CEH Introduction to Ethical Hacking Practice Question
A company wants to test the security of its web application by simulating attacks from an external perspective. They have no prior knowledge of the internal network or application architecture. Which type of test should they perform?
⚠ Common exam trap
Watch out — candidates often confuse 'black-box test' with 'red team engagement', but red team engagements are broader and may include internal knowledge or physical attacks, whereas a black-box test strictly limits information to what is publicly available.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Black-box test
A black-box test is the correct choice because the company has no prior knowledge of the internal network or application architecture. This simulates an external attacker with zero insider information, testing the application from an outsider's perspective without access to source code, network diagrams, or credentials. The test relies solely on publicly available information and direct interaction with the application's interfaces.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Black-box test
Why this is correct
A black-box test simulates an external attacker with no prior knowledge of the target system's internal architecture, source code, or credentials. Testers interact with the web application solely through its public interfaces, mimicking real-world threat actors attempting to exploit vulnerabilities from the outside. This approach is ideal for assessing the effectiveness of perimeter defenses and identifying externally exploitable flaws, directly aligning with a company's goal to test its web application's security from an external perspective.
- ✗
White-box test
Why it's wrong here
A white-box test involves the tester having complete access to the application's internal workings, including source code, design documents, and infrastructure details. This comprehensive knowledge allows for in-depth analysis of code logic, configuration files, and potential internal vulnerabilities that might be missed by external testing. While thorough for identifying deep-seated flaws, it does not simulate an external attacker's perspective, which is what the company primarily seeks for web application security.
- ✗
Red team engagement
Why it's wrong here
A red team engagement is a comprehensive, goal-oriented adversarial simulation designed to test an organization's overall security posture, including people, processes, and technology, against a specific objective (e.g., data exfiltration). Unlike a focused web application test, it often involves multiple attack vectors, social engineering, and physical penetration, aiming to mimic a sophisticated, persistent threat actor across the entire enterprise. It's a broader, more extensive exercise than simply testing a single web application's security.
- ✗
Gray-box test
Why it's wrong here
A gray-box test is conducted with some limited knowledge of the application's internal structure or credentials, such as user accounts or API documentation, but not full source code access. This approach balances the realism of a black-box test with the efficiency of a white-box test, allowing testers to simulate an insider threat or a privileged user. However, for a company wanting to test its web application's security from an *external* attacker's perspective, a gray-box test provides too much initial information.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.