These are the kinds of questions a junior penetration tester or application security analyst is asked, with short answers. The way to make the answers convincing is to have actually done the attacks - the free Web Pentesting course has a lab for every vulnerability below, run against a real target in your browser.
Methodology
Walk me through a web app pentest. Recon and mapping, then test each area - authentication, access control, input handling, business logic - then report findings with impact and clear reproduction steps.
What is the difference between a vulnerability scan and a pentest? A scan is automated and finds known issues; a pentest adds human reasoning, chaining and business-logic flaws a scanner misses.
Web vulnerabilities
Explain SQL injection. Untrusted input changes the meaning of a SQL query, letting you bypass logic or read data. Demo: SQLi lab, and the SQL injection cheat sheet.
Difference between stored and reflected XSS? Stored is saved and served to other users; reflected bounces back in the immediate response. Demo: XSS lab.
What is IDOR? Accessing another user's object by changing an identifier because the app does not check ownership. Demo: IDOR lab.
What is SSRF and why is it dangerous? You make the server request a URL you choose, reaching internal services and cloud metadata. Demo: SSRF lab.
Tools and practice
Which tools do you use? Burp Suite or an intercepting proxy, curl, nmap for recon, and the browser dev tools - but be ready to explain what you look for, not just the tool names.
What is the OWASP Top 10? The industry list of the most critical web risks - see OWASP Top 10 explained with labs.
Stand out
Finish the free Web Pentesting course (26 labs) so you have real exploits to walk through. Doing beats describing every time.