Exercise 1: Choosing Between Black Box, White Box, and Gray Box — Possible Solution ==================================================================== THE SCENARIO ------------------------------ A client wants the most realistic possible simulation of an external attacker, and has a generous multi-week testing window. APPLYING THE CHAPTER'S OWN COMPARISON TABLE ------------------------------ Per this chapter's own table, Black Box testing starts with no source code, no architecture documentation, and no credentials, and is explicitly rated "Highest" for realism, since it "matches a real outside attacker" who also starts with none of that information. White Box is the opposite on realism ("Lowest... real attackers rarely start this informed"), and Gray Box sits in the middle. WHY BLACK BOX IS THE RIGHT CHOICE HERE ------------------------------ The client's own stated priority — "the most realistic possible simulation of an external attacker" — maps directly onto Black Box's own defining trait in the chapter's table. The one real cost of Black Box, per the table, is lower thoroughness "in a fixed timeframe," since "significant time [is] spent just on recon." But the scenario specifically states the client has "a generous multi-week testing window" — which directly removes the one factor that would normally count against Black Box. With realism prioritized and the usual time-pressure downside removed, Black Box is the correct fit. WHY NOT WHITE BOX OR GRAY BOX ------------------------------ White Box would maximize thoroughness but at the direct cost of the realism the client explicitly asked for — per the chapter, "real attackers rarely start this informed." Gray Box is a reasonable general-purpose compromise, but it isn't what was actually asked for here: the client didn't ask for an efficient middle ground, they asked specifically for realism, with time available to support the one approach (Black Box) that delivers it most fully. WHY THIS WORKS AS AN ANSWER ------------------------------ It matches the client's own stated priority (realism) against the exact language of the chapter's comparison table, and explicitly explains why the scenario's generous timeframe neutralizes Black Box's one normal drawback, rather than just picking Black Box by name recognition.