the pen tester has absolutely no knowledge of the system and its functioning in the same manner as an outside attacker
no prior knowledge of the system or network to be assessed
attacker has no knowledge of the network environment (external attack)