nerdexam
CompTIA

CAS-002 · Question #249

The Chief Information Security Officer (CISO) at a software development company is concerned about the lack of introspection during a testing cycle of the company's flagship product. Testing was…

The correct answer is D. Use the internal teams to perform White box testing. White box testing gives testers full access to source code and internal logic, enabling complete coverage of all code paths - critical when unexpected behavior is reported in specific deployments.

Research and Analysis

Question

The Chief Information Security Officer (CISO) at a software development company is concerned about the lack of introspection during a testing cycle of the company's flagship product. Testing was conducted by a small offshore consulting firm and the report by the consulting firm clearly indicates that limited test cases were used and many of the code paths remained untested. The CISO raised concerns about the testing results at the monthly risk committee meeting, highlighting the need to get to the bottom of the product behaving unexpectedly in only some large enterprise deployments. The Security Assurance and Development teams highlighted their availability to redo the testing if required. Which of the following will provide the MOST thorough testing?

Options

  • AHave the small consulting firm redo the Black box testing.
  • BUse the internal teams to perform Grey box testing.
  • CUse the internal team to perform Black box testing.
  • DUse the internal teams to perform White box testing.
  • EUse a larger consulting firm to perform Black box testing.

How the community answered

(26 responses)
  • B
    4% (1)
  • C
    8% (2)
  • D
    73% (19)
  • E
    15% (4)

Why each option

White box testing gives testers full access to source code and internal logic, enabling complete coverage of all code paths - critical when unexpected behavior is reported in specific deployments.

AHave the small consulting firm redo the Black box testing.

The small consulting firm already demonstrated insufficient coverage using black box testing, and repeating the same approach with the same team will produce the same limited results.

BUse the internal teams to perform Grey box testing.

Grey box testing provides only partial knowledge of internals, which improves on black box but still leaves many code paths unexplored compared to full white box access.

CUse the internal team to perform Black box testing.

Black box testing by internal teams still provides zero visibility into code paths or internal logic, making thorough coverage of all execution branches impossible.

DUse the internal teams to perform White box testing.Correct

White box testing provides full visibility into the source code, architecture, and internal logic, allowing testers to deliberately exercise every code path, branch, and condition. Using internal Security Assurance and Development teams maximizes this advantage since they have deep product knowledge and direct code access. This directly addresses the CISO's concern about untested code paths causing unexpected behavior in large enterprise environments.

EUse a larger consulting firm to perform Black box testing.

A larger consulting firm performing black box testing still has no access to source code or internal logic, so untested code paths remain a problem regardless of firm size.

Concept tested: Software testing methodologies - white box vs grey vs black box

Source: https://csrc.nist.gov/glossary/term/white_box_testing

Topics

#white box testing#code coverage#software testing methodology#security testing

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice