Black-Box, White-Box and Grey-Box Security Testing CT-STE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security test engineer is assessing a web application. They have been given a valid user account with low privileges, the API documentation, and a database schema diagram, but not the source code. The goal is to find vulnerabilities that an authenticated user could exploit. Which testing approach is most suitable?

   • AGrey-box testing, using the partial internal knowledge to guide test cases
   • BGrey-box testing, but only testing the application as an unauthenticated user
   • CWhite-box testing, by inferring the source code from the schema
   • DBlack-box testing, without using the provided credentials or schema
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is a common disadvantage of black-box security testing?

   • AIt cannot be automated
   • BIt requires full access to source code, which may not be available
   • CIt may miss vulnerabilities that are only visible with internal knowledge
   • DIt is always more expensive than white-box testing
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is a characteristic of black-box security testing?

   • ATesters have access to the source code and can perform static analysis
   • BTesters have partial knowledge of internal database schemas and credentials
   • CTesters have no knowledge of internal implementation and test from the outside in
   • DTesters are provided with the system's design documents and architecture diagrams
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security test engineer is assessing a critical infrastructure system that has been in production for years. The organization has the source code but is concerned about the risk of introducing changes during testing. They want to identify vulnerabilities that could be exploited by an insider with knowledge of the system. Which testing approach is most appropriate?

   • AWhite-box testing, but only reviewing the code without executing it
   • BWhite-box testing, using a staging environment that mirrors production
   • CGrey-box testing, using partial knowledge from documentation
   • DBlack-box testing, directly against the production system
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security test engineer is asked to assess a third-party payment gateway integration. The organization has no access to the vendor's source code or internal architecture, but they have full API documentation and sample requests. The goal is to identify vulnerabilities that an external attacker could exploit without any insider knowledge. Which testing approach is most appropriate?

   • ABlack-box testing, using only the public API documentation and externally observable behavior
   • BBlack-box testing, but only if the vendor provides a test environment with debug logs
   • CWhite-box testing, by requesting the vendor's source code under NDA
   • DGrey-box testing, using partial knowledge of the internal database schema
   Reveal Solution Discussion Select an answer first