vpn

A VPN answers 'are you allowed on the network?'. Zero-trust access asks 'may this user, on this device, reach this application right now?'. The interview tests whether you can explain why the second question is safer.

IPsec is two protocols that candidates blur together: IKE, which authenticates peers and agrees keys, and ESP, which protects every packet afterwards. Keep them apart and the rest follows.

WireGuard's configuration is a list of public keys and the IP ranges each may use. That small idea replaces most of what IPsec negotiates, and it is the part interviewers ask about.

The VPN gateway is the one internet-facing system that grants network access to whoever passes its login. Treat it like that and most design choices answer themselves.

The device that guards the network is itself a server on the internet, often unmonitored and rarely patched. Interviewers want to hear how you would treat it like one.