A network security team wants to evaluate the organization's real-world susceptibility to attack. They hire an external firm to conduct a test where the testers have no prior knowledge of the environment and attempt to gain unauthorized access.
What type of security test is described, and how does it differ from a white-box test?
- A.A red team exercise; identical to a white-box penetration test
- B.A black-box penetration test, where testers begin with no internal knowledge and simulate an external attacker; a white-box test provides full network diagrams, source code, and credentials to testers so they can focus on finding vulnerabilities rather than reconnaissance
- C.A gray-box test where testers receive partial information about the target
- D.A vulnerability assessment; different from a penetration test only in that it uses automated tools
Why B is correct
Black-box testing: testers start with only a target scope (e.g., a domain name) and no internal knowledge, simulating an external attacker. It tests real-world attack resistance including reconnaissance. White-box testing: testers receive full documentation, source code, architecture diagrams, and credentials, allowing efficient deep vulnerability analysis but not simulating realistic external attack. Gray-box is the middle ground (option C describes gray-box correctly, not the question scenario). A vulnerability assessment (option D) identifies weaknesses but does not attempt exploitation, unlike a penetration test.
Know someone studying for Network Fundamentals? Send them this one.