Black-Box, White-Box and Grey-Box Security Testing CT-STE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A development team has just completed a major refactor of an authentication module. The security test engineer has full access to the source code, build scripts, and internal design documents. The objective is to identify logic flaws in the authentication flow that might not be visible from the outside. Which testing approach is most effective?

   • ABlack-box testing, sending crafted login requests to the running application
   • BWhite-box testing, reviewing the source code and tracing authentication logic
   • CWhite-box testing, but only reviewing the code for known vulnerability patterns
   • DGrey-box testing, using only the API documentation and a valid test account
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security test engineer is comparing testing approaches for a new microservices-based application. The team wants to identify as many vulnerabilities as possible, including those that require deep understanding of the code. They have access to the source code of all services. Which approach will provide the most comprehensive coverage?

   • AGrey-box testing, because it balances external and internal perspectives
   • BWhite-box testing, but only for the most critical services
   • CWhite-box testing, because it allows analysis of all code paths and internal logic
   • DBlack-box testing, because it tests the system from an external perspective
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which testing approach is most likely to use static analysis of source code?

   • AWhite-box testing
   • BBlack-box testing
   • CGrey-box testing
   • DAll three approaches equally
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which activity is typical of white-box security testing?

   • APerforming a code review to identify insecure coding patterns
   • BTesting the login page with a list of common passwords
   • CFuzzing the application's HTTP API with random inputs
   • DIntercepting and modifying network traffic between client and server
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security test engineer is evaluating the security of a custom-built content management system. The organization has the source code and wants to ensure that all code paths are tested, including error handling and edge cases. They also want to identify vulnerabilities that automated scanners might miss. Which testing approach is most effective?

   • ABlack-box testing, because it tests the system from a user's perspective
   • BWhite-box testing, but only using static analysis tools
   • CWhite-box testing, because it allows thorough code review and path coverage
   • DGrey-box testing, because it provides a balance of internal and external perspectives
   Reveal Solution Discussion Select an answer first