Penetration tester skills test for hiring: scenarios, rubric, and scoring

Hiring a penetration tester is an unusual trust decision: you're paying someone to attack your systems, or your clients' systems, and most of the people making that hire can't personally verify the skills. Certifications don't settle it, and a confident talker can survive an unstructured interview. This page gives you a screen that works anyway: ten job-realistic scenarios, markers of a strong answer for each, a 0-4 rubric with role-level bands, minimum bars on ethics and reporting, and a 60-minute interview plan. Everything is lab-safe and reasoning-based; nothing here asks a candidate to touch production systems. Pair it with the penetration tester hiring guide for pay, sourcing, and the rest of the process.

What to screen for

Four dimensions, weighted for hiring: fundamentals and methodology (30%), how the candidate scopes, prioritizes, and sequences work; technical depth in the track you're hiring for, web application or internal network (30%); reporting and communication (25%), whether engineers can fix and executives can act on what they write; and ethics and safety (15%), whether they stay inside authorization and manage risk to systems.

Level expectations, in observable terms: an entry-level tester follows a scoped workflow in a lab and writes reproducible findings with guidance. A practitioner independently executes and prioritizes based on evidence. A consultant adapts methodology to new environments, timeboxes well, and produces client-ready deliverables. A lead designs engagements, negotiates rules of engagement, and manages production risk. Decide which you're hiring before you score anyone.

The test: 10 scenarios with what strong answers cover

Run these as written responses or interview questions. For a 60-minute screen, pick 6 to 8. All are framed for lab or sandbox conditions.

1. Scope and rules-of-engagement clarification

Scenario: The candidate is contracted to test "the customer portal." The statement of work says "external web application penetration test," but the portal uses single sign-on and third-party payment processing.

Prompt: List the top 8 clarifying questions you'd ask before testing begins.

Strong answers cover: authentication and SSO ownership, third-party systems and whether they're in scope, rate limits and availability windows, data handling rules, and safety constraints. A candidate who would start testing without asking about the payment processor is a candidate who will get you a legal letter.

2. First 90 minutes of an engagement

Scenario: One public IP, one domain, a 5-day window, safe scanning permitted.

Prompt: Outline your first 90 minutes: what you collect, what you defer, and what your stop conditions are.

Strong answers cover: passive reconnaissance before active scanning, a prioritized enumeration plan, explicit stop conditions like signs of production fragility, and note-taking from minute one. Weak answers name tools with no sequencing or judgment.

3. Scan output interpretation

Scenario: A lab segment scan shows: 10.0.2.10 with SSH and web ports; 10.0.2.15 with SMB and RDP; 10.0.2.20 with DNS, Kerberos, and LDAP; 10.0.2.25 with MSSQL.

Prompt: Prioritize what you'd validate next and name the top 5 risks this layout suggests, assuming weak hardening.

Strong answers cover: recognizing the domain controller (10.0.2.20) and the exposure of legacy protocols, prioritizing identity infrastructure and exposed remote access, and reasoning about what an attacker would chain rather than reciting port trivia.

4. Access control validation

Scenario: A portal user can view invoices at /invoice?id=18421, and the IDs are sequential.

Prompt: Describe a safe validation approach for this access control issue, including what evidence you'd capture and how you'd avoid exposing other customers' data.

Strong answers cover: validating with the tester's own second account rather than strangers' records, minimal confirmation instead of bulk enumeration, precise evidence (requests, responses, affected scope), and immediate documentation. Anyone proposing to pull thousands of records to "prove impact" fails on judgment.

5. Risk articulation to different audiences

Scenario: Session tokens are strong, but sessions persist 30 days and aren't invalidated on logout.

Prompt: Explain the risk to a product manager and to an engineer, with remediation and retest criteria.

Strong answers cover: two genuinely different explanations (business exposure for the PM, implementation for the engineer), concrete remediation, and specific retest criteria that define "fixed means verified."

6. Scanner triage

Scenario: A scanner flags 40 findings: missing headers, old jQuery, and "potential SQL injection" on three parameters.

Prompt: Describe your triage method. What do you validate manually first, and what counts as confirmed versus informational?

Strong answers cover: validating the injection flags first because impact is highest, an explicit evidence standard for "confirmed," and honest labeling of the noise. Weak answers forward the scanner report as findings, which is what you're paying a tester not to do.

7. Directory attack-path reasoning

Scenario (lab, read-only data): a service account is local admin on multiple servers, several accounts have passwords that never expire, and a helpdesk group can reset passwords for a privileged group.

Prompt: Explain the likely attack paths and which single control change reduces risk fastest, with justification.

Strong answers cover: chaining the helpdesk reset right into privileged access, the service account as lateral-movement fuel, and a defensible pick for the single fix (most name the helpdesk-to-privileged path) with reasoning about blast radius.

8. Cloud misconfiguration write-up

Scenario: A storage bucket is publicly readable and contains application logs with email addresses and password reset tokens.

Prompt: Write a 6-to-10 sentence finding summary covering impact, exposure, evidence expectations, remediation, and logging or incident-response considerations.

Strong answers cover: the token exposure as an account-takeover path, exposure duration and access logging as open questions, remediation beyond "make it private" (rotate tokens, review access logs), and clean, client-ready prose.

9. Executive summary quality

Scenario: Three findings: the invoice access control issue, weak session invalidation, verbose error messages.

Prompt: Draft a 5-to-7 sentence executive summary a CIO would understand, with prioritization and a recommendation.

Strong answers cover: business impact first, correct prioritization (access control above error messages), no jargon, and a clear recommended sequence. This is the deliverable your money actually buys; weight it accordingly.

10. Ethics and safety checkpoint

Scenario: Mid-test, the candidate finds a path that appears to allow downloading a full customer export, and isn't sure whether downloading it violates the rules of engagement.

Prompt: What do you do next?

Strong answers cover: stop, don't download, document the state, contact the client point of contact for authorization, and propose a minimal confirmation approach. Any answer that downloads first and asks later is disqualifying, whatever the rest of the scorecard says.

Scoring rubric

Score each scenario 0 to 4 and sum to a total out of 40. If two people can review, score independently and average.

• 0, unsafe or incorrect: proposes unauthorized actions, misunderstands core concepts, or gives tool-only answers with no reasoning
• 1, partial: recognizes the topic but misses key constraints or gives vague remediation
• 2, competent: sound approach, basic prioritization, reasonable evidence and remediation, gaps in clarity or risk framing
• 3, strong: structured methodology, correct prioritization, clear evidence plan, role-appropriate communication
• 4, excellent: anticipates edge cases, articulates trade-offs, embeds authorization and safety, writes client-ready language

Bands, minimum bars, and red flags

Read totals as discussion prompts, not automatic outcomes: 0 to 14, fundamentals aren't there for this role. 15 to 24, entry scope; can contribute with guidance. 25 to 32, practitioner; runs discrete workstreams with limited oversight. 33 to 37, consultant scope; strong end-to-end execution and client-facing reporting. 38 to 40, follow up with a deeper work sample before you celebrate; scores this high deserve verification.

Minimum bars regardless of total: ethics scenarios (1 and 10) must average 2 or better for any role. Reporting scenarios (8 and 9) must average 3 or better for client-facing roles.

Red flags: any proposal to act outside scope, findings that are really scanner output, remediation advice an engineer couldn't act on, and hostility toward the idea of rules of engagement.

Running it as a 60-minute screen

A workable structure: 10 minutes on scoping and ethics (scenarios 1 and 10), 20 minutes on enumeration and prioritization (2, 3, and 6), 20 minutes on depth in your track (choose from 4, 5, 7, 8), and 10 minutes on the executive summary (9). For finalists, add a reviewed sample report or a sandboxed lab exercise. Use the same scenarios and rubric for every candidate, collect independent scores before discussing, and combine results with references and a structured interview. The scorecard structures the evidence; you make the call.

Fairness and consistency

Everything that makes this screen useful also makes it defensible: scenarios drawn from real engagement work, the same set for every candidate at the same stage, written anchors, documented scores, and accommodations available on request. Time-box transparently, tell candidates what's being assessed, and never require activity against systems you don't own or control.

Run this screen automatically with Truffle

Collecting written scenario responses from twenty applicants and scoring them consistently is real work, and it's exactly the part software should carry. Truffle is a candidate screening platform that combines one-way video interviews with resume screening and talent assessments. Load these scenarios as one-way interview questions, and every candidate answers the same prompts on their own time while AI transcribes and scores each response against the criteria you set, reasoning shown, with 30-second Candidate Shorts so you can hear how a candidate explains risk without watching every full answer. Your shortlist arrives ranked, with the evidence attached. You still make every call.

Plans start at $49 a month. The 7-day free trial includes 30 credits and no credit card. Start free trial.