Compare black-box, white-box, and gray-box penetration testing.

• A. Black-box uses partial knowledge; white-box uses none; gray-box uses full access.
• B. Black-box has no internal knowledge; white-box uses full access; gray-box uses partial knowledge; each yields different insights.
• C. Black-box is the same as white-box; gray-box uses external consultants only.
• D. Black-box tests only for web apps; white-box tests only for networks.

Answer: (B)

Different levels of knowledge and access in a penetration test change what you can learn about a system. In a black-box test, the tester has no internal knowledge about the target, mirroring an external attacker who only sees the outside world. This yields insights into the external surface, perimeter defenses, and what an attacker with no insider information could discover. In a white-box test, the tester has full access to internal details like source code, architecture, and configurations, allowing a deep, thorough examination of internal logic, data flows, and potential flaws that might be invisible from the outside. This approach uncovers issues that require intimate knowledge of how the system is built and operated. Gray-box testing sits in between, giving the tester partial internal knowledge, which helps focus efforts on areas that are most likely to be weak while still simulating some real-world insider awareness. Each method provides different insights because they model different attacker perspectives and levels of access, so they complement rather than replace one another.

The other options misstate how these testing approaches work. Black-box does not use partial knowledge; white-box does not have no internal knowledge; gray-box is not limited to external consultants. And the idea that black-box is only for web apps or white-box only for networks is incorrect, since these testing styles apply across many types of systems and targets.