Security / Penetration Tester interview questions and answers

10 of 10 questions shown

1. juniorAccess controlExplain authentication versus authorization with an IDOR example.

   Model answer. Authentication proves who you are; authorization decides what you may do. In an IDOR, GET /invoices/1042 returns another customer's invoice because the server checks that you are logged in but not that you own the record. Test by replaying requests with a second account's session and swapped identifiers.

   Tools: Burp Suite

   I can answer this
2. juniorWebDescribe reflected, stored and DOM-based XSS and the primary defence.

   Model answer. Reflected: input in the request is echoed in the response. Stored: the payload is saved and served to other users. DOM-based: client-side script writes untrusted data into a dangerous sink such as innerHTML. The primary defence is context-aware output encoding and safe DOM APIs, with a Content Security Policy as defence in depth.

   I can answer this
3. midInjectionHow do you confirm SQL injection when the application returns no errors?

   Model answer. Use boolean-based tests where true and false conditions change the response, time-based tests (SLEEP or pg_sleep) and out-of-band interactions. Stay within the agreed scope. The fix is parameterised queries, not input filtering.

   Tools: Burp Suite

   I can answer this
4. midWebHow does the SameSite cookie attribute change CSRF risk?

   Model answer. SameSite=Lax, the default in Chromium browsers, withholds cookies on cross-site subrequests and POSTs but still sends them on top-level GET navigations. Strict withholds them everywhere. State-changing requests should still use anti-CSRF tokens, and GET must never change state.

   I can answer this
5. midAuthWhat do you check when testing JWT authentication?

   Model answer. Accepting alg none, RS256 to HS256 key confusion, weak HMAC secrets, missing validation of exp, aud and iss, kid injection, revocation and storage location. Remember the payload is only base64url encoded, so it must not hold secrets.

   Tools: Burp Suite, Postman

   I can answer this
6. midServer-sideWhat is SSRF and how do you test for it?

   Model answer. The server fetches a URL the attacker controls. Test URL parameters, webhooks and image fetchers by pointing them at 127.0.0.1 and cloud metadata at 169.254.169.254, try redirects, DNS rebinding and alternative IP encodings. Mitigate with allow-lists, IMDSv2 and egress filtering.

   I can answer this
7. midLogicGive an example of a business-logic flaw and how you find it.

   Model answer. A coupon that can be redeemed several times by sending parallel requests, a race condition. Scanners miss these, so map the intended workflow, then abuse order, repetition and concurrency (Burp Turbo Intruder) and negative or oversized values in price and quantity fields.

   Tools: Burp Suite

   I can answer this
8. seniorEngagementWhat do you agree before starting a penetration test?

   Model answer. Written authorisation, in-scope and out-of-scope assets, testing windows and permitted techniques (denial of service, social engineering). Also data handling, emergency contacts, test accounts for each role and the reporting and retest process.

   I can answer this
9. seniorReportingHow do you rate and report a finding so it drives action?

   Model answer. Combine CVSS base score with business context, give clear reproduction steps and evidence, describe impact in business terms and offer specific remediation. Open the report with a prioritised summary and avoid severity inflation, which erodes trust.

   I can answer this
10. seniorAutomationHow do you add security scanning to CI without drowning teams in false positives?

    Model answer. Run ZAP baseline (passive) scans on pull requests and authenticated active scans nightly on staging, and add dependency and static analysis. Fail the build only on new high-confidence findings, and document each suppression with a reason and an owner.

    Tools: OWASP ZAP

    I can answer this

No question matches those filters. Clear the search or choose All.