Palo Alto Networks Network Security & Protocols interview questions

Encryption alone does not stop a man in the middle: you could be encrypting to the attacker. The property that matters is authentication, and every successful MITM is a story about how it was skipped.

A classic warm-up that rewards precision: what state the server keeps, why spoofed SYNs cost the attacker nothing, and how SYN cookies move that state into the sequence number.

DNSSEC and DNS over HTTPS are often named in the same breath and protect entirely different things. The scored answer separates authenticity of the record from privacy of the query.

NAT is not a firewall, and inbound rules are only half a policy. Interviewers check whether you know what each device decides, and why the outbound direction is where breaches are contained.

Flat networks turn one infected laptop into a company-wide incident. The scored answer draws zones from what talks to what, and shows how identity-based policy replaces IP lists as the network grows.

Inspection is a man in the middle the organisation chose. Interviewers want the mechanism, then a clear view of the new single point of failure it creates and the traffic it must never touch.

A VPN answers 'are you allowed on the network?'. Zero-trust access asks 'may this user, on this device, reach this application right now?'. The interview tests whether you can explain why the second question is safer.

SPF checks a server, DKIM checks a signature, and neither checks the From line the user reads. DMARC ties them to that line. Interviewers want the alignment idea, then the phishing that still gets through.

A shared password, a capture of one handshake and an offline dictionary is still how many Wi-Fi networks fall. The answer explains why, what SAE changed, and why enterprises use certificates instead.

A 2 Tbps flood and one expensive API call per second are both denial of service. The answer that scores matches each attack to the place where it can be stopped, and knows which ones only a provider can absorb.

The internet's routing system still largely believes what networks announce. The strong answer explains why a more specific prefix wins, what RPKI signs, and why path manipulation survives it.

Attackers scan the whole internet continuously and know your forgotten test server before you do. The answer is an inventory built from several sources, compared with what is actually listening.

You cannot read the payload, but you can see who talked to whom, when, how much and how often. That metadata catches beaconing, exfiltration and lateral movement, if you know what normal looks like.

Interviewers do not want the seven OSI names recited. They want you to say which layer an attack lives at, because that decides which control can see it.

NAT drops unsolicited inbound packets as a side effect of bookkeeping, not policy. Port forwards, UPnP, outbound connections and IPv6 all walk around it.

A firewall is a list of match conditions evaluated in order against fields it can see, plus a table that remembers connections. Almost every firewall failure is in one of those three words: order, fields, remember.

Put a proxy in front of an app and two new questions appear: who is the real client, and does the proxy read the request the same way the app does?

Local network protocols were designed for a building full of colleagues. Anyone plugged into the same segment can claim to be the router, and the protocols believe them.

IPsec is two protocols that candidates blur together: IKE, which authenticates peers and agrees keys, and ESP, which protects every packet afterwards. Keep them apart and the rest follows.

WireGuard's configuration is a list of public keys and the IP ranges each may use. That small idea replaces most of what IPsec negotiates, and it is the part interviewers ask about.

The VPN gateway is the one internet-facing system that grants network access to whoever passes its login. Treat it like that and most design choices answer themselves.

Signing does not hide anything. It proves who sent a message and that nobody changed it, which is exactly what relay and tampering attacks need you not to check.

The whole IPv4 internet is scanned many times a day. If a service answers, assume someone has already catalogued it.

The device that guards the network is itself a server on the internet, often unmonitored and rarely patched. Interviewers want to hear how you would treat it like one.

Blocking bad domains at the resolver is one of the cheapest controls there is, until the client stops asking your resolver. A strong answer covers both halves.

SASE is the firewall, proxy and access gateway moved into a provider's network so they sit in front of users wherever they are. The interview is about what each piece inspects, and what you hand the provider in exchange.

In a plant, availability and physical safety outrank confidentiality, and the controllers may be older than the security team. The scored answer adapts IT habits instead of copying them.

Sender authentication proves which domain sent a message, not that the message is safe. The scored answer walks the layers after it and where each one is blind.

The classic 'what happens when you type google.com' turned into a security question. Interviewers want the stack in order, with the attacker who sits at each layer and the control that removes them.

Users type a domain, not https://. That one habit gave attackers a plain-HTTP first request to hijack. HSTS closes it, and preloading closes it before the first visit, with a commitment you cannot easily undo.

Every TLS error is a specific check failing. Engineers who can name which check, from the chain the client actually saw, fix outages in minutes and never 'fix' them by turning validation off.

Pinning trades availability for a narrower trust set. The answer that scores compares each pin target by what it survives, and uses HPKP's retirement as evidence of what goes wrong.

The packets are WireGuard; the interesting part is the coordination server that tells every device whose keys to accept. That server is what a strong answer threat-models.

A MAC address is a label the device chooses and announces in clear text on every frame. The answer turns on that one fact, and on what a network should check instead.