Which statement accurately describes black-box, white-box, and gray-box testing in penetration testing?

• A. Gray-box testing uses no internal knowledge.
• B. Black-box testing uses full internal knowledge.
• C. White-box testing uses partial internal knowledge.
• D. Gray-box testing uses partial internal knowledge.

Answer: (D)

In penetration testing, the amount of internal knowledge available to the tester defines the approach. Gray-box testing uses partial internal knowledge, giving enough context to test more effectively than a blind external attack while still not having full access to all systems. This partial knowledge might include limited credentials or access to certain network details, which helps focus the test and uncover more realistic vulnerabilities without exposing everything.

That’s why gray-box testing is described as using partial internal knowledge. It sits between black-box testing, which involves no internal knowledge and treats the target as an outsider, and white-box testing, which has full internal visibility and access. Descriptions that say gray-box uses no internal knowledge would align with black-box testing, while statements that white-box uses partial internal knowledge misrepresent the level of access involved.