Penetration Tester Interview Questions UK: 8 Real Questions and What Interviewers Want

Before your Penetration Tester interview, it helps to see the questions from the interviewer's side. We have picked eight from our set of 25 and added the reason each one gets asked.

Eight Penetration Tester interview questions, and what the interviewer is thinking

1. What does a typical engagement look like for a penetration tester, from kick-off to final report?

Why they ask: They want to know you understand the full lifecycle and not only the technical testing.

2. Which tools do you use during a penetration test, and when do you choose manual testing over automation?

Why they ask: They want to see that you understand tools as aids to judgement, not substitutes for it.

3. What is the difference between black box, grey box and white box testing, and when would you recommend each?

Why they ask: Choosing the right test type shows you add value at scoping stage.

4. What are CREST and the NCSC CHECK scheme, and why do they matter for penetration testing in the UK?

Why they ask: Many UK clients, especially in government, require accredited testers.

5. How do you test a web application for broken access control, and how would you describe the issue to a developer?

Why they ask: Access control flaws top the OWASP Top 10 and are a staple of UK web tests.

6. How do you decide the severity of a finding, and what are the limits of CVSS?

Why they ask: Accurate risk rating is central to a useful report.

7. You are testing a live system used by a hospital and a test step might slow it down. How do you proceed?

Why they ask: Safety-critical environments demand careful judgement.

8. Tell me about a time you were stuck during a test and how you found a way forward.

Why they ask: They want to see persistence, creativity and sensible use of help.

A sample answer to question 1

What does a typical engagement look like for a penetration tester, from kick-off to final report?

It begins long before any testing. I join a scoping call to understand the client's objectives, systems, constraints and timelines, then agree rules of engagement, in-scope targets, testing windows, emergency contacts and written authorisation. During the test I follow an agreed methodology, such as the OWASP Web Security Testing Guide or PTES, and keep careful notes and evidence throughout. I keep the client informed, and if I find something critical, such as an exposed administrative interface or signs of a previous compromise, I raise it immediately rather than wait for the report. Afterwards I write the report, with an executive summary, technical findings rated by risk, clear reproduction steps and practical remediation advice. Then comes a debrief with the client and often a retest to verify fixes. In my view, scoping, reporting and communication are at least half the value of the work.

Common mistake to avoid: Describing only the hands-on testing; Forgetting written authorisation

Want the rest?

Full model answers, key points and common mistakes for all 25 questions are on the Penetration Tester interview questions page. The first five are free, no sign-up needed.