Network Security Interview Questions — Network Fundamentals
Reviewed by Mark Dickie · Last updated
6 questions on this page you can answer and see marked on the spot. Go to the first one
Network security fundamentals are the core principles and protocols that protect data as it moves across networks. For an interview, you need a solid grasp of the OSI and TCP/IP models, how common protocols like TCP, UDP, DNS, and HTTPS operate, and where security controls sit within those layers. Expect questions on firewalls, segmentation, encryption at the network level, and the mechanics of attacks like ARP spoofing, DNS poisoning, and man-in-the-middle.
What does a network fundamentals interview actually test?
Interviewers want to see if you can reason about traffic flow, identify which layer a control applies to, and explain why a given attack works against a specific protocol weakness. The difficulty range on this page runs from 1 (definitions and protocol basics) to 5 (multi-step attack scenarios and defense design). You should be comfortable moving between layers when explaining your answer.
| Area | Key Topics | Common Question Types |
|---|---|---|
| OSI / TCP/IP models | Layer responsibilities, encapsulation | "Which layer handles X?" |
| Protocols | TCP vs UDP, DNS, DHCP, ARP, TLS | Handshake steps, port numbers, failure modes |
| Network controls | Firewalls, ACLs, VLANs, NAT | Placement, rule ordering, segmentation design |
| Attacks | ARP spoofing, DNS poisoning, MITM, SYN floods | Describe the attack and how to stop it |
| Cryptography at the network layer | IPsec, TLS, VPN tunnels | Tunnel mode vs transport mode, key exchange |
How should you prepare for network security questions?
- Map every protocol you know to its OSI layer. If you cannot place ARP, ICMP, or TLS quickly, that is a gap interviewers will find.
- Learn the TCP three-way handshake and the TLS handshake cold. You should be able to draw both from memory and explain where each step can fail or be attacked.
- Practice describing one attack and its mitigation end to end. Pick ARP spoofing or DNS cache poisoning, explain the mechanism, then explain the specific control that stops it.
- Review segmentation patterns. Know when to use VLANs, private subnets, or zero-trust micro-segmentation, and be able to justify the tradeoffs.
- Drill port numbers for common services. Knowing that HTTPS is 443, DNS is 53, and RDP is 3389 seems basic, but it comes up constantly and hesitation reads poorly.
The quiz below pulls from real interview question banks and lets you self-assess across these areas. Work through it, note where you stumble, and revisit those fundamentals before your next round.
Key facts
- Tarmac has 35 Network Security interview questions on this topic, 10 of them on this page, at difficulty 1–5 of 5.
- Tarmac tracked 865 job postings asking for Network Security in September 2026.
- Roles asking for Network Security advertise a median base salary of A$125,000, across 141 job postings as of September 2026.
- Tarmac last reviewed these Network Security interview questions on 19 October 2026.
At a glance
| Questions | 10 shown · 35 in the bank |
|---|---|
| Difficulty | 1–5 of 5 |
| Formats | Multiple choice, Ordering, Multiple answer, Fill in the blank, True / false, Short answer, Flashcard, Design exercise |
What you'll review
- osi tcp ip stack
- subnetting and cidr
- ports and protocols
Practice questions
Try one before you open the answer. Pick an option and press Check; it's marked on the spot.
In the OSI model, which layer is responsible for routing packets between different networks using logical IP addresses?#
Options
Show answer
The Network layer (Layer 3 of the OSI model) is responsible for routing packets between different networks using logical IP addresses. The Data Link layer forwards frames only within a single local network using MAC addresses, while the Transport layer handles end-to-end delivery between processes.
Routing packets across networks based on logical (IP) addresses is the job of the Network layer, which is Layer 3 of the OSI model. The Data Link layer only forwards frames between directly connected devices using MAC addresses, the Transport layer provides end-to-end delivery between processes (for example via TCP or UDP port numbers), and the Session layer manages dialogue between applications. Only the Network layer matches the routing-by-IP-address description.
Arrange the seven layers of the OSI reference model in order from Layer 1 (bottom) to Layer 7 (top).#
Put these in order
Show answer
The OSI model's seven layers, from bottom to top, are Physical, Data Link, Network, Transport, Session, Presentation, and Application. Each layer is numbered 1 through 7 in that sequence. Lower layers carry bits and frames over links, while upper layers handle sessions, data formatting, and the applications that users interact with.
The OSI model numbers its layers from the bottom up: Physical (bits on the medium) is Layer 1, Data Link (framing and node-to-node delivery on a single link) is Layer 2, Network (logical addressing and routing across networks) is Layer 3, Transport (end-to-end segments, ports, reliability options) is Layer 4, Session (managing dialogues between applications) is Layer 5, Presentation (data format, encoding, and encryption translation) is Layer 6, and Application (the services user programs call) is Layer 7. The sequence is a fixed numbering, so there is exactly one correct order.
In the OSI model, which layer does TCP primarily belong to?#
Options
Show answer
TCP belongs to the Transport layer, which is Layer 4 of the OSI model. It provides reliable, ordered, connection-oriented delivery of data between application processes. IP, by contrast, operates at the Network layer (Layer 3) and handles addressing and routing.
TCP provides end-to-end, connection-oriented, reliable and ordered delivery of a byte stream between processes on two hosts. That is the job of the Transport layer (Layer 4). IP, which handles addressing and routing packets between networks, is the Network layer (Layer 3). Data Link handles frames on a single local link, and Session management is not a separate function in the TCP/IP stack that TCP maps to.
Select all statements that correctly map a protocol or addressing concept to its OSI model layer.#
Options
Pick every one that applies.
Show answer
TCP ports and segments belong to the transport layer, IP addressing and routing belong to the network layer, and MAC addresses and Ethernet frames belong to the data link layer. HTTP methods are application-layer constructs, not physical-layer ones, because the physical layer only moves raw bits over a medium.
The transport layer (Layer 4) handles end-to-end delivery via TCP ports and segment sequencing, so the statement about TCP ports and segments is correct. The network layer (Layer 3) handles logical IP addressing and routing between networks, so that statement is correct. The data link layer (Layer 2) handles MAC addressing and framing on a local link, so the Ethernet frame statement is correct. HTTP methods are defined by the application layer (Layer 7) and are carried inside transport-layer segments; the physical layer (Layer 1) only transmits raw bits over the medium, so the HTTP statement is wrong.
Port numbers and TCP segments belong to layer _____ of the OSI model, which is named the _____ layer.#
Show answer
Port numbers and TCP segments belong to layer 4 of the OSI model, which is named the transport layer.
In the OSI model, layer 4 is the transport layer. It is responsible for end-to-end delivery between application endpoints, which is where TCP and UDP operate and where port numbers are defined. Layer 3 (network) handles IP addressing and routing, and layer 7 (application) handles protocols like HTTP, so neither fits the description.
Consider the IPv4 block 192.168.10.0/26. Select ALL statements that are true about this block.#
Options
Pick every one that applies.
Show answer
For the block 192.168.10.0/26, the block contains 64 total addresses, its broadcast address is 192.168.10.63, and its subnet mask is 255.255.255.192. A /26 leaves 6 host bits, so 2^6 = 64 addresses in total, but only 62 of them are usable hosts.
A /26 prefix leaves 32 - 26 = 6 host bits, so the block holds 2^6 = 64 total addresses, spanning 192.168.10.0 through 192.168.10.63. The last address in the range, 192.168.10.63, is the broadcast address. A /26 mask is 255.255.255.192 (26 one-bits: three full octets plus 192 in the fourth). The address 192.168.10.100 lies outside the 0-63 range in the fourth octet, so it is not in this block. Usable host capacity is 64 minus the network and broadcast addresses, i.e. 62, not 64.
True or False: ICMP messages carry source and destination port numbers in their headers, which is why ICMP is classified as a transport-layer protocol in the TCP/IP model.#
Options
Show answer
False. ICMP is not a transport-layer protocol because its headers contain no port numbers. Only transport protocols such as TCP and UDP use ports. ICMP is carried directly inside IP packets (protocol number 1), so it operates at the network layer as a control and error-reporting companion to IP.
The statement is false on two counts. ICMP has no port numbers: its header contains only a type, a code, a checksum, and type-specific data such as an identifier and sequence number. Port numbers exist only in transport protocols like TCP and UDP. ICMP is also not a transport protocol: it is carried directly inside IP datagrams (IP protocol number 1), so it sits alongside IP at the network layer, serving as a control and error-reporting companion to IP.
A passive observer on the network path captures a full TLS 1.3 HTTPS session between a client and a server running over TCP. Name two pieces of information the observer can still read in plaintext, and explain briefly why TLS does not hide them.#
Show answer
The observer can read the IP source and destination addresses, the TCP source and destination port numbers, and TCP sequence/acknowledgement numbers, plus the server name in the TLS ClientHello (SNI) unless Encrypted Client Hello is used. TLS protects the payload of the TLS records above TCP, but it does not encrypt the IP and TCP headers because those are needed by routers and by TCP itself to deliver and order segments; the SNI is sent in the ClientHello before keys are negotiated, so it is visible by default.
TLS operates on top of TCP and encrypts only the application-data records it carries. The IP and TCP headers must remain readable so that routers can forward packets and TCP can manage ports, sequencing and acknowledgements, so an on-path observer always sees addresses, ports, and sequence numbers. In TLS 1.3 the handshake is encrypted after the key exchange begins, but the ClientHello, including the SNI extension, is sent before keys exist and is therefore visible unless Encrypted Client Hello is deployed. A strong answer names at least one header-level field (IP address, port, sequence number) or the SNI and explains that these are needed for delivery or are sent before encryption starts.
A stateless IDS inspects each IP fragment as it arrives and never reassembles them. An attacker sends overlapping IPv4 fragments whose overlapping bytes differ, so the IDS sees benign payload while the destination host reassembles malicious payload. Name this evasion technique, and state which layer of the TCP/IP model is responsible for the reassembly where the ambiguity arises.#
Show answer
Overlapping-fragment (fragmentation-based) evasion, an inspection/reassembly ambiguity attack. The reassembly happens at the Internet layer (IP, OSI Layer 3), so the IDS and the end host disagree about the reconstructed datagram and thus about the transport payload carried above it.
The IDS and the destination host must agree on the byte stream they reconstruct; when IP fragments overlap with conflicting data, the reassembly policy (for example first-wins versus last-wins, which varies by OS) determines what the host sees. A stateless inspector that examines fragments individually, or that uses a different overlap policy, sees different bytes than the host, which is the classic evasion. The ambiguity originates in IP-layer fragment reassembly (Layer 3 of the TCP/IP Internet layer), even though the malicious content is consumed by higher layers.
A legacy vendor appliance must accept inbound FTP from partner networks on the internet. The server sits behind a stateful firewall and NAT, and the vendor only supports passive-mode FTP. Design how you would expose this service securely. Your design must explain how the control and data connections are handled, how the port range is constrained, how NAT and the firewall are kept consistent, and what risk-reduction alternatives you would recommend.#
Show answer
I would first migrate the partners to SFTP on TCP 22 or FTPS, since plaintext FTP exposes credentials and file contents and needs dynamic ports. If the vendor truly cannot move, I would keep passive-mode FTP but pin the server's passive range to a small fixed interval, for example 50000-50100, and open only that interval plus TCP 21 on the firewall. Passive mode works because the client opens the data connection to the port the server advertises in its PASV reply, so the firewall needs to know that port. The FTP server's advertised address must be the public NAT address, and a stateful FTP helper or ALG should parse the control channel, rewrite the embedded address, and open a temporary pinhole only for the advertised data port. I would restrict source addresses to the partner ranges and place the service behind a VPN where possible, so the open surface is small and auditable. Note that if the control channel is wrapped in TLS, the helper cannot read the PASV reply, which is why explicit pinned ranges are the fallback.
Passive FTP splits control (TCP 21) and data onto a dynamic port the server chooses and announces, so a stateful firewall and NAT must either understand the protocol or be given a pinned range. Pinning the passive range, aligning the advertised address with NAT, and restricting sources together limit exposure, while migrating to SFTP or FTPS removes the dynamic-port problem entirely.
Related interview questions
Job market
See network-security salaries and hiring demand from live job postings.
The other 25 questions
This page shows 10 and marks what you pick. That's as far as a page can go. A free account opens the other 25 and keeps every answer. What you miss comes back until it's right: after a day, then at longer gaps.
Free · the whole bank · 100 marked answers per 30 days · written feedback on the paid plan