Junior Penetration Tester Interview Preparation Guide - FAANG Standard

Direct answer

Start by scoping the problem precisely enough that ownership boundaries become visible, then build a coalition of every team whose work the fix touches rather than waiting for someone to volunteer ownership. Secure a sponsor with authority spanning those teams who can prioritize the fix against each team's other work, and sequence the remediation so early, low-risk wins buy the credibility needed to sustain a multi-month effort.

Structured elaboration

1. Scope with evidence. Document the pattern concretely enough, which systems or teams are affected and how you know, that it reads as a shared problem rather than one team's incident. Vague framing invites everyone to assume it is someone else's issue.
2. Coalition, not delegation. Identify every team whose systems or processes need to change and bring them into a kickoff where they see the evidence directly, rather than hearing about it secondhand from you.
3. Sponsorship. Find someone with authority spanning all the affected teams who can prioritize the fix against each team's existing roadmap. Without this, the effort re-competes for attention every sprint and eventually loses.
4. Phased roadmap. Ship interim mitigations that reduce risk within days to weeks, while the durable fix is designed and rolled out over the following weeks to months. The organization should not be fully exposed while waiting for the complete fix.
5. Communication rhythm. A lightweight, regular update, what is done, what is blocked, what is next, keeps the effort visible to the sponsor and affected teams over a multi-month timeline, instead of fading once the initial urgency wears off.
6. Closure and verification. Define what "done" looks like before you start, and verify it at the end. A systemic fix without a defined closure condition tends to drift indefinitely.

Worked example

Suppose the systemic problem is a class of vulnerability that recurs across several services owned by different teams (the same shape applies to a systemic reliability gap or an accessibility gap spanning many product surfaces). Six teams share the affected pattern. A kickoff is scheduled within the first week so all six see the evidence together. A low-risk compensating control is rolled out across all six teams within the first two weeks, buying time while the durable fix, a shared library or pattern change, is designed and rolled out over roughly two months. Progress is reported every two weeks to the sponsoring lead and the six teams. The effort closes only once every team has migrated to the durable fix and the compensating control has been verified safe to remove.

Trade-offs & pitfalls

• Trying to fix it yourself across every team's codebase does not scale past a handful of teams and burns out the person carrying it.
• Skipping interim mitigation and going straight for the durable fix leaves the organization exposed to the systemic risk for the entire multi-month build, a costly bet if anything slips.
• Junior candidates tend to focus on getting the technical fix right. Senior candidates weight the coalition and sponsorship just as heavily, because a correct fix with no organizational backing stalls the moment it competes with someone's sprint commitments.
• Not defining "done" is a common pitfall: an effort with no closure condition can run indefinitely, consuming goodwill and losing the sponsor's attention long before every team has actually migrated.

Explain SQL Injection & variants (Penetration Tester perspective)

SQL Injection (SQLi) is when unsanitized input is incorporated into SQL queries, letting an attacker modify query logic to read/modify data or escalate access. I look for inputs used in SQL contexts (form fields, URL params, headers, cookies, JSON).

Error-based

• Typical points: search boxes, ID params, filters that display DB errors.
• Manual safe test: submit a quote to provoke DB error and observe response.

' OR 1=1; --

If the app returns SQL error details or extra rows, it’s likely error-based SQLi.

Union-based

• Typical points: list pages, pagination, category IDs where results are directly concatenated.
• Manual safe test: try UNION to enumerate columns/types.

1 UNION SELECT NULL,NULL-- 

If additional content appears (e.g., DB values), UNION injection is possible.

Boolean blind

• Typical points: login forms, filtered results that return same page regardless of data.
• Manual safe test: toggle condition to true/false and compare responses.

' AND 1=1-- 
' AND 1=2-- 

Different responses (content length, element presence) indicate boolean blind SQLi.

Time-based

• Typical points: API endpoints, AJAX calls, parameters that don’t return DB errors.
• Manual safe test: induce delay and observe response time.

' OR IF(1=1, SLEEP(5), 0)-- 

A consistent delay confirms time-based blind SQLi.

For all tests I use non-destructive payloads, low frequency, and get written authorization. Recommend remediation: parameterized queries, input validation, least privilege DB accounts, and proper error handling/logging.

I’d design the cadence around what leadership actually needs: trend, risk, and decisions: not daily implementation detail.

Format:

• A short weekly summary email or doc
• A simple status signal: green / yellow / red
• Three bullets on progress, risks, and next steps
• A clear section for decisions or help needed

How I keep it lightweight:
I’d pull from a team-owned dashboard or a brief async update, so I’m not creating extra reporting work. If the project is moving quickly, I’d report changes at the theme level: what moved materially since last week, what risks increased or decreased, and whether delivery confidence changed.

Worked example
For instance, in a week where a checkout-redesign initiative is underway, the summary might read: "Theme: payments migration. Status: green, holding steady. This week: data migration for the new payment provider completed and passed validation, one day ahead of plan. Risk: the fraud-model retraining depends on two weeks of live traffic on the new UI, which pushes that milestone to the 24th; this was already reflected in the plan so confidence is unchanged. Decision needed: none this week." That's specific enough for leadership to see real progress without a blow-by-blow of daily standups.

What leadership gets:

• Are we on track?
• What changed?
• What decisions or support are needed?

What the team avoids:

• Daily status meetings just for reporting
• Rewriting the same information in multiple places

That balance keeps executives informed while protecting the team’s execution time.

Approach overview
I’d design a hybrid, API-driven assessment pipeline that combines exhaustive automated checks for high-risk accounts with statistically sampled scans elsewhere, plus focused manual pentest verification for lateral-movement paths.

Tooling & automation

• API-based enumeration: AWS IAM, STS, Organizations, CloudTrail, Config APIs to list roles, policies, trust policies, last-used timestamps.
• Static policy analysis: parse JSON policies to build allow graphs (principal -> action/resource) and detect wildcards, iam:PassRole, sts:AssumeRole with conditions.
• Orchestration: serverless workers (Lambda/Fargate) triggered from a central queue to scale across thousands of accounts.
• Storage: graph DB (Neo4j) to model principals, roles, resources, and trust edges.

Sampling vs exhaustive

• Exhaustive for org root, prod, shared services, accounts with critical resources or recent suspicious events.
• Stratified random sampling for dev/test accounts using risk strata (business criticality, exposure).
• Continuous light-touch scans (nightly) and heavy scans on schedule or trigger.

Entitlement risk scoring

• Score factors: privilege breadth (number of allowed actions), sensitive actions (iam:PassRole, sts:AssumeRole, kms:Decrypt), resource scope (wildcards), last-used age, cross-account trust, network exposure.
• Weighted composite score (0–100) stored per role; thresholds drive automated remediation tickets.

Automated assertions / alerts

• Policy rules that fail build assertions: "deny iam:PassRole to wildcard principals", "no inline policies with AdminAccess", "trust policy allows AssumeRole for * without conditions".
• Auto-create findings in ticketing/SIEM; optionally automatically disable or add MFA/require approval for top-risk roles.

Assessing lateral movement potential

• Build attack paths in graph DB: edges = assume-role, pass-role, allowed actions (ec2:StartInstances, lambda:Invoke), resource ownership.
• Simulate chained privileges (BFS up to N hops) to find paths from low-privileged principal to high-value principals/resources.
• Validate high-risk paths via controlled exploitation in a sandbox account: attempt AssumeRole chains, PassRole to service principals, abuse of trust policies, and credential/refresh token abuse.
• Report exploitability, required conditions, and mitigations (least privilege, condition on aws:SourceArn, require external ID, remove unnecessary trust).

Why this works
Scales via API and serverless workers, reduces noise via scoring and sampling, and provides actionable attack-path evidence for remediation validated by manual pentesting.

Scope & assumptions

• Authorized engagement with written scope. Target: config repo accessible by a non-privileged service, microservices using HMAC-signed JWTs, backend DBs reachable from service network.

Recon / discovery

• Enumerate repo locations (k8s secrets, mounted volumes, config repo URLs, CI/CD artifacts).
• Search for predictable filenames/keys (app-config, secrets.yml, JWT_SECRET, HMAC_KEY) via repository browsing, container images, CI logs, or service account access.
• Confirm key material format/length and which service(s) use it by inspecting code/config that constructs/verifies JWTs.

Attack chain (high-level, non-actionable)

1. Obtain secret: read config entry (e.g., via misconfigured mount, CI artifact, or permission escalation).
2. Forge token: craft JWT with admin claims and sign using HMAC secret to produce valid signature accepted by services.
3. Access admin endpoints: present forged token to management APIs/microservices to retrieve credentials, API keys, or create privileged sessions.
4. Lateral movement: use admin API to provision service accounts, create new tokens, or add SSH keys to reach internal hosts.
5. Pivot to DB: use service-to-database credentials or provisioned account to connect to backend DBs and exfiltrate or modify data.

Detection signals

• Unusual token issuances: tokens signed with same key but with atypical claims or unusual iat/exp.
• Sudden administrative API calls from unexpected hosts or service accounts.
• New service accounts, changed RBAC bindings, or unexpected cron/CI jobs.
• Database access outside normal service patterns, anomalous queries, or large exports.

Mitigations & hardening

• Remove long-lived HMAC secrets from repos; use per-service short-lived keys via KMS/secret manager.
• Enforce least privilege for repo and service accounts; audit repo access and CI logs.
• Use asymmetric signatures (RS256) so verification keys are public and signing keys are stored in protected vaults.
• Rotate keys frequently and enable key identifier (kid) checks and key rollover policies.
• Implement token issuance controls: audience (aud), issuer (iss), scope validation, strict claim validation, and short expiry.
• Monitor: alert on unusual admin API usage, token anomalies, and new credential issuance; log signed JWT metadata and verification failures.
• Network segmentation: restrict service network egress to limit pivoting; enforce DB firewall/allowlists and MFA for privileged DB access.

Ethical note: perform these steps only under authorized testing with scope and reporting; include remediation guidance and retest after fixes.

Stepwise approach (overview)

1. Triage scanner output to unique findings (IP/hostname, port, service, vuln ID).
2. Gather evidence from the host to confirm: service banners, configs, package manager, process info, and source references.
3. Map version -> component -> fix and produce an actionable remediation.

Concrete actions & examples

• Validate service banner and process:
  • Run:

# TCP banner + process
nc -v <host> <port>
ssh user@host 'ps aux | grep <service>'

• Use banner text to pin vendor/version (e.g., "nginx/1.14.0").
• Check OS/package metadata:

# Debian/Ubuntu
ssh host 'cat /etc/os-release; dpkg -l | grep nginx'
# RHEL/CentOS
ssh host 'rpm -qa | grep httpd'

• Inspect config files to confirm affected module/feature:

ssh host 'grep -R "ssl_protocols" /etc/nginx*'

• For apps, check dependency manifests:

# Node
cat package.json | jq '.dependencies'
# Java
grep -R "<version>" pom.xml

• Correlate with source/repo references: git commit, Dockerfile, container image tags to find exact deployed artifact.

Mapping to remediation

• If package manager shows vulnerable version -> recommend upgrade + test plan (apt/yum update, pinned versions).
• If custom build/source uses vulnerable library -> update dependency, run CI tests, rebuild images, redeploy.
• If misconfiguration exposes vulnerability -> change config, restart service, validate.
• Provide reproducer steps, evidence (screenshots, command outputs), CVE link, and risk/priority.

Why this works
Combining passive scanner evidence with authoritative artifacts (banners, package metadata, configs, source) reduces false positives and yields precise, actionable remediation steps the ops/dev teams can implement.

Direct answer

Structure it as an evidence led case, not a request for a favor. Open by naming the specific ask, promotion, a stretch assignment, or dedicated time and budget, back it with three or four concrete instances of impact and readiness, and pre-empt the most likely objection with a fallback. The conversation should feel like two people already broadly aligned on the goal, working out timeline and specifics, not a persuasion contest.

Structured elaboration

Open with the ask itself. Name what you want as your first sentence, not your last. Ambiguity in the open lets the conversation get steered before you've made your case.

Bring evidence, not adjectives. Two to four concrete instances where you already operated at the level you're asking for, a project led beyond formal scope, a decision others now rely on, a skill built and applied. Evidence should be specific enough that your manager could describe it to their manager without you in the room.

Anticipate the likely objections. There's no open role at that level, the timing is wrong for budget, you need more evidence in one area. A prepared response isn't a rebuttal, it's a next step, what would close the gap and by when.

Bring a fallback. If the primary ask can't be granted in full, have a smaller alternative ready, an interim scope change, a defined stretch project with a review date, or a partial commitment such as title now and a compensation review next quarter. Arriving with only one possible outcome makes it binary and easy to defer.

Close with a mechanism. Propose a specific follow up date and what would need to be true by then for the answer to change.

Worked example

"I asked for time on my manager's calendar and opened directly, saying I wanted to talk about taking the stretch assignment leading the migration project and what that meant for my scope going forward. I brought three examples where I'd already operated at that level informally, a cross team escalation I'd resolved without waiting for my manager, a proposal the team had adopted, and feedback from a peer who said they now came to me first on a certain class of problem. My manager's first response was that the team couldn't spare me from current work. I'd anticipated that and offered a fallback, take the assignment for the first phase only with a defined handoff point, so my current responsibilities weren't left uncovered. We agreed to that scope, with a check in scheduled for the midpoint to decide whether to extend it."

Trade-offs & pitfalls

• Leading with feelings instead of evidence invites the manager to respond to the emotion rather than the case.
• Bringing only one possible outcome, with no fallback, turns the conversation into a yes or no vote you can lose outright.
• Overloading the evidence list dilutes it. Two or three strong, specific instances beat six vague ones.
• Skipping the close is the most common gap. A conversation that ends without an agreed next step tends to quietly disappear from both people's priorities.

Direct answer
TCP is connection-oriented and guarantees reliable, in-order delivery with built-in flow and congestion control, at the cost of handshake setup latency and head-of-line blocking; UDP is connectionless, with no delivery guarantees, ordering, or congestion control, trading reliability for minimal overhead and lower latency. The right choice depends on whether the application can tolerate loss and reordering itself, or needs the transport layer to handle it.

Structured elaboration

Two examples per protocol: TCP is the right choice for a database connection or a file transfer, where losing or reordering even one byte silently would corrupt the result, and the application has no interest in reimplementing reliability itself. UDP is the right choice for live video/voice calls or DNS queries, where a single lost or late packet is better DISCARDED and moved past (an old, out-of-order audio frame is useless once its playback moment has passed) than retransmitted at the cost of added latency that would make the whole stream feel laggy.

Worked example
A scenario where building custom reliability ON TOP of UDP beats plain TCP: a real-time multiplayer game sending frequent position updates. TCP's strict in-order delivery means a single lost packet blocks EVERY later packet from being delivered to the application until the lost one is retransmitted and received (head-of-line blocking), even if those later packets contain fresher, more relevant position data. Building a thin reliability layer over UDP lets the application decide per-message whether it's worth retransmitting (a player's current position, three updates old, usually isn't worth retransmitting, a newer update has probably already superseded it) rather than being forced into strict in-order delivery for data where "newest wins" matters more than "nothing lost."

Trade-offs & pitfalls
A common mistake is treating "TCP is reliable, UDP isn't" as the END of the analysis; the real question is whether your application's OWN definition of correctness matches TCP's specific guarantees (strict ordering, full reliability) or would be better served by a custom scheme that's more permissive in exactly the ways TCP is rigid. Building your own reliability on UDP is real engineering work (implementing retransmission, sequencing, and congestion awareness yourself), not a shortcut, it's justified specifically when TCP's guarantees don't match what the application actually needs.

Direct answer

GROW is a four-stage, question-led coaching structure: Goal (what success looks like), Reality (the current state), Options (possible paths forward), and Way forward (specific commitments). Applied to a 1:1 with someone who wants to grow a specific skill, it turns a vague aspiration into a concrete next step, and the same question-led habit also works inside a work review, not only a scheduled conversation.

Walking through the four stages

• Goal. Get specific: "What would 'better at this' actually look like, concretely, and how would you know it happened?"
• Reality. Surface the current state without judgment: "Tell me about a recent situation where this was hard, what made it hard?"
• Options. Generate paths rather than prescribing one: "What could you try next, and who or what could help?"
• Way forward. Get a specific, small commitment: "Which one thing will you actually do before we talk again, and what support do you need from me?"

Socratic questioning is the companion technique that runs through all four stages: instead of stating the answer, ask a question that leads the person to notice the gap themselves ("what did you expect to happen there, versus what actually happened?"). It works well when there's time to let someone arrive at the insight; it works poorly when someone is genuinely blocked and just needs the direct answer.

Extending this into reviewing someone's work

The same question-led approach makes a review of someone's work (code, a document, a design, an analysis) constructive rather than purely corrective. Concrete techniques: a review template that separates "must fix" from "worth considering" from "just for your awareness," so feedback doesn't read as one undifferentiated pile of criticism; annotated examples that show a better version alongside the original with a short reason, not just a comment naming the problem; and a Socratic question left in the review itself ("what happens here if this is empty?") instead of stating the bug outright, when the goal is teaching and there's no urgency forcing a direct fix.

Worked example

In a 1:1, a mentee said they wanted to get better at making structural decisions independently instead of always checking first. Goal: they described what "independent" would look like in practice (making a defined class of calls without asking). Reality: walking through a recent case, they could explain their reasoning but hadn't trusted it enough to act without confirmation. Options: they proposed trying it on a low-stakes decision first and reviewing the reasoning after the fact rather than before. Way forward: they committed to making the next reversible decision on their own and bringing the reasoning to the following session, with an explicit offer of support if it went wrong.

Trade-offs and pitfalls

A common mistake is treating GROW as a rigid script and marching through all four stages regardless of what the person actually needs that day. A stronger approach holds the structure loosely: skip Reality if it's already obvious, compress stages under time pressure, and know when the moment calls for direct answers instead of more questions, especially if something is safety-critical or urgent. Inside reviews specifically, overusing Socratic questions when someone is genuinely stuck can read as withholding rather than teaching, so it's worth pairing questions with a clear direct answer once the teaching moment has been made.

Approach (brief)
I map pen-test TTPs to MITRE ATT&CK by: enumerate actions during an engagement, assign ATT&CK tactic/technique IDs, list telemetry that would observe each action, propose concrete detection logic, and surface likely gaps so defenders can prioritize coverage.

Example: Credential Dumping (T1003)

• Telemetry sources: Windows Security/ Sysmon (ProcessCreate, ImageLoaded), LSASS memory dumps, Endpoint EDR process artifacts, PowerShell logs, Network SMB auths.
• Detection logic: alert on suspicious tools (procdump, Mimikatz) spawning from uncommon parents; high-frequency read access to lsass.exe memory; exports of lsass dump to network shares; anomalous use of comsvcs.dll or sekurlsa hooks. Correlate with privileged logins and process hashes.
• Common gaps: lack of process-memory monitoring, disabled Sysmon/ETW, no baseline for administrative tool usage, missed obfuscated/custom loaders.

Example: Lateral Movement (T1021 / T1076)

• Telemetry sources: Windows Event Logs (4624/4648), SMB/Remote Service logs, RDP logs, EDR process creation, network flow logs.
• Detection logic: alert on credentialed remote logons from workstation-to-server; non-standard admin tools used remotely (psexec, wmiexec); one host authenticating to many endpoints in short window; new service creation + remote command execution.
• Common gaps: limited east-west network visibility, missing authentication telemetry from legacy devices, deferred logging, lack of identity-transaction correlation.

Prioritize closing gaps that expose high-impact techniques first (credential access, lateral movement) by enabling Sysmon/EDR, collecting process memory events, centralizing auth logs, and tuning baselines.