Nothing is in scope unless it is written. The RoE is the legal and safety boundary — authorized IPs, the exclude list, windows, banned techniques, emergency contacts, data handling, and who signs. Discovery finds possible weaknesses. Attack confirms them. A scanner line is not a finding. OWASP Top 10 names the risk class; WSTG and ASVS tell me what to test. I rate with a CVSS vector, then I add the client’s business impact. I do not dump production PII to prove I can.
1. Ticket hook — Slack said “also scan payroll”
The SOW is three hostnames: www.example.com, api.example.com, admin.example.com. The RoE exclude list names the payroll VPN and a third-party payment processor. Day two, a manager DMs “we own 203.0.113.0/24, add it.” The junior’s scan already returned a Critical on 203.0.113.40 — an IP WHOIS shows is a hosting neighbor, not the client.
That is the interview. NIST SP 800-115 §5.2.2 is explicit: if you are given authorized IPs, verify that public addresses are under the organization’s purview before testing begins. Appendix B of the same guide requires an exclude list and a signed RoE. A Slack message is not a signature.
Scope — the written in-list (hosts, apps, CIDRs, accounts) plus the exclude list. Rules of Engagement (RoE) — the signed assessment plan: what is authorized, what is banned, when, who to call, how data is handled. Discovery — information gathering, scanning, and vulnerability analysis (possible issues). Attack / exploit — attempting to confirm a possible issue; a successful exploit is a verified finding. PoC — the smallest reproducible evidence that the issue is real. CVSS Base — intrinsic technical severity, 0.0–10.0, published with a vector string. Environmental score — that same issue, re-weighted for this client’s CIA requirements.
2. Mental model: four stations of an engagement
Interviewers mix legal, method, exploit, and reporting on purpose. Keep them on different stations. A WSTG test case is not a Top 10 label. A Nessus plugin is not a finding. A CVSS 9.8 on a lab box is not automatically the first slide in the CISO pack.
What the standard owns
NIST SP 800-115 owns the four-stage pentest loop and the RoE template. OWASP owns the risk list (Top 10) and the test cases (WSTG). FIRST owns the CVSS equations. You do not invent a fifth stage called “the junior already scanned it.”
What the tester owns
Which station you are on, the written boundary, the decision to stop at discovery or proceed to attack, the evidence you will attach, and the sentence that turns a score into a business risk.
VA is breadth. PT is confirmation.
NIST groups techniques in three buckets: review (docs, logs, rulesets), target identification and analysis (discovery, port/service ID, vulnerability scanning), and target vulnerability validation (password cracking, penetration testing, social engineering). A vulnerability assessment lives mostly in the middle bucket. A penetration test adds the third — it exploits to confirm. VAPT, as clients use the word, is usually a scan-plus-manual-validation engagement. Do not let the interviewer treat the acronym as a standard. Treat it as a delivery mix, then name which NIST bucket you are in.
3. Decision flow: in-scope before exploit
Flowchart first. You do not fire Metasploit because a plugin is red. You name the asset, check the in-list and the exclude list, check the banned-technique line, then decide: stay in discovery, or enter attack with a stop condition.
Read left → right, then down. Diamond = written ownership. A Slack “we own it” is not WHOIS and is not a signature.
4. How to choose the method
Use the official words in the room. OWASP itself says the Top 10 is primarily an awareness document, and that using it as a pentest standard is the bare minimum. For a verifiable standard they point you at ASVS. For how to test a web app, the working document is the Web Security Testing Guide.
| Question | First method | Why this, not that | Proof you name |
|---|---|---|---|
| Is this host ours to touch? | RoE in-list + exclude list + WHOIS / inventory | A Slack ping is not authorization. NIST §5.2.2: verify public addresses before testing. | Signed RoE page + owner record |
| What may we do to it? | RoE “testing execution” + banned list | DoS, cred stuffing, production data dumps, and off-hours windows live here — not in the sales deck. | Allowable / unallowable paragraph |
| Client wants “OWASP coverage” | WSTG test cases, mapped to Top 10 labels | Top 10 is a risk list. A04 Insecure Design is mostly not a scanner check. OWASP says so. | WSTG-* IDs in the method appendix |
| Scanner said Critical | Stay in discovery until you attempt (or formally skip) exploit | Version-match plugins are suspects. A confirming request/response is a finding. | PoC request + impact note, or “unverified” |
| How bad is it for this client? | CVSS Base vector + Environmental / business overlay | Base is intrinsic. FIRST tells consumers to add environment. A 4.3 on the payment API can outrank a 9.8 on a lab VM. | Vector string + CIA requirement |
| VA or PT? | Ask what question the buyer needs answered | VA = possible weaknesses, broad, repeatable. PT = confirmed impact, narrower, human-driven. | Which NIST bucket you will execute |
Reciting the 2021 Top 10 in order and calling that a methodology. OWASP’s own “How to use the Top 10 as a standard” page: it is the bare minimum for penetration testing, and they discourage claims of full Top 10 coverage because several risks (notably A04) are not comprehensively testable. Say the list, then name the WSTG cases and the ASVS level you actually ran.
5. Do: lock RoE → prove → report
Side A is legal and logistics. Side B is execution inside the written box. Side C is the close-out a hiring manager wants to hear. Primary source for this block: NIST SP 800-115 Appendix B (RoE template), §5.2.1 (four-stage methodology), and §7.3–7.4 (analysis and data handling).
Side A — Lock the boundary
-
Write the in-list and the exclude list
Hostnames, CIDRs, URLs, test accounts, and third-party systems. NIST Appendix B §4: identify systems not authorized for testing — the exclude list. Verify public IPs are actually the client’s before a packet leaves your box.
-
Write stop conditions and contacts
Appendix B §3.2: criteria for halting, course of action if a procedure harms the network, and the incident-response call tree. Name the person who gets the 2 a.m. call if you land Domain Admin. NIST §7.3: a critical exploit is notified immediately, not buried in Friday’s PDF.
-
Get the signatures
Appendix B §7: at minimum the test team leader and the organization’s senior security management (CSO / CISO / CIO). A project manager emoji-reacting in Slack is not that page.
Side B — Execute inside the box (training mock)
Primary source: NIST §5.2.1 discovery (info gathering + vulnerability analysis) then attack (confirm). Every action is timestamped. §7.2: record test type, tool, commands, and the IP of the testing equipment.
RoE v1.2 signed · window 22:00–06:00 IST · DoS banned · no prod PII export
F-014 · Broken access control (IDOR)
WSTG WSTG-ATHZ-04 · map A01:2021
PoC GET /v1/invoices/8841 as user-b → 200, peer invoice
Data two invoice IDs only · no bulk export
CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N · Base 7.1 High
Env overlay CR:H (invoices = customer financials) → treat as first-week fix
Training mock · not live. Notice the fields: in-list, WSTG ID, smallest PoC, data-handling limit, CVSS vector, then the environmental overlay. That is the finding card, not a scanner CSV.
RoE: in-list / exclude / window / banned / contacts / signatures Ownership: WHOIS or asset inventory for every public IP Discovery log: timestamp, tool, tester IP, command Finding card: asset, WSTG-ID, request/response (redacted), CVSS vector If critical: notify RoE contact now; do not wait for the report
Side C — Close without becoming the incident
-
Handle data as the RoE wrote it
NIST Appendix B §5.3 and §7.4: gathering, storing, transmitting, and destroying test data is written in advance. Vulnerability data is sensitive. Screenshots get redacted. Production dumps do not leave the engagement folder.
-
Write the report the CISO can act on
NIST §5.2.1: the closing report describes identified vulnerabilities, presents a risk rating, and gives mitigation guidance. Structure: executive summary, scope and method, findings (one card each), risk table, remediation, appendix of evidence. Daily status notes already exist because reporting ran in parallel.
-
Rate, then overlay
FIRST CVSS 3.1: publish the Base score and the vector. Qualitative bands: None 0.0, Low 0.1–3.9, Medium 4.0–6.9, High 7.0–8.9, Critical 9.0–10.0. Then say what the Environmental / business overlay does for this asset. Do not relabel a 4.3 as Critical without saying you left the Base equation.
6. Runtime path: NIST four stages
After kickoff the engagement is a loop, not a waterfall. Discovery has two parts: information gathering / scanning, then vulnerability analysis (scanner databases plus the tester’s own knowledge). Attack confirms. A successful exploit often reveals a new host or privilege — that is the feedback arrow back into discovery. Reporting is not a fifth weekend activity; NIST draws it alongside all three other stages.
Read the top row as NIST. The red arrow is the official feedback loop. The bottom row is what you cite when the interviewer asks “PTES or OWASP?” — both, for different jobs.
7. Eight interview scenarios
Q1 · Scenario — Slack said add the payroll /24
SOW lists three hostnames. Mid-engagement the app owner DMs “also scan 203.0.113.0/24, we own it.” A junior’s scanner is already running. First move?
Strong framing (say this)
I halt, I prove ownership, I amend the RoE, I restart only the authorized range. I do not launder an out-of-scope scan through a Friday email.
Evidence to name
Signed RoE in-list and exclude list; WHOIS / asset owner; NIST SP 800-115 §5.2.2 and Appendix B §§4 and 7.
Q2 · Evidence — what must be in the RoE
The interviewer slides a one-page “authorization letter” that only says “Company X permits Techclick to test our website.” What is missing if you are answering from NIST Appendix B?
Strong framing (say this)
I treat Appendix B as the checklist. If a section is blank, we do not start discovery.
Evidence to name
NIST SP 800-115 Appendix B §§1–7 — especially §3.2 incident handling, §4 exclude list, §5.2 technical components, §5.3 data handling, §7 signatures.
Q3 · Compare — OWASP Top 10 versus WSTG
A hiring manager says “we need a full OWASP Top 10 pentest.” How do you answer without sounding like you refused the work?
WSTG-ATHZ-04, WSTG-INPV-05) mapped back to Top 10 labels. For a verifiable standard, point at ASVS.Strong framing (say this)
Top 10 names the conversation. WSTG drives the cases. ASVS is what I put in the method appendix when they need a standard, not a poster.
Evidence to name
OWASP Top 10:2021 list; “How to use the OWASP Top 10 as a standard”; WSTG scenario IDs; ASVS.
Q4 · Troubleshoot — scanner Critical, exploit fails
Nessus reports CVE-shaped Critical on api.example.com from a version banner. Your confirming request does not land. The PM wants it in the Critical slide anyway. What do you do first?
Strong framing (say this)
Possible versus confirmed. I will not launder a banner match into a Critical. I will show the failed confirm so they can still patch if they want defense in depth.
Evidence to name
NIST SP 800-115 §5.2.1 (scanner vs attack) and §7.3 (false positives, NVD/CVSS as a reference — not as automatic severity).
Q5 · Architecture — draw the engagement
Whiteboard. “Draw your methodology.” They have heard of PTES and of OWASP. What do you draw first, and what do you say about the red arrow?
Strong framing (say this)
NIST is the assessment spine I can defend in a regulated shop. PTES is how I talk phases with other testers. OWASP is how I test the web app on that spine.
Evidence to name
NIST SP 800-115 Figure 5-1 and §5.2.1; PTES seven phases as listed in the WSTG methodologies chapter; WSTG IDs in the method appendix.
Q6 · Compare — client asks for “just a scan”
Procurement wants a cheap VAPT. They say “run the scanner, we’ll call it a pentest for the auditor.” How do you separate VA from PT without losing the deal or lying to the auditor?
Strong framing (say this)
VA answers “what might be wrong.” PT answers “what I could actually do.” I will sell them the mix they need, and I will name it correctly on the cover.
Evidence to name
NIST SP 800-115 §2.2 technique groups; §5.2.1 scanner-versus-attack sentence; the report title matching the SOW.
Q7 · Evidence — the report a CISO will fund
You have 40 scanner rows and three confirmed issues, including an IDOR on invoices. What does the closing report contain, and how do you rate the IDOR?
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). If invoices are a high confidentiality requirement, say the overlay and the fix window — do not silently rewrite the Base number to 9.8.Strong framing (say this)
Confirmed first, unverified last. Score plus vector, then the business overlay in a separate sentence.
Evidence to name
NIST §5.2.1 reporting sentence; FIRST CVSS 3.1 §5 qualitative table and §6 vector string; finding card fields from Side B.
Q8 · Unsafe shortcut — dump prod to “prove impact”
A junior lands a SQLi. The RoE bans denial of service and bulk export of personal data. They want sqlmap --dump on the customers table “for the screenshot,” and a UDP flood “to show availability impact.” What do you stop, and what is the safer path?
COUNT(*) / tautology that proves read access, redacted. Availability impact is described and, if needed, tested only if the RoE explicitly allows a controlled test on a named environment. NIST §7.2: if you cause or find an incident, follow the RoE and the org’s escalation — testers stop on the involved systems while response runs.Strong framing (say this)
Smallest confirming evidence. I will not become the breach. If they want a destructive test, it is a new signed line in the RoE, on a named system, with a rollback.
Evidence to name
RoE banned-technique and data-handling clauses; NIST Appendix B §5.2–5.3, §3.2 halt criteria; §7.2 operational impact and incident handling; §7.4 data handling.
8. Traps and proof checklist
| Trap | What you see | Safer next step |
|---|---|---|
| Slack scope change | Extra /24 in the scan queue | Halt. WHOIS / inventory. Written RoE amendment + signatures |
| Authorization letter only | One sentence, no exclude list, no halt criteria | Fill NIST Appendix B before discovery |
| Top 10 as the test plan | “We covered OWASP” with ten scanner plugins | WSTG IDs in the method; ASVS if they need a standard |
| Scanner Critical = finding | Banner match, exploit does not land | Label unverified; do not promote the score |
| No feedback loop | New host after exploit, never re-scanned | Attack → Discovery arrow; test the new privilege |
| Scan titled “pentest” | Auditor asks where the exploit evidence is | Name the NIST bucket on the cover; do not relabel |
| CVSS number without a vector | Nobody can replay the 7.1 | FIRST: score + vector; overlay in a separate sentence |
--dump / DoS for the screenshot |
PII in the evidence zip; or an outage | Smallest confirming PoC; banned techniques stay banned |
- In-list and exclude list spoken; a Slack change is not treated as authorization.
- RoE sections named: halt criteria, contacts, data handling, signatures (lead + CISO/CSO/CIO).
- Ownership of every public IP checked before a packet (NIST §5.2.2).
- OWASP Top 10 used as labels; at least one WSTG ID named; ASVS mentioned if they asked for a standard.
- Discovery versus attack named; a scanner row is not called confirmed.
- Finding card: asset, method ID, redacted PoC, CVSS vector + band, business overlay, fix.
Knowledge check
Six judgment items. Each maps to a promise bullet. Check answers, then reset and re-read the traps table if you miss any.
Sources
- NIST SP 800-115 — Technical Guide to Information Security Testing and Assessment (CSRC landing page)
- NIST SP 800-115 PDF — Figure 5-1 four-stage methodology; §5.2.1 discovery vs attack vs reporting; §5.2.2 verify authorized public IPs; §7.2–7.4 incidents, analysis, data handling; Appendix B RoE template
- OWASP Top 10:2021 — official risk list A01–A10 (awareness document)
- How to use the OWASP Top 10 as a standard — pentest use is bare minimum; ASVS is the verifiable standard; no full-coverage claims
- A01:2021 Broken Access Control — IDOR / force browsing examples used in the finding card
- OWASP Web Security Testing Guide — test-case catalog and
WSTG-*identifiers - WSTG — Penetration Testing Methodologies — PTES seven phases as cited by OWASP
- OWASP ASVS — verifiable application security standard OWASP recommends instead of Top 10-as-test-plan
- FIRST CVSS v3.1 specification — Base / Temporal / Environmental; qualitative bands; score must ship with the vector
Related: Burp Suite pentest interview · SOC analyst interview · Linux interview · Wireshark interview · Interview hub