A rules of engagement (ROE) document for a penetration test specifies a 'black-box' testing approach. What does this mean for the penetration tester?
Select an answer to reveal the explanation.
Short Explanation
Black-box testing means you start with no prior knowledge of the target environment. You have to discover systems, services, and vulnerabilities through reconnaissance, just like an external attacker would.
Full Explanation
Black-box penetration testing simulates an external attacker with no prior knowledge, requiring the tester to perform full reconnaissance to discover systems, services, and vulnerabilities. The option describing full knowledge of architecture, source code, and credentials is wrong because that describes white-box testing. The option limiting the test to web application testing only is wrong because scope is defined separately from the knowledge model; black-box applies to any scope. The option allowing only automated scanning without manual exploitation is wrong because the knowledge model, black/white/grey, does not restrict testing methods; rules of engagement define allowed techniques separately.