A company hired an external vendor to perform a penetration test ofa new payroll system. The company's internal test team had already performed an in-depth application and security test of the system

Interface testing specifically validates the communication channels, data formats, encryption, and security controls between interconnected systems. The internal team tested the payroll application in isolation but failed to test the interfaces and data flows to external systems like tax processors, which is why unencrypted transmissions between systems went undetected until the penetration test.

Negative testing involves sending invalid, unexpected, or malformed inputs to verify a system handles errors correctly, which addresses input validation vulnerabilities rather than unencrypted data transmission between integrated systems.

Performance testing evaluates system behavior under load conditions such as throughput and response time, and has no bearing on whether data is encrypted during transmission to external systems.

Application-level testing was explicitly stated to have been performed adequately by the internal team, and the vulnerability was at the integration/transmission layer between systems rather than within the application itself.