Black-Box, White-Box and Grey-Box Security Testing CT-STE Practice Questions (Page 5)

Questions 21–25

1. 21application · easy

   A security test engineer is asked to compare the knowledge levels required for different testing approaches. They need to explain to a stakeholder that one approach requires no internal knowledge, another requires full internal knowledge, and a third requires partial knowledge. Which statement accurately describes this comparison?

   • AAll three approaches require the same level of internal knowledge
   • BBlack-box requires full internal knowledge, white-box requires no internal knowledge, and grey-box requires partial internal knowledge
   • CBlack-box requires partial internal knowledge, white-box requires no internal knowledge, and grey-box requires full internal knowledge
   • DBlack-box requires no internal knowledge, white-box requires full internal knowledge, and grey-box requires partial internal knowledge
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security test engineer is tasked with testing a newly deployed web application. The organization wants to identify vulnerabilities that an external attacker could exploit without any prior knowledge of the system. They have no access to the source code or internal documentation. Which testing approach should be used?

   • AGrey-box testing, using publicly available information about the application
   • BBlack-box testing, using only the application's external interfaces
   • CWhite-box testing, by guessing the source code structure
   • DBlack-box testing, but only using automated vulnerability scanners
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which statement accurately describes grey-box security testing?

   • ATesting with no knowledge of the system's internals
   • BTesting performed only by automated tools
   • CTesting with full access to source code and internal structure
   • DTesting with partial knowledge of the system's internals, such as credentials or architecture
   Reveal Solution Discussion Select an answer first
5. 24application · easy

   A security test engineer is comparing the techniques used in different testing approaches. They note that one approach relies on fuzzing and input manipulation, another uses code review and static analysis, and a third uses a combination of both. Which statement correctly matches the techniques to the approaches?

   • ABlack-box uses a combination, white-box uses fuzzing, and grey-box uses code review
   • BBlack-box uses fuzzing, white-box uses code review, and grey-box uses a combination
   • CAll approaches use the same techniques
   • DBlack-box uses code review, white-box uses fuzzing, and grey-box uses a combination
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is a primary advantage of white-box security testing compared to black-box testing?

   • AIt can identify all possible vulnerabilities, including logic flaws and backdoors
   • BIt is faster and cheaper to perform than black-box testing
   • CIt does not require any knowledge of the system, making it easier to perform
   • DIt simulates the perspective of an external attacker more accurately
   Reveal Solution Discussion Select an answer first