Short answer: Ethical hacking interview questions cover the five phases of hacking, reconnaissance and scanning, footprinting, Nmap and Metasploit, the OWASP Top 10, XSS and SQL injection, privilege escalation, and the difference between black/white/grey hat hackers. Interviewers want tool fluency plus a clear, legal methodology.
These 40 ethical hacking interview questions are grouped by level with concise, accurate answers. They suit penetration tester, VAPT analyst, and red team roles. New to the field? Start with our explainer on what is ethical hacking and the cyber security roadmap for 2026.
Beginner Ethical Hacking Interview Questions
What is ethical hacking?
Ethical hacking is the authorised, legal practice of probing systems, networks, and applications for vulnerabilities the same way a malicious attacker would, then reporting them so they can be fixed. The key differences from illegal hacking are permission, scope, and intent.
What is the difference between black hat, white hat, and grey hat hackers?
Black hat hackers attack illegally for personal gain. White hat hackers (ethical hackers) test with permission to improve security. Grey hat hackers operate in between, often finding flaws without authorisation but without malicious intent, which is still legally risky.
What are the five phases of hacking?
1) Reconnaissance (information gathering), 2) Scanning (finding live hosts, ports, services), 3) Gaining Access (exploitation), 4) Maintaining Access (persistence), and 5) Clearing Tracks (covering evidence). Ethical hackers follow the same phases but stay within an authorised scope.
What is footprinting?
Footprinting is the first reconnaissance step, collecting information about a target: domains, IP ranges, employees, technologies, emails, and social media. It can be passive (OSINT, WHOIS, Google dorking) or active (direct interaction). It shapes the whole engagement.
What is the difference between active and passive reconnaissance?
Passive recon gathers information without touching the target (WHOIS, DNS records, Shodan, LinkedIn), leaving no trace. Active recon interacts directly with the target (ping sweeps, port scans), which is faster but detectable.
What is Nmap used for?
Nmap is the standard network scanner used to discover live hosts, open ports, running services, and their versions, and to fingerprint operating systems. Common scans: SYN scan (-sS), version detection (-sV), OS detection (-O), and script scan (-sC).
What is a vulnerability scanner, and name a few.
A vulnerability scanner automatically identifies known weaknesses in systems and applications. Examples: Nessus, OpenVAS, Nikto (web), and Qualys. Scanners are fast for coverage but produce false positives that a human must validate.
What is Metasploit?
Metasploit is a penetration testing framework with a large database of exploits, payloads, and auxiliary modules. It is used to develop, test, and execute exploit code against a target in a controlled, authorised way, and to validate whether a vulnerability is truly exploitable.
What is the difference between a vulnerability, an exploit, and a payload?
A vulnerability is the weakness, an exploit is the code or technique that takes advantage of it, and a payload is what runs after successful exploitation (a reverse shell, adding a user, etc.).
What is social engineering?
Social engineering manipulates people, not machines, into revealing information or performing actions (phishing, pretexting, baiting, tailgating). It targets the human, often the weakest link. Awareness training and strict verification processes are the main defences.
What are the common well-known ports an ethical hacker should know?
21 FTP, 22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 80 HTTP, 110 POP3, 143 IMAP, 443 HTTPS, 445 SMB, 3306 MySQL, 3389 RDP. Recognising services quickly speeds up scanning and exploitation planning.
What is the difference between encoding, encryption, and hashing?
Encoding transforms data for compatibility and is reversible without a key (Base64). Encryption protects confidentiality and needs a key to reverse (AES, RSA). Hashing is a one-way fingerprint used for integrity and passwords (SHA-256, bcrypt).
Intermediate Ethical Hacking Interview Questions
What is the OWASP Top 10?
The OWASP Top 10 lists the most critical web application security risks: Broken Access Control, Cryptographic Failures, Injection, Insecure Design, Security Misconfiguration, Vulnerable and Outdated Components, Identification and Authentication Failures, Software and Data Integrity Failures, Security Logging and Monitoring Failures, and SSRF. It guides most web pentests.
Explain Cross-Site Scripting (XSS) and its types.
XSS injects malicious scripts that run in a victim's browser. Stored XSS is saved on the server, Reflected XSS is echoed back in a response, and DOM-based XSS is executed entirely client-side. Mitigate with output encoding, input validation, and CSP.
How does SQL injection work, and how do you prevent it?
SQLi injects malicious SQL through unsanitised input to read, modify, or bypass database logic. Types include error-based, union-based, blind, and time-based. Prevention: parameterised queries, ORMs, input validation, least-privilege DB users, and WAFs.
What is CSRF (Cross-Site Request Forgery)?
CSRF tricks an authenticated user's browser into sending unwanted requests to a site where they are logged in. Defences: anti-CSRF tokens, SameSite cookies, and re-authentication for sensitive actions.
What is the difference between XSS and CSRF?
XSS runs attacker-controlled script in the victim's browser (exploits trust the user has in a site). CSRF forces the victim's browser to perform an action (exploits trust the site has in the user's browser). XSS can often defeat CSRF protections.
What is privilege escalation, and what are its two types?
Privilege escalation is gaining higher access than granted. Vertical escalation moves from a normal user to admin/root; horizontal escalation accesses another user's account at the same level. Causes include kernel exploits, weak permissions, and misconfigurations.
What is a reverse shell vs a bind shell?
In a bind shell, the target opens a port and waits for the attacker to connect. In a reverse shell, the target connects back to the attacker's listener, which is more firewall-friendly because outbound connections are usually allowed.
What is enumeration?
Enumeration actively extracts detailed information from a target after scanning: usernames, shares, services, group memberships, and network resources (via SMB, SNMP, LDAP, etc.). It directly feeds exploitation.
What is the difference between a false positive and a false negative in scanning?
A false positive is a reported vulnerability that does not actually exist; a false negative is a real vulnerability the scanner missed. Manual validation reduces false positives; multiple tools and manual testing reduce false negatives.
What tools do you use for web application penetration testing?
Burp Suite (intercepting proxy and scanner), OWASP ZAP, Nikto, sqlmap for SQLi, dirb/gobuster for content discovery, and the browser dev tools. Burp Suite is the industry standard for manual web testing.
What is a payload in the context of Metasploit?
A payload is the code executed on the target after exploitation. Meterpreter is a powerful in-memory payload offering a stealthy interactive session, file access, privilege escalation, and pivoting.
What is pivoting?
Pivoting uses a compromised machine as a relay to reach otherwise unreachable internal networks, extending access deeper into the environment. It is central to realistic internal penetration tests.
What is the difference between black box, white box, and grey box testing?
Black box: tester has no prior knowledge (simulates an external attacker). White box: full knowledge including source and credentials (thorough). Grey box: partial knowledge (a realistic insider or limited-access attacker). Each fits a different objective.
What is Google dorking?
Google dorking uses advanced search operators (site:, filetype:, inurl:, intitle:) to find exposed files, login pages, config files, and sensitive information indexed by search engines, a powerful passive recon technique.
Advanced Ethical Hacking Interview Questions
Explain the TCP three-way handshake and how a SYN flood abuses it.
TCP connects via SYN, SYN-ACK, ACK. A SYN flood sends many SYN packets with spoofed sources and never completes the handshake, filling the server's connection table and denying service. SYN cookies mitigate it.
What is pass-the-hash?
Pass-the-hash uses a captured NTLM password hash to authenticate to other systems without knowing the plaintext password. It enables lateral movement in Windows domains. Defences: credential guard, LAPS, network segmentation, and least privilege.
What is Active Directory, and why do attackers target it?
Active Directory is Microsoft's directory service that manages users, computers, and permissions across a Windows network. Attackers target it because compromising AD (via Kerberoasting, DCSync, or Golden Tickets) can give control over the entire domain.
What is Kerberoasting?
Kerberoasting requests Kerberos service tickets for accounts with SPNs, then cracks the tickets offline to recover service-account passwords. Defence: strong, long service-account passwords and managed service accounts.
What is the MITRE ATT&CK framework?
MITRE ATT&CK is a knowledge base of real-world adversary tactics and techniques across the attack lifecycle. Red teams use it to plan realistic attacks, and blue teams use it to map detections and find coverage gaps.
How do you approach a penetration test engagement end to end?
Scoping and rules of engagement, reconnaissance, scanning and enumeration, exploitation, post-exploitation and privilege escalation, lateral movement, documenting evidence, cleanup, and finally a clear report with risk ratings and remediation. Written authorisation comes before anything technical.
What goes into a good penetration testing report?
An executive summary, scope and methodology, findings with severity (often CVSS), proof-of-concept evidence, business impact, and clear, prioritised remediation steps. The report is the actual deliverable clients pay for.
What is CVSS?
The Common Vulnerability Scoring System rates vulnerability severity from 0 to 10 based on exploitability and impact metrics, producing Low/Medium/High/Critical ratings that help prioritise fixes.
What is the difference between DoS and DDoS?
DoS comes from a single source; DDoS uses many distributed sources (a botnet), making it far harder to block by IP. DDoS also generates much higher traffic volumes.
What is a buffer overflow?
A buffer overflow writes more data than a memory buffer can hold, overwriting adjacent memory, which can crash a program or let an attacker execute arbitrary code. Modern mitigations include ASLR, DEP/NX, and stack canaries.
How do you stay legal and ethical as a penetration tester?
Always get written authorisation and a defined scope, never exceed it, protect any data you access, follow responsible disclosure, and comply with laws such as India's IT Act. No authorisation means no testing, period.
Which certifications strengthen an ethical hacking career?
CEH for foundations and HR screening, eJPT for a practical entry point, and OSCP for respected hands-on offensive skills. Certifications like CRTA also validate red-teaming ability. Pair certs with real lab and CTF experience.
Ethical Hacking Careers and Salaries in India
In India, junior penetration testers typically start around Rs 4-7 LPA, experienced pentesters and red teamers earn Rs 10-20 LPA, and senior offensive security specialists can exceed Rs 25 LPA. Bug bounty earnings add to this for skilled hunters. Practical, tool-driven skills and a portfolio of write-ups matter most.
Cyber Defence (cyberdefence.org.in), founded by Amit Kumar (CEH, CRTA) in Hisar, Haryana, runs a hands-on ethical hacking / CEH-aligned program (Rs 60,000, 6 months) with EMI options; the EC-Council exam voucher is separate. Our beginner cyber security course (Rs 15,000, 3-4 months) is the ideal first step. We are ISO-certified and GeM-registered, with live online and classroom batches. See the best cyber security online course for lab-driven prep.
FAQ
How should a beginner prepare for an ethical hacking interview?
Learn the five phases of hacking, get fluent with Nmap, Burp Suite, and Metasploit in a home lab, understand the OWASP Top 10, and practise on TryHackMe and Hack The Box. Be ready to explain your methodology, not just tool names.
What are the most common ethical hacking interview questions?
The five phases of hacking, black vs white vs grey hat, footprinting and reconnaissance, Nmap scan types, SQL injection and XSS, privilege escalation, reverse vs bind shells, and how you run an engagement end to end are asked most often.
Is CEH enough to get an ethical hacking job?
CEH helps clear HR filters and builds a solid foundation, but employers want demonstrable hands-on skills. Combine CEH with practical labs, CTFs, and ideally OSCP or a strong portfolio to stand out.
What is the difference between ethical hacking and penetration testing?
Ethical hacking is the broad discipline of legally finding weaknesses; penetration testing is a focused, scoped engagement that simulates an attack to test specific systems. Every pentest is ethical hacking, but ethical hacking is wider.
Do interviewers ask about legality?
Yes. Expect questions on authorisation, scope, responsible disclosure, and compliance with laws like the IT Act. Emphasising that you never test without written permission is essential.
Does Cyber Defence teach practical ethical hacking?
Yes. Our CEH-aligned program is lab-driven, covering recon, scanning, exploitation, web attacks, and reporting on real targets in a safe environment. Reach us at +91-75175-72000 for details.
Want to become a job-ready ethical hacker? Book a free counselling call with Cyber Defence in Hisar. Call or WhatsApp +91-75175-72000 today.