Black-Box, White-Box and Grey-Box Security Testing CT-STE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security test engineer is assessing a web application that has a complex business logic layer. The organization has the source code but is concerned about the time required for a full white-box assessment. They want to balance thoroughness with efficiency. Which approach is most appropriate?

   • AWhite-box testing, focusing on the business logic layer and critical modules
   • BBlack-box testing, using automated scanners to cover the entire application quickly
   • CGrey-box testing, using partial knowledge from documentation and user accounts
   • DWhite-box testing, but only using automated static analysis tools
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   In which scenario is black-box security testing most appropriate?

   • AWhen the organization wants to test the effectiveness of its security controls from an insider's perspective
   • BWhen the tester has been given valid credentials and API documentation
   • CWhen simulating an external attacker's perspective without any internal knowledge
   • DWhen the goal is to identify logic flaws in the source code
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security test engineer is planning a security assessment for a cloud-based application that processes sensitive customer data. The organization has strict compliance requirements and wants to ensure that the testing approach does not expose sensitive data to the testers. They have access to the source code but are concerned about data privacy. Which testing approach is most appropriate?

   • AGrey-box testing, using partial production data to increase realism
   • BBlack-box testing, using production data to simulate real attacks
   • CWhite-box testing, using a test environment with synthetic data
   • DWhite-box testing, but only reviewing code without executing it
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security test engineer is assessing a critical financial application. The organization has provided full access to the source code, database schema, and internal architecture diagrams. The goal is to identify vulnerabilities that could lead to unauthorized transactions. Which testing approach is most effective?

   • ABlack-box testing, because it tests the application from a user's perspective
   • BGrey-box testing, because it provides a balance of internal and external perspectives
   • CWhite-box testing, but only reviewing the code for known vulnerability patterns
   • DWhite-box testing, because it allows analysis of the transaction logic and data flow
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security test engineer is leading a security assessment for a legacy system that is being decommissioned. The organization wants to identify all critical vulnerabilities before the system is retired, but the budget is limited and the source code is available. The team has only two weeks to complete the assessment. Which approach is most appropriate?

   • AWhite-box testing, but only for the most critical modules, and skipping the rest
   • BWhite-box testing, focusing on high-risk areas identified through code review
   • CBlack-box testing, using automated scanners to cover the entire system quickly
   • DGrey-box testing, using partial knowledge from documentation and user accounts
   Reveal Solution Discussion Select an answer first