Fifteen common penetration tester questions
- Walk me through your testing methodology.
- What goes into scoping and rules of engagement?
- Explain SQL injection and how to remediate it.
- Reflected, stored and DOM-based XSS — differences?
- What is server-side request forgery?
- What are insecure direct object references, and why are they common?
- How do you test authentication and session management?
- How would you approach an internal network test?
- What are common Active Directory weaknesses?
- Vulnerability scan versus penetration test?
- How do you avoid disrupting a production system during testing?
- How do you rate the severity of a finding?
- What makes a good penetration test report?
- What would you do if you found evidence of a real compromise?
- How do you keep your skills current?
Methodology and scope
A typical engagement: agree scope, objectives and rules of engagement in writing; perform reconnaissance; enumerate and identify vulnerabilities; exploit carefully to validate impact within the agreed limits; assess post-exploitation impact if permitted; clean up any artefacts; and report. Rules of engagement cover targets, dates and times, allowed techniques, out-of-scope systems, data handling and emergency contacts. Testing anything outside written authorisation is not a grey area — it's off limits.
Web vulnerabilities
| Vulnerability | Root cause | Remediation |
|---|---|---|
| SQL injection | User input concatenated into queries | Parameterised queries, least-privilege database accounts |
| XSS | Untrusted data rendered without encoding | Context-aware output encoding, Content Security Policy |
| IDOR / broken access control | Missing authorisation checks on object IDs | Server-side authorisation on every request |
| SSRF | Server fetches attacker-controlled URLs | Allow-lists, blocking internal ranges and metadata endpoints |
| Authentication flaws | Weak passwords, no MFA, predictable tokens | MFA, rate limiting, secure session handling |
Broken access control regularly tops industry lists of web application risks, so expect detailed questions about testing authorisation with multiple user roles.
Network and Active Directory
- Internal tests start with discovery and service enumeration, then look for weak credentials, unpatched services and misconfigurations.
- Common Active Directory issues include excessive privileges, weak service account passwords susceptible to offline cracking, legacy protocols enabled, and misconfigured delegation.
- The aim is to demonstrate realistic attack paths to valuable assets, then explain how to break those paths.
Reporting and professionalism
A good report has an executive summary in business terms, a clear scope and methodology, and findings with severity, evidence, impact, reproduction steps and specific remediation. Severity combines likelihood and impact, often using a standard scoring system adjusted for the client's context. If you find signs of a real compromise, stop and follow the agreed emergency procedure immediately. Interviewers value candidates who write clearly as much as those who exploit cleverly.
Showing experience
Without professional engagements, legal practice environments — intentionally vulnerable labs, capture-the-flag competitions and certification labs — are the accepted way to build and demonstrate skill. Be ready to walk through one in detail, including what didn't work. See security engineer interview questions.
The practical exercise
Many firms include a hands-on test: a time-boxed lab environment or a deliberately vulnerable application, followed by a short report. The report often matters as much as the findings. Prioritise clear reproduction steps and realistic remediation advice, rate severity sensibly rather than inflating it, and note what you tried that didn't work. Staying strictly within the stated scope of the exercise is itself being assessed.
Practising
Interviewers follow up on the most specific thing you say, so rehearse the second question as well as the first. CoPilot Interview, a free AI interview assistant, runs penetration testing mock interviews with follow-ups and produces a report of likely next-round questions. Prepare a sanitised walkthrough of one engagement or lab, from scoping to report.
Disclosure: CoPilot Interview is our product, so weigh what we say about it accordingly. Everything else on this page applies whichever tool you use, or none.
Frequently asked questions
What questions are asked in a penetration testing interview?
Methodology, scoping and rules of engagement, web vulnerabilities such as SQL injection, XSS, SSRF and broken access control, network and Active Directory testing, severity rating, reporting and ethics.
What is the difference between a vulnerability scan and a penetration test?
A scan uses automated tools to identify potential vulnerabilities. A penetration test involves a skilled tester validating and exploiting issues within an authorised scope to show real-world impact.
What should be in rules of engagement?
Targets in and out of scope, testing windows, permitted techniques, data handling rules, communication and emergency contacts, all agreed in writing before testing.
How do I get pen testing experience legally?
Through intentionally vulnerable practice labs, capture-the-flag competitions, certification labs and authorised bug bounty programmes.
Practise on real interview questions
Run 145 real interview questions across 10 tracks, answer out loud and see a structured answer to compare with yours. Free, no signup.
Try a practice question