SY0-301 · Question #426
A software development company has hired a programmer to develop a plug-in module to an existing proprietary application. After completing the module, the developer needs to test the entire…
The correct answer is C. Gray box testing. Gray box testing applies when the tester has partial internal knowledge of the system, which matches the developer testing their own module within a larger proprietary application they did not fully write.
Question
A software development company has hired a programmer to develop a plug-in module to an existing proprietary application. After completing the module, the developer needs to test the entire application to ensure that the module did not introduce new vulnerabilities. Which of the following is the developer performing when testing the application?
Options
- ABlack box testing
- BWhite box testing
- CGray box testing
- DDesign review
How the community answered
(29 responses)- B3% (1)
- C90% (26)
- D7% (2)
Why each option
Gray box testing applies when the tester has partial internal knowledge of the system, which matches the developer testing their own module within a larger proprietary application they did not fully write.
Black box testing is performed with no knowledge of the internal code or architecture, which does not apply here since the developer wrote part of what is being tested.
White box testing requires complete access to and knowledge of all source code, which the developer does not have for the existing proprietary application.
Gray box testing combines elements of both black box and white box testing. The developer has full knowledge of their own plug-in module's internals but limited knowledge of the proprietary application code it integrates with. This partial-knowledge testing scenario is the definition of gray box testing, and the goal is to find integration vulnerabilities introduced at the boundary.
A design review examines the architectural or design documentation of a system rather than executing the application to discover runtime vulnerabilities.
Concept tested: Gray box testing methodology in software security
Source: https://csrc.nist.gov/glossary/term/gray_box_testing
Topics
Community Discussion
No community discussion yet for this question.