nerdexam
(ISC)2

CGRC · Question #381

Focused testing is a test methodology that assumes some knowledge of the internal structure and implementation detail of the assessment object. This type of testing is also known as: Response:

The correct answer is B. Gray box testing. Gray box testing, also known as focused testing, involves some knowledge of the internal structure and implementation details of the system under assessment.

Assessment/Audit of Security and Privacy Controls

Question

Focused testing is a test methodology that assumes some knowledge of the internal structure and implementation detail of the assessment object. This type of testing is also known as:

Response:

Options

  • AWhite box testing
  • BGray box testing
  • CPenetration testing
  • DBlack box testing

How the community answered

(30 responses)
  • A
    3% (1)
  • B
    87% (26)
  • C
    3% (1)
  • D
    7% (2)

Why each option

Gray box testing, also known as focused testing, involves some knowledge of the internal structure and implementation details of the system under assessment.

AWhite box testing

White box testing involves full knowledge of the internal structure and implementation, which is more extensive than 'some knowledge' described by focused testing.

BGray box testingCorrect

Gray box testing is a software testing technique that combines elements of both black box testing (external perspective) and white box testing (internal perspective), where the tester has partial knowledge of the system's internal workings. This partial knowledge allows for more focused testing efforts on specific areas, aligning with the definition of 'focused testing' which assumes 'some knowledge of the internal structure and implementation detail'.

CPenetration testing

Penetration testing is a type of security test aimed at finding vulnerabilities, rather than a category defined by the extent of internal system knowledge.

DBlack box testing

Black box testing involves no knowledge of the internal structure or implementation details, directly contradicting the premise of having 'some knowledge'.

Concept tested: Software testing methodologies

Source: https://www.nist.gov/privacy-framework/nist-sp-800-115

Topics

#Testing methodologies#Gray box testing#Security assessment

Community Discussion

No community discussion yet for this question.

Full CGRC Practice