Black-Box, White-Box and Grey-Box Security Testing CT-STE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security test engineer is testing a mobile banking app. They have the app's API documentation, a valid test account, and knowledge of the backend database schema, but not the source code. The goal is to identify vulnerabilities that could be exploited by a malicious user with a valid account. Which testing approach is most appropriate?

   • AWhite-box testing, by decompiling the app to obtain source code
   • BGrey-box testing, using the partial knowledge to target authorization and data exposure issues
   • CGrey-box testing, but only testing the app's user interface
   • DBlack-box testing, without using the provided account or schema
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security test engineer is planning a penetration test for a public-facing web application. The organization has a limited budget and wants to simulate an external attacker with no insider knowledge. They also want to minimize the time spent on understanding the application's internals. Which testing approach best meets these constraints?

   • AWhite-box testing, because it provides the most thorough analysis
   • BBlack-box testing, because it requires no internal knowledge and simulates an external attacker
   • CGrey-box testing, because it provides partial internal knowledge
   • DBlack-box testing, but only using automated scanning tools
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which statement best describes black-box security testing?

   • ATesting performed only by automated tools without any human interaction
   • BTesting performed with partial knowledge of internal design and credentials
   • CTesting performed without any knowledge of the internal structure or implementation details
   • DTesting performed with full access to source code and internal architecture
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is an example of grey-box security testing?

   • AA tester with no prior knowledge of the application performs penetration testing from the internet
   • BA developer reviews the source code for SQL injection vulnerabilities
   • CA tester uses only publicly available information to find vulnerabilities in a web application
   • DA tester is given a valid user account and the API documentation, but not the source code, to test for authorization flaws
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   How does the level of knowledge about the system differ among black-box, white-box, and grey-box testing?

   • ABlack-box has partial knowledge, white-box has no knowledge, grey-box has full knowledge
   • BBlack-box has no knowledge, white-box has full knowledge, grey-box has partial knowledge
   • CBlack-box has full knowledge, white-box has no knowledge, grey-box has partial knowledge
   • DAll three approaches require the same level of knowledge
   Reveal Solution Discussion Select an answer first