What a fresher pentest interview covers, at a glance
Landing your first pentesting interview is exciting, and a little nerve-wracking. You’ve done the labs, maybe you’ve got a certification, but what will they actually ask?
We help students prepare for these interviews all the time, and the good news is they’re quite predictable. Interviewers want to see three things: solid fundamentals, a clear methodology, and honesty about what you don’t know. Below are the 25 questions we see most often for fresher and junior pentest roles in India, grouped by topic, with the kind of answers that impress.
| Networking fundamentals | TCP/IP, ports, the handshake, Nmap scan types |
| Web application security | OWASP Top 10, SQLi, XSS, CSRF, SSRF, IDOR |
| Active Directory | Kerberos basics, Kerberoasting, pass-the-hash |
| Privilege escalation | Common Linux and Windows misconfigurations |
| Methodology and reporting | Scoping, rules of engagement, CVSS, writing findings |
| Scenario and HR questions | Walk me through a lab, how you handle being stuck |
Networking fundamentals
1. What’s the difference between TCP and UDP? TCP is connection-oriented: it uses a handshake, guarantees delivery and keeps packets in order. UDP is connectionless and faster but doesn’t guarantee delivery. Give examples: HTTP and SSH use TCP; DNS queries and SNMP typically use UDP.
2. Explain the TCP three-way handshake. The client sends SYN, the server replies SYN-ACK, the client responds ACK. Bonus points if you link it to Nmap: a SYN scan (-sS) sends the SYN and reads the reply without completing the handshake.
3. Name some common ports and their services. 21 FTP, 22 SSH, 25 SMTP, 53 DNS, 80/443 HTTP/HTTPS, 88 Kerberos, 139/445 SMB, 389 LDAP, 1433 MSSQL, 3306 MySQL, 3389 RDP. Interviewers love it when you mention what you’d test on each.
4. What Nmap scans would you run first, and why? A fast full-port TCP scan to find open ports, then service and version detection (-sV) and default scripts (-sC) on what’s open, plus a UDP scan of top ports, since UDP services are easy to miss.
5. What’s the difference between hashing, encryption and encoding? Encoding (like Base64) is reversible and isn’t for security. Encryption is reversible with a key. Hashing is one-way and is used for integrity and password storage. A classic fresher mistake is calling Base64 “encryption”, so don’t.
Web application security
6. What is the OWASP Top 10? A regularly updated awareness list of the most critical web application security risks. Mention a few categories you know well, such as broken access control and injection, and be ready to explain one in depth.
7. Explain SQL injection and how to prevent it. User input is concatenated into a SQL query, letting an attacker change its logic. The fix is parameterised queries (prepared statements), plus least-privilege database accounts and input validation as defence in depth.
8. What are the types of XSS? Reflected (payload comes from the request), stored (saved and served to other users) and DOM-based (happens in client-side JavaScript). Prevention: context-aware output encoding, a Content Security Policy, and HttpOnly cookies to limit the damage.
9. What is CSRF, and how is it prevented? It tricks a logged-in user’s browser into sending an unwanted request. Defences include anti-CSRF tokens, SameSite cookies and checking the Origin header.
10. What is SSRF, and why is it dangerous in the cloud? The server is tricked into making requests to locations the attacker chooses. In cloud environments this can reach internal metadata services and leak credentials, which is why it’s often rated critical.
11. What’s an IDOR? Insecure Direct Object Reference: changing an identifier (say, an invoice ID) lets you access another user’s data because the server doesn’t check authorisation. It’s one of the most common real-world findings.
12. Which Burp Suite tools do you use most? Proxy and HTTP history for mapping, Repeater for manual testing, Intruder for fuzzing, and Decoder and Comparer for analysis. Our Burp Suite for beginners guide covers these if you need a refresher.
Active Directory basics
13. How does Kerberos authentication work, at a high level? The user gets a Ticket Granting Ticket (TGT) from the KDC, then uses it to request service tickets (TGS) for specific services. You don’t need every detail as a fresher, but you should know the flow.
14. What is Kerberoasting? Any domain user can request service tickets for accounts with SPNs. Those tickets are encrypted with the service account’s password hash, so they can be cracked offline. The defence is long, random service account passwords or managed service accounts.
15. What is pass-the-hash? Using a captured NTLM hash to authenticate without knowing the plaintext password. Mention mitigations like LAPS, limiting local admin reuse and protecting privileged accounts. Our Windows AD attack cheatsheet is great revision for this section.
Privilege escalation
16. How would you look for Linux privilege escalation? Check sudo -l, SUID binaries, writable cron jobs and scripts, capabilities, credentials in config files, and the kernel version, supported by an enumeration script but verified manually.
17. And on Windows? Service misconfigurations such as unquoted service paths and weak service permissions, AlwaysInstallElevated, stored credentials, token privileges like SeImpersonatePrivilege, and missing patches.
18. Why shouldn’t you rely only on automated tools? They miss context, produce false positives and can be noisy or even unsafe in production. Interviewers want to hear that you verify findings manually.
Methodology, scoping and reporting
19. What’s the difference between a vulnerability assessment and a penetration test? A VA identifies and lists weaknesses, often with scanners. A pentest goes further and safely exploits them to prove real impact, usually with manual testing.
20. What are rules of engagement, and why do they matter? The agreed scope, timing, permitted techniques, contacts and limits of a test. Testing without written authorisation is illegal, and saying so clearly is a green flag for interviewers.
21. What is CVSS? The Common Vulnerability Scoring System, a standard way to rate severity based on factors like attack vector, complexity, privileges required and impact. Mention that business context can raise or lower real-world priority.
22. What makes a good pentest finding in a report? A clear title, severity, affected assets, a description, reproducible steps with evidence, business impact and practical remediation. Many technically strong candidates lose out because they can’t write this clearly.
Scenario and behavioural questions
23. Walk me through a machine or lab you’ve compromised. Pick one you genuinely understand. Explain recon, the foothold, privilege escalation and what you learned. Clear structure beats a long story.
24. What do you do when you’re stuck? Go back to enumeration, re-read your notes, research the specific service or version, and time-box rabbit holes. Honest, methodical answers win here.
25. How do you keep your skills current? Mention specific platforms, write-ups, CVE analysis, CTFs or certifications you’re working towards. For ideas, see our best cybersecurity labs guide.
How to stand out as a fresher
Say “I don’t know, but here’s how I’d find out.” Interviewers respect honesty far more than bluffing.
Bring proof. A GitHub with scripts, lab write-ups or a blog shows initiative better than any line on your CV. Our cybersecurity resume guide for freshers shows how to present it.
Show your methodology. Even a simple “recon, then enumeration, then exploitation, then reporting” framing makes answers sound professional.
Going for a defensive role instead? Our SOC analyst interview questions cover the blue-team side.
Frequently asked questions
What questions are asked in a penetration tester interview for freshers?
Expect questions on networking fundamentals such as TCP/IP, ports and Nmap; web security topics such as the OWASP Top 10, SQL injection, XSS, CSRF, SSRF and IDOR; Active Directory basics; Linux and Windows privilege escalation; methodology, scoping and reporting; and a walkthrough of a lab you’ve completed.
Do I need a certification to get a pentesting job as a fresher in India?
It isn’t mandatory, but a practical certification such as eJPT, PNPT, CPTS or OSCP, or a recognised one like CEH, helps you get shortlisted. Practical proof such as lab write-ups matters just as much in the interview.
How should I prepare for a pentest interview?
Revise networking and web fundamentals, practise explaining a few labs you’ve completed from start to finish, review common privilege escalation and Active Directory techniques, and prepare a clear example of a well-written finding.
What do interviewers look for in fresher pentesters?
Solid fundamentals, a clear and methodical approach, honesty about gaps in knowledge, good communication and evidence of hands-on practice.
References & further reading
Walk into your interview prepared
You don’t need to know everything to land your first pentesting job. You need strong fundamentals, a clear method, and the confidence to explain what you’ve actually done. Work through these questions out loud, practise on real labs, and you’ll be ahead of most candidates. Our guide to becoming a penetration tester in India covers the bigger picture.
At Macksofy Trainings we prepare students for practical pentest roles through hands-on training and mock interviews, in classroom (BKC Mumbai) and live online formats. Let’s get you interview-ready.
Disclaimer: these questions reflect common patterns in Indian fresher and junior penetration testing interviews as of 2026. Individual employers’ interviews vary. Only ever test systems you have explicit written permission to test.
About the author — Yasir Arafat
Founder and Lead Instructor, Macksofy Trainings
Yasir designs OSCP, CEH v13 and SOC-200 curriculum at Macksofy Trainings, an EC-Council Accredited Training Center in Mumbai, and mentors candidates through practical certification exams.
