One question which caught me off guard was to give an example of an SQL Injection command i used to penetrate a website. I was not prepared for the question and simply told them at this time off the top of my head i can not answer the question. They said that was no problem and they do not usually ask those sort of questions but that one of the interviewers happens to work in the penetration testing section of ERS and was curious.
