Most interview prep lists give you answers you can recite. Reciting is exactly what gets you caught, because the follow-up question is always “have you actually done that?”
These 50 are the questions that come up, grouped by what they test, with answers written the way a working tester would give them. Where a question is better answered by doing it than by reading it, there is a lab link.
Fundamentals and methodology (1 to 8)
1. What is the difference between vulnerability assessment and penetration testing?
Assessment finds and catalogues weaknesses across a broad surface, mostly automated, producing a ranked list with no proof. Testing exploits a narrow subset manually to prove real impact. Assessment measures attack surface; testing measures actual exposure.
2. Walk me through the phases of an engagement.
Scoping and authorisation, reconnaissance and enumeration, vulnerability assessment, exploitation, post-exploitation and lateral movement, reporting, retest.
Mention authorisation first. Interviewers notice when a candidate skips it, because testing outside an agreed scope is a criminal matter in India under the IT Act regardless of intent.
3. Black box, grey box or white box, and which would you recommend?
Black box means no prior knowledge, realistic but time goes to discovery instead of depth. Grey box means partial knowledge, usually a normal user account, and it is the most common commercial choice because it simulates an attacker who already has a foothold. White box gives full access including source, and delivers the best coverage per rupee. Most clients avoid white box because it feels like cheating, which is a bad reason.
4. How do you scope an engagement?
Assets in scope, assets explicitly out with reasons, testing window, rules of engagement, escalation contacts, whether DoS and social engineering are permitted, and what happens if you find something critical mid-test. Get it in writing.
5. You have 400 scanner findings and three days. What do you do?
Triage by exploitability and business impact, not CVSS order. Confirm the ones that would actually matter. Between 30% and 60% of raw scanner output is noise depending on tool and environment, and the skill being tested here is knowing that.
6. What methodologies do you follow?
Name real ones. OWASP WSTG for web, OWASP MASTG for mobile, PTES for engagement structure, NIST SP 800-115. “Industry standard methodology” is a non-answer and auditors reject reports that say it.
7. How do you rate severity?
CVSS as a baseline, adjusted for business context, with the reasoning stated. A stored XSS in an internal panel used by four people and one in a customer checkout can score identically and carry wildly different risk. A pasted score with no context is the mark of an automated report.
8. What is the difference between a threat, a vulnerability and a risk?
A vulnerability is a weakness. A threat is an actor or event that could exploit it. Risk is the combination weighted by likelihood and impact. Interviewers ask this to check whether you can talk to a GRC team, not to test vocabulary.
Networking and reconnaissance (9 to 16)
9. Explain the TCP three-way handshake and why it matters to you.
SYN, SYN-ACK, ACK. It matters because scan types depend on it. A SYN scan never completes the handshake, which is why it is quieter and faster than a connect scan.
10. Difference between a SYN scan and a connect scan?
SYN sends SYN, reads the response, sends RST. Connect completes the full handshake through the OS socket API. SYN needs raw socket privileges; connect does not but is logged by the application.
11. How do you enumerate a host you know nothing about?
Full port sweep first, then targeted service and version detection on what is open, then protocol-specific enumeration. The mistake juniors make is running one aggressive scan across all 65535 ports with scripts enabled and waiting forty minutes for output they then do not read.
12. What is the difference between TCP and UDP scanning, and why is UDP harder?
TCP gives you a handshake to reason about. UDP is connectionless, so closed ports produce ICMP unreachable and open ports often produce nothing at all. Absence of response is ambiguous, which makes UDP scanning slow and unreliable.
13. How do you do subdomain enumeration?
Passive first through certificate transparency logs and public datasets, then active brute forcing with a good wordlist, then permutation of what you found. Resolve everything and probe for live HTTP services. The interesting asset is almost always the one nobody remembered owning.
14. What is DNS zone transfer and is it still relevant?
AXFR requests a full copy of a zone from a nameserver. Rare now but still found on internal and legacy infrastructure, and when it works it hands you the entire internal namespace. Always worth two minutes.
15. How would you identify the technology stack of a target?
Response headers, cookie names, error page fingerprints, static asset paths, favicon hashes, JavaScript bundle contents, and framework-specific default routes.
16. What is OSINT and how does it fit into a VAPT engagement?
Open source intelligence: employee names for username formats, breached credentials for password spraying, exposed documents with metadata, code repositories with hardcoded secrets, and infrastructure disclosed in job listings. It is the phase that determines how good your access phase will be.
Web application (17 to 28)
17. How do you test for SQL injection manually?
Inject a single quote and watch for errors or behaviour change. Then test boolean conditions that should differ, then time-based payloads where there is no visible output. Confirm manually before automating; running sqlmap at everything first is how people miss the injection that needed a custom parameter.
→ Practise on the web challenges before you answer this in a room.
18. What are the types of SQL injection?
In-band including error-based and union-based, blind including boolean-based and time-based, and out-of-band using DNS or HTTP callbacks where nothing comes back in the response.
19. Explain the three types of XSS.
Reflected returns in the immediate response. Stored persists server-side and fires for every user who views the content. DOM-based never reaches the server, because the flaw is a source flowing into a dangerous sink in client-side JavaScript.
20. Why is DOM-based XSS missed most often?
Because if the payload sits in the URL fragment it never leaves the browser. Server logs are clean, proxy history is clean, and scanners that rely on server responses find nothing. You have to read the JavaScript and trace sources into sinks.
21. Why does context matter more than payload in XSS?
The same input landing in an HTML body, an attribute value, an existing script block or a URL attribute requires four different payload shapes. Testers who fire one generic payload and move on report “not vulnerable” on applications that are.
22. How would you find broken access control?
Two accounts. Capture a request as user A, replay it as user B with A’s object identifiers. Test horizontal and vertical movement. Check whether the control is enforced server-side or only hidden in the UI, because hiding a button is not access control.
23. What is CSRF and what actually stops it?
CSRF makes an authenticated user’s browser perform an action they did not intend. Synchroniser tokens tied to the session stop it. SameSite cookie attributes remove the primary delivery mechanism for many variants. Checking the Referer header is not a defence.
24. Explain SSRF and why it is often critical.
The application makes an HTTP request to a destination you control. Because it originates server-side it reaches internal systems you cannot. In cloud environments it frequently escalates to instance credential theft through the metadata service, which is what turns a medium finding into a critical one.
25. How do you bypass an SSRF filter?
Alternative IP encodings, a DNS record you control pointing at an internal address, redirect chains from an allowed host, DNS rebinding between validation and request, alternative URL schemes, IPv6 equivalents. Blocklists lose to this list; allowlisting resolved IPs is the fix.
26. What is file upload vulnerability testing?
Extension and content-type validation bypasses, double extensions, null bytes on older stacks, magic byte spoofing, path traversal in the filename, and whether the upload directory is web-accessible and executable. The last one decides whether it is a medium or a critical.
27. How do you approach a login page?
Username enumeration through response differences and timing, credential stuffing viability, rate limiting on both password and OTP separately, lockout behaviour and whether it enables denial of service, the password reset flow, session handling after login, and token validation.
28. What is IDOR and how does it differ from broken access control?
IDOR is a specific case of broken access control where a direct object reference such as a numeric ID can be changed to access another object. All IDOR is broken access control; not all broken access control is IDOR.
API security (29 to 33)
29. How does API testing differ from web application testing?
No UI to guide discovery, so documentation and captured traffic drive it. Authorisation flaws dominate over injection. Rate limiting and mass assignment matter more. Business logic is harder to infer without a front end telling you what the workflow is supposed to be.
30. What is BOLA and why is it the top API risk?
Broken object level authorisation. The API confirms you are authenticated but not that the object you requested belongs to you. It is number one because APIs expose object identifiers directly and developers assume clients will not modify them.
31. What is mass assignment?
The API binds a request body directly to an internal object, so adding a field the client should not control, such as a role or verification flag, gets written. Test by adding plausible privileged fields to a normal update request.
32. How do you test JWT implementations?
Algorithm confusion where RS256 is switched to HS256 using the public key as the HMAC secret, the none algorithm, weak signing secrets, kid header injection, jwk header abuse, missing expiry validation, and whether the signature is verified at all on every endpoint rather than just the first.
33. What would you check on a GraphQL endpoint?
Introspection enabled in production, query depth and complexity limits, batching abuse for brute forcing, authorisation enforced per-resolver rather than per-endpoint, and field-level data exposure.
Active Directory and Windows (34 to 40)
34. You have a shell on a domain-joined Windows host. What now?
Current user privileges and group membership, cached credentials, domain enumeration for attack paths, Kerberoastable service accounts, AS-REP roastable users, ACL-based escalation paths. Enumerate thoroughly before doing anything noisy.
35. What is Kerberoasting in one sentence?
Requesting a service ticket for an account with an SPN, then cracking it offline, because the ticket is encrypted with a key derived from that service account’s password.
36. What is AS-REP roasting and how does it differ?
It targets accounts with Kerberos pre-authentication disabled. You request authentication data and crack it offline. Kerberoasting needs domain credentials; AS-REP roasting only needs a valid username.
37. What is DCSync?
Abusing replication rights to request password data from a domain controller as if you were another DC. Requires specific directory replication permissions, which is why auditing who holds them matters.
38. Explain the difference between a Golden and a Silver ticket.
Golden forges a TGT using the krbtgt account hash, giving domain-wide access. Silver forges a service ticket using a specific service account hash, giving access to that one service. Golden is broader; silver is quieter.
39. What is the difference between vertical and horizontal privilege escalation?
Vertical moves to a higher privilege level. Horizontal moves to another account at the same level. Horizontal is frequently the more damaging finding in multi-tenant applications, and it is the one that gets under-rated in reports.
40. How do you pivot into an internal network?
Port forwarding or a SOCKS proxy through the compromised host, then routing tooling through it. Interviewers ask this specifically to find out whether you have done it or only read about it, so be ready for the follow-up about what broke.
Linux and privilege escalation (41 to 44)
41. Where do you look first for Linux privilege escalation?
Sudo rights, SUID and SGID binaries, cron jobs and their script permissions, writable paths in PATH, kernel version as a last resort, capabilities, and credentials in configuration files and history.
42. Why is kernel exploitation usually the last option?
It is unstable, it can crash production, and in a real engagement crashing a client system is a serious incident. Misconfiguration paths are safer, quieter and more common.
43. What is a SUID binary and why does it matter?
It executes with the file owner’s privileges rather than the caller’s. A SUID binary owned by root that can be made to execute arbitrary commands, read arbitrary files or write to protected paths is a direct escalation path.
44. How would you establish persistence on a Linux host, and should you?
Technically: cron, systemd units, SSH keys, shell profile files, modified binaries. Practically: only if persistence is explicitly in scope and agreed in the rules of engagement, and you document and remove everything. Answering this question without mentioning scope is a red flag to a good interviewer.
Cloud (45 to 47)
45. What would you check first in an AWS environment?
IAM policies for wildcards and over-permissive grants, publicly exposed storage, metadata service accessibility from application hosts, whether logging is enabled and centralised, and unencrypted snapshots.
46. Why is the instance metadata service a security concern?
It serves instance credentials to anything that can reach it from the host. Combined with SSRF in an application on that host, it converts a web bug into cloud account access. Session-based access controls on the metadata service are the mitigation.
47. What is the shared responsibility model and why does it matter in testing?
The provider secures the infrastructure; the customer secures configuration, identity and data. It matters because it defines what is in scope. Testing the provider’s infrastructure is usually prohibited; testing your client’s configuration of it is the engagement.
Reporting and judgement (48 to 50)
These three separate candidates more than everything above, and almost nobody prepares for them.
48. Explain SQL injection to a CFO in thirty seconds.
The question most candidates fumble. Answer in business terms: what data is exposed, how many records, what the regulatory consequence is, roughly what it costs to fix. No jargon, no acronyms, no mention of a single quote.
49. You find nothing in a week. What do you tell the client?
That you found nothing, with a clear account of what was tested, what was not, and what the limitations were. Inventing findings or inflating severity to justify a fee is the fastest way to lose a client permanently, and interviewers ask this to check your honesty instinct.
50. You accidentally cause an outage during testing. What now?
Stop. Notify the client contact immediately. Document exactly what was sent and when. Assist with recovery. Then include it in the report. This question is not technical and it is often the one that decides the hire.
How to actually prepare
Reading this list twice will not get you through an interview. The follow-up question to every technical answer above is some version of “walk me through a time you did that”, and there is no way to fake it.
The sequence that works:
- Do each one in a lab. Not read about it. Do it, fail at it, and do it again. Every question in the web, AD and Linux sections above maps to something you can break on Hacklido for free.
- Write up three of them properly. Full findings with reproduction steps, impact and remediation. This doubles as portfolio material and as answer practice.
- Practise the last three questions out loud. Explaining a vulnerability in business language is a separate skill from finding it, and it is the one that decides seniority.
- Prepare your own questions. What is the split between compliance testing and research? How many person-days does an engagement get? Who reviews reports before they reach the client? Asking these marks you as someone who has thought about the job rather than the exam.
Found a question here we got wrong, or one that came up in your interview that is missing? Reply below. This list gets updated from what the community reports, and the Hacklido Writers Reward Program pays for good technical writeups if you want to publish your own.
