Due to compliance regulations, a company requires a yearly penetration test. The Chief Information Security Officer (CISO) has asked that it be done under a black box methodology. Which of the…

Question

Options

• AThe risk of unplanned server outages is reduced.
• BUsing documentation provided to them, the pen-test organization can quickly determine areas to
• CThe results will show an in-depth view of the network and should help pin-point areas of internal
• DThe results should reflect what attackers may be able to learn about the company.

• A
  2% (1)
• B
  4% (2)
• C
  2% (1)
• D
  92% (48)

Explanation

Black box (also called zero-knowledge) penetration testing means the testers receive no prior information about the target environment - no network diagrams, no source code, no credentials. This simulates the perspective of a real external attacker. Therefore, the primary advantage (D) is that the results reflect what an actual attacker could realistically discover and exploit. This gives the most authentic risk picture. Option A is incorrect - black box testing actually carries higher risk of unplanned outages because testers may hit unknown production systems without warning (white box testing is safer in this regard). Option B describes white box testing, where documentation is provided to testers. Option C (in-depth internal view and internal vulnerabilities) better describes white box or gray box testing, where testers have inside knowledge to probe deeply.

No community discussion yet for this question.