Free Isaca CCOA Actual Exam Questions - Question 3 Discussion

Question No. 3
A penetration tester has been hired and given access to all code, diagrams, and documentation.
Which type of testing is being conducted?
Select one option, then reveal solution.
US
EL
Ethan L.
2026-02-20

Probably A. The question emphasizes having all code, diagrams, and documentation, which points to full knowledge testing since the tester starts with everything upfront. Partial knowledge usually means some info is missing, so D doesn’t seem right here. Unlimited scope (B) refers more to the range of systems tested rather than the info given. No knowledge (C) is clearly not the case since the tester has all the materials.

0
WO
Will O.
2026-02-18

A imo, full knowledge testing means having all the info upfront, including code and diagrams. Without live system access mentioned, it still fits better than partial or no knowledge options here.

0
UW
Usman W.
2026-02-03

It’s A for sure. Having access to all code, diagrams, and documentation means the tester knows everything upfront—classic full knowledge testing. Partial knowledge (D) usually implies some info is withheld, and no knowledge (C) is black-box with zero inside info. Unlimited scope (B) is about how much they’re allowed to test, not how much they know, so that doesn’t fit here. This one’s pretty straightforward if you focus on the “all code and docs” part.

0
UW
Usman W.
2026-02-01

D imo, partial knowledge fits better here because even though the tester has all the code and docs, they might not have access to the live environment or actual running systems, which is often a key difference in these testing types. Full knowledge usually implies absolutely everything, including live system access, right? So this feels like a classic grey area but partial knowledge should cover it since they’re not completely in the dark but also not unlimited.

0
UW
Usman W.
2026-01-28

It’s A because no knowledge (C) is for black-box, which this clearly isn’t.

0
UW
Usman W.
2026-01-28

A/C? Full knowledge (A) fits since the tester has everything upfront, but the question might be tricky if you think about real-world gaps like live environment or config details that aren’t in docs. No knowledge (C) is obviously out because the tester isn’t blind. I’d rule out B and D since B is about scope limits, and D means only some info, which doesn’t match “all code, diagrams, and documentation.” So it’s mainly A, but worth noting the real environment might still hide surprises.

0
DH
Daniel H.
2026-01-24

A, since full knowledge means having complete access beforehand.

0
DH
Daniel H.
2026-01-23

Does “all code and diagrams” really cover everything, or could there be hidden live environment details missing?

0
UQ
Usman Q.
2026-01-18

It’s A because having all code and diagrams means the tester knows everything upfront, which matches full knowledge testing perfectly. Partial (D) wouldn’t fit since that implies limited info, not all.

0
UQ
Usman Q.
2026-01-18

Probably A since having all code and documentation implies the tester has complete information, not just partial or none. That fits the definition of full knowledge testing best.

0
KZ
Kevin Z.
2026-01-17

Maybe D could fit if you consider that having all code and docs means partial knowledge, as they might not know everything about the environment or live systems. But since the question says "all code, diagrams, and documentation," it sounds like full knowledge to me too. Still, partial knowledge could be a tricky answer if you think about real-world limits.

0
KZ
Kevin Z.
2026-01-16

Probably A, since they have full access to everything.

0