GPEN · Question #228
Which of the following types of Penetration testing provides the testers with complete knowledge of the infrastructure to be tested?
The correct answer is A. White Box. White Box penetration testing gives testers complete prior knowledge of the target infrastructure, including architecture, source code, and credentials.
Question
Which of the following types of Penetration testing provides the testers with complete knowledge of the infrastructure to be tested?
Options
- AWhite Box
- BBlack Box
- CGrey Box
- DWater Fall
How the community answered
(46 responses)- A78% (36)
- B2% (1)
- C7% (3)
- D13% (6)
Why each option
White Box penetration testing gives testers complete prior knowledge of the target infrastructure, including architecture, source code, and credentials.
In White Box testing (also called clear box or crystal box testing), the tester is provided full internal details such as network diagrams, IP schemas, source code, and sometimes valid credentials before the engagement begins. This approach maximizes coverage and efficiency because no time is spent on blind reconnaissance, and it closely simulates an insider threat or a scenario requiring exhaustive validation. It contrasts directly with Black Box, where zero prior knowledge is provided.
Black Box testing provides the tester with no prior knowledge of the target, simulating a completely external attacker starting from zero information.
Grey Box testing provides partial knowledge such as user-level credentials or a high-level network overview, but not full architectural details.
Waterfall is a sequential software development lifecycle model and is not a category or methodology of penetration testing.
Concept tested: White box penetration testing knowledge disclosure level
Source: https://csrc.nist.gov/publications/detail/sp/800-115/final
Topics
Community Discussion
No community discussion yet for this question.