Penetration Testing
Learn Penetration Testing for GCSE Computer Science with this free worksheet and full mark scheme — Foundation and Higher exam-style questions with worked answers for AQA GCSE Computer Science (8525). Penetration testing deliberately attacks a system to find weaknesses before criminals do.
Free downloads
These worksheets and mark schemes are original, written for Virtus Academy and checked against the current AQA specification. Every worksheet comes with a full mark scheme.
Topic overview
Penetration testing means deliberately attacking a system, with permission, to find vulnerabilities before a real attacker does.
There are two forms. White box testing gives the tester full knowledge of the system — source code, network diagrams, credentials — simulating an attack by someone with inside information. Black box testing gives the tester no prior knowledge, simulating an external attacker who must discover everything themselves.
Both have value. White box testing is thorough and can examine every part of the system. Black box testing is more realistic for external threats and tests what an outsider could actually achieve. The essential condition is permission — the same actions without it would be a criminal offence under the Computer Misuse Act.
Revision notes
What it is
Deliberately attacking a system, with permission, to find vulnerabilities before a real attacker exploits them.
The findings are reported so the weaknesses can be fixed. It tests defences in practice rather than in theory.
White box and black box
White box: the tester has full knowledge — source code, network diagrams, credentials.
Black box: the tester has no prior knowledge and must discover everything, simulating an external attacker. Each simulates a different kind of threat.
The permission requirement
Permission is what separates penetration testing from criminal hacking.
The identical actions carried out without authorisation would be an offence under the Computer Misuse Act. Scope and permission are agreed in writing before any testing begins.
Key points
- Penetration testing attacks a system with permission.
- It finds vulnerabilities before real attackers do.
- White box testing gives full knowledge.
- Black box testing gives no prior knowledge.
- Black box simulates an external attacker.
- Permission is legally essential.
Worked examples
Example 1
State the difference between white box and black box penetration testing. [2 marks]
Working
Example 2
Explain why permission is essential before penetration testing. [2 marks]
Working
Example 3
Explain one advantage of black box testing. [2 marks]
Working
Common mistakes
Forgetting the permission requirement.
Without it the testing is a criminal offence.
Confusing white box and black box.
White box has full knowledge; black box has none.
Saying penetration testing prevents attacks.
It identifies vulnerabilities so they can be fixed.
Saying one form is always better.
Each simulates a different kind of threat.
Exam tips
- Always mention that permission is required.
- Contrast the two forms by knowledge given.
- Name the Computer Misuse Act for the legal point.
- Say testing identifies vulnerabilities for fixing.
Key terms
- Penetration testing
- Authorised attacking of a system to find vulnerabilities.
- White box testing
- Testing with full knowledge of the system.
- Black box testing
- Testing with no prior knowledge.
- Computer Misuse Act
- The law making unauthorised access an offence.
Related topics
Written and reviewed against the current AQA specification. Spotted an error? Let us know.