Network Administrator interview questionsDesign review — the firewall rulebase nobody owns round

Purpose

Frames the rulebase as inherited, which is how every network administrator meets one, and signals early that removing rules safely is part of the round rather than an afterthought.

Purpose

The load-bearing question. Tests whether the candidate ranks by exposure — who can reach what, from where — rather than by rule number or hit count, and whether they know that zero hits proves disuse only when the rule could have matched and the traffic was due in the counting period.

Signals to score

• Puts internet-facing RDP first, and uses the 31,000 source addresses as evidence it is being attacked
• Says what an attacker gains from the jump host, not only that RDP is exposed
• Flags guest-to-users access, and notes that yesterday's hits mean something still depends on it
• Flags cameras allowed to any destination on the internet as a foothold that can reach out anywhere
• Flags every user reaching the management network, and asks what the helpdesk actually needs
• Names the flat users-to-servers rule as the largest piece of segmentation debt
• Explains that rule 12 has zero hits because rule 9 matches first
• Recognises rule 15 as dormant rather than dead, because no failover or test fell in the counting period
• Would take out only rule 23 this week, citing the released address rather than the hit count alone
• Notes that no rule has an owner or expiry date, which is how a "temp" rule reached two years old

Follow-up questions

• Rule 7 has a comment saying it's for the vendor. Why is it still first on your list?
• Rule 4 was hit yesterday. What does that tell you before you remove it?
• Three rules have zero hits. Why won't you delete all three?
• What would a compromised camera be able to do under rule 19?
• What's missing from this export that would have prevented half of it?

Purpose

Sets a requirement that sounds like facilities' business and is in fact a network design problem with physical consequences, so the candidate has to decide what belongs to them and what they must ask.

Purpose

Tests segmentation judgment: a zone of its own with a reason, outbound-only paths scoped to named destinations, third-party access that is narrow and accountable, and the questions a network administrator must ask rather than answer, such as how doors behave when the network is down.

Signals to score

• Gives the door system its own zone, separate from users and from CCTV, and says why
• Allows the controllers out only to the vendor's documented cloud destinations on the ports it needs
• Sends DNS and time to internal servers rather than opening them to the internet
• Allows the reception badge workstation to reach the access-control server on its application port only
• Refuses a standing inbound connection for the security company
• Offers named, multi-factor remote access with an expiry instead, or management through the vendor's outbound cloud path
• Treats the external readers' switch ports as outside the building: own VLAN, device authentication, no route beyond the controllers
• Asks facilities how doors behave when the network or the cloud is down, and does not decide it alone
• Logs denied traffic from the zone and alerts when it tries a new destination
• Gives every new rule an owner and a review date

Follow-up questions

• Why not put them in the CCTV zone? They're both building security.
• The security company wants a site-to-site VPN into the zone. What do you say?
• One reader is on the car park wall. What can someone with a laptop do there?
• The cloud service is down. Can people get into the building?
• Who owns these rules in two years' time?

Purpose

Tests whether the candidate sequences removals by risk and dependence, replaces access before withdrawing it, and makes each step reversible and observable rather than running one big tidy-up.

Signals to score

• Handles the rules one at a time, or in small batches, never in one change
• Builds and proves the replacement before removing a rule, for example the vendor's new access before rule 7
• Narrows rule 7 to the vendor's two addresses the same day, before the full replacement exists
• Logs what actually matches rules 4 and 9 over a period covering a month-end before designing their replacements
• Disables rules before deleting them, so the undo is re-enabling one rule
• Watches the final deny's log for the affected sources after each removal
• Adds specific rules above rule 9 and waits until it stops collecting new hits before disabling it
• Tells the owners of what depended on a rule before its removal, and names who they call
• Leaves rules 12 and 15 in place, and records why beside each

Follow-up questions

• Rule 9 has 610 million hits. How do you find out what depends on it?
• Why disable before delete? What does it buy you?
• What do you watch in the first hour after rule 4 goes?
• The vendor can't connect on the morning of an urgent call. What happens?
• When is it safe to finally delete rule 9?

Purpose

A candidate who has inherited a rulebase asks about ownership and review cycles; one who has not asks which firewall brand we run. Naming the topics makes the choice itself the signal.

Purpose

Ends on a specific weakness in the team's own firewall policy, the honest pitch for the candidate this round wants and a warning to anyone hoping for a clean rulebase. Only say it if it still holds.