VAPT Interview Questions

VAPT interviews test four things in sequence: whether you understand fundamentals, whether you have actually exploited something rather than read about it, whether you have a methodology instead of a tool habit, and whether you can explain a finding to someone non-technical. Most candidates prepare only for the first and fail on the third and fourth.

The questions below are grouped by what they are really testing. If you are new to the field, read what is VAPT first.

Fundamentals

What is the difference between vulnerability assessment and penetration testing?
Assessment finds and lists weaknesses across a broad surface, mostly automated, with no proof of exploitability. Testing exploits a narrow set manually to prove real impact. Full breakdown in VAPT vs penetration testing.

Walk me through the phases of an engagement.
Scoping and authorisation, reconnaissance and enumeration, vulnerability assessment, exploitation, post-exploitation and lateral movement, reporting and retest. Mentioning authorisation first is a signal interviewers notice.

Black box, grey box or white box, which would you recommend to a client?
Usually grey box, because it simulates the most realistic serious threat, an attacker with an existing foothold, and spends time on depth rather than discovery. White box gives the best coverage per rupee and clients avoid it for bad reasons.

What is the difference between encoding, encryption and hashing?
Encoding is reversible with no key and is for data format. Encryption is reversible with a key and is for confidentiality. Hashing is one way and is for integrity and verification.

Explain the TCP three-way handshake and why it matters to you.
SYN, SYN-ACK, ACK. It matters because scan types depend on it. A SYN scan never completes the handshake, which is why it is quieter than a connect scan.

Web application

How do you test for SQL injection manually?
Inject a single quote and watch for errors or behaviour change, then test boolean conditions that should be true versus false, then time-based payloads if there is no visible output. Confirm before automating.

What is the difference between reflected, stored and DOM-based XSS?
Reflected returns in the immediate response. Stored persists server-side and fires for other users. DOM-based never reaches the server, the sink is in client-side JavaScript, which is why it gets missed most often.

How would you find broken access control?
Two accounts, capture a request as user A, replay it as user B with A's object identifiers. Also test horizontal and vertical movement, and check whether the control is enforced server-side or only hidden in the UI.

What is CSRF and why does SameSite matter?
CSRF makes a user's browser perform an authenticated action they did not intend. SameSite cookie attributes restrict cross-site cookie sending, which removes the primary delivery mechanism for many CSRF variants.

How do you approach a login page?
Username enumeration through response differences and timing, credential stuffing viability, rate limiting on both password and OTP, account lockout behaviour, password reset flow, session handling after login, and whether the JWT or session token is properly validated.

Network and Active Directory

You have a shell on a Windows host in a domain. What now?
Enumerate current user privileges and group membership, check for cached credentials, enumerate the domain for attack paths, look for Kerberoastable service accounts and AS-REP roastable users, and check ACLs for privilege escalation paths before touching anything noisy.

What is Kerberoasting in one sentence?
Requesting a service ticket for an account with an SPN, then cracking the ticket offline to recover that service account's password, because the ticket is encrypted with a hash of it.

Difference between vertical and horizontal privilege escalation?
Vertical moves to a higher privilege level. Horizontal moves to another account at the same level. Horizontal is frequently the more damaging finding in multi-tenant applications.

How do you pivot into an internal network?
Port forwarding or a SOCKS proxy through the compromised host, then routing tooling through it. The interviewer is checking whether you have actually done this or only read the theory.

API and cloud

What is BOLA and why is it the top API risk?
Broken object level authorisation, where the API checks that you are authenticated but not that the object you requested belongs to you. It is top because APIs expose object identifiers directly and developers assume the client will not change them.

How does API testing differ from web application testing?
No UI to guide you, so documentation and traffic capture drive discovery. Authorisation flaws dominate over injection. Rate limiting and mass assignment matter more. Business logic is harder to infer.

What would you check first in an AWS environment?
IAM policies for over-permissive grants and wildcards, publicly exposed storage, metadata service accessibility from application hosts, and whether logging is enabled and centralised.

AI security

What is prompt injection?
Untrusted input causing a model to follow instructions it should not, because the model receives system instructions and data in the same channel. Detail in prompt injection explained.

How do you scope an AI security test?
Enumerate model capability first. What tools it can call, what data it can read, where its output lands. Impact is determined by capability, not by whether the model can be injected, which you should assume it can.

Methodology and judgement

These separate candidates more than the technical questions, and most people prepare for them least.

You have 400 scanner findings and three days. What do you do?
Triage by exploitability and business impact rather than CVSS. Confirm the ones that would matter if real. The interviewer is testing whether you understand that scanner output is a starting point, not a report.

You find nothing in a week. What do you tell the client?
That you found nothing, with a clear account of what was tested and what was not, and what the limitations were. Inventing findings or inflating severity to justify a fee is the fastest way to lose a client permanently.

You accidentally cause an outage during testing. What now?
Stop, notify the client contact immediately, document exactly what was sent and when, and assist with recovery. Interviewers ask this to check honesty instinct, not technical skill.

How do you rate severity?
CVSS as a baseline, adjusted for business context, with the reasoning stated. A pasted score with no context is the mark of an automated report.

Reporting

Explain SQL injection to a CFO in thirty seconds.
The most common question candidates fumble. Answer in business terms: what data is exposed, how many records, what the regulatory consequence is, what it costs to fix. No jargon.

What makes a good finding write-up?
A descriptive title, business impact before technical detail, reproduction steps a developer can follow without asking you questions, evidence with sensitive data redacted, and remediation specific to their stack. Template in how to write a VAPT report.

Questions you should ask them

Interviews go both ways, and asking these marks you as someone who has thought about the work:

• What is the split between compliance-driven testing and research?
• How many person-days does a typical engagement get?
• Who reviews reports before they go to the client?
• Is there time allocated for skill development?

Practise this

Every technical answer above is better delivered by someone who has done the thing. Hacklido is free and covers web, network and API challenges.

The TCVE VAPT program includes mock interviews built on these scenarios, plus graded report submissions.

Frequently asked questions

What questions are asked in a VAPT interview?

Fundamentals such as the difference between assessment and testing, hands-on questions about specific exploitation, methodology questions about how you prioritise, and communication questions about explaining findings to non-technical stakeholders.

How do I prepare for a penetration testing interview?

Practise on live labs so your hands-on answers come from experience, prepare a methodology you can walk through, and rehearse explaining one technical finding in plain business language.

What is the most common mistake in VAPT interviews?

Preparing only for technical questions. Candidates fail most often on methodology and communication, particularly when asked to explain a vulnerability to a non-technical person.

Do I need certifications to clear a VAPT interview?

No. Demonstrable work such as public writeups, disclosed vulnerabilities or a documented lab consistently outperforms certifications alone in technical interviews.

What should a fresher expect in a VAPT interview?

Fundamentals, one or two hands-on scenarios, and questions about projects on your resume. Freshers are assessed more on how they think through a problem than on breadth of knowledge.