CGRC · Question #413
Penetration tests are sometimes called white hat attacks because in a pen test, the good guys are attempting to break in. What are the different categories of penetration testing? Each correct…
The correct answer is B. Zero-knowledge test C. Full-knowledge test D. Open-box E. Partial-knowledge test F. Closed-box. Penetration testing categories are defined by the level of information given to the testers, commonly including zero-knowledge (black-box/closed-box), partial-knowledge (gray-box), and full-knowledge (white-box/open-box) approaches.
Question
Penetration tests are sometimes called white hat attacks because in a pen test, the good guys are attempting to break in. What are the different categories of penetration testing? Each correct answer represents a complete solution. Choose all that apply. Response:
Options
- AFull-box
- BZero-knowledge test
- CFull-knowledge test
- DOpen-box
- EPartial-knowledge test
- FClosed-box
How the community answered
(24 responses)- A8% (2)
- B92% (22)
Why each option
Penetration testing categories are defined by the level of information given to the testers, commonly including zero-knowledge (black-box/closed-box), partial-knowledge (gray-box), and full-knowledge (white-box/open-box) approaches.
"Full-box" is not a recognized or standard category for penetration testing methodologies based on knowledge level.
Zero-knowledge test (also known as Black-box or Closed-box) means testers have no prior information about the system.
Full-knowledge test (also known as White-box or Open-box) means testers are given complete access to system information, including architecture, source code, and configurations.
Open-box is another term for a full-knowledge test, where testers are provided with comprehensive information about the target system.
Partial-knowledge test (also known as Gray-box) means testers have some limited information about the system, simulating an insider threat or an attacker with some prior reconnaissance.
Closed-box is another term for a zero-knowledge test, where testers are provided no information about the target system, simulating an external attacker.
Concept tested: Penetration test types (knowledge levels)
Source: https://learn.microsoft.com/en-us/azure/security/fundamentals/pen-testing
Topics
Community Discussion
No community discussion yet for this question.