[Penetration Testing] Top 70 Most Interview Questions

[x32x01]

As you prepare for your pentester interview, you may be considering which questions the employer is going to ask you. While there’s no way to know for sure what topics will be covered because information security is a huge field, there are several popular interview questions you can expect to be asked.

Being a pentester has become more important in today’s world as organizations have had to take a more serious look at their security posture and how to improve it. A penetration tester, or pentester, is employed by an organization either as an internal employee or as an external entity such as a contractor hired on a per-job or per-project basis.

In either case, pentesters conduct a penetration test, meaning they survey, assess, and test the security of a given organization by using the same techniques, tactics, and tools that a malicious hacker would use.

Your job interview directly impacts your chances of acceptance so it’s important to dedicate time and attention to this list of interview questions. The following questions are commonly asked during interviews and a great place to start for pentesting:

1. What are the three types of controls that a company can use to defend against hackers?
2. What is the main difference between a hacker and a pentester?
3. What are some other names for a pentester?
4. What does the CIA triad represent when referring to IS (Information Security)?
5. Name some of the crimes categorized as cyber crime.
6. What is the purpose of the OSI model?
7. What are some differences between TCP and UDP?
8. What is a MAC address and where is it stored?
9. What is the difference between a public and a private IP address?
10. In an IPv4 address, what is the difference between the host and network part of the address?
11. What is a router and at which OSI layer does it operate?
12. How many bits are in an IPv4 address?
13. Why use symmetric encryption?
14. What is an algorithm?
15. What is steganography?
16. Why use steganography?
17. What is the benefit of using steganography over cryptography?
18. Why would hashing be used instead of encryption?
19. What is the purpose of a pen testing methodology to a penetration tester?
20. What is the purpose of scoping a penetration test?
21. Why can a penetration tester be charged with trespassing or other illegal acts when they enter a network without a contract?
22. What is the function of Whois when doing reconnaissance?
23. The Wayback Machine is useful in obtaining information about websites. Why?
24. What is OSINT?
25. Why might Google hacking be more useful than just using Google normally?
26. What is the purpose of fragmenting a packet on a network?
27. What is a socket?
28. What is the purpose of performing a ping sweep?
29. What is the purpose of a port scan?
30. Enumeration is used to obtain what type of information?
31. Why would you perform a banner grab?
32. What is the function of the three-way handshake?
33. What is the difference between TCP and UDP?
34. What is a vulnerability scan?
35. What is the advantage of performing and automated scan?
36. What is a vulnerability?
37. Is “COOLTOMMY” a good password? Why or why not?
38. What is a brute-force attack?
39. What is privilege escalation?
40. What is the purpose of a rootkit and why is it so dangerous?
41. What is a virus?
42. How does a Trojan get onto a system typically?
43. What is the purpose of a backdoor?
44. What are some reasons to use netcat?
45. What are some reasons why pentesters should invest time and effort in improving their writing skills?
46. How much technical information would you include in a pentest report?
47. What are some reasons a client would require a VA/PT report after a test?
48. What is a firewall?
49. What is the advantage of using an NIDS?
50. What types of network activity would an HIDS be expected to detect?
51. What is a honeypot?
52. What is a disadvantage of a knowledge-based NIDS?
53. What is a DMZ?
54. What is the purpose of performing evasion?
55. Why use steganography?
56. What is the benefit of using steganography over cryptography?
57. What is the difference between Bluetooth and Wi-Fi networks?
58. What is the range of a Bluetooth network? How can you increase it?
59. What is IoT and what is the biggest problem with IoT?
60. What is the purpose of sandboxing?
61. What common operating system is iOS based off?
62. What is the function of the SELinux kernel in Android?
63. What are the most common development environments used to create applications for Android?
64. What is social engineering?
65. How may an attacker use authority to perform social engineering?
66. Why is social networking useful to gain information?
67. What is the most effective defense against social engineering?
68. What is a vulnerability?
69. What is a DMZ?
70. Where would an NIDS be deployed within a network?