Yup. I have been rejected once because I discussed a variety of options to harden a system instead of blurting out "VPN" as they wanted. They told me that after I discussed some trade offs in security for a little bit.
Young in my career I bombed a five person panel interview once with a bunch of questions like this.
One of them I remember being especially unfair - "if one of our systems connections goes down, how would you troubleshoot it"? I had what I thought was a great answer, reviewing logs, looking for errors, verifying the server or system had internet access, etc... They informed me that the correct answer was checking that the ethernet cable was plugged in...
Along with feeling completely defeated after the interview (since I really needed a job at the time), I felt like it was an extremely loaded question and my answer should have gotten a +1, especially since my answer discussed internet access. I did dodge a bullet though. That startup failed 15 months after my interview.
