nVisium interview question

How would you approach pen testing an app?