CAS-001 · Question #519
Company XYZ has purchased and is now deploying a new HTML5 application. The company wants to hire a penetration tester to evaluate the security of the client and server components of the proprietary…
The correct answer is C. Local proxy D. Fuzzer. In black box testing, the tester has no prior knowledge of the application's internals - no source code, no architecture diagrams. A local proxy (e.g., Burp Suite, OWASP ZAP) sits between the browser and the server, allowing the tester to intercept, inspect, and manipulate…
Question
Company XYZ has purchased and is now deploying a new HTML5 application. The company wants to hire a penetration tester to evaluate the security of the client and server components of the proprietary web application before launch. Which of the following is the penetration tester MOST likely to use while performing black box testing of the security of the company's purchased application? (Select TWO).
Options
- ACode review
- BSandbox
- CLocal proxy
- DFuzzer
- EWeb vulnerability scanner
How the community answered
(25 responses)- A12% (3)
- B8% (2)
- C76% (19)
- E4% (1)
Explanation
In black box testing, the tester has no prior knowledge of the application's internals - no source code, no architecture diagrams. A local proxy (e.g., Burp Suite, OWASP ZAP) sits between the browser and the server, allowing the tester to intercept, inspect, and manipulate HTTP/HTTPS traffic in real time - ideal for discovering injection flaws, session issues, and parameter tampering. A fuzzer sends malformed, unexpected, or random data to application inputs to uncover crashes, errors, or unexpected behavior that may indicate vulnerabilities. Both are active, manual tools suited for black box web app testing. Code review (A) requires source code access - a white box technique. A sandbox (B) is used for malware analysis, not web app pen testing. A web vulnerability scanner (E) is automated and less targeted; while useful, it is less specific to the manual black box methodology described.
Topics
Community Discussion
No community discussion yet for this question.