Browse CompTIA Certification Guides

CompTIA 220-1202 Authentication and Social Engineering Guide

April 13, 2026

Study CompTIA 220-1202 Authentication and Social Engineering: key concepts, common traps, and exam decision cues.

On this page

Core 2 security also tests whether you can recognize a control family quickly: physical control, logical control, authentication method, social-engineering tactic, or vulnerability condition. Many missed questions happen because these categories blur together.

MFA: Multifactor authentication, using more than one factor category to strengthen sign-in security.

Social engineering: Manipulating people into bypassing security controls or revealing information.

What CompTIA is really testing

The exam usually wants you to:

  • classify the control correctly instead of picking something that merely sounds secure
  • distinguish authentication methods and federated sign-in terms at a practical level
  • recognize attack language such as phishing, vishing, smishing, tailgating, and impersonation
  • spot vulnerabilities like unpatched, non-compliant, EOL, or unprotected systems

Physical vs logical security

Control clue Strongest first reading
badge reader, vestibule, fence, guards, locks physical security
ACLs, least privilege, MFA, SSO, PAM, IAM, DLP logical or identity security
smart card, key fob, biometrics, mobile digital key physical-access security with identity function
lighting, cameras, motion sensors deterrence, monitoring, and physical access support

Authentication and identity tie-breaks

If the prompt says… Better first reading
one sign-in for multiple systems SSO
assertion-based enterprise sign-in SAML-style identity exchange
privileged temporary access just-in-time or PAM style access model
multiple proof types MFA
centralized identity and directory path IAM or directory services

Social-engineering recognition map

Attack pattern Strongest first reading
email lure phishing
voice call pretending to be trusted support vishing
text-message lure smishing
fake QR code path QR-based phishing
highly targeted executive or role-focused lure spear phishing or whaling depending on target
follow someone through a secure door tailgating
pretending to be staff or vendor impersonation

Threats vs vulnerabilities

If the question is really about… Strongest first reading
attacker technique or abuse path threat
missing patch, unsupported system, or missing security tool vulnerability
specific human manipulation trick social engineering
control used to reduce risk mitigation or security measure

Common traps

Trap Better reading
picking the biggest-sounding control choose the control family that actually fits the scenario
confusing MFA method examples with factor categories the factor logic matters more than brand or delivery method
calling every scam message “phishing” without reading the medium CompTIA often wants the more precise vishing, smishing, or QR variation
treating unpatched and EOL as attack types they are vulnerability states, not attack methods

Harder scenario question

A user receives a text message claiming to be from payroll with a short link asking for a password reset. Which answer best fits Core 2?

  • A. It is shoulder surfing because the user saw the phone screen
  • B. It is smishing, a text-message social-engineering attack
  • C. It is a badge-reader failure
  • D. It is BitLocker misuse

Correct answer: B. The delivery path is the clue. Core 2 often separates phishing variants by medium.

What strong answers usually do

  • classify the control as physical, logical, access, or identity
  • separate attack type from vulnerability state
  • read the communication medium before naming the social-engineering tactic
  • choose the smallest accurate security term instead of a vague umbrella label

Decision order that usually wins

  1. Decide whether the stem is about a control family, an authentication model, a social-engineering tactic, or a vulnerability state.
  2. Read the medium first for phishing-variant questions.
  3. Separate logical controls from physical controls before picking the secure-sounding answer.
  4. Treat unsupported, unpatched, and non-compliant states as vulnerabilities, not attack methods.
  5. Choose the narrowest accurate security term instead of a broad buzzword.

Quiz

Loading quiz…
Revised on Sunday, May 10, 2026
2.2 Secure Practices
2.4 Windows Security Controls