GSLC-2020: GIAC Security LeadershipDemo

Question

As a routine assessment of the company network’s system security and integrity, which statements about Black Box penetration testing are true?

Each correct answer represents a complete solution. Choose all that apply.

Choose two

A Black box testing provides the testers with complete knowledge of the infrastructure to be tested.
B Black box testing simulates an attack from someone who is familiar with the system.
C Black box testing simulates an attack from someone who is unfamiliar with the system.
D Black box testing assumes no prior knowledge of the infrastructure to be tested.

Explanation

Black-box penetration testing assumes no prior knowledge of the target infrastructure and simulates an attack by someone unfamiliar with the system. NIST defines black-box testing as a methodology that assumes no knowledge of the assessment object’s internal structure or implementation details.

Learn more

NIST CSRC Glossary: Black Box Testing

GSLC-2020: GIAC Security LeadershipDemo

AstroTutor

Notes

Readiness

QuestionQ331

Community Discussion