312-50V9 · Question #265
Seth is starting a penetration test from inside the network. He hasn't been given any information about the network. What type of test is he conducting?
The correct answer is C. Internal, Blackbox. Seth's engagement is an Internal Blackbox test because he originates from inside the network perimeter but has been given no prior knowledge of the target environment.
Question
Seth is starting a penetration test from inside the network. He hasn't been given any information about the network. What type of test is he conducting?
Options
- AInternal Whitebox
- BExternal, Whitebox
- CInternal, Blackbox
- DExternal, Blackbox
How the community answered
(38 responses)- A3% (1)
- C95% (36)
- D3% (1)
Why each option
Seth's engagement is an Internal Blackbox test because he originates from inside the network perimeter but has been given no prior knowledge of the target environment.
Whitebox (also called crystal-box) testing means the tester is given full prior knowledge of the environment such as network maps, source code, and credentials, which directly contradicts the scenario.
External whitebox testing originates from outside the network perimeter with full prior knowledge - Seth is inside the network and has no information, so both designations are incorrect.
The 'internal' classification applies because Seth begins his test from within the network, simulating a threat from a malicious insider or a compromised internal host. The 'blackbox' classification applies because he has received no prior information - no network diagrams, credentials, or system details - requiring him to enumerate and discover the environment entirely on his own.
External blackbox testing starts from outside the network perimeter; Seth is already inside the network, so the 'external' classification does not apply.
Concept tested: Penetration test scoping - internal vs external, black vs white box
Source: https://csrc.nist.gov/publications/detail/sp/800-115/final
Topics
Community Discussion
No community discussion yet for this question.