CSSLP · Question #217
Penetration tests are sometimes called white hat attacks because in a pen test, the good guys are attempting to break in. What are the different categories of penetration testing? Each correct answer
The correct answer is A. Open-box B. Closed-box C. Zero-knowledge test E. Full-knowledge test F. Partial-knowledge test. Penetration tests are categorized based on the level of information provided to the testers, which includes open-box (white-box), closed-box (black-box), and partial-knowledge (grey-box) testing.
Question
Penetration tests are sometimes called white hat attacks because in a pen test, the good guys are attempting to break in. What are the different categories of penetration testing? Each correct answer represents a complete solution. Choose all that apply.
Options
- AOpen-box
- BClosed-box
- CZero-knowledge test
- DFull-box
- EFull-knowledge test
- FPartial-knowledge test
How the community answered
(29 responses)- A90% (26)
- D10% (3)
Why each option
Penetration tests are categorized based on the level of information provided to the testers, which includes open-box (white-box), closed-box (black-box), and partial-knowledge (grey-box) testing.
Open-box testing (also known as white-box or full-knowledge) is a category where the tester is given full knowledge of the system's architecture, source code, and internal details.
Closed-box testing (also known as black-box or zero-knowledge) is a category where the tester has no prior knowledge of the system, simulating an external attacker.
Zero-knowledge test is synonymous with closed-box or black-box testing, where the testers are given no information about the target system.
Full-box is not a standard, recognized category or synonym for penetration testing types based on knowledge level.
Full-knowledge test is synonymous with open-box or white-box testing, where the testers are provided with extensive information about the target system.
Partial-knowledge test (also known as grey-box) is a category where the tester has some limited knowledge of the system, such as user credentials or internal network diagrams.
Concept tested: Types of penetration testing based on knowledge
Source: https://learn.microsoft.com/en-us/azure/security/fundamentals/pen-testing
Topics
Community Discussion
No community discussion yet for this question.