What characterizes a grey box penetration test?

What characterizes a grey box penetration test?

• A. Zero prior knowledge of the system
• B. Full access to source code
• C. Limited knowledge of the system
• D. All internal documentation provided

Answer: (C)

A grey box penetration test is characterized by having limited knowledge of the system being tested. This approach combines elements of both black box testing, which involves no prior knowledge about the system, and white box testing, where complete access to the system's internals—including source code and internal documentation—is provided. In a grey box test, the ethical hacker operates with some understanding of the application's architecture and design, but not with complete access or insight into every aspect. This knowledge is typically derived from exposing the tester to some system configurations, user roles, or interaction patterns, which helps them simulate an attack scenario that an internal user or a semi-privileged attacker might execute. This balance allows for a more realistic evaluation of the system's security posture while still presenting some unknown factors that may exist in a real-world attack scenario.

A grey box penetration test is characterized by having limited knowledge of the system being tested. This approach combines elements of both black box testing, which involves no prior knowledge about the system, and white box testing, where complete access to the system's internals—including source code and internal documentation—is provided.

In a grey box test, the ethical hacker operates with some understanding of the application's architecture and design, but not with complete access or insight into every aspect. This knowledge is typically derived from exposing the tester to some system configurations, user roles, or interaction patterns, which helps them simulate an attack scenario that an internal user or a semi-privileged attacker might execute.

This balance allows for a more realistic evaluation of the system's security posture while still presenting some unknown factors that may exist in a real-world attack scenario.