Interview prep · 8 questions
ACL, NAT and network security interview questions
What do interviewers test with ACL, NAT and security questions?
They test whether you can write a filter that does exactly what was asked, in the right place, without locking out traffic you meant to keep. They also check that you understand how NAT rewrites packets and how to protect switch ports and device management.
Updated
Mock interview
One question at a time. Answer it out loud as you would in the room, then reveal the model answer and rate yourself honestly. Your progress stays in this browser.
What is the difference between a standard and an extended ACL, and where do you place each?
Entry level
A standard ACL matches only the source address, while an extended ACL can match source, destination, protocol and ports. Place an extended ACL close to the source so unwanted traffic is dropped early, and a standard ACL close to the destination, because filtering on source alone near the sender would cut that sender off from everything.
Named lists are easier to read and edit than numbered ones, and most teams prefer them for anything longer than a line or two.
An ACL does nothing until it is applied to an interface in a direction, inbound or outbound.
Common weak answer: Placing a standard ACL on the router next to the user. It blocks the user from every destination, not just the one you meant.
Likely follow-ups
- What changes between applying an ACL inbound and outbound?
- In what order are ACL lines checked?
- How do you change one line of an existing ACL?
What is the implicit deny, and how does it catch people out?
Entry level
Every ACL ends with an invisible "deny everything", so any packet that matches no line is dropped. An ACL written with only deny lines therefore blocks all traffic, and you need a final permit line for whatever should still pass.
Lines are checked top down and the first match wins, so a broad permit near the top makes every specific deny below it useless.
Adding an explicit deny with logging at the end is a common way to see what the implicit deny is catching.
Common weak answer: Forgetting that the implicit deny also drops routing protocol and management traffic crossing that interface.
Likely follow-ups
- Why does the order of lines matter?
- How would you allow everything except one host?
- What would you log to see what an ACL drops?
How do wildcard masks work in an ACL?
Entry level
A wildcard mask marks which bits of the address must match: a 0 bit must match exactly and a 1 bit can be anything. For a subnet it is the inverse of the subnet mask, so 0.0.0.255 matches a whole /24, while 0.0.0.0 matches a single host.
To get the wildcard for a subnet, subtract each octet of its mask from 255: a /26 mask of 255.255.255.192 gives 0.0.0.63.
OSPF network statements use the same wildcard notation, so the same mistake can break a filter and a routing protocol.
Common weak answer: Writing the subnet mask where the wildcard belongs. 255.255.255.0 as a wildcard matches addresses by their last octet only, which is almost never what you meant.
Likely follow-ups
- What wildcard matches a /30?
- Which keyword can replace a wildcard of 0.0.0.0?
- Where else are wildcard masks used?
Your ACL permits the request, but the replies never arrive. Why?
Mid level
An ACL is stateless: it checks every packet on its own, so the reply is filtered as a separate packet and dropped unless a line permits it. Permit the return traffic explicitly, such as echo replies for ping or TCP segments with the ACK flag through the "established" keyword, or use a stateful firewall that tracks sessions.
The trap usually appears when an inbound ACL is added on the interface the replies come back through, written with only the outbound traffic in mind.
A stateful firewall remembers each outgoing session and lets its replies in automatically, the main reason firewalls replaced plain ACLs at the internet edge.
Common weak answer: Assuming an ACL understands sessions the way a firewall does. A plain ACL has no memory of the request.
Likely follow-ups
- What does the established keyword match?
- Why can ping fail in one direction only?
- What does a stateful firewall track?
What is the difference between static NAT, dynamic NAT and PAT?
Entry level
Static NAT maps one inside address to one public address permanently, which suits a server that must be reachable from outside. Dynamic NAT hands out addresses from a public pool as inside hosts need them, and PAT lets many inside hosts share one public address by tracking each session's port.
PAT, also called NAT overload, is what almost every home and office edge uses, because it needs only one public address.
With dynamic NAT, hosts beyond the size of the pool cannot get out until an address is freed; PAT only runs out when it runs out of ports.
Common weak answer: Calling NAT a security feature. It hides inside addresses, but filtering is the firewall's job.
Likely follow-ups
- What do inside local and inside global mean?
- How would you let the internet reach one inside server?
- How do you see the active translations?
What do inside local, inside global and outside global mean in NAT?
Mid level
Inside local is a host's own private address, and inside global is the public address it appears as after translation. Outside global is the real public address of the remote host, and outside local is how that remote host appears to the inside, usually the same address.
Reading a translation table is mostly about these columns: if a session has no inside global address, nothing was translated.
The router also has to know which interfaces are inside and which are outside, or no translation happens at all.
Common weak answer: Swapping inside global and outside global. Inside global is still about your own host, as the world sees it.
Likely follow-ups
- Which interface do you mark as inside?
- Why would a translation never appear in the table?
- What does the ACL in a NAT configuration do?
How does port security stop someone plugging an unknown device into a switch port?
Mid level
Port security limits which and how many MAC addresses may send on an access port, either pinned in the configuration or learned "sticky" from the first device. When a different device sends, the port reacts by its violation mode: shut down into an error-disabled state, or restrict or protect by dropping the frames.
Shutdown is the default and the most visible: the port stays down until someone fixes the cause and resets it. Restrict drops and counts the violations, and protect drops them silently.
MAC addresses can be copied, so port security raises the bar rather than proving identity; 802.1X is the stronger control.
Common weak answer: Forgetting how a port comes back after a violation. You fix the cause first, then bounce the port or rely on automatic recovery.
Likely follow-ups
- What is the difference between restrict and protect?
- How do you recover an error-disabled port?
- Why isn't port security enough on its own?
Why should you manage devices over SSH rather than Telnet, and what does enabling SSH involve?
Entry level
Telnet sends everything, passwords included, in clear text, while SSH encrypts the whole session. Enabling SSH usually means setting a hostname and a domain name, generating a key pair, creating a local user, and allowing only SSH on the remote login lines.
Use SSH version 2, and limit which addresses may log in at all with an access list on the login lines.
Keeping Telnet open "just in case" undoes the point: an attacker on the path needs only one Telnet login to capture the password.
Common weak answer: Saying SSH is safer because it uses a different port. The protection comes from encryption, not the port number.
Likely follow-ups
- Why does the device need a domain name before it can create keys?
- How would you limit management access to one subnet?
- What is the difference between local logins and a central authentication server?