Network security basics
Computer Networks · 10 interview questions
Most interview-level network security reduces to three questions: is the party who they claim to be, has the data been read, and has it been altered. Encryption answers the second, integrity checks the third, and certificates or tokens the first.
The attacks worth knowing follow from missing one of those. A man-in-the-middle attack succeeds when identity isn't verified. Replay attacks succeed when messages carry no freshness. Denial of service doesn't break any of the three — it simply exhausts capacity, which is why it's defended differently.
It's also worth being able to say clearly that HTTPS proves you're talking privately to whoever owns the domain — not that they're honest. That distinction underpins how phishing works.
Network security basics interview questions
- What is a man-in-the-middle attack, and what prevents it?
- An attacker relays traffic between two parties who believe they're talking directly. Certificate-based authentication prevents it: the attacker can't present a valid certificate for the domain, so the client rejects the connection.
- When would you use symmetric versus asymmetric encryption?
- Symmetric for bulk data — it's fast, but both sides need the same secret. Asymmetric for establishing that secret and for signatures, since it needs no pre-shared key but is far slower. TLS uses each for what it's good at.
- What's the difference between hashing and encryption?
- Encryption is reversible with a key; hashing is one-way. Hashing verifies integrity or stores passwords, where you never need the original back — which is exactly why passwords should be hashed and not encrypted.
- Why is SHA-256 a poor choice for hashing passwords?
- Because it's fast, which helps an attacker brute-force billions of guesses. Password hashes should be deliberately slow and memory-hard — bcrypt, scrypt or Argon2 — and salted so identical passwords hash differently.
- Why they ask: A security question that separates people who've thought about threat models.
- What is a replay attack, and how is it stopped?
- Capturing a valid message and re-sending it later to repeat its effect. Prevented by making messages non-reusable — nonces, timestamps or sequence numbers — so a repeat is detectable.
- How does a DDoS differ from a DoS?
- A DoS comes from one source and can be blocked by dropping that source. A DDoS comes from many compromised hosts, so blocking individually doesn't work and mitigation relies on capacity, rate limiting and traffic scrubbing upstream.
- What's the difference between a stateless and a stateful firewall?
- A stateless firewall judges each packet against rules in isolation. A stateful one tracks connections, so it can permit return traffic for a connection it already allowed without a rule for every reply.
- What does a VPN actually provide?
- An encrypted tunnel between your device and the VPN endpoint, hiding traffic from the local network and presenting the endpoint's address to destinations. Beyond that endpoint traffic continues normally — it's not blanket anonymity.
- Does HTTPS mean a site is trustworthy?
- No. It means the connection is encrypted and the server holds a valid certificate for that domain. A phishing site can obtain one trivially, so the padlock proves privacy and identity of the domain — never the honesty of its owner.
- Is SSL still in use?
- No — all SSL versions are deprecated and insecure. The protocol in use is TLS, and current practice is TLS 1.2 or 1.3. 'SSL certificate' persists as a colloquialism for a TLS certificate.
You'll forget most of this by next week
That's not a discipline problem, it's how memory works. In the app these come back on an expanding schedule — right before you'd lose them.
Start free for 7 days