Assessment Methodologies
Engagement framing
Methodology questions test whether you understand the business and legal wrapper around technical work. Before any packet is sent, scope, rules of engagement, testing windows, authorized targets, and escalation contacts must be agreed in writing. Distinguish black-box (no prior knowledge), gray-box (partial credentials or documentation), and white-box (full disclosure) assessments. A penetration test simulates an adversary and usually includes exploitation; a vulnerability assessment enumerates and ranks weaknesses without proving impact.
Phases and frameworks
Know the broad phases shared by PTES, OWASP, and OSSTMM-style approaches: intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting. Passive reconnaissance uses public sources such as DNS records, certificate transparency, search engines, and WHOIS without touching the target; active reconnaissance sends traffic directly and is more detectable. Enumeration of people, technologies, and third parties belongs to OSINT and often shapes later attack paths.
Traps candidates hit
Questions often confuse risk with a raw CVSS score: risk combines likelihood and business impact, so a critical CVSS finding on an isolated lab host may be low business risk. Another common trap is treating out-of-scope hosts as fair game because they are reachable. Report writing is also examined: findings need a clear title, affected asset, reproduction steps, evidence, impact, and remediation. Do not describe scanning tools as exploitation tools, and do not call a compliance audit a penetration test.
Rule of thumb
When unsure whether an action is allowed, stop and check the rules of engagement. Start passive, escalate to active only within the agreed scope, and document every deviation. A finding without reproducible evidence is an opinion, not a result.