nerdexam
(ISC)2

CSSLP · Question #217

Penetration tests are sometimes called white hat attacks because in a pen test, the good guys are attempting to break in. What are the different categories of penetration testing? Each correct answer

The correct answer is A. Open-box B. Closed-box C. Zero-knowledge test E. Full-knowledge test F. Partial-knowledge test. Penetration tests are categorized based on the level of information provided to the testers, which includes open-box (white-box), closed-box (black-box), and partial-knowledge (grey-box) testing.

Secure Software Testing

Question

Penetration tests are sometimes called white hat attacks because in a pen test, the good guys are attempting to break in. What are the different categories of penetration testing? Each correct answer represents a complete solution. Choose all that apply.

Options

  • AOpen-box
  • BClosed-box
  • CZero-knowledge test
  • DFull-box
  • EFull-knowledge test
  • FPartial-knowledge test

How the community answered

(29 responses)
  • A
    90% (26)
  • D
    10% (3)

Why each option

Penetration tests are categorized based on the level of information provided to the testers, which includes open-box (white-box), closed-box (black-box), and partial-knowledge (grey-box) testing.

AOpen-boxCorrect

Open-box testing (also known as white-box or full-knowledge) is a category where the tester is given full knowledge of the system's architecture, source code, and internal details.

BClosed-boxCorrect

Closed-box testing (also known as black-box or zero-knowledge) is a category where the tester has no prior knowledge of the system, simulating an external attacker.

CZero-knowledge testCorrect

Zero-knowledge test is synonymous with closed-box or black-box testing, where the testers are given no information about the target system.

DFull-box

Full-box is not a standard, recognized category or synonym for penetration testing types based on knowledge level.

EFull-knowledge testCorrect

Full-knowledge test is synonymous with open-box or white-box testing, where the testers are provided with extensive information about the target system.

FPartial-knowledge testCorrect

Partial-knowledge test (also known as grey-box) is a category where the tester has some limited knowledge of the system, such as user credentials or internal network diagrams.

Concept tested: Types of penetration testing based on knowledge

Source: https://learn.microsoft.com/en-us/azure/security/fundamentals/pen-testing

Topics

#Penetration testing#Testing methodologies#Black-box testing#White-box testing

Community Discussion

No community discussion yet for this question.

Full CSSLP Practice