312-50V13 · Question #194
What type of analysis is performed when an attacker has partial knowledge of inner-workings of the application?
The correct answer is D. Grey-box. This question seeks the term for a type of security analysis where an attacker possesses partial knowledge of the application's internal workings.
Question
Options
- ABlack-box
- BAnnounced
- CWhite-box
- DGrey-box
How the community answered
(24 responses)- A4% (1)
- B4% (1)
- D92% (22)
Why each option
This question seeks the term for a type of security analysis where an attacker possesses partial knowledge of the application's internal workings.
Black-box analysis is performed without any prior knowledge of the target system's internal structure, code, or architecture, simulating an external attacker.
An 'announced' test refers to whether the target organization is informed about the security assessment, not the level of internal knowledge the tester possesses.
White-box analysis is conducted with full knowledge of the application's internal workings, including access to source code, design documents, and architecture.
Grey-box analysis is a security testing methodology where the tester has some limited or partial knowledge of the internal workings of the system or application, combining aspects of both black-box (no knowledge) and white-box (full knowledge) testing.
Concept tested: Penetration testing methodologies (grey-box)
Source: https://learn.microsoft.com/en-us/azure/security/benchmarks/security-controls-v3-governance-strategy#gs-3-conduct-regular-penetration-testing
Topics
Community Discussion
No community discussion yet for this question.