Before a penetration test of a cloud application begins, the tester is given the full source code, the architecture diagrams and administrator credentials for the test environment. What kind of test is this?
Select an answer to reveal the explanation.
Short Explanation
You've been handed the house keys, the blueprints and the alarm code, so this isn't a break-in; it's an inspection with the lights on. Full knowledge means white-box. Gray-box is the tempting pick, but that's partial knowledge, like a regular user account, not the whole set of drawings.
Full Explanation
Testing approaches are distinguished by how much the tester knows in advance. In white-box testing, also called clear-box or full-knowledge testing, the tester receives source code, architecture and design documents, configurations and often privileged credentials. That allows thorough coverage of logic, data flows and configuration in limited time, because nothing is spent on reconnaissance. Black-box testing gives the tester no internal information, simulating an outside attacker; it shows what an uninformed adversary could find, but coverage is narrower and depends on what can be discovered from outside. Gray-box testing provides partial knowledge, commonly user-level accounts or high-level documentation, representing an insider or an attacker who has compromised a user; source code plus administrative access exceeds partial knowledge. Blind testing describes an engagement in which the tester works only from publicly available information, as in black-box testing, while the defending team is aware of the test; it is the opposite of what this tester was given. Exam caveat: the choice depends on the objective; white-box maximizes coverage, black-box measures external exposure, and cloud testing must also follow the provider's testing policy and the scope agreed in writing. Operational check: confirm the rules of engagement document records the knowledge level, the in-scope cloud resources and approval from the system owner.