Deloitte interview question

Web application security testing process