CAS-001 · Question #324
The Chief Information Security Officer (CISO) at a software development company is concerned about the lack of introspection during a testing cycle of the company's flagship product. Testing was…
The correct answer is D. Use the internal teams to perform White box testing. White box testing (also called clear box or structural testing) is the most thorough because testers have full access to the source code, architecture, and internal logic. This directly addresses the stated problem: limited test cases and untested code paths. The internal…
Question
The Chief Information Security Officer (CISO) at a software development company is concerned about the lack of introspection during a testing cycle of the company's flagship product. Testing was conducted by a small offshore consulting firm and the report by the consulting firm clearly indicates that limited test cases were used and many of the code paths remained untested. The CISO raised concerns about the testing results at the monthly risk committee meeting, highlighting the need to get to the bottom of the product behaving unexpectedly in only some large enterprise deployments. The Security Assurance and Development teams highlighted their availability to redo the testing if required. Which of the following will provide the MOST thorough testing?
Options
- AHave the small consulting firm redo the Black box testing.
- BUse the internal teams to perform Grey box testing.
- CUse the internal team to perform Black box testing.
- DUse the internal teams to perform White box testing.
- EUse a larger consulting firm to perform Black box testing.
How the community answered
(41 responses)- A5% (2)
- B10% (4)
- C2% (1)
- D80% (33)
- E2% (1)
Explanation
White box testing (also called clear box or structural testing) is the most thorough because testers have full access to the source code, architecture, and internal logic. This directly addresses the stated problem: limited test cases and untested code paths. The internal Security Assurance and Development teams already have deep familiarity with the codebase, making them ideally positioned to map and cover all code paths. Options A, C, and E all involve black box testing, where testers have no visibility into internal code - meaning code path coverage remains incomplete, repeating the same problem. Option B (grey box) provides partial knowledge but still cannot guarantee complete coverage of all code paths the way white box testing can.
Topics
Community Discussion
No community discussion yet for this question.