Network Security Interview Questions for Cyber Security
25 Network Security questions with answers for cyber security roles — 5 easy, 16 medium, 4 hard.
About Network Security
Learn how traffic is controlled and monitored: TCP/IP from a security view, firewalls, IDS and IPS, segmentation, DMZ design, VPN and ZTNA, DNS and ARP attacks, DDoS mitigation and TLS. You will practise with Nmap, tcpdump, Wireshark and host firewalls so you can investigate network alerts and design safer networks.
Sheet progressStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
What is the difference between TCP and UDP from a security point of view?
TCP is connection oriented with a three-way handshake, which makes it reliable but open to SYN flood attacks. UDP is connectionless, so it is easy to spoof source addresses and is abused in amplification attacks using DNS, NTP or memcached. Firewalls track TCP state easily, while UDP state is inferred from timeouts. Security monitoring must cover both, since DNS tunnelling uses UDP 53.
A firewall enforces rules on traffic between networks. Packet-filtering firewalls check IP, port and protocol. Stateful firewalls track connections and allow return traffic automatically. Next-generation firewalls add application awareness, user identity, TLS inspection, IPS and URL filtering. Web application firewalls protect HTTP applications from attacks such as SQL injection. Host firewalls like Windows Defender Firewall or nftables protect individual machines.
An Intrusion Detection System monitors traffic or hosts and raises alerts but does not block. An Intrusion Prevention System sits inline and can drop malicious packets in real time. IDS is safer for tuning because false positives do not break traffic, while IPS gives active protection. Detection can be signature based, as in Snort and Suricata rules, or anomaly based using baselines of normal behaviour.
A DMZ, or perimeter network, is a separate zone between the internet and the internal network for public-facing services like web servers, mail relays and reverse proxies. Firewall rules allow internet traffic only to DMZ hosts and allow DMZ hosts only limited, specific connections inward. If a DMZ server is compromised, the attacker still faces another firewall layer before reaching internal systems.
05
How do you scan your own network for open ports with Nmap, with permission?
Only scan networks you own or have written approval for. Start with host discovery, then service and version detection on key ports.
nmap -sn 10.10.0.0/24
nmap -sV -T3 -p 1-1000 10.10.0.15
nmap -sV --top-ports 100 -oA scan_results 10.10.0.0/24
Compare results with the approved service list and raise tickets for unexpected open ports.
06
What is network segmentation and why is it important?
Segmentation splits a network into zones such as user, server, OT, guest and management, with controlled traffic between them using VLANs, firewalls and ACLs. It limits lateral movement, so ransomware on one laptop cannot reach every server. It also reduces compliance scope, for example isolating the cardholder data environment for PCI DSS. Micro-segmentation goes further with per-workload policies in data centres and cloud.
07
How does a VPN protect traffic and what are its limits?
A VPN creates an encrypted tunnel, using IPsec, WireGuard or TLS, between a client and a network, protecting data on untrusted networks. Its limits are important: once connected, users often get broad network access, and VPN appliances are a frequent target for exploited vulnerabilities. That is why many companies move to Zero Trust Network Access, which grants per-application access after identity and device checks.
08
Your SOC sees heavy DNS traffic with long random subdomains from one workstation. Which DNS attacks should you consider and what defences apply?
Key DNS attacks are cache poisoning, which inserts false records; DNS tunnelling, which hides data or command traffic inside queries; domain hijacking through registrar account takeover; and DNS amplification DDoS. Defences include DNSSEC to sign records, protective DNS resolvers that block malicious domains, monitoring for long or high-entropy subdomains, registrar lock with MFA, and rate limiting open resolvers.
09
A user on the office LAN reports repeated certificate warnings and you suspect ARP spoofing. What is happening and how do you stop it?
ARP has no authentication, so an attacker on the same LAN can send fake ARP replies linking their MAC address to the gateway's IP. Victims then send traffic through the attacker, enabling man-in-the-middle interception. Defences include Dynamic ARP Inspection with DHCP snooping on switches, port security, network access control, and encrypting traffic end to end with TLS so intercepted data is useless.
A Distributed Denial of Service attack floods a target from many sources to exhaust bandwidth, connection tables or application resources. Types are volumetric floods, protocol attacks like SYN floods, and application layer floods hitting costly pages. Mitigation uses upstream scrubbing services or CDN providers, anycast networks, rate limiting, SYN cookies, autoscaling, and a tested runbook agreed with the ISP before an attack.
TLS secures data in transit. In the TLS 1.3 handshake the client and server agree on cipher suites, perform an ephemeral key exchange such as X25519 for forward secrecy, and the server proves its identity with a certificate signed by a trusted CA. Both derive session keys, then traffic is encrypted with an AEAD cipher like AES-GCM. TLS 1.0 and 1.1 are deprecated and should be disabled.
NAC checks devices and users before allowing them on the network, typically using 802.1X with a RADIUS server. It can verify certificates, patch level, EDR presence and user identity, then assign a VLAN or policy. Unknown or non-compliant devices go to a quarantine or guest network. NAC is important in offices with many personal devices and IoT equipment such as printers and cameras.
13
How do you handle a network team that refuses a security change you recommended?
Situation: the network team rejected my request to block outbound SMB at the firewall, fearing outages. Task: reduce the risk without damaging the relationship. Action: I shared flow data showing only two servers needed it, proposed an allowlist for them and a one-week monitor-only phase. Result: the team agreed, the rule went live with zero incidents, and we now review rules together monthly.
14
Your IDS alerts on outbound traffic from a database server to an unknown IP on port 443 at 3 AM. How do you investigate?
Database servers rarely need internet access, so this is suspicious. I would check the destination's reputation and WHOIS, look at flow data for volume and duration, and identify the process making the connection using EDR. Then I review recent logins, scheduled tasks and new binaries on the server. If data volume is large or the process is unknown, I contain the host and escalate as a possible exfiltration.
15
Users complain that a new firewall rule broke an application. How do you troubleshoot?
First check the firewall logs for denied traffic from the affected users or servers around the change time. Compare the change ticket with actual app requirements, since apps often use extra ports or dependencies. Use packet capture or a test connection to confirm. Then add a narrow rule for the real need, not an any-any rule, and update documentation so the next change does not repeat the problem.
16
A firewall audit finds 40 percent of rules have not been hit in a year. What do you do?
Unused rules expand attack surface and slow audits. I would export rule hit counts, confirm no seasonal apps like year-end batch jobs depend on them, and contact rule owners listed in tickets. Rules with no owner are disabled first, not deleted, and monitored for a month. After that they are removed. I would also add rule expiry dates and quarterly reviews to the change process.
17
A guest Wi-Fi user can reach internal printers. What is wrong and how do you fix it?
Guest traffic is not properly isolated, likely because the guest SSID shares a VLAN with internal devices or the firewall allows inter-VLAN routing. Fix by placing guests on a separate VLAN with internet-only access, applying ACLs that deny all RFC 1918 internal ranges, and enabling client isolation on the wireless controller. Then test from a guest device and document the design.
18
How would you capture and analyse suspicious traffic using tcpdump and Wireshark?
Capture on the right interface with a filter to limit size, save to a pcap file, then open it in Wireshark.
sudo tcpdump -i eth0 host 10.10.0.15 and port 53 -w dns.pcap
In Wireshark, use display filters such as dns, http.request or tls.handshake.type == 1, and Statistics > Conversations to spot top talkers. Protect pcaps because they may contain sensitive data.
19
How do you write basic Linux host firewall rules with nftables?
Check supported protocol versions, ciphers and certificate details. OpenSSL gives a quick view, and tools like testssl.sh give a full report.
openssl s_client -connect example.com:443 -tls1_2
openssl s_client -connect example.com:443 -servername example.com | openssl x509 -noout -dates -issuer
./testssl.sh example.com
Disable TLS 1.0 and 1.1, weak ciphers like RC4 and 3DES, and fix expiring certificates.
21
Describe a time you handled a stressful outage or security issue.
Situation: during my internship the office internet went down during a client demo because of a broadcast storm. Task: restore service quickly. Action: I checked switch logs, found a looped cable creating a loop, removed it, and then enabled spanning tree and storm control with my senior. Result: service returned in 20 minutes, and I wrote a short runbook so the team could resolve similar issues faster.
Secure Access Service Edge combines networking, such as SD-WAN, with cloud-delivered security services: secure web gateway, CASB, ZTNA and firewall as a service. Users connect to the nearest provider point of presence, and policy follows them anywhere. It suits Indian companies with many branches and hybrid workers because traffic no longer has to backhaul to a head office data centre. Vendor lock-in and migration effort are the trade-offs.
23
Your servers can reach any internet destination freely. Why is this a problem and how do you introduce egress filtering?
Egress filtering controls outbound traffic, allowing only needed destinations and ports. It blocks malware call-backs, data exfiltration and servers reaching the internet directly. Many networks allow all outbound traffic because it is easier and legacy apps have undocumented dependencies. A practical approach is forcing web traffic through a proxy, blocking direct outbound from servers, and allowing exceptions only with business justification.
24
Your company website is under an application layer DDoS attack. What actions do you take?
Confirm it is an attack and not a traffic spike by checking request patterns, user agents and source spread. Enable or tighten the CDN or WAF bot protection and rate limits on targeted URLs, add challenge pages for suspicious clients, and cache heavy pages. Inform the ISP or DDoS provider and management. After the attack, review logs, tune rules and update the runbook.
25
Management wants to replace the VPN with Zero Trust access. How would you plan it?
I would start by inventorying applications and who uses them, then pick a low-risk app group for a pilot with an identity-aware proxy or ZTNA service. Integrate it with the identity provider, enforce MFA and device posture checks, and monitor access logs. Expand app by app, keep the VPN for legacy needs during transition, and retire it once every app is covered and tested.
Frequently asked questions
How important is Network Security in Cyber Security interviews?
Learn how traffic is controlled and monitored: TCP/IP from a security view, firewalls, IDS and IPS, segmentation, DMZ design, VPN and ZTNA, DNS and ARP attacks, DDoS mitigation and TLS. You will practise with Nmap, tcpdump, Wireshark and host firewalls so you can investigate network alerts and design safer networks.
How should I use the Network Security sheet?
Go top to bottom — easy to hard. Answer before opening each answer, tick what you solved and save misses to Last-Minute Revision.