Network Security
Network Security questions test whether you can place a control at the right layer and justify it. Expect segmentation design, firewall and IDS/IPS behaviour, secure remote access, wireless authentication, and the classic interception attacks.
Core rules and concepts
- Defence in depth: perimeter filtering, internal segmentation with VLANs and subnets, microsegmentation for workloads, a DMZ for internet-facing services, and egress filtering.
- Firewalls: stateless packet filters inspect headers only; stateful firewalls track sessions; NGFWs add application awareness and TLS inspection. Default deny with explicit allow, evaluated in order.
- IDS is passive and alerts; IPS is inline and can block. Out-of-band placement cannot stop traffic.
- 802.1X with EAP gives port-based network access control; WPA3-Personal uses SAE to resist offline dictionary attacks; WPA3-Enterprise uses 802.1X.
- VPNs: IPsec with IKEv2 and ESP for site-to-site; TLS VPNs for remote access. A VPN authenticates the tunnel, not a user's authorisation to each application.
- Zero trust: authenticate and authorise every request, assume breach, no implicit trust from network location.
- Attacks to recognise: ARP spoofing, DNS cache poisoning, VLAN hopping via double tagging, DHCP starvation, DDoS, on-path interception. DNSSEC gives origin integrity, not confidentiality.
Worked example
A public web application must reach a database. Put the web tier in a DMZ. The firewall allows 443 from any source to the web tier and 5432 only from the web tier to the database subnet; no inbound path reaches the database directly. An IPS sits inline ahead of the web tier and a WAF terminates HTTP for content inspection. Administrative access runs through a jump host with MFA and recorded sessions, never SSH from the internet. Egress from the DMZ is restricted to the package mirror, which limits command-and-control callbacks if the app is compromised.
Traps that cost marks
- Deploying an IPS out of band and expecting blocking.
- Confusing a WAF with a network firewall, or a VPN with authorisation.
- Designing inbound rules carefully but leaving egress wide open.
- Assuming VLANs alone segment traffic when trunk ports and routing between them are unrestricted.