AppScan is a black box testing tool because it tests the application from the outside without accessing the internal code structure. White box requires code access, gray box combines both approaches, and 'yellow box' is not a standard testing category.