Skip to content
AI Security

Interview question · Network Security & Protocols

With most traffic encrypted, what can network monitoring still detect, and how would you design it?

You cannot read the payload, but you can see who talked to whom, when, how much and how often. That metadata catches beaconing, exfiltration and lateral movement, if you know what normal looks like.

mediumNewPreparation tags: Palo Alto Networks, CrowdStrike, CiscoUpdated Nov 2026

You cannot read the payload, but you can see who talked to whom, when, how much and how often. That metadata catches beaconing, exfiltration and lateral movement, if you know what normal looks like.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

10 answers per topic instead of 5, plus saved progress and bookmarks · costs nothingor unlock all 529 remaining answers · $25

Every worked answer in all 17 topics, every lesson in every course, the full concept curriculum, the complete practice-test bank, and the downloadable security field guides.

6 months · One payment · No auto-renewal

What if · the follow-ups in this answer

The answer works through 6 follow-ups like an interviewer would

A company wants to detect attackers moving inside its network, but most traffic is encrypted.

  1. What data can network detection use?
  2. How do you detect command and control?
  3. How do you detect lateral movement?
  4. How do you detect exfiltration?
  5. How does network detection fit with endpoints?
  6. What detection programme would you build?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Premium opens every answer and ladder.

UP NEXT ON YOUR JOURNEY
Next in this trackExplain the network stack layer by layer: what lives at each layer, how it is attacked, and which control works there.Next in this trackHow does NAT actually work, how do peers get through it, and why is 'we are behind NAT' not a security control?Next in this trackHow do firewalls work underneath: stateless vs stateful filtering, connection tracking, the netfilter path, and failing rule sets?
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.