Seven Networking Questions That Reveal Cybersecurity Interview Gaps
Summary
A practical cybersecurity interview guide links networking fundamentals—including TCP/UDP, DNS, subnetting, network devices, firewalls and IDS/IPS—to attacks, segmentation and security-control limitations.
Key points
- A TCP three-way handshake establishes a connection; SYN floods exploit incomplete handshakes to consume server resources.
- UDP lacks a handshake and can be abused in DNS amplification attacks.
- DNS resolution, TCP connections and TLS handshakes each involve steps that can present security risks.
- Subnetting and network segmentation can limit an attacker's lateral movement between systems.
- Hubs broadcast traffic, switches forward it by MAC address, and routers connect networks; the article discusses ARP poisoning as a way to expose traffic on switched networks.
- Firewalls enforce traffic rules but may not inspect encrypted traffic or stop insider misuse and stolen credentials.
- IDS tools alert on suspicious traffic, while inline IPS tools can block it; false positives from an IPS can disrupt legitimate services.
Article Details
- Topic
- Networking fundamentals and their security implications, including denial-of-service attacks, ARP poisoning, network segmentation, and the capabilities and limitations of security controls.
MITRE ATT&CK
T1498.001 · Direct Network FloodThe article describes SYN flood attacks that overwhelm a server with incomplete connection requests.T1498.002 · Reflection AmplificationThe article describes DNS amplification, where small UDP requests generate large responses that flood a target.T1557.002 · ARP Cache PoisoningThe article identifies ARP poisoning as an attack that can expose network traffic on switched networks.