CT-STE: Certified Tester Security Test EngineerDemo

By ISTQB · Question Mode

QuestionQ17

Security Test Techniques

Which of the following illustrates grey-box security testing?

  • A A security test of a web application attempting to exploit file upload flaws by interacting with the application’s user interface without any access to the application’s source code.
  • B A network security audit performed by a security tester with no prior knowledge of the application or its infrastructure aimed to identify open ports or weak authentication.
  • C A network penetration test using partial knowledge of the system architecture to try to exploit vulnerabilities while remaining unaware of the system’s configuration and code details.
  • D A source code review of a web application, performed by the security test team, aimed to identify vulnerabilities such as SQL injection, with access to the application’s database.
Explanation

Grey-box security testing is performed with partial knowledge of the target environment. A penetration test informed by the system architecture, while lacking detailed configuration and source-code knowledge, is a grey-box test.

Community Discussion

No comments yet. Be the first to start the discussion!