Network Security, Interview Questions.

Layered controls so that one failure does not mean a breach: perimeter filtering, network segmentation, host hardening, identity and MFA, encryption, monitoring and response. Each layer assumes the one before it may fail.

A device or service that allows or blocks traffic by policy. Packet filters match IP, port and protocol. Stateful firewalls also track connections, so return traffic is allowed automatically. Next-generation firewalls add application awareness, user identity, intrusion prevention and TLS inspection. Web application firewalls protect HTTP apps at layer 7. Cloud equivalents are security groups and network ACLs.

An IDS watches traffic and alerts. An IPS sits inline and can block. Detection may be signature-based (known patterns), anomaly-based (deviation from baseline) or behavioural. Inline blocking raises the cost of false positives and the risk of outages, so IPS rules are tuned carefully.

TCP is connection-oriented with a three-way handshake and reliability. UDP is connectionless and fast. Security impact: TCP SYN floods abuse the handshake, UDP is easy to spoof so it is used for amplification attacks (DNS, NTP, memcached), and stateful firewalls handle the two differently.

An encrypted tunnel across an untrusted network. Site-to-site links networks (typically IPsec). Remote access connects individual users (IPsec, SSL/TLS VPN, WireGuard). Full tunnel sends all traffic through the corporate network, while split tunnel sends only corporate destinations, trading visibility for performance.

Dividing a network into zones (VLANs, subnets, security groups) with controlled paths between them. It limits blast radius and lateral movement, protects sensitive systems such as databases and payment systems, and helps compliance scoping. Typical zones: user, server, DMZ, management, guest, OT.

A buffer zone for internet-facing services (web, mail, reverse proxies). Traffic from the internet may reach the DMZ, and the DMZ may reach only specific internal services, so a compromised public server does not have free access inside.

TLS gives confidentiality (symmetric encryption), integrity (authenticated encryption or MACs) and authentication (certificates). The handshake agrees on keys using asymmetric methods. TLS 1.3 removes legacy ciphers, requires forward secrecy, and finishes in fewer round trips.

NAT translates private addresses to public ones. PAT (a form of NAT) maps many internal hosts onto one public IP using different source ports. NAT is not a security control by itself, although it hides internal addressing from casual scanning.

ARP has no authentication, so a host on the same segment can claim another host's IP and intercept traffic. Mitigation: dynamic ARP inspection and DHCP snooping on switches, port security, segmentation, and encryption (TLS and SSH) so intercepted traffic is useless.

A stateless ACL judges every packet alone, so you must write rules for both directions. A stateful firewall remembers connections and automatically permits replies. In AWS, security groups are stateful and network ACLs are stateless, which is why NACLs need ephemeral port rules for return traffic.

Public load balancer in a DMZ or public subnet, application tier in a private subnet reachable only from the load balancer, database tier in a more restricted subnet reachable only from the app tier, a separate management network for admin access via a bastion or session manager, and egress controls (proxy or NAT with allowlists). Log flows at each boundary and deny by default.

"Never trust, always verify": no implicit trust based on network location. Every request is authenticated and authorised using identity, device health and context, with least privilege and continuous evaluation. In practice: strong identity, MFA, device posture checks, microsegmentation, and application-level access (ZTNA) instead of broad VPN access.

Volumetric floods saturate bandwidth, protocol attacks (SYN floods) exhaust state, and application layer attacks (HTTP floods) exhaust app resources. Defence: upstream scrubbing or a CDN with anycast capacity, rate limiting, SYN cookies, WAF rules, autoscaling with cost limits, and hiding origin IPs. Plan and rehearse before an attack.

DNSSEC signs records so resolvers can verify authenticity (integrity, not privacy). DNS filtering blocks known-bad domains. DNS logs are a rich detection source for malware, tunnelling and domain generation. Use resolvers you control, block direct outbound DNS to the internet, and consider DoH or DoT policy to avoid blind spots.

A proxy decrypts, inspects and re-encrypts traffic using a trusted internal certificate authority. It reveals malware and data loss in encrypted traffic, but adds privacy, legal and performance concerns, breaks certificate pinning, and creates a high-value target. Exclude sensitive categories such as banking and health, and protect the inspection keys.

IPsec is a mature, widely interoperable suite (IKE negotiates, ESP encrypts) with many options and more complexity. WireGuard is a small, modern design with fixed strong primitives, simple configuration and good performance. IPsec fits legacy and multi-vendor site-to-site, WireGuard fits simplicity and speed where both ends support it.

WPA3 (or WPA2 with strong settings) using 802.1X with per-user or certificate credentials for staff, a separate isolated guest network, client isolation, rogue access point detection, management on a separate VLAN, and monitoring. Avoid shared pre-shared keys for staff because they cannot be revoked per person.

802.1X authenticates a device or user at the switch port or wireless access point before granting network access, via RADIUS and EAP. NAC adds posture checks (patched, encrypted, EDR present) and places non-compliant devices into a quarantine VLAN.

Firewall and flow logs (NetFlow or VPC Flow Logs), DNS logs, proxy logs, IDS alerts, VPN and authentication logs, DHCP leases, and optionally full packet capture at key choke points. Retention and time synchronisation determine whether you can reconstruct an incident.

Review rules top to bottom, since first match wins. Common problems: "any to any" rules, shadowed rules that never match, stale rules for decommissioned systems, broad source ranges, no logging on deny, and exposed management ports.

1  allow  10.0.0.0/8      -> any            tcp/443          # ok, but egress broad
2  allow  any             -> 10.1.2.10      tcp/3389         # RDP open to world: finding
3  allow  10.1.0.0/16     -> 10.2.0.0/16    any              # too broad between zones
4  deny   any             -> any            any   log        # good: default deny, logged

Controlling outbound traffic. Most breaches need outbound connections for command and control or exfiltration, so allowlisting destinations, forcing traffic through a proxy, and blocking unneeded protocols cuts that path. It is missed because inbound rules feel more urgent and egress requires understanding what the business really needs.

Identity-first: SSO with phishing-resistant MFA, device compliance check, ZTNA broker publishing individual applications rather than full network access, conditional access on risk, per-app logging, and a break-glass path. Keep a VPN only for legacy non-web needs with tight segmentation. Plan capacity, high availability across regions, certificate lifecycle, and clear user support flows.

Introduce segmentation in phases: map flows first, then protect crown jewels, then microsegment with host firewalls or an overlay. Block workstation-to-workstation traffic, restrict SMB and RDP, use tiered admin accounts and jump hosts, deploy LAPS for unique local admin passwords, and alert on unusual east-west flows. Enforce gradually in monitor mode to avoid outages.

BGP trusts what neighbours announce, so mistakes or malicious announcements can hijack or leak routes and redirect traffic. Mitigation: RPKI route origin validation, prefix filters, max-prefix limits, monitoring of your announcements, and for sensitive traffic, end-to-end encryption so a diverted path does not expose content.

Signatures miss new or modified attacks, can be evaded by encryption or fragmentation tricks, and need constant updates. Complement with anomaly detection, protocol analysis, endpoint telemetry, threat intelligence, and behaviour-based correlation in the SIEM. Treat the IDS as one sensor, not the defence.

DNS is nearly always allowed outbound, so data can ride inside queries. Detection: high query volume to one domain, long or high-entropy labels, unusual record types (TXT, NULL), regular timing, and hosts using external resolvers. Respond by forcing internal resolvers, applying filtering and response policy zones, and baselining query rates.

IPv6 may be active even if you do not manage it, creating unmonitored paths. Issues: rogue router advertisements, firewalls and logging that cover only IPv4, and tools that ignore v6. Apply equivalent policy, enable RA guard and DHCPv6 snooping, log v6 flows, or disable it deliberately where unused.

Use default-deny network policies, namespace and workload segmentation, service identity with mutual TLS (via a service mesh or SPIFFE), restrict egress, flow logs, and avoid trusting a pod because it is "inside". Policies must be tested because a CNI that does not enforce them silently provides no protection.

Captures reveal exact payloads, protocol misuse, and timing that logs omit. Limits: storage cost, encryption hides content (metadata and handshake details remain), legal and privacy handling, and capture must already be running at the right place. Use targeted, rolling capture at choke points and keep flow data for long-term coverage.

# capture only suspicious host traffic, rotate files, do not resolve names
tcpdump -i eth0 -nn -s 0 host 10.20.30.40 -G 300 -w /var/captures/host-%H%M.pcap

Confirm it is a SYN flood and not a traffic spike (many half-open connections from many or spoofed sources). Enable SYN cookies, engage the upstream provider or DDoS scrubbing service, apply rate limits at the edge, scale out behind a load balancer if feasible, and block obvious sources. Afterward add capacity planning, always-on protection and a runbook.

Provide access to that application only: ZTNA or a published app behind SSO with MFA, time-boxed account, managed or checked device where possible, logging and session recording for sensitive systems, no broad VPN. Review and remove access at contract end automatically.

Treat as urgent. Check logs for brute force and successful logons from unknown sources, and hunt for compromise. Close the exposure (remove the rule, require VPN or a gateway with MFA), enforce network-level authentication, patch, and rotate credentials if needed. Add detection for new internet-exposed management ports.

Possible causes: expired or mis-issued certificate, an inspection proxy with a missing or untrusted internal CA on the device, a captive portal, or an on-path attacker. Check the certificate chain and issuer from the affected network and from outside, compare fingerprints, and review proxy changes. An unexpected issuer you do not operate is a serious sign, so escalate.

Prefer an API or private connectivity (private link, dedicated tunnel) to exposing the database. Restrict by source address and identity, use mutual TLS, least-privilege database accounts, row and column limits, rate limits, full logging, and a documented review. Never expose the database port to the internet.