Question 1

What is Network Security?

Accepted Answer

Network security is a broad term that covers a multitude of technologies, devices, and processes. It is a set of rules and configurations designed to protect the integrity, confidentiality, and accessibility of computer networks and data using both software and hardware technologies.

Question 2

Explain the OSI Model and its security implications.

Accepted Answer

The Open Systems Interconnection (OSI) model describes seven layers that computer systems use to communicate over a network. Each layer has specific security risks:
1. **Physical**: Physical theft, wiretapping.
2. **Data Link**: MAC spoofing, ARP poisoning.
3. **Network**: IP spoofing, DDoS.
4. **Transport**: SYN flood, port scanning.
5. **Session**: Session hijacking.
6. **Presentation**: Format manipulation.
7. **Application**: SQLi, XSS, Malware.

Question 3

What is the difference between TCP and UDP in terms of security?

Accepted Answer

- **TCP**: Reliable and connection-oriented. Vulnerable to SYN flood attacks due to the three-way handshake.
- **UDP**: Connectionless and faster. Vulnerable to amplification and reflection attacks because there is no handshake to verify the source IP.

Question 4

What is a Three-Way Handshake?

Accepted Answer

It's the process used in a TCP/IP network to make a connection between a client and a server:
1. **SYN**: Client sends a synchronize packet.
2. **SYN-ACK**: Server acknowledges and sends its own sync.
3. **ACK**: Client acknowledges the server's sync.
Attackers exploit this by sending many SYNs and never sending the final ACK (SYN Flood).

Question 5

What is DNS Security (DNSSEC)?

Accepted Answer

DNSSEC (Domain Name System Security Extensions) adds a layer of security to the DNS process by attaching digital signatures to DNS records. This prevents attackers from redirecting users to malicious websites via DNS spoofing or cache poisoning.

Question 6

Explain HTTP vs HTTPS.

Accepted Answer

- **HTTP**: Data is sent in plain text. Vulnerable to sniffing.
- **HTTPS**: HTTP over SSL/TLS. Data is encrypted, ensuring confidentiality and integrity between the user's browser and the server.

Question 7

What is SSL/TLS Handshake?

Accepted Answer

The TLS handshake is the process by which a client and server establish an encrypted connection. It involves negotiating the TLS version, choosing cipher suites, and verifying the server's identity via a digital certificate.

Question 8

What is an IP Address and what is IP Spoofing?

Accepted Answer

An IP address is a unique identifier for a device on a network. IP spoofing is a technique where an attacker sends IP packets with a forged source IP address to conceal their identity or impersonate another computer system.

Question 9

What is MAC Address and MAC Spoofing?

Accepted Answer

A MAC address is a unique physical address assigned to a network interface controller (NIC). MAC spoofing involves changing the assigned MAC address to bypass access control lists (ACLs) on routers or switches.

Question 10

What is ARP (Address Resolution Protocol)?

Accepted Answer

ARP is used to map an IP address to a physical MAC address on a local area network. Since ARP doesn't verify the legitimacy of replies, it's vulnerable to 'ARP Poisoning' where an attacker maps their MAC to a target's IP.

Question 11

Explain DHCP and DHCP Snooping.

Accepted Answer

DHCP automatically assigns IP addresses to devices. DHCP Snooping is a security feature that acts like a firewall between untrusted hosts and trusted DHCP servers, preventing 'Rogue DHCP' attacks.

Question 12

What is ICMP and how is it abused?

Accepted Answer

ICMP (Internet Control Message Protocol) is used for network diagnostics (e.g., Ping). Attackers use it for network mapping ('Ping Sweeps') and DDoS attacks ('Smurf attack').

Question 13

What is Port 445 used for and why is it high risk?

Accepted Answer

Port 445 is used for SMB (Server Message Block) over TCP. It is high risk because it's frequently used for file sharing and has had many critical vulnerabilities (e.g., EternalBlue used by WannaCry).

Question 14

What is a 'Well-Known Port'?

Accepted Answer

Well-known ports are those from 0 to 1023. They are reserved for standard services like FTP (21), SSH (22), DNS (53), and HTTP (80).

Question 15

What is the difference between IPv4 and IPv6 from a security standpoint?

Accepted Answer

IPv6 was designed with IPsec (encryption/authentication) as a mandatory requirement, whereas it was optional in IPv4. IPv6 also eliminates the need for NAT, though it introduces new complexities in firewalling.

Question 16

What is SNMP and its security risks?

Accepted Answer

SNMP (Simple Network Management Protocol) is used to manage network devices. Older versions (v1, v2c) send community strings (passwords) in plain text. SNMPv3 is the secure version as it supports encryption.

Question 17

What is an MTU (Maximum Transmission Unit)?

Accepted Answer

MTU is the largest size packet that can be transmitted over a network. Fragile networks can be attacked by sending packets just over the MTU size to force fragmentation and overhead (Teardrop attack).

Question 18

What is BGP (Border Gateway Protocol) Hijacking?

Accepted Answer

BGP is the protocol that routes traffic between large networks (Autonomous Systems). BGP hijacking occurs when an attacker falsely advertises ownership of IP prefixes to redirect internet traffic to their own network.

Question 19

Explain TTL (Time to Live).

Accepted Answer

TTL is a value in an IP packet that tells a network router whether or not the packet has been in the network too long and should be discarded. It prevents packets from looping infinitely.

Question 20

What is SSH and why is it preferred over Telnet?

Accepted Answer

SSH (Secure Shell) provides a secure, encrypted channel over an unsecure network. Telnet sends all data, including passwords, in clear text, making it insecure.

Question 21

What is FTP vs SFTP?

Accepted Answer

- **FTP**: Unencrypted, uses two ports (20, 21).
- **SFTP**: Secure FTP over SSH. Single port (22), fully encrypted.

Question 22

What is a Port Scan?

Accepted Answer

A port scan is a reconnaissance technique used to identify which ports on a network are open and what services are running. Tools like Nmap are commonly used.
Code Example:
nmap -sV <target_ip>

Question 23

What is NAT (Network Address Translation)?

Accepted Answer

NAT allows a single device, such as a router, to act as an agent between the Internet and a local network, which means that only a single, unique IP address is required to represent an entire group of computers.

Question 24

What is the difference between a Hub, Switch, and Router?

Accepted Answer

- **Hub**: Broadcasts traffic to all ports (Insecure).
- **Switch**: Sends traffic only to the specific MAC address (More secure).
- **Router**: Connects different networks and makes routing decisions based on IP addresses.

Question 25

What is Flow Control?

Accepted Answer

Flow control is the process of managing the rate of data transmission between two nodes to prevent a fast sender from overwhelming a slow receiver.

Question 26

What is a Firewall and how does it work?

Accepted Answer

A firewall is a network security device that monitors and filters incoming and outgoing network traffic based on an organization's previously established security policies. It acts as a barrier between a trusted internal network and an untrusted external network, like the Internet.

Question 27

Explain the types of Firewalls.

Accepted Answer

1. **Packet Filtering**: Inspects individual packets (IP, Port).
2. **Stateful Inspection**: Keeps track of the state of active connections.
3. **Application Layer (Proxy)**: Inspects specific application data (HTTP, FTP).
4. **Next-Generation Firewall (NGFW)**: Includes deep packet inspection (DPI), IPS, and identity awareness.

Question 28

What is a DMZ (Demilitarized Zone)?

Accepted Answer

A DMZ is a physical or logical subnetwork that contains and exposes an organization's external-facing services to an untrusted, usually larger, network such as the Internet. It adds an extra layer of security to an organization's local area network (LAN).

Question 29

What is an IDS vs an IPS?

Accepted Answer

- **IDS (Intrusion Detection System)**: A passive system that identifies and alerts for suspicious activity (e.g., Snort).
- **IPS (Intrusion Prevention System)**: An active system that detects and blocks threats in real-time.

Question 30

Explain 'Defense in Depth'.

Accepted Answer

Defense in Depth is an information assurance concept in which multiple layers of security controls (defense) are placed throughout an information technology (IT) system. Its intent is to provide redundancy in the event a security control fails.

Network Security Interview Master

Difficulty Filters

Tools & Options

What is Network Security?

Explain the OSI Model and its security implications.

What is the difference between TCP and UDP in terms of security?

What is a Three-Way Handshake?

What is DNS Security (DNSSEC)?

Explain HTTP vs HTTPS.

What is SSL/TLS Handshake?

What is an IP Address and what is IP Spoofing?

What is MAC Address and MAC Spoofing?

What is ARP (Address Resolution Protocol)?

Explain DHCP and DHCP Snooping.

What is ICMP and how is it abused?

What is Port 445 used for and why is it high risk?

What is a 'Well-Known Port'?

What is the difference between IPv4 and IPv6 from a security standpoint?

What is SNMP and its security risks?

What is an MTU (Maximum Transmission Unit)?

What is BGP (Border Gateway Protocol) Hijacking?

Explain TTL (Time to Live).

What is SSH and why is it preferred over Telnet?

What is FTP vs SFTP?

What is a Port Scan?

What is NAT (Network Address Translation)?

What is the difference between a Hub, Switch, and Router?

What is Flow Control?

What is a Firewall and how does it work?

Explain the types of Firewalls.

What is a DMZ (Demilitarized Zone)?

What is an IDS vs an IPS?

Explain 'Defense in Depth'.

What is a Load Balancer and its security benefits?

What is a Bastion Host?

What is a Web Application Firewall (WAF)?

Explain SIEM (Security Information and Event Management).

What is a Honeypot?

What are 'Air-Gapped' networks?

Explain Forward Proxy vs Reverse Proxy.

What is Network Segmentation?

Explain VLAN (Virtual Local Area Network) Security.

What is a 'Zero Trust' architecture?

Explain RADIUS vs TACACS+.

What is Split Tunneling in a VPN?

What is Deep Packet Inspection (DPI)?

What is Port Security on a switch?

What is a 'Shadow IT'?

Explain the importance of Log Management.

What is an ACL (Access Control List)?

What is Endpoint Security?

What is BYOD (Bring Your Own Device) security?

Difference between Hub and Switch security?

What is a VPN and what are its key components?

Explain IPsec and its two modes.

What is SSL/TLS VPN?

Explain WireGuard.

What are the common Wireless encryption standards?

What is WPA3 and why is it better than WPA2?

What is a 'Rogue Access Point'?

What is 'Evil Twin' attack?

Explain SSID Broadcasting and its security value.

What is Wardriving?

What is Bluejacking vs Bluesnarfing?

What is 'Site-to-Site' VPN vs 'Remote Access' VPN?

What is WPS (Wi-Fi Protected Setup) and its vulnerability?

Explain the 'RADIUS' protocol in Wireless Security.

What is a 'Portal Page' / 'Captive Portal'?

What is KRACK (Key Reinstallation Attack)?

Explain MAC Filtering and how to bypass it.

What is an 'Always-On' VPN?

Explain Public Key Infrastructure (PKI) in VPNs.

What is 'Beaconing'?

Explain 'Perfect Forward Secrecy' (PFS).

What is L2TP (Layer 2 Tunneling Protocol)?

Difference between PPTP and L2TP?

What is a VPN Kill Switch?

How does 802.1X work?

What is Threat Modeling?

Explain the STRIDE model.

Neural Networks Tutorial: Complete Deep Learning & Backpropagation Guide