nerdexam
GIAC

GPEN · Question #228

Which of the following types of Penetration testing provides the testers with complete knowledge of the infrastructure to be tested?

The correct answer is A. White Box. White Box penetration testing gives testers complete prior knowledge of the target infrastructure, including architecture, source code, and credentials.

Penetration Testing Foundations & Reconnaissance

Question

Which of the following types of Penetration testing provides the testers with complete knowledge of the infrastructure to be tested?

Options

  • AWhite Box
  • BBlack Box
  • CGrey Box
  • DWater Fall

How the community answered

(46 responses)
  • A
    78% (36)
  • B
    2% (1)
  • C
    7% (3)
  • D
    13% (6)

Why each option

White Box penetration testing gives testers complete prior knowledge of the target infrastructure, including architecture, source code, and credentials.

AWhite BoxCorrect

In White Box testing (also called clear box or crystal box testing), the tester is provided full internal details such as network diagrams, IP schemas, source code, and sometimes valid credentials before the engagement begins. This approach maximizes coverage and efficiency because no time is spent on blind reconnaissance, and it closely simulates an insider threat or a scenario requiring exhaustive validation. It contrasts directly with Black Box, where zero prior knowledge is provided.

BBlack Box

Black Box testing provides the tester with no prior knowledge of the target, simulating a completely external attacker starting from zero information.

CGrey Box

Grey Box testing provides partial knowledge such as user-level credentials or a high-level network overview, but not full architectural details.

DWater Fall

Waterfall is a sequential software development lifecycle model and is not a category or methodology of penetration testing.

Concept tested: White box penetration testing knowledge disclosure level

Source: https://csrc.nist.gov/publications/detail/sp/800-115/final

Topics

#white box testing#penetration testing types#full disclosure#test methodology

Community Discussion

No community discussion yet for this question.

Full GPEN Practice