NCC Group interview question

How would you test a website for security flaws?