nerdexam
CompTIA

SY0-501 · Question #509

Which of the following types of penetration test will allow the tester to have access only to password hashes prior to the penetration test?

The correct answer is B. Gray box. A gray box penetration test provides the tester with some limited internal knowledge, such as password hashes, to simulate a targeted attack or insider threat.

Submitted by yuriko_h· Mar 4, 2026Security operations

Question

Which of the following types of penetration test will allow the tester to have access only to password hashes prior to the penetration test?

Options

  • ABlack box
  • BGray box
  • CCredentialed
  • DWhite box

How the community answered

(20 responses)
  • A
    10% (2)
  • B
    85% (17)
  • D
    5% (1)

Why each option

A gray box penetration test provides the tester with some limited internal knowledge, such as password hashes, to simulate a targeted attack or insider threat.

ABlack box

A black box penetration test provides the tester with no prior internal knowledge or access to system details, simulating an external attacker with no initial foothold.

BGray boxCorrect

A gray box penetration test is characterized by the tester having partial knowledge of the target system's internal structure or assets, which includes having access to information like password hashes prior to the test. This approach helps simulate an attacker who has gained some initial internal access or an insider with limited system insight.

CCredentialed

A credentialed test typically implies direct access to valid login credentials (username and password), enabling authenticated scanning or testing, rather than just password hashes that require cracking.

DWhite box

A white box penetration test grants the tester full and comprehensive knowledge of the system's architecture, source code, and often administrative access, which far exceeds having only password hashes.

Concept tested: Penetration testing methodologies (black, gray, white box)

Source: https://csrc.nist.gov/publications/detail/sp/800-115/final

Topics

#gray box testing#penetration testing#password hashes#reconnaissance

Community Discussion

No community discussion yet for this question.

Full SY0-501 Practice