CISSP: Certified Information Systems Security Professional

Question

An organization plans a penetration test that emulates the malicious activities of a former network administrator. Which type of penetration test is required?

Explanation

White-box testing assumes explicit and substantial knowledge of the target’s internal structure and implementation. A former network administrator would have extensive knowledge of network architecture, configurations, and privileged administrative processes, matching the white-box threat model.

Learn more

NIST SP 800-171A, Appendix D: Test Assessment Method

CISSP: Certified Information Systems Security Professional

AstroTutor

Notes

Readiness

QuestionQ208

Community Discussion