nerdexam
EC-Council

312-50V13 · Question #17

The "Gray-box testing" methodology enforces what kind of restriction?

The correct answer is B. The internal operation of a system in only partly accessible to the tester. Gray-Box Testing Explained Gray-box testing sits between black-box and white-box testing - the tester has partial knowledge of the system's internal workings, making B correct. This "partial access" might include some documentation, database schemas, or architecture diagrams…

Submitted by packet_pusher· Mar 6, 2026Introduction to Ethical Hacking

Question

The "Gray-box testing" methodology enforces what kind of restriction?

Options

  • AOnly the external operation of a system is accessible to the tester.
  • BThe internal operation of a system in only partly accessible to the tester.
  • COnly the internal operation of a system is known to the tester.
  • DThe internal operation of a system is completely known to the tester.

How the community answered

(49 responses)
  • A
    4% (2)
  • B
    92% (45)
  • C
    2% (1)
  • D
    2% (1)

Explanation

Gray-Box Testing Explained

Gray-box testing sits between black-box and white-box testing - the tester has partial knowledge of the system's internal workings, making B correct. This "partial access" might include some documentation, database schemas, or architecture diagrams, but not the full source code or complete system internals.

Why the distractors are wrong:

  • A describes black-box testing, where the tester only sees inputs and outputs with no internal knowledge whatsoever.
  • C is a near-miss distractor - gray-box testers don't rely solely on internal knowledge; they combine limited internal insight with external testing.
  • D describes white-box testing, where the tester has complete visibility into the source code and internal logic.

Memory Tip: Think of the color spectrum - black = no light (no internal knowledge), white = full light (complete internal knowledge), and gray = somewhere in between (partial knowledge). The color literally tells you the answer!

Topics

#Gray-box testing#Penetration testing methodologies#Security assessment types

Community Discussion

No community discussion yet for this question.

Full 312-50V13 Practice