Networking Security interview questions
Networking Security questions a Cybersecurity can be asked, from first job to senior. Open one to see the strongest answer and why it works.
What does a firewall actually decide, and what can it not protect you from?
The strongest answer: It allows or blocks traffic by source, destination, port and protocol — it cannot tell a good request from a malicious one on a port you have allowed
Why it works: Exactly — that gap is why an allowed port still needs application controls, and why egress rules matter too.
- Firewalls filter reachability, not intent.
- Match on address, port, protocol.
- Allowed ports still carry attacks.
- Filter egress as well as ingress.
Why does a security team care about DNS, both as a control and as evidence?
The strongest answer: As a control it can refuse to resolve known-bad or newly registered domains, so the connection never happens; as evidence, resolver logs show which host asked for what, which is often the first thread in an investigation
Why it works: Right — cheap prevention plus a per-host trail that survives even when the payload itself is encrypted.
- DNS is control and evidence.
- Refuse to resolve known bad.
- Keep and actually read resolver logs.
- Look for odd lookup patterns.
What is the difference between an IDS and an IPS, and which would you put on a production path first?
The strongest answer: An IDS watches a copy of the traffic and alerts; an IPS sits inline and can drop it. On a production path I start in detect mode, tune the false positives, then enable blocking rule by rule
Why it works: Exactly — inline blocking is an availability decision, so earn it one rule at a time.
- Detect out of band, block inline.
- IDS alerts on a copy.
- IPS drops in the path.
- Tune first, then enable blocking.
A flat network lets any workstation reach the database servers directly.
What does segmentation buy you here, and how would you start without breaking the business?
The strongest answer: It limits how far one compromised host reaches, so I map the flows that actually exist, block the paths nobody uses first, and tighten toward allow-listed traffic between zones
Why it works: Right — the risk is blast radius, and mapping real flows before enforcing is what keeps the project alive.
- Segmentation limits blast radius.
- Map the flows that exist.
- Block the unused paths first.
- Tighten toward allow-listed zones.
Admin panels are on the public internet with a strong password. What do you add first?
The strongest answer: SSO, MFA, and a network or identity gate — a password on /admin is a scanning target, not a design
Why it works: Exactly. Identity and reachability. Security-by-path is folklore. Rate limits help; they do not replace a gate.
- SSO + MFA.
- Shrink who can reach it.
- Do not hide by URL.
- Rate limits are extra, not enough.
A server is making outbound connections to an address nobody recognises, and the endpoint agent shows nothing unusual.
You can take a packet capture. What are you hoping it tells you, and what will it not tell you?
The strongest answer: Which host talked to what, when, how much and over which protocol, plus the requested name and certificate details — it will not show the contents of a properly encrypted session
Why it works: Right — metadata, timing and volume usually carry the answer, and knowing the limit stops you promising content you cannot get.
- Capture gives metadata, not plaintext.
- Who, when, how much, which protocol.
- Encrypted payloads stay closed.
- Scope the capture and its retention.
A vendor proposes decrypting all outbound employee traffic at the gateway so the tools can inspect it.
You own the decision. How do you answer?
The strongest answer: Scope it: never banking, health or staff personal accounts, announce it, restrict who may read what comes out, and check the trade-off against what endpoint telemetry already gives us
Why it works: Right — the question is proportionality plus access control, and the endpoint often sees the same thing without breaking the connection.
- Proportionate, announced, scoped.
- Exclude banking, health, personal.
- Restrict who reads the output.
- Compare with endpoint telemetry.
Contractors need three internal applications. The default answer is a VPN. What is the strategic case against one?
The strongest answer: A VPN grants network reach and then trusts what is behind it; per-application access tied to identity and device state gives them those three applications without putting a stranger on the network
Why it works: Exactly — the unit of access becomes the application, not the network, and device posture joins the decision.
- Grant applications, not networks.
- Tie access to identity and device.
- Time-box third-party access.
- Log per application, not per tunnel.