What type of hands on tests should I expect in a interview for a entry level penetration tester?
And what do examiners expect a candidate to accomplish (i.e. full compromise)?
The reason I ask is that I went for a pen test interview and I was given a 4 hour exam. I was not presented with any guidelines or expectations. The test consisted of looking at ip-pbx log files for the given scenario:
We have been approached by a customer who has been advised by their telecoms provider that a large amount of phone fraud (for clarity, this is where the phone line has been used to generate large call costs to the client such as premium rate or international calls) has been conducted on their company phone line.
The phone system utilises a Shoretel Voice over IP (VoIP) gateway. From internal investigation by the client, it would appear that the fraud was conducted between the 30th December 2011 to 6th January 2012.
Our task is to conduct a technical review of the logs supplied by the client with an aim to:
Identify how this fraud was conducted. Identify the source of the fraud (external or internal).
You will have until 13:00 to submit your report which should contain an executive summary of your findings and a technical section outlining your finding at a technical level.
You can find the log files here.
I did not have a clue what to do, at least not with pbx and these types of log files.
Is this type of exam common for entry level pen testing positions?
I thought the log analysis for this given scenario was more geared towards forensics and incident response (which wasn’t outlined in the job advertisement) am I wrong?
When it was sent suddenly my career aspirations quickly fizzled into a cold chill, my immediate thought was, O NO... NOT LOG FILES! I can’t imagine anything more soul destroying than this.
If the answer to the question seems subjective then at least this may help serve other graduates in their quest.