Cloudflare Network Security & Protocols interview questions

The whole IPv4 internet is scanned many times a day. If a service answers, assume someone has already catalogued it.

The packets are WireGuard; the interesting part is the coordination server that tells every device whose keys to accept. That server is what a strong answer threat-models.

Blocking bad domains at the resolver is one of the cheapest controls there is, until the client stops asking your resolver. A strong answer covers both halves.

SASE is the firewall, proxy and access gateway moved into a provider's network so they sit in front of users wherever they are. The interview is about what each piece inspects, and what you hand the provider in exchange.

Most networks that say they do not run IPv6 run it anyway, unmanaged. The scored answer finds the three places that matters and decides deliberately.

Nobody attacks your DNS; they just claim the cloud resource your DNS still points at. The scored answer explains why it is so common and how to stop it at deprovisioning.

Sender authentication proves which domain sent a message, not that the message is safe. The scored answer walks the layers after it and where each one is blind.

The classic 'what happens when you type google.com' turned into a security question. Interviewers want the stack in order, with the attacker who sits at each layer and the control that removes them.

Encryption alone does not stop a man in the middle: you could be encrypting to the attacker. The property that matters is authentication, and every successful MITM is a story about how it was skipped.

A classic warm-up that rewards precision: what state the server keeps, why spoofed SYNs cost the attacker nothing, and how SYN cookies move that state into the sequence number.

DNSSEC and DNS over HTTPS are often named in the same breath and protect entirely different things. The scored answer separates authenticity of the record from privacy of the query.

Users type a domain, not https://. That one habit gave attackers a plain-HTTP first request to hijack. HSTS closes it, and preloading closes it before the first visit, with a commitment you cannot easily undo.

NAT is not a firewall, and inbound rules are only half a policy. Interviewers check whether you know what each device decides, and why the outbound direction is where breaches are contained.

Flat networks turn one infected laptop into a company-wide incident. The scored answer draws zones from what talks to what, and shows how identity-based policy replaces IP lists as the network grows.

Every TLS error is a specific check failing. Engineers who can name which check, from the chain the client actually saw, fix outages in minutes and never 'fix' them by turning validation off.

Inspection is a man in the middle the organisation chose. Interviewers want the mechanism, then a clear view of the new single point of failure it creates and the traffic it must never touch.

Pinning trades availability for a narrower trust set. The answer that scores compares each pin target by what it survives, and uses HPKP's retirement as evidence of what goes wrong.

A VPN answers 'are you allowed on the network?'. Zero-trust access asks 'may this user, on this device, reach this application right now?'. The interview tests whether you can explain why the second question is safer.

SPF checks a server, DKIM checks a signature, and neither checks the From line the user reads. DMARC ties them to that line. Interviewers want the alignment idea, then the phishing that still gets through.

A shared password, a capture of one handshake and an offline dictionary is still how many Wi-Fi networks fall. The answer explains why, what SAE changed, and why enterprises use certificates instead.

A 2 Tbps flood and one expensive API call per second are both denial of service. The answer that scores matches each attack to the place where it can be stopped, and knows which ones only a provider can absorb.

The internet's routing system still largely believes what networks announce. The strong answer explains why a more specific prefix wins, what RPKI signs, and why path manipulation survives it.