Fresher to mid-level · 17 questions with answers
Network rounds reward precision. Interviewers can tell within two answers whether you've actually looked at a packet capture or only read a summary. These questions cover the ground that comes up most, with answers pitched at how you should say them.
You'll answer these out loud, under time pressure, with an interviewer asking follow-ups. Do a free 5-question AI mock interview and get scored feedback in minutes — no card needed.
Start free mock interviewPhysical, data link, network, transport, session, presentation, application. Map controls: port security at layer 2, ACLs and firewalls at 3 and 4, TLS at the presentation boundary, WAF and application filtering at 7. Interviewers use the mapping, not the list, to judge you.
SYN, SYN-ACK, ACK. The security angle is the half-open state after SYN-ACK — a SYN flood fills that table so legitimate connections are refused. SYN cookies mitigate it without keeping state.
Recursive resolution from resolver to root, TLD and authoritative servers, with caching at each step. Attacks: cache poisoning, spoofed responses over UDP, DNS tunnelling for exfiltration, and NXDOMAIN floods. Defences include DNSSEC, DoH or DoT, and monitoring for high-entropy subdomain queries.
An attacker on the local segment answers ARP requests with their own MAC, so traffic for the gateway flows through them. Defend with dynamic ARP inspection, DHCP snooping and port security — and remember that TLS still protects the content even when the path is hijacked.
NAT translates addresses so many internal hosts share a public IP; it hides topology as a side effect but is not a security control. A firewall enforces policy. Candidates who call NAT a security feature get marked down.
It terminates and forwards traffic on behalf of clients, giving you URL filtering, TLS inspection, malware scanning and a central log of every outbound request. That log is often the most valuable investigation source in a breach.
Client hello with supported ciphers, server hello with its choice and certificate, certificate validation against a trusted CA, key exchange (ECDHE for forward secrecy), then symmetric encryption for the session. TLS 1.3 cuts the round trips and removes the weak options.
Each session uses ephemeral keys, so compromising the server's long-term private key later doesn't let an attacker decrypt captured past traffic. Achieved with ephemeral Diffie-Hellman key exchange.
IPsec operates at the network layer and typically gives full network access — good for site-to-site. SSL/TLS VPNs work at the application layer through a browser or client and are easier to scope to specific applications, which suits remote users and contractors.
Transport mode encrypts the payload only and is used host-to-host; tunnel mode encrypts the whole original packet inside a new one and is used for site-to-site gateways. AH provides integrity, ESP provides encryption and integrity.
Inventory with automated discovery, short-lived certificates issued through ACME automation, and alerting well before expiry. Manual spreadsheets are how outages happen — say so; it shows operational experience.
You'll answer these out loud, under time pressure, with an interviewer asking follow-ups. Do a free 5-question AI mock interview and get scored feedback in minutes — no card needed.
Start free mock interviewA network segment holding internet-facing services, separated from the internal network by firewalls on both sides. If the public web server is compromised, the attacker still faces a policy boundary before reaching internal systems.
Separate zones for user endpoints, servers, management, guest wireless, and OT or lab environments, with explicit allow rules between them and no flat routing. Put administrative interfaces on a dedicated management network reachable only through a jump host.
Change default credentials, disable unused services and ports, restrict management access by source and put it on the management VLAN, use SSH not Telnet, enforce centralised authentication and logging, and keep firmware patched.
A web application firewall inspects HTTP traffic and blocks known attack patterns. It cannot fix broken access control or business-logic flaws, and it is a compensating control — it buys time until the code is fixed, not a replacement for fixing it.
Watch for unusual east-west SMB and RDP between workstations, new admin share access, Kerberos anomalies like ticket requests for many services, and remote service creation. Segmentation plus east-west visibility is what makes this detectable at all.
Probing a host or range to enumerate open services. Detect it by connection attempts across many ports or hosts from one source in a short window, high rates of TCP resets, and connections to ports with no listening service. Distinguish it from vulnerability scanners you actually own.
Yes — network fundamentals underpin SOC, cloud security and penetration testing roles, so these questions come up even when the job title doesn't say network.
Expect packet-level follow-ups: what a specific flag means, what you'd see in a capture, how you'd prove a theory. Answering with what you would observe, not just what is true, is what separates strong candidates.
Wireshark and tcpdump, nmap, a firewall or NGFW you've configured, and basic familiarity with a SIEM for log-based network detection.
You'll answer these out loud, under time pressure, with an interviewer asking follow-ups. Do a free 5-question AI mock interview and get scored feedback in minutes — no card needed.
Start free mock interview