Question

A financial services firm wants a penetration test that simulates the actions of a malicious insider who has legitimate standard-user network credentials but no documentation of the internal architecture. Leadership wants the test to realistically reflect what such an insider could discover and exploit while keeping the engagement time-efficient. Which testing approach best fits this objective?

Accepted Answer

Gray-box testing, where testers are given limited information such as standard user credentials but not full architecture documentation

Answer

Black-box testing, where the testers receive no information and must enumerate everything externally

Answer

White-box testing, where testers receive full source code, network diagrams, and administrative access

Answer

A double-blind test, where neither the testers nor the security operations team have any prior knowledge