PT0-002 Engagement Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Grey box

  Why it's wrong here

  Grey box testing grants the tester partial knowledge, such as a valid low-privileged domain account or limited network diagrams, to emulate an authenticated internal threat. Because the engagement involves only piecemeal information rather than complete architectural and code-level details, it does not satisfy a scenario where the tester is granted full system knowledge. The correct answer must reflect total visibility, not a middle ground.

• ✗

  Black box

  Why it's wrong here

  Black box testing provides no prior knowledge of the target, forcing the tester to perform reconnaissance and behave like an unprivileged external attacker. While this approach validates external perimeter controls, it cannot be selected when the engagement explicitly provides the tester with full credentials, source code, and infrastructure documentation. Lack of insider knowledge runs directly contrary to the premise that the tester has complete access.

• ✗

  Red team

  Why it's wrong here

  Red teaming is a goal-based security exercise that emulates adversarial tactics, techniques, and procedures across multiple layers, not a knowledge-level classification like black, grey, or white box. A red team can operate with black, grey, or white knowledge depending on the rules of engagement, so selecting it as a testing type would mismatch the question's focus on the amount of information provided. The premise asks for a testing methodology defined by knowledge, not an operational exercise format.

• ✓

  White box

  Why this is correct

  White box testing, also called clear box or open box testing, gives the tester full knowledge of the target environment, including source code, architecture diagrams, configuration files, and administrative credentials. This comprehensive visibility allows the pentester to perform detailed code review, identify programming flaws, and validate configuration hardening with maximum efficiency. When the engagement premise states the tester is provided complete system details, white box is the only correct classification.

Go deeper

Related to this question