network security
AI security interview questions tagged network security, across every topic.
13 questions · 2 unlocked for you
Concepts behind "network security"
Explanations of the mechanisms these questions rely on.
Foundational
Attacker Positions on the NetworkNetwork attacks are best understood by the attacker's position: on the local link (ARP spoofing, rogue DHCP, evil-twin Wi-Fi), in name resolution (DNS spoofing, resolver compromise, registrar takeover), in routing (BGP hijacks and leaks), or as a trusted intermediary (an interception proxy or an installed root). Each position lets the attacker read or alter traffic that is not protected end to end. TLS with proper certificate validation defeats all of them unless the attacker can make the client trust their certificate, which is why the strongest network defences are authentication, plus controls that stop the attacker getting into position. Network Security
Foundational
DNS Security: Resolution, Poisoning, DNSSEC and Encrypted DNSDNS resolution passes through a stub resolver, a recursive resolver and a chain of authoritative servers, with caching at each step. Attacks target each part: forged responses that poison caches, malicious or compromised resolvers, takeovers of registrar and DNS-provider accounts, and dangling records that allow subdomain takeover. DNSSEC signs records so validating resolvers can detect forgery but provides no confidentiality; DNS over TLS and HTTPS encrypt the client-to-resolver hop but trust the resolver. TLS certificate validation remains the backstop when DNS lies. Network Security
Foundational
TCP/IP for Security EngineersIP does not authenticate source addresses, so spoofing is possible wherever networks skip ingress filtering, and spoofed UDP becomes reflection and amplification. TCP's handshake and sequence numbers stop an off-path attacker from blindly injecting data, but only probabilistically, and side channels have repeatedly narrowed the odds. Neither layer offers confidentiality or integrity against anyone on the path. Security engineers need these limits to reason about SYN floods, blind resets, off-path DNS poisoning and why every channel worth protecting needs TLS or another authenticated layer above. Network Security
Foundational
Wi-Fi Security and 802.1XWPA2-Personal derives keys from a shared passphrase, so a captured handshake can be attacked offline; WPA3-Personal's SAE handshake removes that, though its transition mode and early implementations had flaws. KRACK showed that even WPA2's key handshake could be made to reuse nonces. Enterprise Wi-Fi uses 802.1X with EAP and a RADIUS server, and its security depends on clients validating the server's certificate and name: without that, an evil twin collects credentials. Certificate-based EAP-TLS with a private CA, WPA3 with protected management frames, and the same controls on wired ports are the current baseline. Network Security
Foundational
How TLS 1.3 WorksTLS 1.3 sets up an encrypted, authenticated connection in one round trip. The client and server run an ephemeral Diffie-Hellman exchange to agree on fresh keys, the server proves its identity by signing the handshake with the private key behind its certificate, and both sides confirm with a MAC over everything exchanged. After that, data flows under AEAD encryption. TLS protects data in transit between two endpoints; it does not protect the endpoints, the data at rest, or decide who is allowed to do what. Cryptography & PKI
Foundational
Server-Side Request ForgeryServer-side request forgery (SSRF) happens when an application fetches a URL that an attacker can influence, letting the attacker use the server's network position to reach internal services, cloud metadata endpoints and admin interfaces. String checks on URLs are easy to bypass. Robust defences validate the resolved IP address, connect to that exact address, re-check redirects, prefer allowlists, and route outbound fetches through an egress proxy. LLM tools that fetch web pages are SSRF primitives by design. Application Security