46.2 Networking Interview Questions

Q9. What is the difference between a public IP and a private IP?

A public IP is routable on the internet. A private IP is from RFC 1918 ranges such as 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 and is used inside a LAN or VPC. In my Sahyadri lab, EC2 has a private IP in the VPC and may have an Elastic IP for public access. Attackers usually see the public face first; defenders must lock that face down.

Q10. What is NAT and why does it matter for security?

Network Address Translation lets many private hosts share one public address. It hides internal layout from casual internet view, but it is not a firewall by itself. Security groups and host firewalls still matter. In interviews I say NAT obscures; controls protect.

Q11. Explain CIDR in simple terms.

CIDR writes IP plus prefix length, like 10.0.0.0/24, meaning the first 24 bits are the network. Larger prefix means smaller host count. I use CIDR when sizing subnets and when writing security group rules so I do not open 0.0.0.0/0 by habit.

Q12. Which ports must you know cold for cyber interviews?

At least: 22 SSH, 80 HTTP, 443 HTTPS, 53 DNS, 25/587 mail related, 3306 MySQL, 3389 RDP, 445 SMB, 389/636 LDAP/LDAPS. For each I can say service plus risk if exposed to the world. Example: 3306 to 0.0.0.0/0 is a common SME mistake.

Q13. TCP versus UDP – how do you explain it?

TCP is connection-oriented with reliability features; UDP is connectionless and lighter. HTTPS and SSH use TCP. DNS often uses UDP for queries and TCP for larger responses or zone transfers. Attackers abuse both; defenders filter and monitor both.

Q14. Walk through the TCP three-way handshake.

Client sends SYN, server replies SYN-ACK, client sends ACK, then data can flow. Half-open floods try to exhaust server state; modern stacks use SYN cookies and rate limits. I explain the handshake so I can explain SYN flood defence, not to give an attack recipe.

Q15. What happens in a DNS lookup at a high level?

The stub resolver asks a recursive resolver, which may query root, TLD, and authoritative name servers until it gets an answer such as an A or AAAA record. Poisoning and hijacks are risks; defenders use DNSSEC where fit, restrict zone transfers, and monitor sudden record changes.

Q16. What is the idea of TLS for HTTPS?

TLS provides encryption (एन्क्रिप्शन) and integrity for data in transit and helps authenticate the server via certificates. HTTPS is HTTP over TLS, usually on port 443. I recommend TLS 1.2 or 1.3, disable ancient protocols, and use certificates from a trusted CA or Let’s Encrypt via Certbot in labs.

Q17. What is a security group rule you would never leave open on a public Elastic IP for Sahyadri Traders?

I would not leave MySQL 3306, RDP 3389, or random admin panels open to 0.0.0.0/0. I allow 443 from the internet if the site must be public, and SSH 22 only from my office or home IP. Least privilege beats convenience.

Q18. OSI model versus TCP/IP – what do interviewers want?

They want mapping sense, not pedantic layer wars. Example: TLS protects data above transport; DNS is application-related; IP is network. I use the model to place controls: firewall at network edges, app secure coding higher up.

Q19. What is a well-known port versus an ephemeral port?

Well-known ports (0–1023) identify common services. Ephemeral ports are temporary client-side ports for connections. When I read ss -tulnp or connection tables, I separate listeners on well-known ports from short-lived client ports.

Q20. How would you explain a VPN in one interview minute?

A VPN creates an encrypted tunnel over an untrusted network so traffic between my laptop and the office or VPC is protected in transit. It does not replace patching or MFA. For Raja-Rani shop staff on cafe Wi-Fi, VPN plus HTTPS is better than raw HTTP to internal tools.