A penetration tester is hired to do a risk assessment of a company's DMZ. The rules of engagement states that the penetration test be done from an external IP address with no prior knowledge of the…

White box testing provides the tester with full knowledge of the internal environment, including architecture, source code, and credentials, the opposite of this scenario.

Grey box testing provides partial knowledge such as some credentials or internal documentation, but this engagement explicitly states no prior knowledge.

Red box is not a standard penetration testing classification; the recognized categories are black, grey, and white box.

Black box testing means the tester starts with zero internal knowledge - no network diagrams, no credentials, no source code - mimicking a real external attacker. The rules of engagement here specify an external IP and no prior knowledge of internal IT systems, which exactly matches the black box definition.