An IT auditor tests an application as an authenticated user. This is an example of which of the following types of testing?

The correct answer is D. Gray box. Gray box testing sits between black box and white box testing. In gray box testing, the tester has partial knowledge of the system - in this case, the auditor has valid credentials (authenticated access) but does not have full internal system knowledge such as source code or…

Security operations

Question

Options

APenetration
BWhite box
CBlack box
DGray box

How the community answered

(44 responses)

A
2% (1)
B
7% (3)
C
2% (1)
D
89% (39)

Explanation

Gray box testing sits between black box and white box testing. In gray box testing, the tester has partial knowledge of the system - in this case, the auditor has valid credentials (authenticated access) but does not have full internal system knowledge such as source code or architecture diagrams. Black box testing involves no prior knowledge or access (simulating an external attacker with no credentials). White box testing grants the tester full internal knowledge, including source code and architecture. Penetration testing is a methodology rather than a knowledge-level classification and can be performed as any of the three types. Authenticated access with limited internal knowledge is the defining characteristic of gray box testing.

Topics

#gray box testing#authenticated testing#security testing#penetration testing

Community Discussion

No community discussion yet for this question.

Full SY0-301 Practice