A penetration tester has been hired and given access to all code, diagrams, and documentation. Which type of testing is being conducted?

The scenario describes a penetration testing approach where the tester is given access to all code,

diagrams, and documentation, which is indicative of a Full Knowledge (also known as White Box)

testing methodology.

Characteristics:

Comprehensive Access: The tester has complete information about the system, including source

code, network architecture, and configurations.

Efficiency: Since the tester knows the environment, they can directly focus on finding vulnerabilities

without spending time on reconnaissance.

Simulates Insider Threats: Mimics the perspective of an insider or a trusted attacker with full access.

Purpose: To thoroughly assess the security posture from an informed perspective and identify

vulnerabilities efficiently.

Other options analysis:

B . Unlimited scope: Scope typically refers to the range of testing activities, not the knowledge level.

C . No knowledge: This describes Black Box testing where no prior information is given.

D . Partial knowledge: This would be Gray Box testing, where some information is provided.

CCOA Official Review Manual, 1st Edition Reference:

Chapter 8: Penetration Testing Methodologies: Differentiates between full, partial, and no-

knowledge testing approaches.

Chapter 9: Security Assessment Techniques: Discusses how white-box testing leverages complete

information for in-depth analysis.