Pete, a developer, writes an application. Jane, the security analyst, knows some things about the overall
application but does not have all the details. Jane needs to review the software before it is released to
production. Which of the following reviews should Jane conduct?

A.
Gray Box Testing

B.
Black Box Testing

C.
Business Impact Analysis

D.
White Box Testing

Explanation:
Gray box testing, also called gray box analysis, is a strategy for software debugging in which the tester has
limited knowledge of the internal details of the program. A gray box is a device, program or system whoseworkings are partially understood.
Gray box testing can be contrasted with black box testing, a scenario in which the tester has no knowledge or
access to the internal workings of a program, or white box testing, a scenario in which the internal particulars
are fully known. Gray box testing is commonly used in penetration tests.
Gray box testing is considered to be non-intrusive and unbiased because it does not require that the tester have
access to the source code. With respect to internal processes, gray box testing treats a program as a black box
that must be analyzed from the outside. During a gray box test, the person may know how the system
components interact but not have detailed knowledge about internal program functions and operation. A clear
distinction exists between the developer and the tester, thereby minimizing the risk of personnel conflicts.