CISSP Security Assessment and Testing Practice Question
Which THREE of the following are valid types of penetration testing based on the level of knowledge provided to the tester?
⚠ Common exam trap
CISSP often tests the three knowledge-based pen test types (white, grey, black) while seeding color-based distractors like 'blue box' and 'red box' that refer to team roles, not testing methodologies — candidates who conflate team colors with test types select the wrong options.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
White box
The three valid penetration-testing types classified by the tester's level of knowledge are White box (B), Grey box (C), and Black box (D). White box testing gives the tester full knowledge of the target, including source code, architecture, and credentials, making it the highest-knowledge category. Grey box testing provides partial knowledge, such as limited documentation or user-level credentials, simulating an insider with some access. Black box testing provides no prior knowledge of the target, simulating an external attacker who must perform reconnaissance. Blue box (A) and Red box (E) are not standard knowledge-based penetration-testing classifications; 'blue team' and 'red team' refer to defensive and offensive roles, not levels of tester knowledge.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Blue box
Why it's wrong here
While the term "blue team" refers to defensive security operations, "blue box" is not a recognized industry term for a penetration testing methodology. Historically, a blue box was a phreaking tool used to bypass telephone switching systems, but it has no definition within modern security assessment frameworks.
- ✓
White box
Why this is correct
White-box penetration testing, also known as clear-box testing, provides the assessor with complete access to system documentation, source code, network diagrams, and IP addressing schemes. This comprehensive visibility allows for a highly thorough security assessment, simulating an insider threat or a scenario where an attacker has obtained deep administrative access.
- ✓
Grey box
Why this is correct
Grey-box testing strikes a balance by granting the evaluator limited or partial information about the target environment, such as low-privilege user credentials or basic architectural diagrams. This approach simulates an attacker who has successfully breached the perimeter and is attempting lateral movement or privilege escalation from a standard user perspective.
- ✓
Black box
Why this is correct
Black-box testing simulates an external adversary with zero prior knowledge of the target organization's internal infrastructure, source code, or configurations. The assessor must rely entirely on open-source intelligence gathering, external scanning, and reconnaissance to discover vulnerabilities, closely mimicking a real-world opportunistic or targeted cyberattack.
- ✗
Red box
Why it's wrong here
Although "red teaming" represents adversarial attack simulations, the term "red box" is not a valid classification for penetration testing. In legacy telecommunications hacking, a red box was a device used to simulate the sound of coins dropping into payphones, making it entirely irrelevant to modern cybersecurity assessment methodologies.
Go deeper
Related to this question
About these practice questions
One of 816 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.