Top 50 Ethical Hacking Interview Questions and Answers in 2025

The internet service provider provides an IP address that represents the location of a device connected to the internet. In comparison, the MAC address is provided by the network interface cards (NICs) in the system itself.

MAC address is for the system’s physical address, and IP address gives a unique logical address.

Footprinting in ethical hacking is a practice that involves gathering information about the victim system that will face the cyber attack.

Footprinting is the first step towards hacking, and the hacker creates strategies for finding the bugs in the system. Footprinting can be either passive or active.

A brute force attack is a trick or a technique of hacking in which hackers use trial and error to find login credentials and encryption codes of the desired system.

It is a simple but also an effective method for ethical hacking.

It can be avoided by understanding the poisoning process and identifying it. Using VPNs while using public Wi-Fi keeps the ARP poisoning away.

Static ARP can also be used to prevent spoofing. It is better to use ARP poisoning detectors to prevent the attack. Also, staying away from trust relationships with IP addresses helps.

I will use strong passwords and keep the software updated. I will not open any attachments that I am not sure about.

Also, I’ll use encryption technology and install antivirus protection. I will not take offers from any unsolicited sources. In addition, I’ll use only reliable third-party plugins and add-ons.

This is the stage where the attacker begins compromising the vulnerabilities in the target system. Here, the details of the victim are extracted from open ports. These details can include usernames, user groups, network source, routing tables, machine names, banners, SNMP details, DNS details, applications, etc.

Sniffing is a process of stealing, monitoring, and capturing data packets passing through any particular network. If we don’t use encryption, sniffing tools or sniffers can gather the information from our system. Sniffers are also used to monitor network traffic.

Attackers can see all types of traffic through sniffing, protected or unprotected. Sniffing is of two kinds: active sniffing and passive sniffing.

Active sniffing includes injecting ARPs (address resolution protocols) into a network to flood the switch to the content address memory cable. This will redirect the actual traffic to other ports, which will let the attacker sniff traffic from the switch.

On the other hand, passive sniffing is the process done through the hub. In any system that uses a hub, systems can perform this kind of sniffing on them. For example, any data sent on LAN can be seen by all the users connected on LAN by passive sniffing. This is called passive cause attackers wait for data to be sent so they can capture it.

IDS stands for Intrusion Detection System. It is a system device or software that monitors suspicious activities on the network and gives alerts when they sense any threat.

Burp Suite is a toolset used for penetration testing of any web application. It is a Java-based testing framework used for web penetration.

It contains tools like Spider, Proxy, Intruder, Repeater, Decoder, Sequencer, Scanner, Extender.

SQL injection is a cyber-attack in which malicious SQL code is used for gaining access to a database or system. SQLi allows hackers to view data that they can not usually retrieve. SQL injection is broadly of three types.

In-band or Unsanitized SQL injection, Inferential or Blind SQL injection, and Out-of-band SQL injection.

Denial of service attack (DoS) is a cyber-attack where the authorities or the authorized users can not access their system. It affects all the internet-based services like emails, websites, banking operations, etc.

Attacker flood target system with malicious emails and links until normal traffic can not be processed, which results in denial of service.

Active reconnaissance and passive reconnaissance are types of cyberattacks. In the passive kind of attack, the attacker engages with the targeted network or the system to gather a piece of information like passwords and data.

In passive reconnaissance, no direct engagement is performed. It gives no alerts to the victim system and collects information without the target knowing.

Ethical hacking and hacking both are types of activities in which an attacker is trying to find information about the targeted digital device or system. 

The difference is that hacking is an activity that includes stealing or destroying information and data. In contrast, ethical hacking is the activity in which the same tools are used to safeguard the network or device so that hackers with malicious intentions can not get access.

Hacking is an illegal practice, while ethical hacking is performed with permission from the authority.

Phishing is a cyberattack where the attacker or hacker sends a mail or an SMS with a malicious link. The hacker steals data and information like passwords and important banking credentials when that link is opened.

Attackers often use fake names of trusted brands and dupe users into opening the message.

For countermeasures, a user should not open any email or SMS from any source that is not reliable. Filtering emails for phishing threats and detecting malware on endpoints also helps.

Black hat hackers use hacking tricks and techniques for malicious purposes like stealing corporate data, transferring funds from others’ bank accounts, asking for ransom, etc. 

Their motives are to profit themselves by selling the stolen data, asking for money to decrypt the hacked data or accounts, etc. These are illegal activities and crimes. 

White hat hackers are ethical hackers who apply their skills to identify and fix the vulnerabilities in a system. 

Their role is to correct the weaknesses that black hat hackers can otherwise exploit. White hat hackers have the authority to hack the systems to make them more secure. 

Grey hat hackers fall between white hat and black hat hackers. These hackers gain access to systems or networks without authority but don’t do malicious activities like stealing data or money. 

Grey hat hackers find vulnerabilities and inform the system owners about them.

Top vulnerabilities are SQL Injection, XML external entities (XXE), Sensitive data exposure, Cross-site scripting (XSS), Insecure deserialization, Using components with known vulnerabilities, Security misconfiguration, Broken authentication, Broken access control, Insufficient logging, and monitoring.

There are several ways to mitigate an SQL injection.

Prepared statements with parameterized queries, stored procedures, allow-list input validation, and escaping all user-supplied input are primary defenses can be used to mitigate SQL injections.

Also, additional defenses like performing allow-list input validation as a secondary defense and enforcing least privilege helps.

A keylogger is a software program in a system that monitors the activity and gives access to the hacker. The fraudulent software records everything we type with a keyboard. Keylogger is used for stealing information like passwords and banking card details.

The best ways of saving a compromised system are to disconnect the internet as soon as possible. Check if there are any malicious activities in log files or the recent activity section. Scan the system’s security with reliable antivirus software.

Simple Network Management Protocol.

Simple Mail Transfer Protocol.

I will keep all the confidential information secure and say no to them. And I would advise visiting the office for any inquiry related to that.

In a half-open scanning or an SYN scanning, the hacker sends an SYN to the system and waits for an ACK response from the target. 

If a response is received through that, the scanner does not respond. Since the TCP connection remains incomplete, the system won’t log the interaction, but after that sender can see if the port is closed or open. It is used for DoS type of attacks.

TCP communication occurs between client and server. A client is provided a service or task by a server in the network. Before it transmits data, TCP secures a connection between client and server, which remains there till communication happens.

Cryptography is a technique by which information is secured by encryption and decryption. It is a mathematical function that protects the plain text by encrypting it.

CIA Triad is a fundamental security infrastructure measurement in any network and its safety. C stands for confidentiality, I for Integrity, and A for availability.

Both techniques create a unique code out of the plain text. Hashing is a one-way function in which the plain text is coded but can not be used to reveal the original text. Encryption is a two-way process in which we can encrypt the plain text and decrypt it later with the proper input.

A firewall is a cyber security device used to protect a network from harmful traffic that can gain unauthorized access to the network.

It is used to prevent malicious traffic by creating a barrier between the network and the traffic. It will stop open access to all and deal with network crashes from attackers.

Vulnerability assessment discloses security weaknesses in the network while penetration testing tests network security measures and defenses if they are strong enough or not, basically for checking if they are hack-proof or not.

Vulnerability assessment is automated, and penetration testing combines automatic and manual processes.

In a TCP/IP network, a three-way handshake is a method to create a connection between a local host and server. TCP transmits three messages before a session is initiated between client and server.

The OSI Model has seven layers. Physical layer, network layer, transport layer, data link layer, session layer, presentation layer, and application layer.

MITM attack stands for a man-in-the-middle attack. This occurs when an attacker interrupts any data transfer or any ongoing conversation without both parties knowing about it. The attacker secretly steals information by placing himself in the middle while pretending to be both participants.

A VPN gives users anonymity by creating a private network from a public network.

It hides a user's online activity and hides IP addresses by creating a virtual network. VPNs are also used to guard the network against hackers and frauds.

An XSS attack is a malicious injection in which a harmful script is injected into the trusted website. The attacker uses a web application to perform this action.

To prevent these types of attacks, it is advised to use user data only when required and by using web application vulnerability scanning tools.

A botnet is a group of internet-connected devices which are controlled by the hacker who can operate the whole system from his device. A botnet can be used for stealing data, carrying out DoS attacks, and banking details.

Honeypots are a security mechanism that adds to the system security other than a firewall. This is used as an easy entry point that misleads the hackers, and they can’t get to the additional useful information in the system. This security pattern uses deception technology to deceive attackers.

A virus triggers when the host activates it unintentionally, but for replication, it needs further permissions. Worms self propagate on their own once they get into the system and they can spread very quickly in the system. A worm is more dangerous in any system as it can infect all email contacts.

A polymorphic virus is a deadly and destructive type of virus that keeps changing within the system, making it difficult for antivirus to detect. It keeps changing the encryption codes to stay undetected. It spreads with spam and infected websites.

Shoulder surfing is a technique used for stealing bank details, login credentials, and other crucial information. When a user is inserting the credentials in their device, the criminal watches from behind over their shoulder to steal the data.

CSRF stands for Cross-Site Request Forgery.

Port scanning is used to determine port status if that is open or not. It helps the user to detect if there is any security threat or breach. It is used by the administration to verify security policies, while attackers use it to identify network services and exploit them.

WAF is a security tool used for filtering and blocking unwanted traffic. This firewall is used to prevent attacks like XSS, SQL injections, and cookie poisoning. WAF stands for web application firewall.

Network sniffing is a practice where the attacker steals data packets on a network containing sensitive and crucial information.

Network administrators use it to monitor and troubleshoot unwanted traffic on the network.

A Remote Desktop Protocol is a safe network communication protocol developed by Microsoft. It allows users to use windows on a different device from another location. RDP uses an encryption channel for communications.

Forward secrecy is a feature that assures that the long-term and vital secrets shared in the session are kept safe. It works by generating unique keys every time a user initiates a session.

Wireshark, Paessler PRTG, ManageEngine, NetFlow Analyzer, Tcpdump, Auvik, SolarWinds Network Packet Sniffer, NetworkMiner, WinDump, ManageEngine are used for packet sniffing.

When a hijacker takes over an internet session, it is called session hijacking. The hijackers target web browsers for stealing login credentials or banking credentials.

Hijacker gets in between the website’s server or application and the victim’s computer to hijack a session.

Backdoor is a process that bypasses the information to another device. The malware enters through outdated plugins or input fields. In any unsecured application, remote access is granted to file servers, giving hackers access to control the system.

WEP or Weak Encryption Protocol is a method used for a security breach in any wireless network. It is of two types: active cracking and passive cracking.

I will not open the link at any cost. I will log into the bank application or online banking platform in a regular manner and check if there is an actual problem or not. I will visit my bank branch for further information.