SY0-701 Question 472
Single answerPenetration testing: Physical , Offensive , Defensive , Integrated , Known environment , Partially known environment , Unknown environmentA healthcare organization is hiring a third-party firm to evaluate how well its security team can detect and respond to a realistic attack against its headquarters. Leadership wants the testers to begin with only the company name and public website, attempt to gain physical access to the building, and use any discovered weaknesses to pivot into the internal network without notifying the SOC in advance. Which type of penetration test BEST matches these requirements?
- A
Known environment integrated test
- B
Unknown environment offensive test with a physical component
- C
Partially known environment defensive assessment
- D
Known environment physical assessment only
Show answer and explanation
Correct answer: B
Explanation
The best answer is an unknown environment offensive test with a physical component. In Security+ terminology, an unknown environment engagement most closely matches a black-box assessment, where testers receive little to no internal knowledge and must rely on reconnaissance just as a real attacker would. Because the organization wants to assess how well the security team detects and responds to an unannounced, realistic attack, this is clearly an offensive exercise rather than a defensive review. The requirement to attempt entry into the headquarters adds a physical penetration testing element, and the follow-on pivot into the internal network makes it a combined real-world attack path. This type of engagement is consistent with common penetration testing best practices described in standards and guidance such as NIST SP 800-115, which distinguishes testing approaches by scope, information provided, and objective, including realistic attacker emulation and social/physical techniques where authorized.
- A. Incorrect.
Incorrect. A known environment test gives the testers significant internal knowledge up front, such as network diagrams, credentials, or asset inventories. That does not match the scenario, where the testers start with only public information. Although an integrated test can involve coordination across domains, the key mismatch is the level of prior knowledge.
- B. Correct.
Correct. This is an unknown environment test because the testers begin with essentially no internal information beyond what is publicly available, which aligns with a black-box style engagement. It is offensive because the goal is to simulate a real attacker attempting to gain access and exploit weaknesses. It also includes a physical component because the team is expected to try to enter the building and then pivot into the internal network. Not notifying the SOC in advance further supports a realistic adversary simulation focused on measuring detection and response.
- C. Incorrect.
Incorrect. A partially known environment test would provide limited internal information to the testers, which is more than the scenario allows. A defensive assessment typically focuses on validating protective controls from the defender perspective, rather than conducting a realistic attack simulation designed to emulate an external threat actor without prior notice to the SOC.
- D. Incorrect.
Incorrect. While the scenario does include physical testing, it is not limited to physical access. The testers are also expected to pivot into the internal network, making this broader than a physical assessment only. In addition, a known environment test would provide internal details to the testers, which conflicts with the requirement to start with only public information.