An external contractor, who has not been given information about the software or network architecture, is conducting a penetration test. Which of the following BEST describes the test being performed?

A black box penetration test simulates an attack by an external, unknown threat actor, as the tester is given no prior information about the internal network topology, system architecture, or application source code. This approach evaluates the system's defenses from a completely external perspective, mirroring real-world external attackers.

A white box test (or crystal box) involves the tester having full knowledge of the system's architecture, source code, and internal workings, which directly contradicts the scenario where no information is provided.

Passive reconnaissance is a preliminary phase of information gathering where the attacker collects information about the target without directly interacting with it, and it does not describe the overall type of penetration test based on the level of initial knowledge.

A vulnerability scan is an automated process that identifies known security weaknesses in systems and applications, but it is distinct from a penetration test and does not describe the specific knowledge-level context of the testing methodology.