← WA Computer Science ATAR Unit 2

Black, grey and white box testing

Test approaches defined by what the tester knows beforehand: black box knows nothing (outsider view), grey box knows some (insider view), white box knows everything (full knowledge).

Part of: WA Computer Science ATAR Year 11 — Cyber Security — Module 144

Understanding Black, grey and white box testing in WA Computer Science ATAR Unit 2

What it does: Grey box testing gives the tester some information, matching the insider view of a user with limited access. The dictionary shows the core idea: the amount of prior knowledge goes from none to some to all. An outsider usually starts with no inside knowledge, which is the black box view. White box means full knowledge. Black box is the one where the tester knows nothing.

Common mistakes: Knowing nothing and having an external attacker view describes black box testing. White box testers know everything, so line 1 should be approach = "black box". A black box tester knows nothing about the system beforehand. Line 2 should be tests["black"] = "none".

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Black, grey and white box testing to a class →

This module's key terms are also in a printable crossword (Modules 125–266) and word search (Modules 28–266).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
A penetration tester is given no information about the target system and attacks it like an outsider. Which approach is this?
Black box testingWhite box testing
Matches
black box test: tester is given the source code and network diagrams
↓
Source code and network diagrams are full knowledge, which belongs to white box testing. A black box tester starts with no inside information.
Applying
Meanings
Term
Black, grey and white box testing
Meaning
Test approaches defined by what the tester knows beforehand: black box knows nothing (outsider view), grey box knows some (insider view), white box knows everything (full knowledge).
Practice
black box: knows nothing, outsider view
Testing
Gaps
box testing: tester knows nothing
Check Answer
Spots
1approach = "white box"
2knowledge = "none"

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Nautilus' badge — Default Expert, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A penetration tester is given no information about the target system and attacks it like an outsider. Which approach is this?
A. White box testing
B. Black box testing ✓
In black box testing the tester knows nothing beforehand, so they take the external attacker view.
2. A tester is given the source code, network diagrams and admin documentation before testing. Which approach is this?
A. Black box testing
B. White box testing ✓
White box testing gives the tester full knowledge of the system, including code and design.
3. A tester is given a standard staff login and a basic outline of the network. This simulates an insider or a user with some access. Which approach is it?
A. Grey box testing ✓
B. Black box testing
Grey box testing gives partial knowledge, like an insider with limited access.
4. What is the main thing that separates black, grey and white box testing?
A. How much the tester knows about the system beforehand ✓
B. How fast the tester can run the scans
The three approaches differ in the amount of prior knowledge the tester starts with, not in speed or tools.
5. Which approach best matches the view of an external attacker who has just found your company's website?
A. Black box ✓
B. White box
An outsider usually starts with no inside knowledge, which is the black box view.

Match the Pairs

black box test → The tester starts with no inside knowledge and attacks like an outsider, seeing only what the public can see.
white box test → The tester is given full knowledge of the system, such as source code, network diagrams and configuration details.
A grey box tester has partial knowledge, like a normal user or employee who has a login but not the source code. → tester_knowledge = 'partial: user login only'
The three approaches differ in how much the tester knows about the target system beforehand. → knowledge = {'black': 'none', 'grey': 'some', 'white': 'all'}
black box test: tester is given the source code and network diagrams → Source code and network diagrams are full knowledge, which belongs to white box testing. A black box tester starts with no inside information.
white box test: tester only knows the company's public website address → Knowing only a public address is outsider knowledge, which belongs to black box testing. A white box tester has full inside knowledge of the system.

Key Term

Black, grey and white box testing
Test approaches defined by what the tester knows beforehand: black box knows nothing (outsider view), grey box knows some (insider view), white box knows everything (full knowledge).

Fill in the Blanks

1. black box testing: tester knows nothing
Hint: Type the colour of the test approach where the tester has no prior knowledge of the system.
2. grey box testing: tester knows some details
Hint: Type the word for how much the tester knows beforehand in the middle approach.
3. white box testing: tester has full knowledge
Hint: Type the colour of the approach where the tester is given complete information about the system.
4. Black box view: like an external attacker
Hint: Type the word describing an attacker who is outside the organisation.
5. Grey box view: like an insider user
Hint: Type the word for a person who already has some access inside the organisation.

Spot the Error

Question 1
A approach = "white box"
B knowledge = "none"
C view = "external attacker"
D print(approach, knowledge, view)
Line A — Knowing nothing and having an external attacker view describes black box testing. White box testers know everything, so line 1 should be approach = "black box".
Question 2
A tests = {}
B tests["black"] = "everything"
C tests["grey"] = "some"
D tests["white"] = "everything"
Line B — A black box tester knows nothing about the system beforehand. Line 2 should be tests["black"] = "none".
Question 3
A if knowledge == "none":
B approach = "black box"
C elif knowledge == "full":
D approach = "grey box"
E else:
F approach = "white box"
Line C — Grey box testing means the tester knows some of the system. Full knowledge belongs to white box (the else branch), so line 3 should test for "some".
Question 4
A approach = "white box"
B has_source_code = True
C has_network_map = False
D print(approach)
Line C — White box testers have full knowledge of the system, including network layouts. Line 3 should set has_network_map = True.
Question 5
A def pick(role):
B if role == "outsider":
C return "black box"
D elif role = "employee":
E return "grey box"
Line D — A single = assigns a value, while == compares values. Line 4 should be elif role == "employee": so the insider view returns grey box.

Student with a class code? Join your class →