Skip to content
AI Security

Interview question · Network Security & Protocols

How does a mesh VPN like Tailscale work, and what are you trusting when you adopt one?

The packets are WireGuard; the interesting part is the coordination server that tells every device whose keys to accept. That server is what a strong answer threat-models.

mediumNewPreparation tags: Google, Cloudflare, MicrosoftUpdated Nov 2026

The packets are WireGuard; the interesting part is the coordination server that tells every device whose keys to accept. That server is what a strong answer threat-models.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

10 answers per topic instead of 5, plus saved progress and bookmarks · costs nothingor unlock all 529 remaining answers · $25

Every worked answer in all 17 topics, every lesson in every course, the full concept curriculum, the complete practice-test bank, and the downloadable security field guides.

6 months · One payment · No auto-renewal

What if · the follow-ups in this answer

The answer works through 5 follow-ups like an interviewer would

A 60-person startup replaces its office VPN with a hosted mesh VPN. Engineers reach production databases through it, CI enrols runners with an auth key, and one subnet router exposes the old office network.

  1. Where do the WireGuard private keys live, and who can decrypt traffic?
  2. What if the vendor's coordination service were compromised?
  3. What does the CI auth key put at risk?
  4. What does the subnet router change?
  5. What controls do you put in place?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Premium opens every answer and ladder.

UP NEXT ON YOUR JOURNEY
Next in this trackIs MAC address filtering a security control? Explain MAC spoofing, MAC randomisation and what to use instead.Next in this trackHow do attackers compromise routers, firewalls and VPN appliances, and how would you harden and monitor them?Next in this trackHow does protective DNS filtering work, and how do DNS over HTTPS and DNS over TLS change what a network can see and enforce?
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.