A penetration tester is hired to do a risk assessment of a company's DMZ. The rules of engagement states that the penetration test be done from an external IP address with no prior knowledge of the in

White box testing gives the tester full knowledge of internal systems including network diagrams, credentials, and source code, which is the opposite of the scenario described.

Grey box testing provides the tester with partial knowledge of the internal environment, whereas this engagement specifies zero prior knowledge.

Red box is not a recognized or standard category in penetration testing methodology classifications.

Black box testing means the tester is given no prior knowledge of the target environment, replicating the perspective of an external threat actor who has not obtained insider information. The test originates from an external IP address, further reinforcing the outsider simulation. This methodology evaluates how well the organization's perimeter defenses hold against an uninformed adversary.