NCC Group Interview Question

How would you test a website for security flaws?