What steps would you take if you saw an unexpected spike of traffic leaving the network late at night?

What the interviewer is looking for

• This question tests network security. Designs segmentation and firewall rules on least privilege, understands VPNs, zero trust access, access control and monitoring for suspicious traffic.
• Strong answers: Identifies source and destination, checks for legitimate jobs like backups, involves security, contains by blocking if suspicious, and preserves logs.
• Likely follow-up: What monitoring would help you spot that sooner?

Another way it may be asked: At three in the morning, a lot of data starts flowing out of your network. How would you respond?

A structure to follow: Answer, explain, example, limits

1. Step 1

   Answer

   Give your direct answer in the first sentence so the interviewer knows where you are going.

2. Step 2

   Explain

   Say how it works or why you would do it that way, in plain words before jargon.

3. Step 3

   Example

   Anchor it in something you have actually done or seen, with the detail that shows hands-on experience.

4. Step 4

   Limits

   Say when your approach would not be the right one. It shows judgement.

This is guidance on shape, not a script. Use your own real experience and facts; never invent details to fill a gap. See the STAR guide and answer frameworks.

Common slips

• Reciting a definition without showing you have applied it.
• Using terms you cannot explain if asked a level deeper.
• Claiming experience beyond what you can discuss in detail.

How to practise it

Say the answer in 90 seconds, then answer the follow-up as if it were a new question.

Related questions

• How would you set up firewall rules and segmentation for a network with guest wireless, office staff and payment terminals?
• Explain what happens on the network, step by step, when someone types a website address into their browser and presses enter.
• What is a VLAN, and why would an office separate its traffic into different VLANs?
• A user says they cannot reach the internet, but their coworker sitting next to them can. How would you troubleshoot it?
• When would you choose OSPF versus BGP, and what problems have you seen with either in practice?

Browse all questions