FAANG-Standard Interview Preparation Guide: Entry-Level Penetration Tester

Direct answer

My review process is the same shape whether the missed target was a shipped feature, a sales deal, or an analysis that didn't land: pull the actual evidence before the conversation rather than relying on memory, keep the room to the people who were actually close to the work, and end with a small number of specific, owned, tracked actions rather than a document full of general lessons nobody is accountable for.

What I actually do

Before the review, gather the real evidence. I pull whatever record exists of what actually happened: timelines, decisions made along the way, the original target and assumptions, rather than relying on how people remember it a week later, since memory tends to smooth over the specific decision points that actually mattered.

Keep the room small and close to the work. I include the people who were directly involved and whoever owns the target that was missed, and generally avoid a large audience, since a bigger room tends to produce more defensiveness and less specific, honest detail.

Ask a small set of standing questions regardless of what kind of work it was. What did we expect to happen and why did we expect that. Where did reality diverge from that expectation, and how early could we have noticed. What would have changed the outcome if we'd known it in time. I ask these the same way whether the missed target was a delivery deadline or a deal that didn't close, since the shape of a useful review doesn't actually depend on what kind of work it was.

Convert findings into a small number of owned actions, not a document. I resist letting the review end in a list of general lessons like "communicate earlier." Every real finding gets turned into one specific action with a name attached and a way to check later that it actually happened, and I deliberately cap the list short, usually two or three items, because a long list of actions is a sign none of them will actually get done.

Make sure the conclusions show up in the next piece of work, not just the next document. If a review concludes I was missing a specific skill or piece of context, I turn that into a concrete, time-boxed plan with something checkable at the end of it, so I can tell later whether the gap actually closed.

Worked example

A feature I owned to reduce signup drop-off missed its target badly: we'd projected a meaningful lift in completed signups within two weeks of launch, and by day ten we were sitting at roughly a third of that. Before the review, I pulled the actual daily completion numbers, the original rollout plan, and the two decisions we'd made along the way about which user segment to launch to first, rather than trusting how the team remembered the sequence a week later. I kept the room to the three people who'd built and shipped it plus the manager who owned the target, five people, not the wider team. Working through the standard questions, we traced the gap to two things: the in-product prompt explaining the change to users had shipped a week late, and the segment we'd launched to first turned out to overlap heavily with people who rarely touched that part of the product at all, so even a working feature had almost nobody in front of it. Both were visible in the data if anyone had checked mid-launch, and nobody had. That turned into three owned actions: I took the mid-launch data check-in for my own future rollouts, with a specific date attached; the engineer who owned the prompt copy moved it into the same release checklist as the code so it can't ship late again; and the PM agreed to sanity-check target audiences against real usage data before picking one next time. Two launches later, the mid-launch check-in caught a similar prompt delay early enough to fix it before it cost the whole window, which is the actual evidence the review changed something, not just a document that described it well.

Trade-offs and pitfalls

The most common pitfall is producing a thorough-looking document that changes nothing, because the findings stayed general enough that no one felt individually responsible for acting on them. The trade-off in keeping the action list short is that some real findings get left out; I accept that, because a long list that nothing gets done on teaches less than a short list that actually changes the next attempt.

Clarify scope & goals
Capture defensible evidence from a pentest so auditors (PCI/SOX) can verify integrity, origin, and chain-of-custody.

Procedure overview

1. Evidence capture — isolate artifact, assign ID, compute hash
2. Secure transfer — encrypted transport to evidence store
3. Storage & access — encrypted, auditable store with least privilege
4. Logging & documentation — immutable logs, signatures, audit packet for reviewers

Required metadata (per artifact)

• Evidence ID (UUID)
• Source system IP/hostname, owner, environment (prod/test)
• Capture timestamp (UTC) and timezone
• Captured-by (tester identity + role)
• Capture method/tool and version
• Purpose/test case/reference ticket
• SHA-256 hash and file size
• Chain-of-custody events (who, when, why)
• Retention period and disposition instructions

Hashing example

sha256sum artifact.bin > artifact.bin.sha256

Secure storage & encryption

• Store in WORM-capable object store or encrypted file system.
• At-rest: AES-256-GCM with KMS-managed keys.
• In-transit: TLS 1.2+ or SFTP with server key pinning.
• Key custody: separation of duties; keys managed by security/ops, not testers.

Personnel & access controls

• Role-based access (tester, reviewer, custodian) via RBAC/LDAP.
• MFA for all access; JIT temporary elevations for privileged actions.
• Approvals required for export; dual-control for deletion.

Logging & tamper evidence

• Append-only audit log (SIEM + immutable storage) recording all C-O-C events.
• Log entries include evidence ID, action, actor, timestamp, hash before/after.
• Periodic signed hash-tree (Merkle) or signed manifests to detect alteration.

Audit packet for reviewers

• Evidence file(s) + .sha256
• Metadata sheet (CSV/JSON)
• Signed chain-of-custody log (PDF) with human-readable timeline
• Tool outputs and screenshots showing capture context
• Key custody and retention policy references

Notes & best practices

• Use standardized templates; automate capture (scripts) to reduce human error.
• Retain original and working copies; always work on copies with hash chaining.
• Ensure legal/contractual scope documented before capture.

Direct answer

Encryption in transit protects data while it is moving between two points, for example your laptop and a website. Encryption at rest protects data while it is sitting in storage, for example on a server's hard drive. Both work the same basic way: the data is scrambled using a digital key, and only someone with the matching key can unscramble it back to something readable. HTTPS (the lock icon in a browser) is the everyday example of encryption in transit; a company laptop or database with disk encryption turned on is the everyday example of encryption at rest.

Structured elaboration

When I explain this to a stakeholder who is not technical, I make three deliberate choices:

1. Pick an analogy that survives the obvious follow-up question. "Scrambling data" invites "how do you unscramble it back?" so I go straight to a locked box with a key: the box (the data) can sit on a shelf (at rest) or travel in a delivery truck (in transit), and either way, only someone holding the matching key can open it. This analogy already answers the natural next question ("who has the key?") instead of dodging it.
2. Decide what to omit, not just simplify. I leave out algorithm names, protocol versions, and how the encryption keys themselves are generated and stored. Those details do not change the stakeholder's decision (do we need this, is it enough for compliance). What I keep is the one thing that matters to them: even if someone steals the disk or intercepts the network traffic, they get scrambled data they cannot use without the key.
3. Check understanding without quizzing them. Instead of asking "does that make sense?" (which invites a reflexive yes), I ask them to restate it in their own words, or pose a concrete scenario: "if someone stole this laptop from a parked car, what would they actually get?" Their answer tells me whether the concept landed.

Worked example

Here is close to what I would actually say:

"Think of our data like paperwork in a locked filing cabinet. 'Encryption at rest' means the paperwork sitting in that cabinet, meaning on our servers or backups, is written in a code that only a specific key can decode. If someone breaks into the building and steals the cabinet, they walk away with pages of gibberish. 'Encryption in transit' is the same idea for paperwork that is being carried from one office to another, meaning data moving between your browser and our servers. The little padlock icon you see next to a website address means that trip is protected the same way: even if someone intercepts the envelope mid-delivery, they cannot read what is inside. In both cases the 'key' is just a digital code that locks and unlocks the data. We keep that key separate from the data itself and tightly restrict who can use it, the same way you would not tape the safe combination to the safe."

If they ask a follow-up like "so is our data safe no matter what," that is the moment to add the caveat below rather than let the analogy imply more than it should.

Trade-offs and pitfalls

• The locked-box analogy breaks down around key management: a real safe has one physical key, but a digital key can be copied, and who is allowed to use it (and how that is audited) matters as much as the encryption itself. If the stakeholder is making a security or compliance decision, that caveat has to come back in, even though it complicates the clean story.
• Oversimplifying to "it's encrypted so it's safe" can create false assurance. Encryption at rest does not protect data while an application has it decrypted in memory for processing, and encryption in transit does not protect against someone who is logged in as an authorized user misusing their access. Naming that boundary once, briefly, is worth the extra sentence.
• Dropping all technical vocabulary can cost credibility with a stakeholder who has picked up some of it (for example, someone who has heard the term TLS from a vendor). It is fine to mention the term once, defined in one plain clause ("TLS, the technology behind that browser padlock"), so the explanation still connects to language they may encounter elsewhere.

Scope & objectives

• I’d define goals (assess entry controls, receptionist procedures, badge tech, insider risk) and explicit out-of-scope items (no forced entry, no hardware destruction, no systems payloads).
• Deliverables: executive summary, technical findings, risk ratings, reproducible evidence, remediation roadmap.

Legal & approvals

• Obtain written Rules of Engagement (RoE) signed by Legal, Security, Facilities and a senior authorizing officer. RoE lists dates/times, allowed tools (test badges, RFID reader), stop-word, escalation contacts, insurance, privacy clauses, and liability limits.
• Get facilities approval for access to restricted areas for testers and an on-call facilities escort if required.

Non-destructive test design

• Controlled tailgating: scripted attempts during peak and off-peak hours using pre-approved testers in normal attire; an observer/reception witness records outcome.
• Badge-cloning reconnaissance: passive scanning to enumerate badge tech (NFC, prox) from public areas only; active cloning only if explicitly authorized and with inert test badges supplied by client.
• Recon limited to surface observations; no tampering with doors, locks, or CCTV.

Social-engineering constraints

• Pre-approved personas and scripts; no coerced or aggressive behavior; no attempts to obtain credentials via phishing or device planting unless separately authorized.
• Use of a “stop word” and immediate withdrawal if staff requests proof or identifies suspicion.

Safety & privacy

• Prohibit photography of private workstations, employee screens, or PII; if imagery required, redact or obtain written consent. Prioritize physical safety—no deception that could endanger staff.

Evidence & admissibility

• Collect time-stamped logs, signed witness statements, photos of public-facing controls (with redaction), tool output, and video only if pre-authorized. Maintain chain-of-custody: file hashes, centralized secure storage, and RoE-linked signatures.

Reporting & remediation

• Provide prioritized findings (Critical/High/Medium/Low), root cause analysis, reproducible steps, and mitigation tiers:
  • Process: enforce badge validation, tailgate-aware reception scripts, visitor escort policy.
  • Technical: upgrade to mutual authentication readers, anti-passback, alarms.
  • Training: targeted receptionist and employee awareness, testing cadence.
• Offer retest plan and executive briefing for leadership.

Direct answer
TCP's retransmission timeout (RTO) is computed from a smoothed estimate of round-trip time (SRTT) plus a term for how MUCH the round-trip time has been varying (RTTVAR), not from RTT alone, so the timer stays reasonably tight on a stable path and automatically widens on a noisy one.

Structured elaboration
The standard algorithm (RFC 6298) updates two running estimates on every new RTT sample:
$\text{RTTVAR} = (1-\beta)\cdot \text{RTTVAR} + \beta \cdot |\text{SRTT} - \text{RTT}_{\text{sample}}|$
$\text{SRTT} = (1-\alpha)\cdot \text{SRTT} + \alpha \cdot \text{RTT}_{\text{sample}}$
with the standard constants $\alpha = 1/8$ and $\beta = 1/4$. The retransmission timeout itself is then:
$\text{RTO} = \text{SRTT} + \max(\text{clock granularity}, 4 \cdot \text{RTTVAR})$
The intuition: if round-trip times are steady (RTTVAR is small), RTO sits close to the smoothed RTT, so genuine loss is detected quickly. If round-trip times are jittery (RTTVAR is large, common on congested or highly variable paths), RTO widens automatically, so ordinary jitter isn't mistaken for loss and doesn't trigger a storm of unnecessary retransmissions.

Retransmissions triggered purely by the RTO timer firing (as opposed to fast retransmit via duplicate ACKs) are treated as a MUCH stronger signal of serious congestion, since it means not even a single later segment's ACK arrived to trigger a duplicate-ACK-based fast retransmit; the response is to collapse all the way back to slow start, not the gentler fast-recovery halving.

Worked example
Suppose a connection's SRTT has settled around 50ms with RTTVAR around 10ms. RTO would be approximately $50 + 4\times10 = 90$ ms. If a burst of network jitter pushes several samples up to 120ms, RTTVAR grows to reflect that variability (say to 25ms), and RTO widens to roughly $70 + 4\times25 = 170$ ms (SRTT itself also shifts upward, more slowly, toward the new samples). This is why an environment full of many short-lived connections (each starting from scratch with no RTT history) behaves differently from one with few long-lived connections (which have had time to build a stable, well-calibrated SRTT/RTTVAR estimate): short-lived connections are stuck using a generic initial RTO (commonly 1 second per RFC 6298) until they've collected enough samples to calibrate, making them systematically slower to detect a REAL loss early in their life.

Trade-offs & pitfalls
A common mistake is assuming a single fixed RTO value would be simpler and just as effective; a fixed timeout either fires too eagerly on a naturally variable path (spurious retransmissions that waste bandwidth and can trigger unnecessary congestion-window collapses) or too slowly on a stable path (wasted time before a real loss is detected), the adaptive SRTT/RTTVAR scheme exists specifically to avoid both failure modes at once.

Situation / summary
As a penetration tester I evaluate both agent- and network-based scanning for large enterprises. Each has trade-offs across coverage, visibility, overhead, ephemeral resources, network impact, and agent security — I prefer a pragmatic hybrid strategy.

Coverage

• Agent-based: host-level depth (local configs, credentials, running processes, file-system, container images). Great for endpoints behind NAT or segmented environments.
• Network-based: good for perimeter, discovery of listening services, misconfigured network paths, and live ports. Misses host-only issues (local privilege escalation).

Administrative overhead

• Agents: deployment, versioning, configuration drift, consent/privilege management across OS/containers — heavier operational burden.
• Network scans: centralized scheduling, fewer endpoints to manage but require adequate network reach and permission windows.

Visibility into running processes

• Agents: can enumerate processes, loaded modules, kernel hooks — essential for detecting evasive malware or in-memory issues.
• Network: only infers services via ports/protocols; limited process-level insight.

Network load

• Agents: offload scanning work locally; minimal network chatter for results upload.
• Network scans: generate high-volume probes that can trigger IDS/IPS or impact production; must throttle and coordinate.

Ephemeral workloads (containers, serverless)

• Agents: require lightweight, immutable-image-friendly agents (or eBPF sidecars) or image-scanning pipelines; otherwise miss short-lived instances.
• Network: short-lived workloads may not appear during scan windows; use orchestration hooks and CI/CD pipeline scans.

Security & maintenance of agents

• Agents increase attack surface: credential storage, local privileges, update channels. Mitigations: least privilege, signing, centralized attestation, automatic patching, runtime integrity checks, allowlist communication, and regular pentests of the agent itself.

Recommendation
Use hybrid: agent-based for deep host/process-level findings and segmented/internal assets; network-based for discovery, segmentation testing, and low-touch environments. Automate agent deployment in CI/CD, integrate image scanning for ephemeral workloads, and enforce strict hardening and monitoring for agents.

Brief definitions

• Reverse shell: compromised host initiates an outbound connection to attacker listener; shell traffic runs over that session.
• Bind shell: compromised host opens/listens on a port and attacker connects in to issue commands.

How firewalls/NAT/egress filtering affect them

• Reverse shell: more likely to succeed across NAT/firewalls because most environments allow outbound TCP/UDP (HTTP/HTTPS). Egress filtering or strict proxying can block it or force use of allowed ports/protocols (e.g., 443 over TLS).
• Bind shell: blocked by host/network ingress restrictions, NAT without port forwarding makes direct inbound connections impossible; requires open ports or pivoting.

When to prefer each

• Reverse shell preferred: internal networks, machines behind NAT/firewalls, Windows endpoints with strict inbound rules — use when outbound is allowed. Example: using staged payload contacting attacker on 443/HTTPS.
• Bind shell practical: when you have direct network access (e.g., same LAN segment, cloud instance with public IP and misconfigured security group) and you want simpler setup without client-initiated callbacks.

Hardening & defensive signals

• Hardening: egress filtering, proxy enforcement, host-based firewall blocking unusual outbound ports, application allowlisting, and endpoint detection/response (EDR) rules.
• Detection signals: sudden outbound connections to rare IPs/ports, long-lived encrypted sessions from client to unfamiliar hosts, creation of listening processes on uncommon ports, new services, suspicious parent/child process chains (cmd/python spawning network sockets), abnormal netstat/tcpdump artifacts, IDS/IPS alerts for reverse-shell-like patterns.

I led assessments where reverse shells via HTTPS callbacks bypassed perimeter NAT; after remediation, egress proxying and EDR process lineage stopped those callbacks.

Situation: On a prior project, we uncovered a late dependency issue that would push a release by a few weeks.

Task: I needed to tell stakeholders early, explain the impact clearly, and keep trust intact.

Action: I didn’t wait until we had perfect data. I shared the risk as soon as the pattern was clear, framed it around business impact, and presented options rather than just the problem. I explained what was affected, what was still on track, and what we could do next: reduce scope, add temporary support, or adjust the release sequence. I also set a short update cadence so no one had to guess.

Result: The group made a quick decision on scope, leadership appreciated the early warning, and the conversation stayed focused on trade-offs instead of blame. The key was being direct, specific, and calm.

What I learned is that trust is protected by speed, honesty, and a recommendation. If I bring a risk with a clear path forward, stakeholders usually stay engaged instead of feeling surprised or managed around.

Approach (brief)
I map pen-test TTPs to MITRE ATT&CK by: enumerate actions during an engagement, assign ATT&CK tactic/technique IDs, list telemetry that would observe each action, propose concrete detection logic, and surface likely gaps so defenders can prioritize coverage.

Example: Credential Dumping (T1003)

• Telemetry sources: Windows Security/ Sysmon (ProcessCreate, ImageLoaded), LSASS memory dumps, Endpoint EDR process artifacts, PowerShell logs, Network SMB auths.
• Detection logic: alert on suspicious tools (procdump, Mimikatz) spawning from uncommon parents; high-frequency read access to lsass.exe memory; exports of lsass dump to network shares; anomalous use of comsvcs.dll or sekurlsa hooks. Correlate with privileged logins and process hashes.
• Common gaps: lack of process-memory monitoring, disabled Sysmon/ETW, no baseline for administrative tool usage, missed obfuscated/custom loaders.

Example: Lateral Movement (T1021 / T1076)

• Telemetry sources: Windows Event Logs (4624/4648), SMB/Remote Service logs, RDP logs, EDR process creation, network flow logs.
• Detection logic: alert on credentialed remote logons from workstation-to-server; non-standard admin tools used remotely (psexec, wmiexec); one host authenticating to many endpoints in short window; new service creation + remote command execution.
• Common gaps: limited east-west network visibility, missing authentication telemetry from legacy devices, deferred logging, lack of identity-transaction correlation.

Prioritize closing gaps that expose high-impact techniques first (credential access, lateral movement) by enabling Sysmon/EDR, collecting process memory events, centralizing auth logs, and tuning baselines.

Approach summary
I’d build a scoped, non-destructive test plan that exercises MFA paths (primary MFA, fallbacks, SSO/OAuth, recovery) in isolated environments and with instrumented test accounts in production only when absolutely allowed and monitored.

Test environments & accounts

• Prefer dedicated test/staging tenant mirroring production config (SMS providers, OAuth clients).
• Production: create labeled test accounts (admin and user roles) with consent in writing, feature flags, and opt-in phone/email addresses controlled by the test team (simulated SMS via provider sandbox or virtual numbers, dedicated email inboxes).
• Obtain written rules of engagement: allowed targets, time windows, escalation contacts, data retention and deletion, and legal sign-off.

MFA primary + fallback tests

• Backup codes: attempt reuse, brute-force resilience (rate limits), token format validation, and invalidation on use.
• SMS/email recovery: test interception scenarios using provider sandbox, simulate delivery delays, code reuse, and code predictability; verify one-time-use and expiry enforcement.
• Recovery workflows: perform account recovery flows end-to-end (support ticket, identity proofing) to find privilege escalation or bypasses; validate audit trails.

SSO / OAuth flows

• Test token exchange, redirect URI validation, state parameter enforcement, PKCE for public clients, refresh token rotation, and session fixation. Attempt token replay and misuse of OAuth client credentials in a controlled lab.

Social-engineering vectors

• Conduct controlled phishing/smishing during engagement with pre-approved templates and targets (test accounts or consenting staff). Use double opt-in and observer witnesses for live calls. Evaluate fallback acceptance of social proofs (security questions, knowledge-based) and staff escalation behavior.

Safety, privacy & validation

• Never use real user accounts or PII. Use synthetic or consenting test users. Log all actions centrally; notify ops and monitoring to avoid false incidents. After tests, produce reproducible PoC steps and remediation suggestions. Provide metrics: time-to-bypass, rate-limit gaps, recovery success rate, and residual risks.

Deliverables

• Executive summary, technical findings with PoCs, risk ratings, remediation roadmap, and retest plan.