money or change payment details. There is no attachment to scan, just a convincing request.

Pretexting, impersonation, and web-based traps

Not every attack arrives as an obvious message. Some build a fake scenario, wear a borrowed identity, or poison a site you already trust, so the target walks into the trap while doing something that feels completely normal.

Pretexting, impersonation, watering hole, and typosquatting all appear in Objective 2.2. Pharming is the closely related DNS-redirection trick worth knowing alongside them:

The through-line is misplaced trust. The victim believes they are dealing with a person, a site, or a web address that is exactly what it claims to be, and everything else follows from that one wrong assumption.

• Pretexting. Inventing a believable backstory to justify the ask, such as posing as the vendor's support team verifying your setup. Pretexting is the engine under most of the other attacks.
• Impersonation. Posing as a specific trusted role or person, whether by email, on the phone, or standing in your lobby in a delivery uniform.
• Watering hole. Compromising a website a target group is known to visit, so the victims infect themselves during ordinary browsing.
• Typosquatting. Registering look-alike domains, a swapped letter or a wrong extension, to catch mistyped addresses and misread links.
• Pharming. Redirecting a correct web address to a fake copy, usually by tampering with DNS or a local hosts file, so even careful typing lands on the attacker's page.

Low-tech attacks that still work

Social engineering is not always digital. Some of the oldest moves happen in a hallway, over a shoulder, or in a trash bin, and Security+ still expects you to name them and know how they are used.

Treat these as reconnaissance as much as attacks. A name from a discarded memo, a badge number glimpsed at a door, or a password read over a shoulder becomes the believable detail that makes tomorrow's phishing email land.

• Tailgating and piggybacking. Following an authorized person through a secure door before it closes, often with full hands or a friendly nod so no one asks for a badge.
• Shoulder surfing. Watching someone type a password or PIN, or reading sensitive data off their screen, in person or through a camera or a reflection.
• Dumpster diving. Digging through discarded paper, drives, and sticky notes for credentials, org charts, or any detail that makes the next attack more convincing.

What defenses does a help desk actually use?

Because the target is a person, the defense is mostly people and process, backed by a few technical controls. On a real desk, the same five moves come up again and again, and the exam rewards knowing which one addresses which attack.

Here is the working set:

You can drill these exact decisions before test day. A full-length practice exam pushes you to label the attack and pick the control under time pressure, which is how the real questions are framed.

• Security awareness training and phishing simulations. Teach staff the levers and the named attacks, then run safe test campaigns so people practice spotting them before a real one lands.
• Verification and callback procedures. For any money movement or password reset, confirm the request through a known, separate channel. Never trust the phone number or link inside the suspicious message itself.
• Phishing-resistant MFA. Authentication that cannot be relayed or read aloud to an attacker, such as FIDO2 security keys or passkeys, beats one-time codes a caller can talk you into sharing. Know the MFA factor categories for the exam, and read CISA's guidance on phishing-resistant MFA for the reasoning.
• Email authentication with SPF, DKIM, and DMARC. SPF lists which servers may send for a domain, DKIM signs each message so tampering shows, and DMARC tells receivers what to do when those checks fail. Together they make spoofing a known domain far harder.
• Reporting and a no-blame culture. A one-click report button and a team that thanks people for reporting, even the false alarms, means the one real attack surfaces early instead of hiding in someone's shame.

The human layer is the one you can train

Social engineering wins by skipping the technology and talking straight to a person, which is exactly why it shows up so much on SY0-701 and in real help desk work. Learn the six principles, name the attacks in the phishing family and beyond, and know the handful of defenses that actually blunt them: training, verification, phishing-resistant MFA, email authentication, and easy reporting. When you can spot the lever behind a message, the trick loses most of its power. Practice labeling live scenarios, then check your progress on the Mastery Index so you walk into the exam knowing this domain cold.