Open cardosec

Case 2AB0C8 · Network · L3 Applied

Designing Egress Control

Practise as: Explain it · InterviewLevel: L3 Applied

Interview questionWhy does outbound (egress) filtering matter, and how would you design it?

  1. 01 What is it?
  2. 02 How is it abused?
  3. 03 How do you stop it?
Practise this card As Interview
What a strong answer covers

Try it out loud first. Then check yourself:

  1. Most attacks need to call out: C2 beacons, payload downloads and exfiltration all leave through egress.
  2. Servers should default-deny outbound and allow only named destinations; users go through a proxy with logging.
  3. Force DNS through your resolvers and block direct DNS and DNS over HTTPS elsewhere, or attackers tunnel past you.
  4. Trade-offs: SaaS and cloud endpoints change constantly, so maintain allowlists by service and review exceptions.

If the interviewer pushes back

  • Attackers use a popular cloud storage provider for C2. How does your egress design still help?

Go deeper

More Network cards

All Network cards →

cardosec draws a security topic and gives you a clock: explain it out loud with no notes, then see what you covered and what you missed. Free during early access.

Reviewed 2026-10-09