A company hires a penetration testing firm and gives the testers only the company's name. They receive no network diagrams, credentials, or source code, so they must discover everything the way an outside attacker would. What type of penetration test is this?
Select an answer to reveal the explanation.
Short Explanation
No diagrams, no passwords, no code: the testers start blind, just like a real outsider. That's an unknown-environment test. Don't confuse it with partially known, where you'd hand them at least something like a user account or an IP range.
Full Explanation
Penetration test types are distinguished by how much information the testers receive in advance. In an unknown-environment test, testers receive little or no internal information and must perform their own reconnaissance to discover systems, services, and weaknesses, closely simulating an external attacker who has no insider knowledge. Giving the firm only the company's name fits that description. A known-environment test gives testers full information, such as network diagrams, credentials, configurations, and possibly source code, so they can examine systems thoroughly and efficiently; it trades realism for depth of coverage. A partially known-environment test sits between the two, providing limited information such as a user-level account or a list of in-scope address ranges, often to simulate an insider or an attacker who has already gained a foothold. A defensive exercise focuses on the blue team's detection and response activities rather than on attackers discovering and exploiting weaknesses with a defined level of prior knowledge, so it does not describe how much information testers were given. Exam caveat: unknown-environment tests can miss vulnerabilities simply because testers never found the asset in the time allowed, so they do not guarantee broad coverage. Operational check: confirm the rules of engagement record what information was withheld and that the final report lists every asset the testers discovered.