Top 100 Network Security Interview Questions for Network Engineers (2026)

Security interviews test something different from most networking interviews. The technical knowledge matters, but interviewers also watch how you reason about risk and trade-offs. A candidate who says “encrypt everything” without considering latency, key management, or certificate expiry is missing half the problem. These 100 questions cover what actually gets asked in security-focused engineering roles — with answers that reflect how the technology works in production, not just in theory.

 May 2026  |  ⏱ 40 min read  |   Network Security • NGFW • Zero Trust • PKI • SIEM  |  ⚙ Mid to Senior Network Engineers

What Security Interviewers Actually Test

Three things separate good answers from forgettable ones: threat modeling (knowing what you’re defending against), defense-in-depth reasoning (layered controls, not single points of protection), and operational awareness (knowing that perfect security that nobody can use gets bypassed). Every answer below tries to reflect that reality.

10 Categories — 10 Questions Each

①  Network Security Fundamentals (Q1–Q10) ②  Firewalls & Perimeter Security (Q11–Q20) ③  VPN & Encryption (Q21–Q30) ④  IDS, IPS & Threat Detection (Q31–Q40) ⑤  Zero Trust & Access Control (Q41–Q50)

⑥  Network Attacks & Threat Vectors (Q51–Q60) ⑦  PKI, Certificates & Cryptography (Q61–Q70) ⑧  Security Protocols & Standards (Q71–Q80) ⑨  Security Operations & SIEM (Q81–Q90) ⑩  Cloud Security & Modern Architecture (Q91–Q100)

Category 1 — Q1 to Q10 Network Security Fundamentals



Q1. What is the CIA triad and how does each element apply to a real network?

Confidentiality ensures information is accessible only to authorized parties. On a network, this means encryption in transit (TLS, IPsec), proper access controls, and VLANs that isolate sensitive traffic. Integrity ensures data hasn’t been tampered with. Hashing (SHA-256, SHA-3), digital signatures, and checksums verify integrity. A corrupted routing update from a forged OSPF neighbor violates integrity. Availability ensures systems remain accessible. DDoS protection, redundant links, HA firewall pairs, and BCP/DR plans address this. Every security control you implement affects at least one of these. Overly aggressive firewall rules improve confidentiality and integrity but hurt availability. Interviewers want to see you think in those terms.

Follow-up: “Give me an example where improving one element hurts another.” Answer: End-to-end encryption improves confidentiality but can prevent IPS from inspecting traffic for threats (availability and integrity trade-off).

Q2. What is defense in depth and why is a single security control insufficient?

Defense in depth means layering multiple security controls so that if one fails, others still protect the asset. A perimeter firewall is not enough because phishing bypasses it entirely — the attacker lands inside the network. An endpoint EDR solution alone isn’t enough because lateral movement between hosts isn’t always detectable at the host level. Layered controls: perimeter firewall, network segmentation, internal firewalls, endpoint protection, application-layer controls, data encryption, strong authentication, and logging. No single control is fail-proof. The attacker only needs to find one gap. The defender needs to close all of them.

Q3. What is the principle of least privilege and how do you apply it to network access?

Least privilege means giving users and systems only the access they need to do their job, nothing more. On a network: a workstation in the HR VLAN should be able to reach the HR application server and internet, not the engineering VLAN or the financial database. Contractors get access to exactly the applications they need — not the corporate network. Network devices get SNMP read-only access for monitoring, not read-write unless configuration changes are intended. This limits blast radius when credentials are compromised. Implemented through VLANs, firewall ACLs, NAC policies, 802.1X VLAN assignment, and ZTNA application-level policies.

Q4. What is network segmentation and why does it matter for security?

Network segmentation divides a network into isolated zones where traffic between zones requires explicit policy approval. Without it, a single compromised endpoint can reach everything on the network. Segmentation models: VLANs at Layer 2, subnet boundaries at Layer 3, firewall zones for policy enforcement, and microsegmentation at the workload level (NSX DFW, Cisco ACI contracts). A flat network where every device can ping every other device is a ransomware’s best friend — lateral movement is trivial. Segmentation forces attackers to break through multiple policy boundaries instead of one.

Q5. What is the attack surface and how do you reduce it?

The attack surface is the total set of points where an attacker can attempt to enter or extract data from an environment. For a network, this includes every externally reachable IP, open port, VPN endpoint, web application, API, email gateway, and remote access system. Reduction strategies: close unused ports and services, disable protocols that aren’t needed (Telnet, HTTP, SNMPv1), remove unnecessary management access from internet-facing interfaces, use firewall rules to limit egress as well as ingress, hide internal IP addressing behind NAT, and remove decommissioned systems that still have network connectivity.

Q6. What is the difference between authentication, authorization, and accounting (AAA)?

Authentication: proving identity. Username/password, MFA, certificates, biometrics. Authorization: determining what an authenticated identity is allowed to do. After a network admin logs into a router, authorization determines whether they can run show commands only or also configuration commands. TACACS+ separates authentication and authorization — you can use AD for authentication and local TACACS+ policies for command authorization. Accounting: recording what an identity did — which commands ran, how long a VPN session lasted, what files were accessed. Required for forensics and compliance audits. RADIUS combines authentication and authorization in one Access-Accept response; TACACS+ separates all three.

Q7. What is multi-factor authentication and what factors exist?

MFA requires two or more factors from different categories. Three categories: Something you know (password, PIN, security question). Something you have (hardware token, TOTP app like Google Authenticator or Duo, smart card, push notification to a mobile device). Something you are (fingerprint, face recognition, retina scan). SMS OTP is technically “something you have” but is vulnerable to SIM swapping — avoid it for high-security access. FIDO2/WebAuthn hardware keys (YubiKey) provide the strongest second factor by combining a cryptographic secret with physical possession. MFA defeats stolen credential attacks because the attacker needs the second factor too.

Q8. What is a DMZ and what goes in it?

A DMZ (Demilitarized Zone) is a network segment that sits between the untrusted internet and the trusted internal network. Systems in the DMZ are accessible from the internet but can’t freely reach the internal network. This limits what an attacker can reach if they compromise a DMZ server. Systems that belong in a DMZ: public web servers, email gateways (MX), DNS resolvers (authoritative), reverse proxies, VPN concentrators, and public-facing API endpoints. The internal network should only accept connections from the DMZ that are explicitly needed — an internal database server should accept SQL connections from the DMZ web server on a specific port, nothing else.

Q9. What is a vulnerability vs a threat vs a risk?

Vulnerability: a weakness in a system, configuration, or process. An unpatched web server with CVE-2024-XXXX is a vulnerability. Threat: the potential for something bad to happen. A nation-state group known to exploit that CVE is a threat. Risk: the intersection of vulnerability, threat, and impact. Risk = Likelihood × Impact. A critical vulnerability with a known exploit being actively used against organizations in your industry is high risk. A vulnerability in software you don’t run is zero risk. Risk prioritization drives remediation order — CVSS scores measure severity, not risk, which depends on your specific environment.

Q10. What is the difference between symmetric and asymmetric encryption and when is each used?

Symmetric: same key encrypts and decrypts. Fast. AES-256 is the standard — used for bulk data encryption. Problem: key distribution. How do two parties securely share the key? Asymmetric: public key encrypts (or verifies a signature), private key decrypts (or creates a signature). RSA-2048/4096, ECDSA, ECDH. Slower, computationally expensive. Solves key distribution — publish your public key anywhere. The real world uses both: TLS uses asymmetric cryptography (RSA or ECDH) during the handshake to securely exchange a symmetric session key, then switches to symmetric AES for the bulk data transfer. Asymmetric for key exchange; symmetric for data.

Category 2 — Q11 to Q20 Firewalls & Perimeter Security



Q11. What is the difference between a stateless and stateful firewall?

Stateless: filters packets individually based on source IP, destination IP, port, and protocol. No memory of connection state. A packet matching the ACL is permitted regardless of whether it’s part of an established session or a spoofed attack. Stateless filters are used for performance-sensitive scenarios (DDoS mitigation at ISP level, simple ACLs on router interfaces) because they’re faster. Stateful: tracks connection state in a session table. The firewall knows whether an incoming packet is part of an established session it allowed out, a new connection, or an unsolicited inbound packet. Return traffic for permitted outbound connections is automatically allowed. Stateful firewalls block unsolicited inbound packets even if the ACL would otherwise permit them, because the session doesn’t exist in the state table.

Q12. What is a Next-Generation Firewall (NGFW) and what does it add beyond stateful inspection?

A traditional stateful firewall knows about ports and IPs. An NGFW understands application identities, user identities, and content. It adds: Application Identification (recognize Facebook vs. Facebook Messenger vs. BitTorrent, even on non-standard ports), User Identity (policy based on Active Directory username, not just IP), SSL/TLS Inspection (decrypt and inspect HTTPS traffic), IPS (signature-based threat detection inline), URL Filtering (categorized web content control), AV and malware scanning, and Threat Intelligence (block known-bad IPs and domains from feeds). Palo Alto, Cisco FTD, Fortinet FortiGate, and Check Point are the main NGFW vendors. The distinction matters because most modern threats use HTTPS and port 443 — a traditional firewall sees only “allowed HTTPS traffic.”

Q13. What is SSL/TLS inspection and what are the privacy and security implications?

TLS inspection (deep packet inspection or SSL decryption) intercepts HTTPS connections at a firewall or proxy. The firewall terminates the TLS session from the client (presenting its own certificate signed by a corporate CA), inspects the decrypted content, re-encrypts it, and forwards it to the server. Security benefit: malware hiding in encrypted traffic is visible. Problems: certificate pinning in applications breaks (the presented certificate won’t match the expected pinned cert, causing failures for apps like banking, some mobile apps). Privacy: all employee web traffic, including personal browsing, is decrypted and inspected. Legal requirements: some jurisdictions require notifying employees of inspection. Exemption lists are mandatory for healthcare, financial, and privacy-sensitive sites.

Q14. How do you design firewall rules to minimize both risk and operational friction?

Key principles: deny by default (implicit deny at the bottom), permit only what’s explicitly required, use specific rules not broad ones (avoid permit any any), order rules from most specific to most general, log denied traffic (not just allowed, for forensics), and document the business justification for each rule. For application control: allow by application identity rather than port (allow Salesforce HTTPS, not all port 443). For maintenance: use named object groups so changing an IP means changing one object, not hunting through 200 rules. Regularly audit and remove rules that no longer have a business purpose — stale rules are a common audit finding.

Q15. What is egress filtering and why do most organizations neglect it?

Egress filtering controls what traffic leaves your network, not just what enters. Most organizations focus on inbound threats. Egress filtering catches: compromised endpoints calling back to C2 (command and control) servers, data exfiltration (large uploads to unknown destinations), DNS tunneling (unusual DNS query patterns), and internal hosts initiating connections that shouldn’t be initiating anything (printers shouldn’t be connecting to external IPs). Practical egress controls: block outbound traffic on non-standard ports that applications don’t need, restrict which internal systems can make external DNS queries, alert on large outbound data transfers, and block outbound connections to known-bad IPs using threat intelligence feeds. Neglect is common because tight egress filtering generates legitimate traffic breakage that generates helpdesk tickets.

Q16. What is a web application firewall (WAF) and how is it different from a network firewall?

A network firewall (even NGFW) understands network protocols and application categories. A WAF understands HTTP/HTTPS at the request and response level — it parses HTTP headers, URL parameters, request bodies, cookies, and responses. It protects against OWASP Top 10 attacks: SQL injection (malicious SQL in form fields), cross-site scripting (XSS), cross-site request forgery (CSRF), path traversal, and SSRF. WAFs can operate in signature mode (block known attack patterns), positive security model (allow only known good requests), or anomaly mode. A WAF sits in front of web applications, not as a general network gateway. Cloudflare, AWS WAF, F5 Advanced WAF, Imperva, and Barracuda are common WAF products.

Q17. What is network address translation (NAT) and does it provide security?

NAT translates private IP addresses to public IP addresses. It provides a form of obscurity — internal IP addressing isn’t directly visible externally — and incidentally blocks unsolicited inbound connections (because the NAT table has no entry for traffic that wasn’t initiated from inside). It is not a security control on its own. NAT doesn’t inspect traffic content, doesn’t detect malware, doesn’t prevent compromised internal hosts from calling out. Relying on NAT for security is a classic mistake. IPv6 doesn’t use NAT (every device can have a globally routable address), which forces organizations to implement proper stateful firewall security rather than depending on NAT to hide hosts.

Q18. What is firewall high availability and what are the trade-offs of active-active vs active-passive?

Active-Passive: one firewall handles all traffic; the standby monitors and takes over if the primary fails. Session state is synchronized so failover is transparent for established connections. Simple, predictable. The standby unit’s capacity is wasted during normal operation. Active-Active: both firewalls pass traffic simultaneously. Better utilization of hardware. More complex: session synchronization must happen between both units, asymmetric routing (where different packets of the same flow take different paths) can cause the wrong firewall to see traffic and drop it. State tables need synchronization in both directions. Active-active is preferred when you need the throughput of both units; active-passive is preferred when simplicity and predictability matter more than capacity.

Q19. What is a proxy firewall and how does it differ from a packet filter?

A proxy firewall (application-layer gateway) terminates the connection from the client, inspects the full application-layer content, and opens a new connection to the destination. The proxy is a full participant in the conversation, not a passive observer. This enables deep content inspection — it can read HTTP headers, validate XML/JSON, detect file types regardless of file extension, and enforce application-specific policies. Disadvantage: every connection is terminated and re-initiated, which adds latency and requires the proxy to understand each protocol it handles. A packet filter only sees IP headers and port numbers — it doesn’t understand what’s inside the packets. Explicit web proxies (Squid, Blue Coat, Zscaler ZIA) are proxy firewalls for HTTP/HTTPS.

Q20. How does a firewall handle fragmented packets and why is this a security concern?

IP fragmentation splits a large packet into smaller fragments that are reassembled at the destination. Attackers use fragmentation to evade firewalls: split a malicious payload across fragments so no individual fragment contains the complete attack signature. Classic attack: the TCP header spans two fragments — the first fragment has a partial TCP header (not enough to check the port), and the second completes it. A simple packet filter can’t reconstruct the complete packet to check the port. Modern stateful firewalls reassemble fragments before inspection. NIDS systems must also reassemble fragments. The Ping of Death was a fragmentation attack sending oversized ICMP packets. Fragment-based evasion is still used against legacy network devices that don’t reassemble before applying ACLs.

Category 3 — Q21 to Q30 VPN & Encryption



Q21. What is perfect forward secrecy (PFS) and why is it important for VPN security?

Without PFS, if an attacker captures all encrypted VPN traffic today and later compromises the long-term private key, they can decrypt all historical traffic. PFS prevents this by generating a unique session key for each session using an ephemeral Diffie-Hellman exchange. Even if the long-term key is later compromised, the session keys derived from the ephemeral DH exchange are gone — they were never stored. In IPsec, PFS is configured in Phase 2 with a Diffie-Hellman group specification. In TLS 1.3, PFS is mandatory — all cipher suites use ephemeral key exchange (ECDHE). TLS 1.2 supports PFS cipher suites (ECDHE-*) but also supports non-PFS suites (RSA key exchange). Configure TLS to enforce ECDHE cipher suites only.

Q22. What is IKEv2 and how does it improve over IKEv1?

Internet Key Exchange version 2 (RFC 7296) negotiates IPsec security associations. IKEv2 improvements over IKEv1: fewer messages in the initial exchange (4 messages vs. 6 for IKEv1 main mode), simpler and cleaner protocol design, built-in support for NAT traversal (NAT-T), MOBIKE (Mobile IKE extension allowing endpoint IP changes without renegotiating — important for mobile devices moving between Wi-Fi and LTE), dead peer detection (DPD) is built in, and EAP authentication is natively supported for remote access users without requiring XAUTH hacks. IKEv2 supports asymmetric authentication — the gateway uses certificates, the client uses EAP (username/password or token). Always prefer IKEv2 for new VPN deployments.

Q23. What encryption and hashing algorithms should you use for VPNs in 2026?

For encryption: AES-256-GCM (AES in Galois/Counter Mode) is the recommendation — authenticated encryption provides confidentiality and integrity in one operation. AES-128-GCM is acceptable for most use cases where performance matters. Avoid DES (56-bit, broken), 3DES (112-bit effective, deprecated in RFC 8221), and RC4 (completely broken). For hashing/integrity: SHA-256 minimum, SHA-384 or SHA-512 preferred. Avoid MD5 (collision attacks known since 2004) and SHA-1 (collision demonstrated in 2017). For key exchange: ECDH with P-384 or P-521 (or Diffie-Hellman Group 19/20), or DH Group 14 (2048-bit MODP) as minimum. Never use DH groups below 14.

Q24. What is split tunneling in VPN and what are the security implications?

Split tunneling sends only traffic destined for corporate resources through the VPN; internet-bound traffic goes directly from the client’s local internet connection without traversing the VPN gateway. Advantages: reduces VPN gateway load, improves performance for SaaS applications (Microsoft 365, Zoom), reduces bandwidth costs. Security risks: internet traffic from VPN clients bypasses corporate security controls (firewall, web proxy, DLP, IPS). A compromised host with split tunneling can reach the internet freely while having access to internal resources — potentially providing a pivot point. Mitigation when split tunneling is required: enforce endpoint security (EDR, DNS filtering) on clients, and use ZTNA instead of full VPN to limit what internal resources are accessible.

Q25. What is a man-in-the-middle attack on a VPN and how do certificates prevent it?

In a MITM attack on a VPN, the attacker intercepts the connection between the client and the VPN gateway, presenting their own credentials to both sides and forwarding traffic. Without mutual authentication, a client might connect to an attacker’s fake VPN gateway and receive a tunnel that the attacker can inspect. Certificates prevent this: the VPN gateway presents a certificate signed by a CA that the client trusts. The client verifies the certificate chain and checks that the server name matches the certificate’s common name or SAN. If the attacker can’t present a valid certificate for the gateway’s hostname (because they don’t have the private key), the client rejects the connection. Mutual certificate authentication (both client and server present certificates) eliminates credential theft vectors entirely.

Q26. What is TLS 1.3 and what makes it more secure than TLS 1.2?

TLS 1.3 (RFC 8446, 2018) eliminates insecure cipher suites that existed in TLS 1.2. Key changes: only 5 cipher suites remain, all using AEAD (Authenticated Encryption with Associated Data) modes like AES-GCM and ChaCha20-Poly1305. PFS is mandatory — RSA key exchange (which isn’t forward-secret) is removed entirely. The handshake is faster: TLS 1.3 requires 1-RTT instead of TLS 1.2’s 2-RTT (with an optional 0-RTT resumption mode, though 0-RTT has replay attack concerns). Removed: RC4, MD5, SHA-1, RSA key exchange, CBC-mode cipher suites vulnerable to BEAST/POODLE, DH groups below 1024-bit. The result is a cleaner, faster, more secure protocol with a smaller attack surface. Enterprises should enforce TLS 1.2 minimum, TLS 1.3 preferred on all endpoints and gateways.

Q27. What is DNSSEC and how does it protect against DNS-based attacks?

DNS Security Extensions adds cryptographic signatures to DNS records. Without DNSSEC, an attacker can send forged DNS responses to redirect users to malicious servers (DNS cache poisoning, Kaminsky attack). DNSSEC signs DNS zone data with a private key. Resolvers verify responses against the published public key (DNSKEY records). A chain of trust exists from the root zone down to the domain. DNSSEC doesn’t encrypt DNS queries — it only validates authenticity and integrity. DNS over HTTPS (DoH) and DNS over TLS (DoT) encrypt the DNS query/response itself but don’t validate the content. DNSSEC + DoH/DoT together address both tampering and privacy concerns. Many ISPs and enterprise DNS resolvers validate DNSSEC, but end-to-end deployment depends on each domain enabling it.

Q28. What is certificate pinning and what problems does it cause?

Certificate pinning hardcodes a specific certificate or public key hash into an application. When the app connects, it verifies the presented certificate matches the pinned value, regardless of whether it chains to a trusted CA. This prevents MITM attacks even by a corporate CA used for SSL inspection. The problem: if the server’s certificate expires or is renewed with a different key, all client applications need to be updated simultaneously. And it completely breaks SSL inspection proxies — the proxy’s certificate doesn’t match the pinned value, so the app refuses to connect. Banking apps, mobile applications, and some endpoint security tools use pinning. Organizations doing SSL inspection must add exceptions for pinned apps. HPKP (HTTP Public Key Pinning) was deprecated in browsers due to operational risk of lockout from misconfiguration.

Q29. What is a VPN concentrator and how does it scale for large remote workforces?

A VPN concentrator is a dedicated device or cluster that terminates a large number of remote access VPN tunnels. It handles the cryptographic processing, authentication, IP address assignment, and routing for remote users. Scaling approaches: hardware acceleration for crypto operations (ASICs that handle AES encryption without burdening the CPU), load balancing across multiple concentrators (Cisco ASA with VPN load balancing, or load-balanced pairs), and SSL VPN for clientless browser-based access. The COVID-19 period exposed how many organizations weren’t sized for 100% remote workforce — VPN concentrators became a bottleneck. This accelerated ZTNA adoption because ZTNA distributes the access decision to multiple cloud PoPs rather than a single on-prem gateway.

Q30. What is a rogue access point and how do you detect and prevent it?

A rogue AP is an unauthorized wireless access point connected to the corporate network — either placed by an attacker for eavesdropping or installed by an employee for convenience (a “soft AP” on a laptop). Detection: wireless controllers and APs in monitor mode scan all RF channels for 802.11 beacons. Unknown BSSIDs are flagged as rogue or unclassified. Checking whether the discovered AP is connected to your wired network (via its MAC address in your switch MAC table or via ARP) distinguishes a rogue connected to your network from an external neighbor’s AP. Prevention: 802.1X port authentication on all wired ports (an unauthorized AP connecting to a wired port can’t authenticate), NAC policies, network segmentation so an unauthorized AP can’t reach internal resources even if connected, and employee security awareness training.

Category 4 — Q31 to Q40 IDS, IPS & Threat Detection



Q31. What is the difference between signature-based and anomaly-based IDS/IPS?

Signature-based: matches traffic patterns against a database of known attack signatures. Fast and accurate for known threats. Zero false positives for well-written signatures. Cannot detect zero-day attacks or modified variants of known attacks. Requires constant signature updates. Anomaly-based: builds a baseline of normal network behavior and alerts when traffic deviates significantly. Can detect unknown threats. High false positive rate — legitimate traffic changes (end of month batch jobs, software updates) can trigger alerts. Requires a training period and ongoing tuning. Behavioral analysis: a modern variant of anomaly detection using ML to model normal entity behavior and detect deviations. Used in NDR (Network Detection and Response) products like Darktrace, Vectra, ExtraHop. Most production IPS/NGFW combine signatures (for known threats) with behavior analysis (for unknown).

Q32. What is a false positive and false negative in IDS/IPS and which is worse?

False positive: legitimate traffic flagged as malicious. Results in blocked legitimate traffic or wasted analyst time investigating non-events. High false positive rates cause alert fatigue — analysts start ignoring alerts, including real ones. False negative: malicious traffic that isn’t detected. The attack succeeds undetected. Which is worse depends on context. In an IPS blocking mode: false positives are immediately disruptive (applications break). False negatives are silent failures. For IDS in detect-only mode: false negatives are the primary concern because nothing is blocked. In practice, both matter — the goal is tuning signatures and thresholds to minimize both. Start IPS in detect-only mode, tune aggressively, then switch to block mode once the false positive rate is acceptable.

Q33. What is a honeypot and how is it used for threat detection?

A honeypot is a decoy system designed to attract attackers. It has no legitimate use — any connection to it is either a misconfigured system or an attacker. Honeypots provide early detection of lateral movement (an attacker moving through the network will eventually try to connect to the honeypot) and threat intelligence (what are attackers looking for?). Types: low-interaction honeypots (emulate specific services, capture connection attempts), high-interaction honeypots (real operating systems that attackers can interact with, capturing full attack sequences), and honeynets (a network of honeypots). Deception technology (Attivo, FortiDeceptor, Illusive Networks) extends this idea by deploying fake credentials, fake files, and fake network paths across the entire environment to detect attackers early in the kill chain.

Q34. What is network traffic analysis (NTA) and what tools are used?

NTA (also called NDR — Network Detection and Response) analyzes network flows, packet metadata, and protocol behavior to detect threats. It doesn’t rely on signatures alone — it looks at communication patterns, volume, timing, and behavioral baselines. Tools: NetFlow/IPFIX analysis (flow data from routers and switches — source/destination IPs, ports, bytes, packets — stored in Stealthwatch, Darktrace, or SIEM), packet capture and analysis (Wireshark, Zeek/Bro for scriptable network analysis), commercial NDR (ExtraHop Reveal(x), Darktrace, Vectra AI, Cisco Stealthwatch/Secure Network Analytics). Flow data is lighter-weight but less detailed; full packet capture is comprehensive but requires significant storage. Zeek generates structured logs (connection logs, DNS logs, HTTP logs) from raw packets, making large-scale analysis practical.

Q35. What is a botnet and how does C2 (command and control) traffic appear on the network?

A botnet is a network of compromised devices controlled by an attacker (the botmaster). Infected devices call back to C2 servers to receive instructions (send spam, participate in DDoS, exfiltrate data). C2 traffic characteristics: regular periodic beacons to the same external IP (often at consistent intervals — 30 seconds, 5 minutes), connections using unusual ports or protocol mismatches (HTTP traffic on port 443), domain generation algorithms (DGA) producing unusual randomly-generated domain lookups, connections to recently registered domains or domains with no history, DNS tunneling (data encoded in DNS queries/responses), use of legitimate services as C2 (GitHub, Pastebin, Slack, Telegram) — this is increasingly common because these services are rarely blocked. Behavioral detection looks for periodic beaconing patterns; DNS filtering blocks DGA domains using threat intelligence.

Q36. What is threat intelligence and how do you operationalize it on a network?

Threat intelligence is curated information about known adversaries, their tactics, techniques, and indicators of compromise (IOCs — malicious IP addresses, domains, file hashes, URLs). Sources: commercial feeds (Recorded Future, CrowdStrike Falcon X, ThreatConnect), open-source feeds (Talos, AlienVault OTX, MISP), government feeds (CISA AIS, ISACs), and internal intelligence from past incidents. Operationalizing: feed malicious IPs and domains into firewall block lists (dynamic objects that auto-update), push IOCs to SIEM correlation rules, integrate with DNS security (Cisco Umbrella, Infoblox) to block malicious domains at the DNS layer, use STIX/TAXII standard formats to automate feed ingestion. The challenge: threat intelligence feeds contain false positives. Blocking a legitimate CDN IP based on a bad feed entry can cause widespread outages.

Q37. What is lateral movement and how do you detect it on the network?

Lateral movement is how attackers spread through a network after initial compromise, looking for high-value targets like domain controllers, file servers, or databases. Common techniques: pass-the-hash (using captured NTLM hashes to authenticate without knowing the password), pass-the-ticket (Kerberos ticket theft), PsExec (remote execution tool), WMI and PowerShell remoting, RDP, SMB file share access. Network detection: unexpected connections between workstations (workstations don’t normally initiate SMB connections to each other), admin tools (PsExec, WMI) running from unexpected sources, RDP connections at unusual hours, new connections to domain controllers from previously-unseen source IPs, large amounts of Kerberos ticket requests. Network segmentation (workstations in one VLAN can’t reach other workstations) stops lateral movement at the network layer.

Q38. What is the MITRE ATT&CK framework and how is it used in network security?

MITRE ATT&CK is a knowledge base of adversary tactics (what they’re trying to achieve) and techniques (how they achieve it), organized into 14 tactic categories from Initial Access through Exfiltration and Impact. Unlike CVSS (vulnerability scoring), ATT&CK maps attacker behavior. Uses in network security: map your detection capabilities against ATT&CK to identify gaps (what techniques would we miss?), use ATT&CK technique IDs in SIEM rules for structured classification, inform red team exercises by testing specific techniques, prioritize security investments based on which techniques adversaries targeting your industry use most. The Navigator tool at mitre.org/cti lets you visualize coverage and gaps. Network-specific techniques include T1071 (C2 over standard protocols), T1046 (network service discovery), and T1021 (remote services).

Q39. What is DNS over HTTPS (DoH) and why is it a security concern for enterprises?

DoH encrypts DNS queries inside HTTPS connections (port 443) to a DoH-capable resolver (like Cloudflare 1.1.1.1 or Google 8.8.8.8). Privacy benefit: the DNS query is hidden from network observers and ISPs. Security concern for enterprises: DNS is a primary control point. Enterprises use DNS filtering (Cisco Umbrella, Infoblox BloxOne, Zscaler) to block malicious domains. When a client uses DoH to bypass the corporate DNS resolver, all DNS-based security controls are bypassed. Malware increasingly uses DoH to evade detection. Enterprise response: block outbound DoH at the firewall (block port 443 to known DoH resolvers), redirect all DNS to the corporate resolver, or deploy DNS clients that support enterprise DoH (where the resolver is the corporate DNS server, not an external one). WPAD (Web Proxy Auto-Discovery) and DNS policies can help enforce corporate resolver use.

Q40. What is threat hunting and how does it differ from reactive incident response?

Reactive incident response starts when an alert fires. Threat hunting is proactive: analysts hypothesize that a specific attack technique might be occurring in the environment and search for evidence, even without an alert. Hunting assumption: sophisticated attackers have evaded automated detection. Hunt example: “Are any internal hosts making DNS queries for unusually long domain names?” (DGA indicator) or “Are any hosts communicating with external IPs on port 443 at regular 30-second intervals?” (beaconing). Tools: Zeek logs in Elasticsearch, NetFlow data in Stealthwatch, EDR data in CrowdStrike or SentinelOne, SIEM queries. Successful hunts produce new detection rules that make future automated detection better. It’s a skill-intensive activity that requires understanding attacker TTPs and the ability to write complex queries across large datasets.

Category 5 — Q41 to Q50 Zero Trust & Access Control



Q41. What is Zero Trust and why does “never trust, always verify” matter?

Traditional network security assumes that devices inside the network perimeter are trustworthy. Zero Trust rejects that assumption: trust is never implicit, regardless of network location. Every access request — from inside the data center or from a coffee shop — must be authenticated, authorized, and continuously evaluated. The principle matters because the perimeter has dissolved. Employees work from home, cloud services sit outside the data center, and attackers who breach the perimeter have traditionally had wide freedom of movement. Zero Trust’s core tenets (NIST SP 800-207): verify every user and device explicitly, use least-privilege access, and assume breach (design systems assuming the attacker is already inside). Zero Trust is an architecture, not a product — it’s implemented through combinations of IAM, ZTNA, MFA, EDR, microsegmentation, and continuous monitoring.

Q42. What is ZTNA (Zero Trust Network Access) and how does it differ from VPN?

VPN gives authenticated users network-level access — they’re on the corporate network and can reach anything the network allows. ZTNA gives authenticated users application-level access — they can reach specific applications, not the network. Each access request is evaluated against identity, device posture, location, and time. The application is never exposed directly to the internet; traffic flows through a broker. ZTNA benefits: no implicit trust after authentication, minimal access scope, applications are invisible to unauthenticated users (dark cloud), continuous posture assessment during sessions. Limitations: ZTNA handles HTTP/HTTPS well; non-HTTP protocols are harder; bare-metal servers without agents don’t participate as easily. VPN still wins for infrastructure access (SSH, RDP to servers) and OT environments where ZTNA agents aren’t deployable.

Q43. What is NAC (Network Access Control) and how does it enforce security policies?

NAC controls which devices can access the network and what they can access based on their identity and security posture. Before a device is granted access, NAC checks: is it authenticated (802.1X), does it meet patch level requirements, is antivirus running and updated, is disk encryption enabled, is it a managed corporate device or a personal device? Based on posture, NAC assigns the device to an appropriate VLAN — compliant devices get the corporate VLAN, non-compliant devices go to a remediation VLAN (internet only, with instructions to update), and unknown devices go to a guest VLAN. Cisco ISE is the most widely deployed enterprise NAC platform. FortiNAC, Aruba ClearPass, and Portnox are alternatives. NAC integrates with 802.1X for wired authentication and RADIUS for VLAN assignment.

Q44. What is microsegmentation and how does it differ from traditional VLAN-based segmentation?

VLANs create Layer 2 segments — devices in the same VLAN can communicate freely. Even with inter-VLAN routing through a firewall, all devices in the same VLAN are on the same flat network. Microsegmentation applies security policy at the individual workload level. In a VMware NSX environment, the Distributed Firewall applies policy at each VM’s virtual NIC — even two VMs in the same VLAN can be prevented from communicating unless a policy explicitly permits it. In a Cisco ACI environment, EPGs (Endpoint Groups) define policy groups and Contracts define permitted traffic between EPGs. Two VMs in the same VLAN can be in different EPGs with no Contract between them, blocking all traffic. Microsegmentation requires per-workload inventory and dramatically more granular policy management, but limits lateral movement to individual workloads rather than entire network segments.

Q45. What is PAM (Privileged Access Management) and why is it critical?

PAM manages, monitors, and controls access to privileged accounts — accounts with administrative access to systems, network devices, databases, or cloud infrastructure. Privileged credentials are the highest-value target for attackers. PAM solutions: store privileged credentials in a vault (CyberArk, BeyondTrust, Thycotic), check credentials out for each session without revealing the actual password to the user, record all privileged sessions (full session video + keystroke logs) for forensics, enforce MFA for all privileged access, auto-rotate credentials after each use, and alert on anomalous privileged activity. For network engineers: PAM controls who can SSH to routers, run configure terminal, and make changes. Every access is logged, attributed, and auditable.

Q46. What is role-based access control (RBAC) and attribute-based access control (ABAC)?

RBAC: access is based on the role assigned to a user. Network Admin role gets read/write access to all devices. Read-Only Analyst gets show commands only. Roles are defined, users are assigned to roles, permissions follow the role. Simple to manage for stable organizations. ABAC: access is based on attributes of the user, the resource, the environment, and the request. Example policy: “Allow access to financial database only if user.department=Finance AND device.compliant=true AND time.hour BETWEEN 8 AND 18 AND request.location=office.” ABAC is more granular and dynamic but significantly more complex to define and manage. Zero Trust architectures tend toward ABAC because access decisions consider context (device posture, location, risk score) beyond just role assignment.

Q47. What is 802.1X and how does the authentication flow work?

IEEE 802.1X is port-based network access control. Three roles: Supplicant (the client device), Authenticator (the switch or wireless AP), Authentication Server (RADIUS server, typically Cisco ISE). Flow: the supplicant connects to the switch port. The authenticator blocks all traffic except EAP (Extensible Authentication Protocol). The authenticator relays EAP messages between supplicant and authentication server (EAP over RADIUS). The authentication server verifies credentials (certificate, password, token) and sends Access-Accept or Access-Reject. Accept can include VLAN assignment, SGT, and downloadable ACL attributes. The authenticator opens the port for the specific VLAN and policy. For devices without 802.1X supplicants, MAB (MAC Authentication Bypass) uses the device’s MAC address for authentication — less secure but necessary for IoT and printers.

Q48. What is a Security Group Tag (SGT) in Cisco TrustSec?

SGTs are numeric labels (2–65535) assigned to traffic as it enters the network, based on identity (user, device, location). Traffic carries the SGT through the network (inline tagging on Cisco devices using the CMD header in 802.1Q) or via SGACL policies. At enforcement points, SGACL (Security Group ACL) permits or denies traffic based on source SGT and destination SGT pairs, rather than IP addresses. Example: SGT 10 = employees, SGT 20 = contractors. Policy: employees can reach the data warehouse (SGT 30), contractors cannot. This policy is IP-independent — when an employee’s IP changes (DHCP), their SGT follows their identity, and the policy still applies. Simplifies policy management dramatically in large, dynamic environments where IP-based ACLs become unmanageable.

Q49. What is SAML and how is it used for network security applications?

Security Assertion Markup Language (SAML 2.0) is an XML-based standard for exchanging authentication and authorization data between an Identity Provider (IdP — Okta, Azure AD, Ping) and a Service Provider (SP — the application being accessed). Flow: user attempts to access the SP, the SP redirects to the IdP for authentication, the IdP authenticates the user (with MFA), and returns a signed XML assertion to the SP confirming identity and attributes. The SP grants access. SAML enables SSO (Single Sign-On) — one authentication at the IdP grants access to all SAML-integrated applications. For network security: VPN gateways, ZTNA proxies, web application portals, and management platforms (FortiManager, Cisco ISE, Palo Alto Panorama) support SAML for centralized authentication. OAuth 2.0 and OIDC are the modern API-centric alternatives to SAML.

Q50. What is a jump server (bastion host) and how does it secure administrative access?

A jump server (or jump host, bastion host) is a hardened, monitored server that administrators must authenticate through before accessing production systems. Instead of allowing direct SSH from any admin workstation to any server, all SSH connections go through the jump server. The jump server enforces MFA, records all sessions, and can restrict which users can reach which destination systems. Benefits: single chokepoint for auditing all admin access, limits attack surface (only the jump server has SSH access to production, not all admin laptops), and provides session recording for forensics. Implement with PAM integration (CyberArk, BeyondTrust) for credential vaulting and session recording. Cloud versions: AWS Session Manager and Azure Bastion provide managed jump server functionality without requiring a dedicated VM.

Category 6 — Q51 to Q60 Network Attacks & Threat Vectors

⚠️

Q51. What is a DDoS attack and what mitigation techniques exist at the network level?

A Distributed Denial of Service attack floods a target with traffic from many sources (often a botnet) to exhaust bandwidth, connection table capacity, or CPU of the target. Types: volumetric (UDP flood, ICMP flood — consume bandwidth), protocol attacks (SYN flood — exhaust connection state tables, ICMP fragmentation), application layer (HTTP GET flood — looks like legitimate traffic). Network-level mitigations: Upstream scrubbing (Cloudflare, Akamai, AWS Shield divert traffic through cleaning centers that filter attack traffic and return clean traffic), BGP blackholing (announce the victim IP with a community tag instructing upstream ISPs to drop all traffic to it — kills the attack but also kills legitimate traffic), RTBH (Remotely Triggered Black Hole), rate limiting at the ISP level, and anycast diffusion (spread the attack across many PoPs). For SYN floods: SYN cookies on the firewall (respond without allocating state until the handshake completes).

Q52. What is ARP spoofing and how do you prevent it?

ARP (Address Resolution Protocol) has no authentication. Any device can send a gratuitous ARP claiming to own any IP address. An attacker sends ARP replies claiming their MAC is associated with the default gateway’s IP. Victims update their ARP cache with the attacker’s MAC, and all traffic intended for the gateway goes to the attacker instead — a man-in-the-middle position. Prevention: Dynamic ARP Inspection (DAI) on Cisco switches validates ARP packets against the DHCP snooping binding table. ARP replies on untrusted ports are dropped if the IP-MAC mapping doesn’t match a known DHCP lease. Static ARP entries on critical hosts for the gateway (doesn’t scale). 802.1X limits which devices can send traffic on a port at all. Private VLANs prevent direct communication between devices in the same VLAN segment. ARP Watch (monitoring tool) alerts on ARP mapping changes.

Q53. What is DNS poisoning and how does DNSSEC address it?

DNS cache poisoning injects a forged DNS response into a resolver’s cache, redirecting users who query that resolver to attacker-controlled servers. The Kaminsky attack (2008) demonstrated a practical method: an attacker floods a resolver with fake DNS responses with random transaction IDs, eventually winning a race against the legitimate response. Mitigations pre-DNSSEC: source port randomization (DNS queries from random source ports, making guessing the transaction ID + source port harder), 0x20 encoding (random capitalization in queries that must match in responses). DNSSEC permanently solves this: signed records can’t be forged without the zone’s private key. The chain of trust from root → TLD → authoritative zone ensures forged responses are rejected by validating resolvers.

Q54. What is a BGP hijack attack and what are the consequences?

BGP (the routing protocol of the internet) relies on trust — routers accept route announcements from peers without cryptographic verification by default. A BGP hijack occurs when an AS announces a prefix that belongs to another organization, causing traffic destined for the victim to be routed to the attacker. Consequences: traffic interception (MITM on a global scale), traffic blackholing (victim traffic disappears), or traffic analysis. Notable incidents: Pakistan Telecom hijacking YouTube (2008), Russian AS announcing Amazon IP prefixes (2018, intercepting AWS traffic), and numerous cryptocurrency theft attacks. Prevention: RPKI (Resource Public Key Infrastructure) cryptographically signs route origin authorization (ROA) records, allowing routers to validate that an AS is authorized to announce a prefix. BGP route filtering between peers, IRR (Internet Routing Registry) filtering, and monitoring (BGPMon, RIPE RIS) for unexpected announcements of your prefixes.

Q55. What is a VLAN hopping attack and how do you mitigate it?

Two VLAN hopping techniques: Switch spoofing: an attacker’s device sends DTP (Dynamic Trunking Protocol) frames to negotiate a trunk with the switch, gaining access to all VLANs. Prevention: disable DTP on all access ports (switchport mode access + switchport nonegotiate), never leave ports in dynamic auto or dynamic desirable. Double tagging: attacker sends a frame with two 802.1Q tags. The outer tag matches the native VLAN (untagged on trunk) and gets stripped by the first switch. The inner tag then identifies a different VLAN, which the second switch acts on. Prevention: change the native VLAN to an unused VLAN that carries no traffic, and tag the native VLAN explicitly on all trunks (vlan dot1q tag native).

Q56. What is a supply chain attack and what network controls can help?

A supply chain attack compromises a trusted third party (software vendor, hardware manufacturer, MSP) to reach the actual target. The SolarWinds SUNBURST attack (2020) compromised the SolarWinds Orion build process, inserting backdoor code into legitimate software updates distributed to 18,000 organizations. Network controls that help: network segmentation for management systems (limit what a monitoring server can access), egress filtering (SUNBURST beaconed to avsvmcloud.com — egress blocking of unusual domains would have slowed detection), monitoring for unusual traffic from trusted management systems, and strict ACLs on network management traffic paths. The NSA’s advice post-SolarWinds: treat your monitoring infrastructure with the same security level as your highest-value assets, because monitoring servers have elevated access everywhere.

Q57. What is OSPF route injection and how do you secure routing protocols?

An attacker connected to a network segment with an OSPF-enabled interface can advertise malicious routes, redirecting traffic through their system. Without authentication, OSPF accepts all LSAs from neighbors. Mitigation: OSPF authentication. MD5 authentication is supported by all OSPF implementations but MD5 is weakened — use SHA-256/SHA-512 HMAC with OSPF Cryptographic Authentication (RFC 5709) on Cisco IOS-XE: ip ospf authentication message-digest on interfaces. For BGP: use MD5 authentication on BGP sessions between peers (TCP MD5 signature protects the BGP session). EIGRP supports HMAC-SHA-256 key chains. Apply passive-interface on OSPF interfaces that face users or external networks — they receive routes but don’t form adjacencies.

Q58. What is DNS tunneling and how do you detect it?

DNS tunneling encodes data inside DNS queries and responses to exfiltrate data or establish a C2 channel through firewalls that allow DNS traffic. An attacker registers a domain (evil.com) and runs a DNS server. Malware on a compromised host encodes data as subdomains (base64 encoded chunks: aGVsbG8gd29ybGQ.evil.com). The DNS query reaches the attacker’s authoritative server, which decodes the data. Responses carry data back. Tools: iodine, dnscat2. Detection: unusually long domain names in DNS queries (legitimate FQDNs rarely exceed 50 characters), high query volume to a single domain with many unique subdomains, queries for TXT record types (unusual in normal traffic), NULL/TYPE65 record types, NXDOMAIN response patterns, and entropy analysis of subdomain strings. DNS security platforms (Cisco Umbrella, Infoblox) with behavioral analytics detect tunneling patterns.

Q59. What is IP spoofing and how does BCP38 prevent it?

IP spoofing uses a false source IP address in packets to hide the attacker’s identity or amplify DDoS attacks (send requests with the victim’s IP as the source — responses flood the victim). BCP38 (RFC 2827, Network Ingress Filtering) says ISPs and organizations should filter outbound traffic — drop packets leaving your network with source IPs that don’t belong to your address space. If every ISP implemented BCP38, spoofing would be impossible because spoofed packets would be dropped at the source network. Cisco implementation: uRPF (Unicast Reverse Path Forwarding) — ip verify unicast source reachable-via rx on inbound interfaces. Strict mode (rx) verifies the source IP is reachable via the same interface it arrived on. Loose mode (any) verifies the source is in the routing table via any interface. Apply at customer-facing edges.

Q60. What is a network traffic amplification attack?

Amplification attacks use protocols where the response is much larger than the request. An attacker sends small spoofed requests (using the victim’s IP as source) to many open servers; all the large responses flood the victim. Examples: DNS amplification (send small DNS query for a large record like ANY — amplification factor up to 70x), NTP amplification (send monlist request — up to 556x amplification), memcached amplification (UDP port 11211 — up to 51,000x amplification, largest DDoS attacks recorded). Mitigation: disable unnecessary UDP services on your servers (don’t run open resolvers), rate-limit DNS responses per client IP, ISPs implement BCP38 to prevent spoofed requests originating from their networks, and use DDoS scrubbing services to absorb the amplified traffic volume at the victim side.

Category 7 — Q61 to Q70 PKI, Certificates & Cryptography



Q61. What is PKI (Public Key Infrastructure) and how does it work?

PKI is the framework for issuing and managing digital certificates that bind public keys to identities. Components: CA (Certificate Authority): issues and signs certificates. A root CA’s certificate is self-signed and pre-installed in operating systems and browsers. Intermediate CAs are signed by the root and sign end-entity certificates. Certificate: a document containing a public key, the identity it belongs to, validity period, and the CA’s signature. CRL (Certificate Revocation List): a list of revoked certificates. OCSP (Online Certificate Status Protocol): real-time revocation checking. RA (Registration Authority): verifies identity before the CA issues a certificate. Trust chain: browser trusts the root CA, root CA’s signature validates the intermediate, intermediate’s signature validates the end-entity certificate. If any link breaks, the chain is untrusted.

Q62. What is certificate revocation and what are the problems with CRL and OCSP?

CRL (Certificate Revocation List): the CA publishes a list of revoked certificate serial numbers. Clients download the CRL and check against it. Problem: CRLs can be megabytes in size, are updated periodically (not real-time), and adding client latency for download. OCSP (Online Certificate Status Protocol): client sends the certificate serial number to the OCSP responder; gets a signed response (good/revoked/unknown) in real time. Problem: privacy concern (the CA knows which sites you visit), OCSP responder availability issues (if it’s down, should you reject the connection?), latency. OCSP stapling: the web server obtains and caches the OCSP response, including it in the TLS handshake. Solves privacy and availability concerns. Most modern TLS implementations use OCSP stapling. CRLite / CCADB: newer approaches that compress revocation into compact bloom filters, avoiding per-request OCSP lookups.

Q63. What is a digital signature and how does it provide non-repudiation?

A digital signature is created by hashing a message and encrypting the hash with the sender’s private key. The recipient decrypts the signature with the sender’s public key, hashes the received message, and compares the two hashes. If they match, the message came from the private key holder and hasn’t been altered. Non-repudiation: the sender cannot deny signing the message because only they have the private key. This requires the private key to be kept secret and exclusively controlled by the key holder. Certificate-based authentication for VPNs uses this: the device signing the key exchange with its private key proves it owns the certificate, and the certificate proves (via the CA) who the device is. Code signing certificates use the same mechanism to verify software hasn’t been tampered with.

Q64. What is a self-signed certificate and when is it acceptable to use one?

A self-signed certificate is signed by its own private key rather than by a CA. There’s no chain of trust — the certificate asserts its own validity. Browsers display a warning because they can’t verify the identity. Acceptable uses: internal management interfaces (router HTTPS management, storage array web UI) where only administrators access the interface and know the expected certificate, lab environments, development/testing, and internal services where the corporate CA cert is distributed to all client trust stores. Not acceptable: any service accessible to users who need to trust it, external-facing services, or anywhere where users would click through the certificate warning without understanding the implication. Self-signed certs for anything user-facing train users to ignore certificate warnings — a security behavior you absolutely don’t want.

Q65. What is ECDSA vs RSA for certificates, and which should you prefer?

RSA: based on the difficulty of factoring large integers. RSA-2048 is the minimum acceptable; RSA-4096 is more secure but slower. RSA key generation and operations are computationally expensive. Widely supported by all systems including legacy. ECDSA (Elliptic Curve Digital Signature Algorithm): based on elliptic curve discrete logarithm problem. A 256-bit ECDSA key (P-256) provides security equivalent to RSA-3072. ECDSA signatures are smaller and operations are faster. Less computational overhead on both client and server. The choice for new deployments: ECDSA P-256 or P-384 for performance-sensitive services. RSA-2048 for legacy compatibility requirements. For TLS: many sites use ECDSA certificates with RSA backup for older clients. If your client base is modern (TLS 1.3 capable), ECDSA only is fine.

Q66. What is key length and how does it relate to security strength?

Key length determines resistance to brute-force and mathematical attacks. For symmetric encryption (AES): 128-bit keys have 2^128 possible keys — computationally infeasible to brute force. 256-bit is overkill today but future-proofs against quantum computing advances. For RSA: the mathematical attack (factoring) is easier than brute force. RSA-1024 is broken (factorable in practice). RSA-2048 is current minimum. RSA-4096 is future-safe. For elliptic curves: 256-bit ECDSA provides approximately 128-bit security strength. The important concept: different algorithms have different relationships between key length and security strength. NIST SP 800-57 provides guidance on comparable security strengths across algorithms. Post-quantum cryptography (PQC) algorithms — CRYSTALS-Kyber, CRYSTALS-Dilithium — were standardized by NIST in 2024 to resist quantum computer attacks on current public-key cryptography.

Q67. What is a certificate transparency log and why does it matter for security monitoring?

Certificate Transparency (RFC 6962) requires public CAs to log every certificate they issue to publicly auditable logs. Browsers enforce CT for public certificates — a certificate not in a CT log results in a connection error. Why it matters: if a CA is compromised and issues a fraudulent certificate for your domain, CT makes it visible. Organizations can monitor CT logs for any certificate issued for their domains (crt.sh, Facebook’s CT monitoring tool, Project Sonar). When an attacker or rogue CA issues a certificate for google.com (as happened with DigiNotar in 2011 and CNNIC in 2015), CT log monitoring can detect it. This is also useful for discovering shadow IT — employees using external CAs to issue certs for internal domains visible to cloud services.

Q68. What is a hash function and which algorithms are acceptable today?

A cryptographic hash function takes input of any size and produces a fixed-size output (digest). Properties: deterministic (same input always produces same output), one-way (can’t reverse-engineer input from output), collision-resistant (computationally infeasible to find two inputs with the same hash). MD5 (128-bit): broken — collision attacks demonstrated in 2004, practical collision generation in seconds. Do not use for security purposes. Legacy use in non-security contexts only. SHA-1 (160-bit): broken — first practical collision (SHAttered attack) demonstrated by Google/CWI in 2017. Deprecated by browsers since 2017. SHA-256 (256-bit): secure, widely used, recommended minimum. SHA-384 / SHA-512: higher security margin, appropriate for sensitive applications. SHA-3 (Keccak): different internal structure, provides diversity if SHA-2 weaknesses are found. Blake2/Blake3: fast alternatives for performance-sensitive hashing.

Q69. What is an HSM (Hardware Security Module) and when is it required?

An HSM is a tamper-resistant hardware device that manages cryptographic keys and performs cryptographic operations. Keys stored in an HSM never leave the device in plaintext — cryptographic operations happen inside the HSM. Tampering triggers key destruction. Use cases: root CA private key storage (the most sensitive key in a PKI), TLS private key protection for high-value services, payment processing (PCI DSS requires HSMs for PIN encryption), code signing key protection, and encryption key management for databases and storage. Cloud HSMs: AWS CloudHSM, Azure Dedicated HSM, Google Cloud HSM. Software HSMs exist but don’t provide hardware tamper resistance. If a root CA’s private key is compromised, every certificate it ever issued is potentially suspect — that’s why root CA keys are kept offline in HSMs in air-gapped environments, used only for periodic intermediate CA signing ceremonies.

Q70. What is quantum computing’s threat to current cryptography?

Shor’s algorithm (1994) shows that a sufficiently large quantum computer can factor large integers and solve discrete logarithm problems in polynomial time — breaking RSA, DSA, and elliptic curve cryptography. Grover’s algorithm provides a quadratic speedup for brute-force attacks on symmetric encryption — AES-256 effectively becomes AES-128 in terms of security strength against a quantum attacker. The timeline for cryptographically relevant quantum computers (CRQCs) capable of breaking current encryption is uncertain — estimates range from 10–30 years. The “harvest now, decrypt later” threat is real: adversaries capture encrypted traffic today to decrypt when quantum capability arrives. NIST finalized post-quantum cryptography standards in 2024: CRYSTALS-Kyber (ML-KEM) for key encapsulation, CRYSTALS-Dilithium (ML-DSA) and FALCON for signatures. Begin cryptographic agility planning now — the migration will take years.

Category 8 — Q71 to Q80 Security Protocols & Standards



Q71. What is HTTPS Strict Transport Security (HSTS) and how does it prevent SSL stripping?

An SSL stripping attack downgrades an HTTPS connection to HTTP. An attacker acting as MITM serves the site over HTTP to the victim while maintaining HTTPS with the server — the user sees no padlock but isn’t warned because HTTP is “valid.” HSTS (RFC 6797) instructs the browser to always use HTTPS for a domain via the Strict-Transport-Security header. After the first HTTPS visit, the browser refuses to connect via HTTP for the specified max-age period. HSTS Preloading submits the domain to a browser-embedded list — browsers never make plain HTTP connections to preloaded domains, even on the very first visit (eliminating the first-visit vulnerability). Configure with a long max-age (minimum one year, 31536000 seconds), include subdomains, and submit to the preload list.

Q72. What is SPF, DKIM, and DMARC and how do they prevent email spoofing?

SPF (Sender Policy Framework): a DNS TXT record listing the IP addresses authorized to send email for your domain. Receiving servers check whether the sending server’s IP is in the SPF record. Prevents envelope sender forgery. DKIM (DomainKeys Identified Mail): the sending server signs the email body and headers with a private key. The public key is in DNS. Receiving servers verify the signature. Proves the email content hasn’t been modified and confirms the signing domain. DMARC (Domain-based Message Authentication, Reporting, and Conformance): policy specifying what to do with emails that fail SPF or DKIM (none, quarantine, or reject) and where to send aggregate reports. DMARC also requires the From: header domain to align with SPF or DKIM results (preventing From: header spoofing). Deploy in order: SPF → DKIM → DMARC (start with p=none, move to p=quarantine, then p=reject when confident).

Q73. What is SNMPv3 and why should you never use SNMPv1 or v2c for monitoring?

SNMPv1 and v2c transmit community strings (passwords) in plaintext. Anyone capturing network traffic on a management VLAN can read the community string and use it to poll sensitive device data or (with read-write community) modify device configuration. This is not theoretical — network captures routinely expose SNMP community strings. SNMPv3 adds: Authentication using HMAC-MD5 or HMAC-SHA (verifies message integrity and origin), Privacy using DES or AES (encrypts the SNMP PDU contents), and Engine ID (prevents replay attacks). Configure SNMPv3 with authPriv security level (both authentication and privacy), use SHA for auth and AES-128 for privacy, create unique users with strong auth and priv passphrases, and restrict which management stations can contact SNMP. Disable v1 and v2c globally: no snmp-server community public.

Q74. What is MACsec (802.1AE) and how does it secure a campus network?

MACsec provides Layer 2 encryption and authentication between two directly connected devices (host-to-switch or switch-to-switch). It encrypts Ethernet frames using AES-256-GCM, providing confidentiality and integrity at the link layer. Unlike IPsec (Layer 3) or TLS (Layer 7), MACsec protects all Layer 2 traffic including ARP, DHCP, and Layer 2 protocol messages. MKA (MACsec Key Agreement protocol, 802.1X-based) handles key exchange and session establishment. Implemented on Cisco Catalyst 9000 series switches and on supported NICs. Use cases: protecting inter-switch links in shared colocation facilities (where physical cable access by other tenants is possible), encrypting sensitive traffic segments without application changes, and compliance requirements for data-in-motion encryption that includes non-IP traffic.

Q75. What is SSH hardening and what settings matter most?

Default SSH configurations often include insecure settings. Critical hardening steps: Disable SSH v1 (broken, use only SSH v2), disable password authentication (use public key authentication exclusively — eliminates brute-force risk), disable root login (require login as a non-privileged user, then su/sudo), limit allowed users/groups (AllowUsers or AllowGroups), limit authentication attempts (MaxAuthTries 3), set idle timeout (ClientAliveInterval 300), use strong key exchange algorithms (only Curve25519 or ECDH), restrict to management VLANs via firewall, and use non-standard ports to reduce automated scanning noise (security through obscurity, not a primary control). Ed25519 keys are recommended for public key authentication (smaller, faster, more secure than RSA-2048).

Q76. What is RBAC on network devices and how is it implemented with TACACS+?

TACACS+ (Cisco proprietary, TCP port 49) provides per-command authorization for device administration. Configuration: the TACACS+ server (Cisco ISE, FreeRADIUS with TACACS+ module) defines command sets per group. Network Engineer group: can run configure terminal, interface, router commands. Read-Only group: all show commands only. SOC Analyst group: show and debug. Every command entered is sent to the TACACS+ server for authorization and logged in the accounting record. Cisco IOS-XE configuration: aaa authorization commands 15 default group tacacs+ local. Always configure local as fallback for when TACACS+ is unreachable — without it, you’re locked out if connectivity to TACACS+ server fails.

Q77. What is PCI DSS and which network security controls does it require?

PCI DSS (Payment Card Industry Data Security Standard) protects cardholder data. Network-specific requirements: Requirement 1: install and maintain network security controls (firewalls between CDE and untrusted networks, between CDE and other internal networks). Requirement 2: no vendor default passwords, disable unnecessary services. Requirement 4: encrypt transmission of cardholder data over public networks (TLS 1.2+ minimum). Requirement 6: protect public-facing web applications against known attacks (WAF or code review). Requirement 10: log all access to network resources and cardholder data (with NTP synchronization). Requirement 11: test security systems regularly (quarterly vulnerability scans, annual penetration test). The CDE (Cardholder Data Environment) must be segmented from the rest of the network — PCI requires firewall rules documenting all allowed traffic into and out of the CDE.

Q78. What is NIST SP 800-53 and how does it relate to network security controls?

NIST Special Publication 800-53 is a catalog of security and privacy controls for federal information systems, widely adopted by private sector as a comprehensive security framework. Organized into 20 control families. Network-relevant families: AC (Access Control — least privilege, network segmentation), AU (Audit and Accountability — logging, monitoring), CA (Assessment, Authorization — security assessment), CM (Configuration Management — baseline configurations, change control), IA (Identification and Authentication — MFA, AAA), SC (System and Communications Protection — encryption in transit, boundary protection, network separation), SI (System and Information Integrity — malware protection, security alerts, intrusion detection). Used with the NIST Cybersecurity Framework (CSF) which organizes security activities into Identify, Protect, Detect, Respond, and Recover functions.

Q79. What is RPKI and how does it secure BGP routing?

Resource Public Key Infrastructure uses cryptographic certificates to validate the right of an AS to originate specific IP prefixes. An IP address holder creates a Route Origin Authorization (ROA) object signed with a certificate issued by their RIR (ARIN, RIPE, APNIC). The ROA specifies which AS is authorized to announce which prefix(es) and the maximum prefix length. Routers with RPKI validation (RPKI-to-Router protocol, RTR) receive ROA data from a local validator cache. BGP routes are classified as: Valid (AS and prefix match a ROA), Invalid (AS not authorized in any ROA covering this prefix — potential hijack), or NotFound (no ROA exists). Network operators configure BGP policy to drop Invalid routes. RPKI deployment has grown significantly — over 50% of internet prefixes have ROAs as of 2025, making hijack attacks much harder against covered prefixes.

Q80. What is Kerberos and how does pass-the-ticket attack work against it?

Kerberos is the authentication protocol used in Active Directory. A user authenticates to the KDC (Key Distribution Center) with a password hash — gets a TGT (Ticket Granting Ticket). The TGT is used to request service tickets for specific resources without re-entering the password. Pass-the-Ticket (PtT): an attacker extracts a valid Kerberos ticket from memory on a compromised host (using mimikatz) and injects it into their own session. They can now authenticate to services as the ticket’s owner without knowing the password. Golden Ticket attack: compromise the krbtgt account (the KDC’s service account) and forge tickets for any user with any privileges, valid for 10 years. Mitigation: Enable Credential Guard (prevents lsass from being read), implement Protected Users security group (prevents ticket extraction), monitor for anomalous Kerberos requests (overpass-the-hash, unusual service principal names), and regularly rotate the krbtgt account password (twice, due to replication).

Category 9 — Q81 to Q90 Security Operations & SIEM



Q81. What is a SIEM and what makes a SIEM correlation rule effective?

A SIEM (Security Information and Event Management) aggregates logs from across the environment, normalizes them into a common format, and applies correlation rules to identify patterns that indicate attacks. Splunk, Microsoft Sentinel, IBM QRadar, Google Chronicle, and Elastic SIEM are common platforms. An effective correlation rule: specific enough to minimize false positives, sensitive enough to catch real attacks, includes context (user, asset, location), has a defined severity and playbook for response, and is tested against both benign and malicious scenarios. Example effective rule: “Five or more authentication failures followed by a success for the same user account within 10 minutes from a single source IP.” This catches password spray attacks without generating excessive noise from a single mistyped password. The hardest part of SIEM is tuning — the default rules from vendors are almost never production-ready without customization.

Q82. What logs should every network engineer ensure are being collected?

Minimum critical log sources: Firewall traffic logs (permitted and denied connections with source/destination IP, port, rule name), DNS query logs (every DNS request with client IP — enables retrospective investigation of C2 domains and DGA), Authentication logs (Windows Security Event ID 4624/4625 for logon success/failure, 4768/4769/4771 for Kerberos), VPN connection logs (user, source IP, duration, data transferred), DHCP logs (IP assignment history — who had which IP at what time), Network device logs (routing changes, ACL violations, configuration changes via TACACS+), Proxy/web gateway logs (full URL and user for HTTPS proxied traffic), and IDS/IPS alert logs. For forensics: without DHCP logs, you can’t attribute a firewall log entry to a specific workstation. The DHCP lease history is what bridges IP address to hostname/user.

Q83. What is SOAR and how does it improve incident response?

Security Orchestration, Automation, and Response platforms automate repetitive security tasks and coordinate responses across multiple security tools. When a SIEM alert fires, SOAR can automatically: query threat intelligence to check whether the involved IP is known malicious, look up the involved user in Active Directory, check whether the endpoint has outstanding patches from the vulnerability management system, quarantine the endpoint if certain criteria are met (send command to EDR), block the IP on the firewall (via API call), create a ticket in ServiceNow with all context pre-populated, and notify the analyst with a summary. This reduces mean time to respond (MTTR) from hours to minutes for repetitive alert types. Splunk SOAR, Microsoft Sentinel Playbooks, Palo Alto Cortex XSOAR, and IBM Resilient are common platforms. The ROI is highest for high-volume, low-complexity alerts (phishing triage, user account lockout investigation).

Q84. What is mean time to detect (MTTD) and mean time to respond (MTTR)?

MTTD: the average time between when an attacker first compromises a system and when the security team detects it. Industry average historically around 197 days (M-Trends 2024 showed improvement to ~10 days median globally, but significant variance). Reducing MTTD: better detection rules, continuous monitoring, network behavioral analytics, endpoint telemetry. MTTR: the average time from detection to containment and remediation. Reducing MTTR: SOAR automation, pre-approved playbooks, clear escalation paths, regular tabletop exercises. Dwell time: the total time an attacker is in the environment, undetected. Long dwell times correlate with greater damage (data theft, ransomware staging). These metrics are tracked in SOC dashboards and used to measure security program effectiveness over time.

Q85. What is a SOC (Security Operations Center) and what are its Tier 1, 2, and 3 functions?

Tier 1: alert triage. Analysts monitor the SIEM dashboard, classify alerts (true positive vs. false positive), perform initial investigation using predefined playbooks, escalate to Tier 2 when warranted. High volume, lower complexity. Tier 2: incident response. Deeper investigation of escalated incidents, malware analysis, forensic data collection, containment actions, coordination with affected business units. Tier 3: threat hunting, advanced forensics, threat intelligence, security engineering (improving detections, building new correlation rules, red team/purple team activities). Not all SOCs have all three tiers — smaller organizations combine functions. Key metrics per tier: Tier 1 tracks alert volume and escalation rate; Tier 2 tracks incident resolution time; Tier 3 tracks new threat detections and security control improvements.

Q86. What is a penetration test and how does it differ from a vulnerability scan?

Vulnerability scan: automated tool (Nessus, Qualys, Rapid7 InsightVM) that checks systems against a database of known vulnerabilities, misconfigurations, and missing patches. Fast, broad, can run continuously. Produces a list of potential issues but doesn’t verify exploitability. Many findings are false positives. Penetration test: a skilled human tester actively attempts to exploit vulnerabilities to demonstrate real-world impact. Pentesters chain multiple small weaknesses into significant compromises. They test detection and response (can you detect the attack?). Produces actionable evidence of what an attacker could actually do. More expensive, less frequent (annual or after significant changes). Types: external (internet-facing), internal (assumes internal attacker position), web application (OWASP Top 10 focused), social engineering, red team (full adversary simulation with no rules). Bug bounty programs extend vulnerability discovery using external researchers continuously.

Q87. What is forensic network evidence and how do you preserve chain of custody?

Network forensic evidence includes: packet captures (PCAP files), NetFlow/IPFIX records, firewall and proxy logs, DNS logs, DHCP history, SIEM data exports, and IDS/IPS alert data. Chain of custody ensures evidence is collected, handled, and stored in a way that would survive legal challenge. Key steps: document the hash (SHA-256) of collected data immediately after collection, record who collected what, when, from which system, how (commands used), store in an evidence repository with access logging, and never analyze original evidence (work from copies). Log data that rolls off retention cannot be recovered — hold period decisions affect investigative capability. When you suspect a compromise: preserve logs before they age out, collect memory dumps before systems are rebooted (volatile evidence), and coordinate with legal/HR before taking actions that have compliance implications.

Q88. What is UEBA (User and Entity Behavior Analytics)?

UEBA uses machine learning to model the normal behavior of users and entities (hosts, applications) and alerts when behavior deviates significantly from baseline. Unlike signature-based detection (which can’t detect unknown attacks), UEBA catches insider threats and novel attacks based on behavioral anomalies. Examples: a user who normally works 9-5 in Chicago suddenly authenticates at 3am from an IP in Romania (impossible travel), a developer account that normally accesses code repositories suddenly starts querying the customer database at high volume (anomalous data access), or a service account that normally makes 10 authentication requests per hour suddenly makes 10,000 (credential stuffing or account takeover). Exabeam, Securonix, Splunk UBA, and Microsoft Sentinel’s behavior analytics module offer UEBA. High false positive rates during initial deployment require careful tuning.

Q89. What is a tabletop exercise and how does it improve incident response?

A tabletop exercise is a structured discussion where key stakeholders (security, network, IT, legal, communications, executive) walk through a simulated incident scenario. No systems are affected — it’s a verbal and discussion-based exercise. Example scenario: “You receive a ransomware alert at 2am. Walk through your response.” The facilitator introduces complications: “The CISO is traveling. The backup system is on the same segment as the encrypted servers. The attacker is watching your IR Slack channel.” Tabletops reveal: gaps in incident response plans (the plan says ‘contact Legal’ but nobody knows who that is), unclear decision authority, communication breakdowns, and missing playbooks. Run annually at minimum, after significant incidents, and after major infrastructure changes. FEMA’s National Incident Management System (NIMS) framework informs many tabletop exercise designs.

Q90. What is alert fatigue and how do you address it?

Alert fatigue occurs when security analysts are overwhelmed by too many alerts, many of which are false positives or low-priority events. Result: analysts start triaging alerts superficially, ignoring or closing alerts without proper investigation, and real incidents are missed in the noise. A study found that the average SOC receives 11,000 alerts per day — impossible to investigate individually. Addressing it: tune out-of-the-box SIEM rules aggressively before enabling them in production, build context-rich alerts (include user, asset criticality, threat intel) to help analysts quickly determine relevance, use SOAR to auto-close known false positives, tier alerts by severity and route lower-severity items to automated response, establish alert SLOs (Service Level Objectives) for response times per severity, and regularly review low-fidelity rules with high volumes and eliminate or refine them. Quality over quantity: 50 high-fidelity alerts per day is more useful than 5,000 noisy ones.

Category 10 — Q91 to Q100 Cloud Security & Modern Architecture

☁️

Q91. What is the shared responsibility model in cloud security?

Cloud providers (AWS, Azure, GCP) secure the underlying infrastructure — physical data centers, hypervisors, network hardware, and cloud service software. Customers are responsible for what they do inside the cloud: operating system patching (for IaaS), network security groups/ACLs, IAM configuration, encryption of data at rest and in transit, application security, and log monitoring. The division varies by service type: IaaS (EC2, Azure VMs) — customer responsible for OS and above. PaaS (RDS, Azure App Service) — provider manages OS and runtime, customer responsible for application and data. SaaS (Office 365, Salesforce) — provider responsible for almost everything, customer responsible for user access configuration and data classification. Most cloud security incidents are customer-side misconfiguration: public S3 buckets, overly permissive IAM roles, unrestricted security groups.

Q92. What is a cloud security posture management (CSPM) tool?

CSPM tools continuously audit cloud environment configurations against security best practices and compliance frameworks, identifying misconfigurations before attackers do. They check for: publicly exposed S3 buckets or Azure Blob Storage, security groups that allow 0.0.0.0/0 on port 22 or 3389, IAM users with admin rights who haven’t used them in 90 days, CloudTrail logging disabled, encryption not enabled on storage volumes, MFA not enforced on root/admin accounts, and VPCs with unrestricted peering. Tools: Prisma Cloud (Palo Alto), Wiz, Orca Security, AWS Security Hub, Microsoft Defender for Cloud, Lacework. CSPM is now the baseline for any organization with significant cloud footprint — manual configuration review at cloud scale is impossible. Findings typically include hundreds of issues on first scan; prioritize by exploitability and exposure (internet-facing misconfigs first).

Q93. What is a security group in AWS and how does it differ from a network ACL?

Security Groups: stateful firewall applied at the instance (ENI) level. Allow rules only (no explicit deny — implicit deny for anything not permitted). Stateful: return traffic for allowed outbound connections is automatically permitted inbound. Can reference other security groups as sources (e.g., allow inbound from the application server security group — no need to know individual IPs). Network ACLs: stateless firewall applied at the subnet level. Supports both allow and deny rules, evaluated in numerical order, first match wins. Stateless: you must explicitly allow both inbound and outbound traffic for a connection. Good for coarse-grained subnet-level filtering (block specific IP ranges). In practice: security groups for per-instance control, NACLs as a coarser additional layer or for emergency blocking of known-bad IPs across an entire subnet. Default NACL allows all traffic; default security group blocks all inbound from outside.

Q94. What is SASE and how does it change network security architecture?

Secure Access Service Edge (Gartner, 2019) converges networking (SD-WAN) and security (SWG, CASB, ZTNA, FWaaS) into a single cloud-delivered service. Traffic from branch offices and remote users goes to the nearest SASE PoP (Point of Presence) rather than backhauling to a central data center. At the PoP, traffic is inspected by the security stack and forwarded to the destination. Impact on network security architecture: eliminates the data center as the mandatory inspection chokepoint, enables consistent security policy regardless of user location (office, remote, branch), reduces the attack surface of perimeter security appliances (no public-facing VPN concentrators or proxies), and unifies management of security policies across all traffic types. Primary vendors: Zscaler (SSE leader), Palo Alto Prisma SASE, Netskope, Cisco+, Fortinet FortiSASE, Cato Networks.

Q95. What is CASB and what SaaS security risks does it address?

Cloud Access Security Broker sits between users and SaaS applications, providing visibility and control over cloud usage. Problems CASB addresses: Shadow IT discovery (employees using personal Dropbox, Gmail, or unsanctioned SaaS apps — CASB identifies these from proxy logs and can block or restrict). Data loss prevention (detecting and blocking sensitive data uploads to cloud storage). Threat detection (impossible travel, anomalous download volumes indicating data theft). Compliance (ensuring sanctioned SaaS apps are configured to meet regulatory requirements — DLP policies in Office 365, encryption settings). CASB deployment modes: API mode (connects directly to SaaS APIs for policy enforcement on data at rest — works without being in the traffic path), reverse proxy (intercepts browser access to managed apps), and forward proxy (intercepts all outbound traffic, needs to be in path). Microsoft Defender for Cloud Apps, Netskope, Zscaler CASB, and McAfee MVISION Cloud are major products.

Q96. What is infrastructure as code (IaC) and how does it introduce security risks?

IaC defines infrastructure (virtual networks, security groups, IAM policies, firewalls) in code files (Terraform HCL, AWS CloudFormation, Pulumi). This enables version control, repeatability, and automation. Security risks: IaC files containing hardcoded secrets (API keys, passwords) committed to version control — secret scanning tools (GitGuardian, Trufflesecurity) address this. Misconfigurations in IaC that deploy insecure resources at scale (one bad Terraform module can deploy hundreds of misconfigured instances). IaC security tools: Checkov, KICS, Terrascan — scan Terraform/CloudFormation for security misconfigurations before deployment. Integrating IaC security scanning into CI/CD pipelines (shift-left security) catches misconfigurations before they reach production. Drift detection monitors whether live infrastructure matches the IaC definition.

Q97. What is container security and what network-level controls apply to Kubernetes?

Kubernetes runs containerized workloads in pods. By default, all pods can communicate with all other pods — equivalent to a flat network. Kubernetes NetworkPolicy resources define which pods can communicate with which other pods (using label selectors), implementing microsegmentation at the Kubernetes layer. A CNI (Container Network Interface) plugin that supports NetworkPolicy (Calico, Cilium, Weave) must be installed — without a NetworkPolicy-capable CNI, NetworkPolicy resources are created but not enforced. Additional network security: use Kubernetes Network Policies to enforce least-privilege pod communication, expose services externally only through Ingress controllers (not NodePort/LoadBalancer on every service), scan container images for vulnerabilities (Trivy, Snyk, Anchore), use admission controllers (OPA Gatekeeper, Kyverno) to enforce security policies on pod definitions before they’re created, and use a service mesh (Istio, Linkerd) for mTLS between pods.

Q98. What is a service mesh and how does it provide security in microservices?

A service mesh (Istio, Linkerd, Consul Connect) adds a sidecar proxy to every pod (Envoy proxy, typically). Service-to-service communication passes through the sidecar, which enforces policy. Security capabilities: mTLS (mutual TLS) automatically encrypts all inter-service traffic without application code changes, service identity (cryptographic identity for each service, not just IP-based), authorization policy (service A can only call service B on specific paths/methods — not just any TCP connection), traffic observability (request metrics, traces, and logs for every service interaction). This provides encryption and access control at Layer 7 between microservices. Without a service mesh or equivalent, inter-pod communication is typically unencrypted even within the cluster — a compromised pod can observe all unencrypted traffic on the same node.

Q99. What is API security and what are the most common API vulnerabilities?

APIs have become the dominant attack surface. OWASP API Security Top 10 (2023): Broken Object Level Authorization (BOLA/IDOR — user A can access user B’s data by changing an ID in the request), Broken Authentication (weak tokens, no token expiry), Broken Object Property Level Authorization (returning more data than needed in responses), Unrestricted Resource Consumption (no rate limiting — enables enumeration and DoS), Broken Function Level Authorization (accessing admin functions as a regular user), Unrestricted Access to Sensitive Business Flows (abusing business logic). Network-level API security controls: API Gateway (rate limiting, authentication, schema validation), WAF for OWASP attack patterns, mutual TLS between services, OAuth 2.0 with short-lived access tokens, API key rotation, and API traffic monitoring (detect unusual patterns like mass data extraction or scanning).

Q100. Where is network security headed in 2026 and beyond?

Several trends are reshaping the field: AI in security operations — LLMs (Microsoft Copilot for Security, Google Chronicle AI, CrowdStrike Charlotte AI) assist analysts in investigation and threat hunting, but also empower attackers to generate more convincing phishing and write more sophisticated malware. Post-quantum cryptography migration — NIST finalized PQC standards in 2024; organizations need cryptographic agility plans to migrate from RSA/ECC. SASE maturation — the market is consolidating; expect fewer vendors offering more complete single-platform solutions. Operational Technology (OT) security — increased attacks on critical infrastructure are forcing IT security practices into industrial environments, which have very different constraints (legacy protocols, can’t patch production systems). Identity as the new perimeter — as physical network boundaries disappear, controlling what identities can do, from any device, anywhere, becomes the primary security model. Network engineers increasingly need to understand identity and cloud security alongside traditional networking.

Quick Reference: Network Security Key Concepts

Concept	What It Does	When To Use It
Defense in Depth	Multiple overlapping security layers	Always — never rely on a single control
Zero Trust / ZTNA	Verify every access, per-application scope	Remote access, contractor access, SaaS
MFA	Two+ authentication factors required	All privileged access, VPN, admin portals
AES-256-GCM	Authenticated symmetric encryption	VPN, TLS, data at rest
RPKI	Cryptographic BGP route origin validation	Any organization announcing BGP prefixes
DAI + DHCP Snooping	Prevents ARP spoofing and rogue DHCP	All enterprise access layer switches
TLS 1.3	PFS-mandatory, simplified cipher suites	All HTTPS, enforce minimum TLS 1.2
TACACS+	Per-command device admin authorization	All network device management
PFS (IKEv2)	Ephemeral keys per session	All IPsec VPN tunnels

What Separates Security Engineers from Networking Engineers Who Know Security

Threat modeling	Before building any control, ask: what’s the threat? What’s the realistic attack? What would an attacker do if this control wasn’t here?
Risk-based thinking	Perfect security is impossible and often counterproductive. Every decision is a trade-off between security, usability, and cost. Know which risks are worth taking.
Attacker perspective	The best security engineers think like attackers. Knowing how ARP spoofing, DNS tunneling, and BGP hijacks work makes you better at preventing and detecting them.
Operational awareness	Security controls that people work around are worse than no controls — they create a false sense of security while the real risk walks through the side door.

Tags: Network Security Interview Questions Zero Trust Cryptography SIEM & SOC Firewall Security Cloud Security PKI & VPN SASE & ZTNA