SY0-501 · Question #216
As part of the SDLC, a third party is hired to perform a penetration test. The third party will have access to the source code, integration tests, and network diagrams. Which of the following BEST…
The correct answer is C. White box. The assessment described is a white box penetration test because the third party has full knowledge of the system's internals, including source code and network diagrams.
Question
As part of the SDLC, a third party is hired to perform a penetration test. The third party will have access to the source code, integration tests, and network diagrams. Which of the following BEST describes the assessment being performed?
Options
- ABlack box
- BRegression
- CWhite box
- DFuzzing
How the community answered
(32 responses)- A3% (1)
- B9% (3)
- C81% (26)
- D6% (2)
Why each option
The assessment described is a white box penetration test because the third party has full knowledge of the system's internals, including source code and network diagrams.
Black box testing involves no prior knowledge of the system's internal workings, simulating an external attacker with no privileged information, which contradicts the given access to source code and network diagrams.
Regression testing is a type of software testing that ensures recent code changes have not introduced new defects or re-opened old ones, not a category of penetration test based on the tester's knowledge level.
White box penetration testing, also known as crystal box or clear box testing, involves the tester having complete knowledge of the system's architecture, source code, network infrastructure, and other internal workings. This comprehensive access allows for a detailed and thorough assessment of vulnerabilities that might be overlooked in less transparent testing methods, directly matching the scenario where the third party has access to source code, integration tests, and network diagrams.
Fuzzing is a specific software testing technique that involves feeding malformed or unexpected inputs to a program to discover software vulnerabilities, not a description of the overall penetration test methodology based on knowledge access.
Concept tested: Penetration test types (white box)
Source: https://learn.microsoft.com/en-us/azure/security/fundamentals/pen-testing
Topics
Community Discussion
No community discussion yet for this question.