CompTIA A+ 1202 Objective 2.5: Compare and Contrast Common Social Engineering Attacks, Threats, and Vulnerabilities

September 9, 2025•45 min read•CompTIA A+ Core 2 Certification

CompTIA A+ Exam Focus: This objective covers the critical understanding of social engineering attacks, various security threats, and system vulnerabilities that IT professionals must recognize and defend against. You'll need to understand how attackers exploit human psychology, technical weaknesses, and system vulnerabilities to compromise security. These concepts are essential for implementing effective security measures and educating users about potential risks.

Social Engineering

Social engineering is the art of manipulating people into performing actions or divulging confidential information. Unlike traditional hacking that exploits technical vulnerabilities, social engineering targets the human element of security, which is often the weakest link in any security system.

Phishing

Definition and Characteristics:

Mass Communication: Sends fraudulent messages to large numbers of recipients
Urgency Tactics: Creates sense of urgency to prompt immediate action
Authority Impersonation: Pretends to be from legitimate organizations
Link Manipulation: Uses deceptive links that appear legitimate
Information Harvesting: Attempts to steal credentials or personal information

Common Phishing Techniques:

Fake Login Pages: Replicas of legitimate websites to steal credentials
Malicious Attachments: Email attachments containing malware
Urgent Requests: Claims of account suspension or security breaches
Prize Notifications: Fake lottery wins or contest prizes
Charity Scams: Fake charitable organizations requesting donations

Vishing (Voice Phishing)

Voice-based Social Engineering:

Phone Calls: Uses telephone calls instead of email
Caller ID Spoofing: Manipulates caller ID to appear legitimate
Automated Systems: Uses robocalls and automated voice systems
Personal Information: Attempts to extract sensitive information over phone
Authority Figures: Impersonates bank officials, government agents, or tech support

Common Vishing Scenarios:

Bank Fraud Alerts: Fake calls about suspicious account activity
Tech Support Scams: Claims of computer infections requiring remote access
Tax Authority Impersonation: Fake IRS calls about tax issues
Lottery Scams: Fake prize notifications requiring payment
Medical Insurance: Fake calls about insurance coverage issues

Smishing (SMS Phishing)

SMS-based Attacks:

Text Messages: Uses SMS messages to deliver malicious content
Shortened URLs: Uses URL shorteners to hide malicious links
Premium Rate Scams: Tricks users into sending premium rate messages
Malware Distribution: Sends links to malicious apps or websites
Two-Factor Authentication Bypass: Attempts to intercept 2FA codes

Common Smishing Techniques:

Package Delivery: Fake delivery notifications with tracking links
Bank Alerts: Fake banking security alerts
App Updates: Fake app update notifications
Contest Entries: Fake contest or survey invitations
Account Verification: Fake account verification requests

QR Code Phishing

QR Code-based Attacks:

Malicious QR Codes: QR codes that lead to malicious websites
Physical Placement: Placed in public locations to trick users
URL Obfuscation: Hides malicious URLs behind QR codes
Mobile Targeting: Specifically targets mobile device users
Trust Exploitation: Exploits user trust in QR codes

QR Code Attack Vectors:

Restaurant Menus: Fake QR codes on restaurant tables
Parking Meters: Malicious QR codes on parking payment systems
Wi-Fi Access: Fake QR codes for Wi-Fi network access
Event Tickets: Fake QR codes for event access
Product Information: Malicious QR codes on product packaging

Spear Phishing

Targeted Phishing Attacks:

Specific Targets: Targets specific individuals or organizations
Personalized Content: Uses personal information to increase credibility
Research-based: Conducts research on targets before attacking
Higher Success Rate: More effective than mass phishing campaigns
Business Email Compromise: Often used in BEC attacks

Spear Phishing Characteristics:

Executive Targeting: Targets high-level executives and decision makers
Industry-specific: Uses industry-specific terminology and context
Social Media Intelligence: Uses social media for target research
Internal Communication: Mimics internal company communications
Financial Transactions: Often involves financial or sensitive data requests

Whaling

Executive-level Phishing:

High-value Targets: Targets C-level executives and senior management
Maximum Impact: Aims for maximum financial or data damage
Sophisticated Techniques: Uses advanced social engineering methods
Authority Exploitation: Exploits executive authority and access
Long-term Planning: Often involves extended reconnaissance

Whaling Attack Methods:

CEO Fraud: Impersonates CEO to authorize fraudulent transactions
Legal Impersonation: Pretends to be from legal or compliance departments
Board Communication: Mimics board-level communications
Merger and Acquisition: Exploits confidential M&A information
Regulatory Compliance: Fake regulatory compliance requests

Shoulder Surfing

Visual Information Theft:

Direct Observation: Watching users enter passwords or sensitive information
Public Spaces: Common in airports, coffee shops, and public transportation
ATM Targeting: Watching people enter PINs at ATMs
Computer Screens: Reading information displayed on computer screens
Mobile Devices: Watching users enter information on mobile devices

Shoulder Surfing Prevention:

Privacy Screens: Use privacy filters on computer screens
Body Positioning: Position body to block view of screen
Secure Locations: Use private areas for sensitive information entry
Biometric Authentication: Use biometrics instead of passwords when possible
Awareness Training: Educate users about shoulder surfing risks

Tailgating

Physical Access Exploitation:

Unauthorized Entry: Following authorized personnel into secure areas
Social Manipulation: Uses social pressure to gain access
Authority Exploitation: Pretends to have legitimate business in the area
Distraction Techniques: Creates distractions to slip past security
Multiple Attempts: May try multiple times if initially unsuccessful

Tailgating Scenarios:

Office Buildings: Following employees into office buildings
Data Centers: Gaining access to server rooms and data centers
Parking Garages: Following vehicles into restricted parking areas
Elevator Access: Using elevators to reach restricted floors
Loading Docks: Exploiting delivery and loading areas

Impersonation

Identity-based Attacks:

Authority Figures: Impersonates police, government officials, or executives
Service Personnel: Pretends to be maintenance, IT support, or delivery personnel
Trusted Contacts: Impersonates colleagues, friends, or family members
Professional Roles: Claims to be lawyers, doctors, or other professionals
Emergency Personnel: Impersonates firefighters, paramedics, or security

Impersonation Techniques:

Uniforms and Badges: Uses fake uniforms and identification badges
Voice Mimicking: Mimics voices of known individuals
Document Forgery: Creates fake documents and credentials
Social Media Profiles: Creates fake social media profiles
Email Spoofing: Sends emails from spoofed addresses

Dumpster Diving

Information Gathering from Trash:

Physical Documents: Searches through discarded paper documents
Electronic Media: Looks for discarded hard drives, USB drives, and CDs
Personal Information: Seeks personal and financial information
Business Intelligence: Gathers information about business operations
Password Information: Looks for written passwords and login information

Dumpster Diving Targets:

Bank Statements: Financial information and account details
Employee Directories: Contact information and organizational structure
Network Diagrams: Information about network infrastructure
Password Lists: Written passwords and login credentials
Customer Lists: Customer information and contact details

Threats

Security threats are potential dangers that can exploit vulnerabilities in systems, networks, or processes. Understanding different types of threats helps IT professionals implement appropriate countermeasures and response strategies.

Denial of Service (DoS)

Service Disruption Attacks:

Resource Exhaustion: Overwhelms system resources to cause service failure
Bandwidth Consumption: Saturates network bandwidth with traffic
Connection Flooding: Exhausts available connections to servers
Application Layer Attacks: Targets specific applications or services
Single Source: Originates from a single source or system

DoS Attack Types:

SYN Flood: Sends multiple SYN requests without completing handshake
Ping Flood: Sends large numbers of ping requests
HTTP Flood: Overwhelms web servers with HTTP requests
DNS Amplification: Uses DNS servers to amplify attack traffic
Application-specific: Targets specific application vulnerabilities

Distributed Denial of Service (DDoS)

Coordinated Attack Networks:

Multiple Sources: Originates from multiple compromised systems
Botnet Networks: Uses networks of compromised computers (botnets)
Geographic Distribution: Attacks from multiple geographic locations
Higher Impact: More difficult to mitigate than single-source attacks
Command and Control: Controlled by attackers through C&C servers

DDoS Attack Vectors:

Volume-based: Overwhelms bandwidth with high traffic volume
Protocol-based: Exploits network protocol weaknesses
Application-based: Targets application layer with sophisticated requests
Reflection Attacks: Uses third-party servers to amplify traffic
Multi-vector: Combines multiple attack types simultaneously

Evil Twin

Rogue Access Point Attacks:

Fake Wi-Fi Networks: Creates malicious wireless access points
Legitimate Appearance: Mimics legitimate network names and settings
Man-in-the-Middle: Intercepts and monitors network traffic
Credential Theft: Captures login credentials and sensitive data
Public Location Targeting: Common in airports, hotels, and cafes

Evil Twin Characteristics:

SSID Spoofing: Uses similar or identical network names
Stronger Signal: Often provides stronger signal than legitimate network
No Authentication: May offer open access to attract users
Traffic Interception: Captures all data transmitted through the network
Malware Distribution: Can inject malware into user traffic

Zero-day Attack

Unknown Vulnerability Exploitation:

Unknown Vulnerabilities: Exploits vulnerabilities not yet discovered or patched
No Defense: No existing security measures to prevent the attack
High Value: Extremely valuable to attackers and security researchers
Limited Window: Effective until vulnerability is discovered and patched
Advanced Persistent Threats: Often used in sophisticated APT campaigns

Zero-day Attack Lifecycle:

Discovery: Vulnerability discovered by researchers or attackers
Exploit Development: Creation of exploit code for the vulnerability
Targeted Attacks: Initial attacks against high-value targets
Widespread Exploitation: Mass exploitation once exploit becomes public
Patch Development: Vendor develops and releases security patches

Spoofing

Identity and Source Manipulation:

IP Address Spoofing: Falsifies source IP addresses in network packets
Email Spoofing: Forges sender addresses in email messages
Caller ID Spoofing: Manipulates caller identification information
MAC Address Spoofing: Changes network interface MAC addresses
DNS Spoofing: Provides false DNS responses to redirect traffic

Spoofing Attack Types:

ARP Spoofing: Manipulates ARP tables to redirect network traffic
GPS Spoofing: Provides false GPS location information
Website Spoofing: Creates fake websites that mimic legitimate ones
Biometric Spoofing: Uses fake biometric data to bypass authentication
Certificate Spoofing: Creates fake SSL/TLS certificates

On-path Attack

Traffic Interception and Manipulation:

Man-in-the-Middle: Intercepts and potentially modifies communications
Traffic Analysis: Monitors and analyzes network traffic patterns
Data Modification: Alters data in transit between parties
Session Hijacking: Takes over established communication sessions
Transparent Operation: Often operates without detection by users

On-path Attack Methods:

ARP Poisoning: Manipulates ARP tables to redirect traffic
DNS Hijacking: Redirects DNS queries to malicious servers
SSL Stripping: Downgrades HTTPS connections to HTTP
Wi-Fi Interception: Intercepts traffic on wireless networks
Router Compromise: Compromises network infrastructure devices

Brute-force Attack

Systematic Password Guessing:

Exhaustive Search: Tries all possible password combinations
Automated Tools: Uses software to automate password attempts
Time-intensive: Can take significant time for complex passwords
Resource Intensive: Requires substantial computational resources
Detection Risk: High risk of detection due to multiple failed attempts

Brute-force Attack Types:

Online Brute-force: Attacks against live systems and services
Offline Brute-force: Attacks against captured password hashes
Hybrid Attacks: Combines dictionary words with brute-force techniques
Distributed Brute-force: Uses multiple systems to distribute the attack
GPU-accelerated: Uses graphics processing units for faster attacks

Dictionary Attack

Word-based Password Cracking:

Word Lists: Uses predefined lists of common words and passwords
Faster than Brute-force: More efficient than trying all combinations
Common Passwords: Targets commonly used passwords and patterns
Language-specific: Uses word lists in different languages
Context-aware: Uses industry or organization-specific word lists

Dictionary Attack Variants:

Pure Dictionary: Uses exact words from dictionaries
Hybrid Dictionary: Combines dictionary words with numbers and symbols
Rule-based: Applies transformation rules to dictionary words
Personal Information: Uses personal information in word lists
Leaked Passwords: Uses passwords from previous data breaches

Insider Threat

Internal Security Risks:

Authorized Access: Individuals with legitimate access to systems
Malicious Intent: Deliberate actions to harm the organization
Accidental Actions: Unintentional security breaches by employees
Privileged Access: Often involves users with elevated privileges
Difficult Detection: Hard to detect due to legitimate access

Insider Threat Types:

Malicious Insiders: Employees who deliberately cause harm
Negligent Insiders: Employees who accidentally cause security issues
Compromised Insiders: Employees whose accounts have been compromised
Third-party Insiders: Contractors and vendors with system access
Former Employees: Ex-employees with retained access or knowledge

Structured Query Language (SQL) Injection

Database Attack Technique:

Code Injection: Inserts malicious SQL code into application inputs
Database Manipulation: Alters database queries to access unauthorized data
Data Extraction: Retrieves sensitive information from databases
Data Modification: Alters, inserts, or deletes database records
System Compromise: Can lead to complete system compromise

SQL Injection Types:

Union-based: Uses UNION statements to extract data
Boolean-based: Uses boolean conditions to infer data
Time-based: Uses time delays to infer data
Error-based: Exploits database error messages
Blind SQL Injection: Attacks without visible error messages

Cross-site Scripting (XSS)

Web Application Vulnerability:

Script Injection: Injects malicious scripts into web applications
Client-side Execution: Scripts execute in users' browsers
Session Hijacking: Steals user session cookies and tokens
Credential Theft: Captures user login credentials
Malware Distribution: Delivers malware to users' systems

XSS Attack Types:

Stored XSS: Malicious scripts stored on the server
Reflected XSS: Malicious scripts reflected from user input
DOM-based XSS: Scripts executed through DOM manipulation
Self-XSS: Tricks users into executing scripts themselves
Blind XSS: Scripts executed in contexts not visible to attackers

Business Email Compromise (BEC)

Email-based Financial Fraud:

Executive Impersonation: Impersonates high-level executives
Financial Transactions: Targets financial transfers and payments
Urgent Requests: Creates urgency to bypass normal procedures
Social Engineering: Uses psychological manipulation techniques
High Financial Impact: Often results in significant financial losses

BEC Attack Scenarios:

CEO Fraud: Impersonates CEO to authorize wire transfers
Vendor Impersonation: Pretends to be legitimate vendors
Attorney Impersonation: Impersonates legal counsel for urgent matters
Account Compromise: Compromises legitimate email accounts
W-2 Theft: Requests employee tax information for identity theft

Supply Chain/Pipeline Attack

Third-party Compromise:

Vendor Compromise: Attacks through compromised suppliers or vendors
Software Supply Chain: Compromises software during development or distribution
Hardware Supply Chain: Compromises hardware during manufacturing
Trust Exploitation: Exploits trust relationships between organizations
Widespread Impact: Can affect multiple organizations simultaneously

Supply Chain Attack Vectors:

Malicious Updates: Distributes malware through software updates
Compromised Libraries: Infects open-source libraries and dependencies
Hardware Implants: Inserts malicious hardware during manufacturing
Third-party Access: Exploits vendor access to customer systems
Watering Hole Attacks: Compromises websites frequented by target organizations

Vulnerabilities

Vulnerabilities are weaknesses in systems, processes, or configurations that can be exploited by threats. Understanding common vulnerabilities helps IT professionals implement appropriate security measures and maintain secure environments.

Non-compliant Systems

Compliance Violations:

Regulatory Non-compliance: Systems that don't meet regulatory requirements
Industry Standards: Failure to meet industry-specific security standards
Policy Violations: Systems that violate organizational security policies
Configuration Drift: Systems that have drifted from secure configurations
Audit Failures: Systems that fail security audits and assessments

Common Compliance Issues:

PCI DSS Violations: Payment card industry compliance failures
HIPAA Violations: Healthcare information privacy violations
SOX Violations: Sarbanes-Oxley financial reporting violations
GDPR Violations: European data protection regulation violations
ISO 27001: Information security management system failures

Unpatched Systems

Missing Security Updates:

Operating System Patches: Missing OS security updates and fixes
Application Updates: Outdated applications with known vulnerabilities
Firmware Updates: Outdated device firmware with security flaws
Driver Updates: Outdated device drivers with vulnerabilities
Library Dependencies: Outdated third-party libraries and components

Patch Management Challenges:

Testing Requirements: Need to test patches before deployment
Downtime Concerns: Patches may require system restarts
Compatibility Issues: Patches may break existing functionality
Resource Constraints: Limited resources for patch management
Legacy Systems: Older systems may not support current patches

Unprotected Systems

Missing Security Controls:

Missing Antivirus: Systems without antivirus or anti-malware protection
Missing Firewall: Systems without firewall protection
No Encryption: Systems without data encryption
Weak Authentication: Systems with weak or no authentication
No Monitoring: Systems without security monitoring and logging

Protection Gaps:

Network Segmentation: Lack of network segmentation and isolation
Access Controls: Insufficient access control mechanisms
Backup Systems: Missing or inadequate backup and recovery systems
Incident Response: Lack of incident response capabilities
Security Awareness: Insufficient security awareness training

End of Life (EOL)

Unsupported Systems:

No Security Updates: Systems no longer receiving security patches
No Technical Support: Lack of vendor technical support
Known Vulnerabilities: Accumulation of unpatched vulnerabilities
Compliance Issues: May violate compliance requirements
Integration Problems: Difficulties integrating with modern systems

EOL System Risks:

Windows XP: No longer supported by Microsoft
Windows 7: End of support for consumer versions
Legacy Applications: Applications no longer supported by vendors
Hardware Components: Hardware no longer supported by manufacturers
Network Equipment: Network devices past their support lifecycle

Bring Your Own Device (BYOD)

Personal Device Risks:

Uncontrolled Devices: Personal devices not managed by IT
Mixed Data: Personal and business data on same device
Unknown Security Posture: Unknown security configuration and updates
Lost or Stolen Devices: Risk of data exposure from lost devices
Malware Infection: Personal devices may be infected with malware

BYOD Security Challenges:

Device Management: Difficulty managing diverse personal devices
Data Separation: Challenges separating personal and business data
Compliance Issues: May violate data protection regulations
Network Access: Uncontrolled access to corporate networks
Application Security: Unknown security of personal applications

Security Best Practices:

User Education: Regular security awareness training for all users
Multi-layered Defense: Implement multiple layers of security controls
Regular Updates: Keep all systems and software updated
Access Controls: Implement strong authentication and authorization
Monitoring: Continuous monitoring and logging of security events
Incident Response: Develop and test incident response procedures
Vulnerability Management: Regular vulnerability assessments and remediation

Exam Preparation Tips

Key Areas to Focus On:

Social Engineering Types: Know the differences between phishing, vishing, smishing, and other social engineering attacks
Attack Characteristics: Understand the specific characteristics and methods of each attack type
Threat Categories: Know the differences between DoS, DDoS, spoofing, and other threat types
Vulnerability Types: Understand common system vulnerabilities and their implications
Prevention Methods: Know appropriate countermeasures for each type of attack
Real-world Scenarios: Be able to identify attack types in real-world situations

Practice Scenarios:

Identify the type of social engineering attack in a given scenario
Recommend appropriate countermeasures for specific threats
Recognize system vulnerabilities and their security implications
Develop security awareness training content for users
Implement security controls to prevent common attacks
Respond to security incidents involving social engineering

Summary

CompTIA A+ 1202 Objective 2.5 covers the critical understanding of social engineering attacks, security threats, and system vulnerabilities that IT professionals must recognize and defend against. From phishing and vishing to DoS attacks and unpatched systems, these concepts form the foundation of modern cybersecurity awareness. Master these topics through hands-on practice and real-world scenarios to excel both on the exam and in your IT security career. Remember that the human element is often the weakest link in security, making user education and awareness training essential components of any comprehensive security strategy.

Previous: Objective 2.4 Malware Detection Prevention

Next: Objective 2.6 Soho Malware Removal