Network Security Interview Questions and Answers: Firewalls, VPNs, TLS and Attacks

Key takeaways

• Give each answer three parts: what it is, how it can be attacked or fail, and how you would defend.
• Know the basics cold: CIA, firewall types, IDS versus IPS, VPN, TLS, NAT and segmentation.
• Be ready for scenarios: a suspected compromised host, an exposed port, or a phishing report.
• Mention logging and monitoring: defence without visibility is a weak answer.
• Do not invent experience. Say what you have practised in a lab.

These are common topics for network security roles, not a record of what a particular company asked. Practise saying each answer aloud in under a minute.

Fundamentals

1. What is network security?

Protecting network infrastructure and the data on it from unauthorised access, misuse, modification and disruption, using controls such as firewalls, encryption, access control and monitoring.

2. What is the CIA triad?

Confidentiality (only authorised people see data), Integrity (data is not altered) and Availability (systems work when needed). Authentication and non-repudiation support these goals.

3. What is defence in depth?

Using multiple layers of control, such as perimeter filtering, segmentation, host protection, strong authentication and monitoring, so that one failure does not mean compromise.

4. Difference between a threat, a vulnerability and a risk?

A threat can cause harm, a vulnerability is a weakness, and risk is the likelihood and impact of a threat exploiting a vulnerability.

Firewalls and filtering

5. How does a firewall work?

It allows or blocks traffic using rules based on addresses, ports, protocols and, in some types, applications and users. Default deny is the safest policy.

6. Types of firewalls?

Packet filtering (stateless rules), stateful (tracks connections), proxy or application-level (inspects and relays), and next-generation (application awareness, intrusion prevention, user identity). See our guide to what a firewall is and how it works.

7. Stateful versus stateless?

A stateless filter judges each packet alone. A stateful firewall remembers connection state, so it allows replies to outbound connections and drops unsolicited inbound packets.

8. What is a DMZ?

A separate zone for public-facing servers so an attack on them does not directly reach the internal network.

9. What is a WAF?

A web application firewall inspects HTTP traffic to block attacks such as SQL injection and cross-site scripting. It complements, and does not replace, secure coding.

Detection and monitoring

10. IDS versus IPS?

An intrusion detection system monitors and alerts. An intrusion prevention system sits in line and can block. Both use signatures, anomaly detection or both.

11. What is a SIEM?

A system that collects and correlates logs from many sources, raises alerts and supports investigation. Good alerting needs tuned use cases and good log coverage.

12. What is a honeypot?

A decoy system that attracts attackers so you can study their behaviour and get early warning. It should be isolated and monitored.

Encryption and VPN

13. Symmetric versus asymmetric encryption?

Symmetric uses one shared key and is fast, for bulk data. Asymmetric uses a public and private key pair for key exchange and signatures. TLS combines both.

14. What is hashing?

A one-way function that creates a fixed-size digest, used to check integrity and store passwords with a salt and a slow algorithm such as bcrypt or Argon2.

15. How does TLS protect data?

The client and server agree on versions and ciphers, the server proves identity with a certificate, keys are exchanged, and application data is encrypted and integrity-protected. TLS 1.3 is the current version, and older SSL and TLS 1.0 and 1.1 should be disabled.

16. What is a VPN?

An encrypted tunnel across an untrusted network. Site-to-site VPNs link networks, and remote-access VPNs connect users. Protect VPN logins with MFA.

17. What is IPsec?

A suite for securing IP traffic. IKE negotiates keys (UDP 500, and 4500 for NAT traversal), ESP encrypts and authenticates. Modes are transport and tunnel.

18. What is PKI?

The system of certificate authorities, certificates and trust rules that binds public keys to identities.

Attacks and defence

19. What is a man-in-the-middle attack and how do you prevent it?

The attacker sits between two parties to read or change traffic. Defences: TLS with certificate validation, HSTS, secure Wi-Fi, and protection against ARP and DNS spoofing.

20. What is ARP spoofing?

Sending false ARP replies to associate the attacker's MAC with another host's IP. Use dynamic ARP inspection, port security and monitoring.

21. What is DNS poisoning?

Inserting false records into a resolver's cache. Mitigate with DNSSEC, randomised source ports and patched resolvers.

22. What is a DDoS attack and how do you reduce it?

Overwhelming a service with traffic from many sources. Use upstream scrubbing or a CDN, rate limiting, anycast and capacity planning.

23. SQL injection and XSS?

Web attacks that inject commands or scripts through unvalidated input. Prevent with parameterised queries, output encoding and a WAF as a second layer. Check the OWASP Top 10.

24. What is phishing and how do you reduce its impact?

Deceptive messages that steal credentials or deliver malware. Use email filtering, phishing-resistant MFA, reporting buttons and user training.

25. What is port scanning and how do you detect it?

Probing hosts to find open ports. Defenders see many connection attempts to different ports in logs or IDS. Use it on your own systems to find exposure.

Access control and architecture

26. What is zero trust?

A model that trusts no user or device by default. Every request is verified by identity, device health and context, with least privilege.

27. What is network segmentation?

Dividing a network into zones with controlled traffic between them, using VLANs, firewalls or micro-segmentation, to limit lateral movement.

28. What is 802.1X and NAC?

802.1X authenticates devices before they get network access. Network access control checks device posture and puts devices in the right segment.

29. What is MFA and why prefer phishing-resistant methods?

MFA needs two or more factors. SMS and push approvals can be intercepted or fatigued. Passkeys and security keys bind login to the real site.

30. What is the principle of least privilege?

Users and systems get only the access they need, for only as long as they need it.

Operations and scenarios

31. How would you secure a new Linux server on the network?

Patch, remove unneeded services, firewall with default deny, key-based SSH, least privilege accounts, logging to a central system and regular scans of your own host.

32. A host is sending traffic to an unknown external IP. What do you do?

Verify with logs and flows, isolate the host if justified, capture evidence, identify the process, check for other hosts with the same traffic, and follow the incident process.

33. What is the difference between a vulnerability scan and a penetration test?

A scan automatically finds known weaknesses. A penetration test, done with written authorisation, also tries to exploit and chain them to show real impact.

34. What logs matter most?

Firewall, DNS, authentication, VPN, proxy and endpoint logs, kept centrally with synchronised time.

35. How do you keep up to date?

Read vendor advisories, CERT-In notices and the National Vulnerability Database, and practise in a lab. Do not claim experience you do not have.

More practice: common cyber security interview questions and CompTIA Security+ style questions.

Common mistakes

• Memorising definitions without examples.
• Calling NAT or an obscured SSID a security control.
• Forgetting logging and monitoring.
• Saying you "hacked" a system outside a lab or authorised test.

Next steps

Next steps: to build hands-on network security skills, see our Certified Network Defender course, and read what a firewall is.

Related reading

• Top Cyber Security Interview Questions 2026