Network Security

1. How does a Virtual Private Network (VPN) protect user data over a public network?

A VPN uses two techniques together: tunneling and encryption.

1. Tunneling — your data packet is wrapped (encapsulated) inside another packet addressed to the VPN server. This hides the real contents and destination from the network.
2. Encryption — the encapsulated data is scrambled with strong cryptographic protocols, so even if it’s intercepted, it’s unreadable.

Your data → encrypt → wrap in VPN tunnel → public internet → VPN server
                                                              ↓
                                                        unwrap + decrypt

To an outside observer, they see encrypted traffic to a VPN endpoint — not your actual activity. That’s how a VPN protects data on public Wi-Fi and hides traffic from the ISP.

2. What makes HTTPS secure compared to standard HTTP traffic?

HTTPS encrypts the data with SSL/TLS, while HTTP sends everything as plain text.

• HTTP — transmits data in clear text over port 80. Anyone on the path (or network) can read it.
• HTTPS — wraps the traffic in an SSL/TLS cryptographic layer over port 443. Data is unreadable to snoopers.

What TLS provides:

• Confidentiality — encryption keeps content secret.
• Integrity — tampering is detected.
• Authentication — the site’s certificate proves you’re talking to the real server.

HTTP:   [login: alice, password: hunter2]  ← visible to anyone
HTTPS:  [0x9F2A...encrypted blob...]       ← unreadable

3. What are the three core principles defined by the CIA Triad in network security?

The CIA Triad is the foundation of information security:

• Confidentiality — data is only readable by authorized parties. Enforced with encryption and access control.
• Integrity — data can’t be altered by unauthorized parties. Enforced with hashing and digital signatures.
• Availability — systems and data are accessible when needed. Ensured via redundancy, backups, and uptime design.

Confidentiality  →  keep it secret (encryption)
Integrity        →  keep it correct (hashing)
Availability     →  keep it reachable (redundancy)

Nearly every security control maps to one of these three goals.

4. What is the operational difference between Symmetric and Asymmetric Encryption?

• Symmetric encryption — the same key encrypts and decrypts. Fast (AES), but the key must be shared securely beforehand.
• Asymmetric encryption — a public/private key pair. The public key encrypts; the mathematically linked private key decrypts. Slower, but solves key distribution.

	Symmetric	Asymmetric
Keys	One shared key	Public + private
Speed	Fast	Slow
Key distribution	Hard	Solved
Examples	AES, DES	RSA, ECC

Real systems combine both: asymmetric to exchange the symmetric key, symmetric for the bulk data.

5. What malicious technique involves an attacker altering the source IP address in a packet header to mimic a trusted system?

IP Spoofing.

The attacker rewrites the source IP in the packet header so it looks like the traffic comes from a trusted local node — not the attacker’s real address.

Real source:  attacker (192.168.1.99)
Spoofed:      192.168.1.10  (a trusted server)
              ↑ source IP forged in the header

Why it matters: firewalls and access rules trust certain IPs. Spoofing lets an attacker get past those filters or shift the blame for an attack. It’s often a step in a bigger attack (DDoS reflection, session hijacking).

• MAC Flooding — overwhelms a switch’s CAM table.
• MitM — intercepts traffic between two parties.
• Broadcast Storming — floods the network with broadcast frames.

IP spoofing is the one that fakes the source address.

6. What is the primary architectural purpose of a Demilitarized Zone (DMZ) in network security?

A DMZ is a buffer zone between the untrusted internet and the trusted internal network.

            Internet
               │
          [Firewall]
               │
        ┌──────┴──────┐
        │   DMZ       │  ← web server, mail server, DNS
        │  (public    │    (things the internet must reach)
        │  servers)   │
        └──────┬──────┘
               │  (second firewall / stricter rules)
        [Internal LAN]

The idea: public-facing servers (web, mail) are the most likely to be attacked. Putting them in a DMZ means a breach of the web server doesn’t give access to the internal network. If the DMZ box is compromised, the internal LAN is still behind another layer of protection.

7. What is the structural operational difference between a MAC Flooding attack and an ARP Poisoning attack?

• MAC Flooding — attacks a switch’s CAM (MAC address) table. The attacker floods fake MAC entries until the table overflows. The switch can’t learn real mappings, so it fails open and broadcasts everything like a hub — letting the attacker sniff traffic between other hosts.
• ARP Poisoning — attacks hosts’ ARP caches. The attacker sends forged ARP replies associating their MAC address with a legitimate IP. Traffic meant for that IP gets redirected to the attacker (a classic MitM setup).

MAC Flooding:  overflow the switch's CAM table → switch behaves like a hub
ARP Poisoning: forge MAC↔IP mapping → attacker becomes the "middle man"

One breaks the switch’s forwarding memory; the other poisons the address-resolution cache.

8. How does a Zone-Based Firewall differ fundamentally from a traditional Access Control List (ACL) security configuration?

• Traditional ACL — rules are applied linearly to individual interfaces (“on Gig0/1, deny 10.1.1.0/24”). Every interface gets its own rule list; policies get tangled fast.
• Zone-Based Firewall — interfaces are grouped into logical zones (Inside, DMZ, Outside), and policies are defined between zone pairs.

ACL style:            Zone-based style:
[Gi0/1]──rules        [Inside]  ── zone-pair policy ──→ [DMZ]
[Gi0/2]──rules        [Inside]  ── zone-pair policy ──→ [Outside]
[Gi0/3]──rules        [DMZ]     ── zone-pair policy ──→ [Outside]

Benefit: instead of maintaining dozens of per-port ACLs, you define a handful of zone-to-zone policies. Add a new interface, drop it in a zone, and it inherits the zone’s security posture automatically. Much cleaner at scale.

9. During the Key Exchange step of an SSL/TLS Handshake, how is the Pre-Master Secret securely shared?

The client encrypts the Pre-Master Secret with the server’s public key; only the server can decrypt it with its private key.

Client                                      Server
  │  1. ClientHello ──────────────────────→
  │  2. ← ServerHello + certificate (pub key)
  │  3. generate Pre-Master Secret
  │  4. encrypt PMS with server's PUBLIC key
  │     ── Encrypted(PMS) ────────────────→
  │                                        5. decrypt with PRIVATE key
  │  6. both derive the same session keys

Why this works: the Pre-Master Secret crosses an untrusted network in ciphertext that only the server’s private key can open. Even if a sniffer captures the message, they don’t have the private key, so they can’t recover the secret. From that shared secret, both sides derive the same symmetric session keys for the rest of the conversation.

10. What is the operational difference between IPSec Tunnel Mode and Transport Mode?

• Transport Mode — encrypts only the payload; the original IP headers stay exposed. Used for end-to-end host-to-host communication (the two endpoints are the actual communicators).

Transport:  [IP hdr][ESP][payload]
            ↑ kept clear

• Tunnel Mode — encrypts the entire original packet and wraps it in a new outer IP header. Used for site-to-site VPNs (the tunnel endpoints are gateways, not the real hosts).

Tunnel:  [new outer IP][ESP][orig IP hdr][payload]
                          ↑ everything encrypted

Transport: host ──────── host            (one conversation)
Tunnel:    site A ───── site B           (networks bridged)

Tunnel mode hides even the internal addressing (good for VPNs); transport mode keeps headers readable for intermediate routing.

11. How does an Intrusion Prevention System (IPS) differ from an Intrusion Detection System (IDS)?

• IDS — a passive camera. It monitors a copy of traffic, detects threats, logs and alerts — but takes no direct action.
• IPS — an inline guard. It sits directly in the traffic path and can actively block/drop malicious packets or terminate sessions in real time.

IDS:   traffic ──copy──→ [IDS] → alert (passive)
       traffic ──passes through untouched──→

IPS:   traffic ──→ [IPS inline] ──forward──→
                     └── malicious → DROP

Same detection engines, different posture: IDS watches and warns; IPS watches and stops. An IPS that can drop traffic also needs to be reliable — a false positive blocks legitimate traffic.

12. What distinguishes a Distributed Denial of Service (DDoS) attack from a standard Denial of Service (DoS) attack?

Both aim to overwhelm a target and take it offline.

• DoS — launched from a single attacking source.
• DDoS — launched from a coordinated army of thousands of compromised devices (a botnet) simultaneously.

DoS:  [attacker] ──flood──→ target
DDoS: [bot1][bot2][bot3]...[bot5000] ──flood──→ target
        (a botnet, spread across the globe)

Why DDoS is worse: a single source can be black-holed by blocking that IP. A botnet’s traffic comes from thousands of distributed IPs, so filtering is nearly impossible — and the sheer volume can saturate the target’s bandwidth. Volume + distributed origin = far harder to defend.

13. How do Intranets and Extranets differ in terms of network accessibility?

• Intranet — a private network for internal employees only (HR portal, internal docs, company apps).
• Extranet — the intranet plus controlled access for trusted outsiders — suppliers, partners, clients — via a secure portal.

Intranet:   [Employees only]
Extranet:   [Employees] + [Suppliers / Partners / Clients]
                 └── limited, authenticated, secure portal

Internet  = everyone
Intranet  = the company only
Extranet  = the company + invited external partners

The extranet exposes a slice of the internal network — not the whole thing — behind authentication and fine-grained permissions.

14. What switch security feature protects a local network against an unauthorized Rogue DHCP Server?

DHCP Snooping.

It classifies switch ports as trusted or untrusted and only lets DHCP server responses (Offer/Ack) in on trusted ports.

                ┌─────────── Switch ───────────┐
Legit DHCP server ── trusted port ✓ responses accepted
Rogue DHCP server ── untrusted port ✗ Offer/Ack dropped
Client ──────────── untrusted port (requests allowed out)

Why it matters: a rogue DHCP server could hand clients a malicious IP/gateway/DNS — redirecting traffic through the attacker. DHCP Snooping blocks any DHCP server message arriving on an untrusted port, so only the real, authorized DHCP server can answer. (It also builds a binding table that helps defend against IP spoofing.)

15. What is the tactical purpose of deploying a Honeypot within an enterprise security architecture?

A honeypot is an isolated decoy designed to look like a valuable target so attackers waste time and reveal their methods on it — instead of real assets.

[real servers]        [Honeypot]
   ✓ safe        attacker probes the decoy
                 attacker "breaks in" (simulated data)
                 defenders watch every move, log techniques

Value:

• Lures attackers away from production systems.
• Delays them while defenders respond.
• Reveals attack techniques and tools — intelligence for hardening the real network.

The honeypot contains only fake data, so nothing real is at risk. It’s the network equivalent of a decoy wallet you bait and watch.

16. What are the common web application attacks — XSS, SQL Injection, and Session Hijacking?

Three attacks every placement candidate should explain:

• XSS (Cross-Site Scripting) — the attacker injects a script into a page that other users view. If the site reflects user input without sanitizing it, a comment field like <script>steal cookies</script> executes in every visitor’s browser — the script can steal session cookies, redirect users, or deface the page. Stored XSS lives in the database (posted once, runs for everyone); reflected XSS bounces straight back in a URL/error. Defense: escape/validate all user input, use CSP headers.
• SQL Injection — the attacker injects SQL into an input field to manipulate the query. ' OR '1'='1 in a login form turns WHERE user='x' into WHERE user='x' OR '1'='1' — bypassing authentication or dumping the database. Defense: parameterized queries / prepared statements (never string-concatenate user input), input validation, least-privilege DB accounts.
• Session Hijacking — the attacker steals the victim’s session cookie/ID and replays it, impersonating the logged-in user. Done via XSS, sniffing (unencrypted), or predicting session IDs. Defense: HTTPS everywhere, HttpOnly + Secure cookie flags, session rotation on login, short timeouts.

The common thread: never trust user input. Validation and parameterized queries stop injection; HttpOnly cookies, HTTPS, and CSP stop cookie theft. Know one defense per attack — that’s what interviewers probe.