Foundational and intermediate network security interview questions covering the concepts every security role builds on.
What's the difference between TCP and UDP?
TCP is connection-oriented and guarantees delivery and order — used where reliability matters, like web browsing. UDP is connectionless and faster but doesn't guarantee delivery — used where speed matters more than reliability, like video streaming.
What is a DMZ and why would you use one?
A DMZ (demilitarized zone) is a network segment that sits between the internal network and the internet, hosting public-facing services. It limits exposure — if a service in the DMZ is compromised, the attacker still doesn't have direct access to the internal network.
Explain the difference between symmetric and asymmetric encryption.
Symmetric encryption uses the same key to encrypt and decrypt — fast, but the key must be shared securely. Asymmetric encryption uses a public/private key pair — slower, but solves the key distribution problem, which is why it's used to establish secure connections before switching to symmetric encryption for the actual data.
What is network segmentation and why does it matter?
Segmentation divides a network into smaller isolated zones, limiting how far an attacker can move if one segment is compromised. It's a core defense against lateral movement in an active breach.
How does a firewall differ from an IDS?
A firewall actively controls traffic based on rules — it can block. An IDS passively monitors and alerts on suspicious traffic but doesn't block it directly — that's the job of an IPS.
Go deeper
These questions are just the surface
Our Network Security Foundations program builds the hands-on experience behind these answers — not just memorized responses.
