CAS-003 · Question #193
The Chief Information Security Officer (CISO) at a software development company is concerned about the lack of introspection during a testing cycle of the company's flagship product. Testing was…
The correct answer is D. Use the internal teams to perform White box testing. White box testing (also called clear box or structural testing) gives testers full access to source code, architecture, and internal logic, enabling them to design test cases that exercise every code path, branch, and condition. Since the CISO's concern is that many code paths…
Question
The Chief Information Security Officer (CISO) at a software development company is concerned about the lack of introspection during a testing cycle of the company's flagship product. Testing was conducted by a small offshore consulting firm and the report by the consulting firm clearly indicates that limited test cases were used and many of the code paths remained untested. The CISO raised concerns about the testing results at the monthly risk committee meeting, highlighting the need to get to the bottom of the product behaving unexpectedly in only some large enterprise deployments. The Security Assurance and Development teams highlighted their availability to redo the testing if required. Which of the following will provide the MOST thorough testing?
Options
- AHave the small consulting firm redo the Black box testing.
- BUse the internal teams to perform Grey box testing.
- CUse the internal team to perform Black box testing.
- DUse the internal teams to perform White box testing.
- EUse a larger consulting firm to perform Black box testing.
How the community answered
(32 responses)- A9% (3)
- B3% (1)
- C3% (1)
- D78% (25)
- E6% (2)
Explanation
White box testing (also called clear box or structural testing) gives testers full access to source code, architecture, and internal logic, enabling them to design test cases that exercise every code path, branch, and condition. Since the CISO's concern is that many code paths remain untested and the product behaves unexpectedly in certain enterprise environments, white box testing is the most thorough approach. The internal Security Assurance and Development teams already have full knowledge of the codebase, making them ideal candidates. Black box testing (options A, C, E) simulates an external attacker with no code visibility and is likely to miss the same code paths the offshore firm missed. Grey box (option B) is partial-better than black box, but still inferior to full white box coverage.
Topics
Community Discussion
No community discussion yet for this question.