Certifications vs Real Experience: How to Validate IT Infrastructure Candidates Before You Hire

Every infrastructure hiring manager has a version of this story. The CV looked excellent. CCNP on it, maybe a VMware certification alongside, perhaps an AWS badge for good measure. The interview went fine. The person started, settled in and everything seemed reasonable for a few weeks.

Then came the first real outage. A production environment down, pressure mounting, half the business asking for updates and it became quietly obvious that the new hire had studied all of this but never actually lived through it. They knew what the textbook said. They’d never had to make a call at 2am with incomplete information and a very real clock running.

That gap, between what a certification proves and what the job demands, is one of the most expensive problems in infrastructure hiring. Expensive quite literally: the Uptime Institute’s 2026 Annual Outage Analysis found 57% of operators said their most recent major outage cost more than $100,000, with one in five putting it above $1 million. And the uncomfortable truth is that most hiring processes are built to miss the gap entirely.

 Hire Production-Ready Infra Talent with Prism HRC

What a certification actually tells you

Let’s be fair to certifications first, because they’re not worthless. A CCNA, CCNP, RHCSA, VMware or AWS certification tells you something genuinely useful: this person committed time to structured study, absorbed a defined body of knowledge and passed an exam designed to be non-trivial. That’s a real signal of effort and baseline understanding.

What it doesn’t tell you is anything about production. Certifications test knowledge under controlled conditions, with clean scenarios, known variables and no consequences for a wrong answer beyond losing a mark. Production is the opposite of all of that. It’s messy, it’s half-documented, it’s full of decisions made by people who left two years ago and it punishes mistakes immediately and publicly.

So the right way to think about a certification is as a filter, not a verdict. It gets someone into the conversation. It doesn’t get them the job.

First things first: is the certification even real?

Before you assess what a certification proves, it’s worth establishing that it exists. Certification fraud is more common than most hiring managers assume, ranging from outright fabrication to inflated claims (“completed the training” quietly becoming “certified”) to certifications that lapsed years ago and were never renewed.

The numbers bear this out. HireRight’s 2025 Global Benchmark Report found that more than three-quarters of employers globally uncovered at least one candidate discrepancy during background screening in the previous year, with a roughly 20% discrepancy rate across employment, academic and professional licence verification. Checkr’s 2025 survey of 3,000 US hiring managers put it more bluntly: 60% had caught candidates lying on resumes or applications. Roughly one in five checks surfaces something.

The good news is that every major vendor offers a way to verify. The general approach is consistent across them:

Most vendors operate a verification system where a certification holder can generate a verification code, a shareable digital badge, or a public credential link. Cisco, Red Hat, VMware, Microsoft and AWS each run some form of this. Cisco certificates, for instance, carry a 16-digit verification number on the certificate itself, while Red Hat, AWS, Microsoft and VMware all issue digital badges through Credly.

The cleanest method is to ask the candidate directly for their verification code, credential ID or badge link during the interview process. A genuine certification holder can produce this quickly, it’s a normal request and anyone who becomes evasive about it is telling you something.

Check the status, not just the existence. Many certifications expire, CCNA and CCNP both lapse after three years without recertification. A CCNP earned in 2019 and never renewed is a legitimate achievement and an expired credential at the same time. The verification will usually show you the current status and expiry date.

Watch for the training-versus-certified distinction. Completing a course is not the same as passing the certification exam and CVs blur this line constantly, sometimes innocently.

A practical note: each vendor’s verification method changes periodically as they update their credentialing platforms. Confirm the current process on the vendor’s own site rather than relying on a link or procedure from a year-old article.

At Prism HRC, verifying certification authenticity is a standard part of how we screen infrastructure candidates, precisely because it’s a quick check that catches a surprising number of problems before they reach a client interview.

Let Prism HRC Verify Your Candidates

Now the harder part: testing for real experience

Once you know the certification is genuine, you still haven’t learned whether the person can do the job. That requires a different kind of assessment and the single most effective tool is the scenario question.

The principle is simple. Stop asking what something is and start asking what they’d do. “What is OSPF?” tells you whether someone studied. “Our OSPF adjacency keeps flapping between two routers in production, walk me through how you’d diagnose it” tells you whether they’ve been there.

Three techniques work particularly well together.

Scenario-based troubleshooting. Present a realistic problem with incomplete information and watch how they reason. Strong candidates ask clarifying questions before proposing fixes. They talk about what they’d check first and why. They mention things like blast radius, rollback and who they’d inform. Weak candidates jump straight to a solution, usually the textbook one.

Small, practical lab tasks. A short hands-on exercise, 30 to 45 minutes, reveals an enormous amount. You’re not testing whether they can finish perfectly; you’re watching how they work. Do they check before they change? Do they document? Do they notice when something looks wrong?

Incident-focused reference checks. This is the most underused tool in infrastructure hiring. Instead of asking a referee whether the candidate was good, ask about a specific incident: “Tell me about a time something broke on their watch. What happened, what did they do and how did it resolve?” The answer tells you far more than any general endorsement.

Role family 1: Servers and virtualisation

For system administrators, VMware specialists and Linux or Windows infrastructure engineers, a proper system administrator skills assessment should go well beyond asking about commands.

What certifications typically cover here: RHCSA, RHCE, VMware VCP, Microsoft certifications. These demonstrate knowledge of the platform, its tooling and standard operations.

What they don’t cover: running that platform under load, through failures, with real users affected and real data at risk.

Scenario questions worth asking:

• “A production VM is running unusually slowly, but the host shows normal CPU and memory. Where do you look next?”
• “You’ve been asked to patch a cluster of production servers with no downtime window. How do you approach it?”
• “A colleague ran a command that deleted data they shouldn’t have touched. Walk me through the first hour.”
• “How do you decide whether to reboot a problematic production server versus continuing to investigate?”

What strong answers sound like: they talk about storage latency, network bottlenecks, noisy neighbours, snapshot sprawl. They mention backups, change windows, communication and rollback before they mention the fix. They’ve clearly been in the room when it mattered.

Lab task: give them access to a small test environment with a deliberately misconfigured service and ask them to find and fix it, narrating as they go.

Role family 2: Networking and security

For network engineers, this is where CCNA CCNP hiring tends to go wrong most often, because networking certifications are genuinely rigorous and it’s easy to over-trust them.

It’s also where the stakes concentrate. The Uptime Institute’s analysis found that 53% of all outages stem from IT and network issues, frequently tied to misconfiguration and change-management failures, with the majority of severe outages judged preventable through better process and earlier detection. In other words, exactly the judgment your interview should be testing for.

What certifications typically cover here: CCNA, CCNP and security equivalents. Solid protocol knowledge, configuration syntax, theoretical design principles.

What they don’t cover: diagnosing a problem across a live network where the documentation is wrong, the change log is incomplete and three teams are each certain the problem is somebody else’s.

Network engineer interview questions that actually reveal experience:

• “Users in one office report intermittent slowness. Nothing is down. Where do you start?”
• “You push a routing change and lose connectivity to the device you’re configuring. What now?”
• “Describe a time a network issue turned out to be something other than the network.”
• “How would you approach troubleshooting a problem that only appears under peak load?”

That second question is particularly revealing, because anyone who’s genuinely worked in production has locked themselves out of a device at least once and they’ll usually tell you about it with a rueful laugh. The answer also surfaces whether they use scheduled rollback, console access and change approval.

What strong answers sound like: they go layer by layer. They mention packet captures, interface counters, logs, recent changes. They’re comfortable saying “I’d need to check X before I could say.” They talk about what they’d communicate to users while investigating.

Lab task: a small topology with a deliberate misconfiguration, or a packet capture to interpret.

Role family 3: Cloud infrastructure

Cloud is where certification inflation is most visible, partly because the certifications are accessible and heavily marketed and partly because “worked with AWS” can mean anything from architecting a multi-account environment to clicking through a tutorial.

What certifications typically cover here: AWS, Azure and GCP associate and professional certifications. Service knowledge, architectural patterns, the vendor’s recommended approach.

What they don’t cover: cost, scale, migration pain and what happens when the recommended approach doesn’t fit the business reality.

Scenario questions worth asking:

• “Our cloud bill jumped 40% last month with no obvious change in usage. How do you investigate?”
• “Design an environment for three product teams who need isolation but shared services. Talk me through the trade-offs.”
• “A deployment worked in staging and failed in production. What differences would you look for?”
• “Tell me about a migration you worked on. What went wrong?”

The cost question is a good differentiator. Candidates who have genuinely run cloud infrastructure think about cost instinctively, because somebody has asked them about it. Candidates who have only studied rarely raise it unprompted.

What strong answers sound like: they mention tagging, cost allocation, idle resources, data transfer charges, right-sizing. On architecture, they discuss account separation, IAM boundaries and governance rather than just listing services. They’re honest about what went wrong in past migrations, because something always does.

Lab task: ask them to review an existing infrastructure-as-code template and identify problems with it.

Putting it together: a validation framework

A practical process for any infrastructure hire looks roughly like this:

1. Verify the certification through the vendor’s own process, including current status and expiry.
2. Screen the CV for depth, not breadth. Someone who went deep on one platform usually beats someone who lists five.
3. Run scenario-based IT infrastructure interview questions tuned to the role family.
4. Set a short, practical lab task and observe the working style, not just the result.
5. Check references on specific incidents, not general performance.
6. Probe recency and scale. A skill last used two years ago may be stale and lab-scale experience is not production-scale experience.

None of this is complicated. It’s just more deliberate than most processes manage, which is exactly why mis-hires keep happening.

Get Pre-Screened Infra Engineers from Prism HRC

Where Prism HRC fits in

As an IT infrastructure recruitment agency we see these searches from the side hiring managers usually don’t: the candidates who look identical on paper and turn out to be nothing alike. Verifying certification authenticity is where we start, because it’s quick and, with roughly one in five background checks surfacing a discrepancy, it catches real problems. But the bigger value sits in what comes after, screening for demonstrated production experience rather than credential count and asking the kind of scenario questions that separate someone who has studied the platform from someone who has been woken up by it.

If you’re hiring across servers, networking or cloud infrastructure, that distinction is usually the difference between a hire who steadies the team and one who becomes another problem to manage.