CISSP Security Assessment and Testing Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Blue box

  Why it's wrong here

  While the term "blue team" refers to defensive security operations, "blue box" is not a recognized industry term for a penetration testing methodology. Historically, a blue box was a phreaking tool used to bypass telephone switching systems, but it has no definition within modern security assessment frameworks.

• ✓

  White box

  Why this is correct

  White-box penetration testing, also known as clear-box testing, provides the assessor with complete access to system documentation, source code, network diagrams, and IP addressing schemes. This comprehensive visibility allows for a highly thorough security assessment, simulating an insider threat or a scenario where an attacker has obtained deep administrative access.

• ✓

  Grey box

  Why this is correct

  Grey-box testing strikes a balance by granting the evaluator limited or partial information about the target environment, such as low-privilege user credentials or basic architectural diagrams. This approach simulates an attacker who has successfully breached the perimeter and is attempting lateral movement or privilege escalation from a standard user perspective.

• ✓

  Black box

  Why this is correct

  Black-box testing simulates an external adversary with zero prior knowledge of the target organization's internal infrastructure, source code, or configurations. The assessor must rely entirely on open-source intelligence gathering, external scanning, and reconnaissance to discover vulnerabilities, closely mimicking a real-world opportunistic or targeted cyberattack.

• ✗

  Red box

  Why it's wrong here

  Although "red teaming" represents adversarial attack simulations, the term "red box" is not a valid classification for penetration testing. In legacy telecommunications hacking, a red box was a device used to simulate the sound of coins dropping into payphones, making it entirely irrelevant to modern cybersecurity assessment methodologies.

Go deeper

Related to this question