Black, grey and white box testing

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A penetration tester is given no information about the target system and attacks it like an outsider. Which approach is this?

A White box testing

B Black box testing

2. A tester is given the source code, network diagrams and admin documentation before testing. Which approach is this?

A Black box testing

B White box testing

3. A tester is given a standard staff login and a basic outline of the network. This simulates an insider or a user with some access. Which approach is it?

A Grey box testing

B Black box testing

4. What is the main thing that separates black, grey and white box testing?

A How much the tester knows about the system beforehand

B How fast the tester can run the scans

5. Which approach best matches the view of an external attacker who has just found your company's website?

A Black box

B White box

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1black box test		ASource code and network diagrams are full knowledge, which belongs to white box testing. A black box tester starts with no inside information.
2white box test		BThe tester starts with no inside knowledge and attacks like an outsider, seeing only what the public can see.
3A grey box tester has partial knowledge, like a normal user or employee who has a login but not the source code.		Cknowledge = {'black': 'none', 'grey': 'some', 'white': 'all'}
4The three approaches differ in how much the tester knows about the target system beforehand.		DKnowing only a public address is outsider knowledge, which belongs to black box testing. A white box tester has full inside knowledge of the system.
5black box test: tester is given the source code and network diagrams		Etester_knowledge = 'partial: user login only'
6white box test: tester only knows the company's public website address		FThe tester is given full knowledge of the system, such as source code, network diagrams and configuration details.

Definitions

Black, grey and white box testing

Fill in the Blanks

Complete each line of code by filling in the missing parts.

_____ box testing: tester knows nothing

grey box testing: tester knows ____ details

_____ box testing: tester has full knowledge

Black box view: like an ________ attacker

Grey box view: like an _______ user

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A approach = "white box"

B knowledge = "none"

C view = "external attacker"

D print(approach, knowledge, view)

Question 2

A tests = {}

B tests["black"] = "everything"

C tests["grey"] = "some"

D tests["white"] = "everything"

Question 3

A if knowledge == "none":

B approach = "black box"

C elif knowledge == "full":

D approach = "grey box"

E else:

F approach = "white box"

Question 4

A approach = "white box"

B has_source_code = True

C has_network_map = False

D print(approach)

Question 5

A def pick(role):

B if role == "outsider":

C return "black box"

D elif role = "employee":

E return "grey box"

Answer Key

Black, grey and white box testing

Section A: Quick Questions

B — Black box testing

B — White box testing

A — Grey box testing

A — How much the tester knows about the system beforehand

A — Black box

Section B: Match the Pairs

black box test → The tester starts with no inside knowledge and attacks like an outsider, seeing only what the public can see.

white box test → The tester is given full knowledge of the system, such as source code, network diagrams and configuration details.

A grey box tester has partial knowledge, like a normal user or employee who has a login but not the source code. → tester_knowledge = 'partial: user login only'

The three approaches differ in how much the tester knows about the target system beforehand. → knowledge = {'black': 'none', 'grey': 'some', 'white': 'all'}

black box test: tester is given the source code and network diagrams → Source code and network diagrams are full knowledge, which belongs to white box testing. A black box tester starts with no inside information.

white box test: tester only knows the company's public website address → Knowing only a public address is outsider knowledge, which belongs to black box testing. A white box tester has full inside knowledge of the system.

Section C: Definitions

Black, grey and white box testing — Test approaches defined by what the tester knows beforehand: black box knows nothing (outsider view), grey box knows some (insider view), white box knows everything (full knowledge).

Section D: Fill in the Blanks

black box testing: tester knows nothing

grey box testing: tester knows some details

white box testing: tester has full knowledge

Black box view: like an external attacker

Grey box view: like an insider user

Section E: Spot the Error

A — Knowing nothing and having an external attacker view describes black box testing. White box testers know everything, so line 1 should be approach = "black box".

B — A black box tester knows nothing about the system beforehand. Line 2 should be tests["black"] = "none".

C — Grey box testing means the tester knows some of the system. Full knowledge belongs to white box (the else branch), so line 3 should test for "some".

C — White box testers have full knowledge of the system, including network layouts. Line 3 should set has_network_map = True.

D — A single = assigns a value, while == compares values. Line 4 should be elif role == "employee": so the insider view returns grey box.