PT0-002 Practice Question: A client requests a penetration test but only…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Red team

  Why it's wrong here

  Red teaming is an objective-driven, full-scope adversarial simulation that tests people, processes, and technologies, not a classification of information sharing. It can be conducted using black, grey, or white box knowledge levels, so the term is orthogonal to the scenario. The client's question is about how much network information was provided, making Red team an incorrect answer here.

• ✗

  Black box

  Why it's wrong here

  Black box testing assumes the tester starts with zero prior knowledge of the target, relying solely on public information and active reconnaissance. Since the client explicitly supplied network diagrams and credentials, the engagement already includes internal details that a black box tester would have to discover on their own. This provision contradicts the no-knowledge premise, so Black box cannot be the correct classification.

• ✓

  Grey box

  Why this is correct

  Grey box testing occupies the middle ground between black and white box, giving the tester limited but realistic information such as network diagrams, IP ranges, and low-privileged credentials. This approach mirrors an insider or partially compromised external attacker and is the standard for many commercial penetration tests because it balances thoroughness with real-world conditions. The client's provision of network diagrams and credentials exactly matches this limited-information model, making Grey box the correct answer.

• ✗

  White box

  Why it's wrong here

  White box testing, also known as full disclosure testing, grants the tester complete visibility into the environment, including application source code, architecture documentation, and administrative credentials. Merely providing network diagrams and standard user credentials falls far short of that complete knowledge level. Because the client only shared partial information rather than full transparency, the engagement cannot be classified as White box.

Go deeper

Related to this question