Penetration Testing interview questions
Penetration Testing questions a Cybersecurity can be asked, from first job to senior. Open one to see the strongest answer and why it works.
A scoped external test starts on Monday. What does reconnaissance mean, and what does a defender learn from it?
The strongest answer: Collecting what is publicly discoverable — domains, exposed services, technologies, people — which tells the defender how much of their surface is visible before anyone touches a system
Why it works: Exactly — and the defensive lesson is inventory: forgotten subdomains and staging hosts surface here first.
- Recon maps what is visible.
- Mostly passive, little trace.
- Compare findings with the asset list.
- Forgotten hosts are the finding.
Mid-test you find that a host inside the allowed IP range clearly belongs to a different company.
What do you do?
The strongest answer: Stop touching it, tell the client and the test lead immediately, record exactly what was already sent, and wait for written confirmation before anything continues
Why it works: Right — written authorisation, immediate disclosure and a record of what was sent is what keeps testing lawful.
- Authorisation is written, not implied.
- Stop and report immediately.
- Record exactly what was sent.
- Resume only on written approval.
A pentester files “open redirect on logout.” What do you not do?
The strongest answer: I do not argue that they are “not a real attacker” — I triage impact, fix or accept with a name, and I do not bury the finding in a PDF nobody owns
Why it works: Exactly. Findings are gifts with owners. Score-grooming and deletion are red flags.
- Triage impact.
- Own the fix or the accept.
- Do not groom the score.
- Do not delete the report.
What is the difference between scanning and enumeration, and why does the difference matter to the defender?
The strongest answer: Scanning finds what is reachable — hosts, ports, services; enumeration goes to a service that was found and pulls detail from it, such as versions or valid names. Enumeration is noisier, and it is usually the step detection should catch
Why it works: Exactly — knowing where the boundary is tells a blue team which log would have shown the step.
- Scan finds reachable; enumeration pulls detail.
- Enumeration is the louder step.
- Know which log would show it.
- Filter the noise, keep the signal.
A pentest dump has 80 Mediums. How do you start?
The strongest answer: By exploitability and asset — what is internet-facing, what is authz, what is already mitigated — I do not open 80 tickets of equal noise
Why it works: Exactly. Triage is context. CVSS is an input. Mass-accept and gagging testers are red flags.
- Sort by exploitability and asset.
- CVSS is an input.
- Do not mass-accept.
- Do not gag Mediums.
What makes a pentest program, not a PDF you buy once a year?
The strongest answer: A scope that matches the money path, time to fix, and a retest — plus an owner for each finding, not a trophy in a drawer
Why it works: Exactly. Scope, fix, retest, owners. Audit-week theatre and trophy PDFs are not a program.
- Scope the money path.
- Time to fix + retest.
- Named owners.
- Do not buy a trophy PDF.
A scanner reports a critical vulnerability on an internal service. The pentest report on the same service says it was not exploitable.
Are these in conflict, and what do you do with the finding?
The strongest answer: No — vulnerable means the weakness is present, exploitable means a path to reach and use it exists here. I record the reason it is unreachable, keep the patch scheduled, and re-test if the network or config changes
Why it works: Right — exploitability is a property of today’s configuration, so the reason and the re-test date matter as much as the verdict.
- Vulnerable is not exploitable.
- Record the compensating reason.
- Keep the patch scheduled.
- Re-test when the context changes.
Pentest findings die in a PDF. Where should they live?
The strongest answer: In the product backlog with the same ranks as other work — security is not a parallel universe of tickets nobody grooms
Why it works: Exactly. Same backlog, visible rank. Secret projects and CTO mail are how fixes miss a sprint.
- Same backlog as product.
- Visible rank.
- No secret projects.
- No mailbox trackers.
A report says “low-privilege access led to full control of the host”. As the defender, which classes of weakness allow that, and what do you fix first?
The strongest answer: Over-permissive service accounts, writable paths or scheduled jobs running as a privileged user, stored credentials, and unpatched privileged components — I fix reused credentials and over-privileged service accounts first, because those travel to other hosts
Why it works: Right — it is a class, not one trick, and the weaknesses that grant reuse elsewhere outrank the host-local ones.
- Escalation is a class, not a trick.
- Hunt stored and reused credentials.
- Audit what runs as privileged.
- Fix what travels between hosts.
Red team and SOC are fighting about a missed detection. How do you run the learning?
The strongest answer: What signal was missing, what rule we will add or drop, and whether the test was in scope — no scoreboard, no blame
Why it works: Exactly. Detection quality is the product. Scoreboards make both sides hide.
- Missing signal + next rule.
- Check the scope.
- No scoreboard.
- Do not ban the test.
When do you fund a bounty on top of a pentest?
The strongest answer: When the attack surface is public and you can triage — a bounty is a continuous crowd, not a replacement for a scoped test of the money path
Why it works: Exactly. Different jobs. Cheap-crowd and marketing-bounties are how you drown in noise or buy a logo.
- Pentest: scoped money path.
- Bounty: continuous public surface.
- Triage capacity first.
- Do not buy a logo.