Black Friday Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 70special

Huawei H12-721 HCNP-Security-CISN (Huawei Certified Network Professional - Constructing Infrastructure of Security Network) Exam Practice Test

Page: 1 / 25
Total 245 questions

HCNP-Security-CISN (Huawei Certified Network Professional - Constructing Infrastructure of Security Network) Questions and Answers

Testing Engine

  • Product Type: Testing Engine
$37.5  $124.99

PDF Study Guide

  • Product Type: PDF Study Guide
$33  $109.99
Question 1

Is the correct statement about TCP proxy and TCP reverse source probing?

Options:

A.

TCP proxy and TCP reverse source probe can prevent SYN Flood

B.

The principle of the TCP proxy is that the device acts as a proxy for the TCP connection between the two ends. When one end initiates the connection, it must first complete the TCP 3 handshake with the device.

C.

Use TCP proxy mode for attack defense, you must enable the state detection mechanism.

D.

TCP reverse source detection detects the source IP by sending a Reset packet.

Question 2

Which of the following methods is used to switch between active and standby links in the IPSec backup and backup system?

Options:

A.

hot standby

B.

link-group

C.

Eth-trunk

D.

ip-link

Question 3

In the IPSec active/standby link backup application scenario, gateway B uses IPSec tunneling technology and gateway A to establish an IPSec VPN.

Options:

A.

TRUE

B.

FALSE

Question 4

A user wants to limit the maximum bandwidth of the 192.168.1.0/24 network segment to 500M, and limit all IP addresses in the network segment to maintain a bandwidth of 1M. How should I configure a current limiting policy for this requirement?

Options:

A.

Configure per-IP traffic limiting. The maximum bandwidth of the host on the 192.168.1.0/24 network segment is 500M.

B.

Configure overall traffic limiting. The maximum bandwidth of the host on the network segment 192.168.1.0/24 is 1M.

C.

Configure the overall traffic limiting. The maximum bandwidth of the host on the 192.168.1.0/24 network segment is 500M.

D.

Configure the overall traffic limiting. The maximum bandwidth of the host on the network segment 192.168.1.0/24 is 500M. Then use the per-IP traffic limiting to ensure that the server bandwidth is 1M.

Question 5

Regarding the Radius authentication process, there are the following steps: 1. The Radius client (network access server) in the network device receives the username and password, and sends an authentication request to the Radius server; 2 the user logs in to the USG access server, etc. When the network device sends the username and password to the network access server; 3. After receiving the legitimate request, the Radius server completes the authentication and returns the required user authorization information to the client. What is the correct order?

Options:

A.

1 2 3

B.

2 1 3

C.

3 1 2

D.

2 3 1

Question 6

Which of the following statements is true for virtual service technology?

Options:

A.

For multiple real servers, the real servers need to be in the same network segment and in the same security zone.

B.

For multiple real servers, the real servers may not be in the same network segment, but they must be in the same security zone.

C.

For multiple real servers, the real server may not be in the same security zone, but must be in the same network segment

D.

For multiple real servers, the network segment and security zone where the real server is located does not affect the load balancing function.

Question 7

The IPSec establishment of a device is unsuccessful. The debug print information is as follows. What are the possible causes of the fault?

? %%01IKE/4/WARING(1):phase2:proposal mismatch,please check ipsec proposal configuration 0 34476900 %%01IKE/7/DEBUG(d) dropped message from 3.3.3.1 due to notification type NO_PROPOSAL_CHOSEN

Options:

A.

IKE proposal parameters are inconsistent

B.

IPSec proposal parameters are inconsistent

C.

ike peer configuration error

D.

Security acl configuration error

Question 8

An administrator can view the IPSec status information and Debug information as follows. What is the most likely fault?

Options:

A.

local IKE policy does not match the peer IKE policy.

B.

local ike remote name does not match peer ike name

C.

local ipsec proposal does not match the peer ipsec proposal

D.

The local security acl or the peer security acl does not match.

Question 9

The dual-system hot backup load balancing service interface works at Layer 3, and the upstream and downstream routers are connected to each other. The two USG devices are active and standby. Therefore, both the hrp track master and the hrp track slave must be configured on the morning service interface.

Options:

A.

TRUE

B.

FALSE

Question 10

In the IPSec VPN, the digital certificate is used for identity authentication. If the IKE main mode is used for negotiation, the certificate verification is completed in message 5 and message 6.

Options:

A.

TRUE

B.

FALSE

Question 11

The following scan snoop attacks are:

Options:

A.

SIP Flood attack

B.

HTTP Flood attack

C.

IP address scanning attack

D.

ICMP redirect packet attack

Question 12

Which of the following security services can a secure multi-instance provide for a virtual firewall?

Options:

A.

address binding

B.

blacklist

C.

ASPF

D.

VPN routing

Question 13

The virtual firewall forwards multiple instances. The firewall has multiple routing tables and forwarding tables. The addresses are overlapped and are implemented on the same configuration interface. Users with configuration rights can configure and view all data.

Options:

A.

TRUE

B.

FALSE

Question 14

The topology of the BFD-bound static route is as follows: The administrator has configured the following on firewall A: [USG9000_A] bfd [USG9000_A-bfd] quit [USG9000_A] bfd aa bind peer-ip 1.1.1.2 [USG9000_A- Bfd session-aa] discriminator local 10 [USG9000_A-bfd session-aa] discriminator remote 20 Which of the following configurations can be added to the firewall to implement BFD-bound static routes?

Options:

A.

[USG9000_A-bfd session-aa] commit

B.

[USG9000_A]bfd aa bind local-ip 1.1.1.1

C.

[USG9000_A]ip route-static 0.0.0.0 0 1.1.1.2 track bfd-session aa

D.

[USG9000_A] ip route-static 0.0.0.0 0 1.1.1.2 bfd-session aa

Question 15

A user dials to the LNS of the company through L2TP over IPSec using the VPN client, and the final dialup fails. However, the debug ike all and debug l2tp all did not see any information on the LNS. The two stages of establishing ike failed. What are the reasons for the failure?

Options:

A.

Interest traffic ACL configuration error

B.

The firewall (LNS) is connected to the public network. The IPSec policy is not applied to the interface.

C.

IPSec data stream does not reach the firewall

D.

L2TP is not enabled on D LNS

Question 16

Which of the following does the virtual firewall technical feature not include?

Options:

A.

provides multi-instance, multi-instance, multi-instance, multi-instance, and multi-instance VPN. The application is flexible and can meet multiple networking requirements.

B.

Each virtual firewall can independently support four security zones: Trust, Untrust, DMZ, and Local. The interfaces are flexibly divided and allocated.

C.

technically guarantees that each virtual system and a separate firewall are identical in implementation, and very secure, and can be directly accessed between virtual systems.

D.

Provide independent administrator privileges for each virtual system

Question 17

SSL VPN authentication is successful. Using the file sharing function, you can view directories and files, but you cannot upload, delete, and rename files. What are the possible reasons?

Options:

A.

If the file server type is NFS, the user UID and GID attributes do not allow the user to upload, delete, or rename files.

B.

If the type of the file server is SMB, the currently logged-in user has only read permission for the file share resource, but no write permission.

C.

Only the viewing function is enabled in the SSL file sharing function configuration of the C firewall.

D.

Some TCP connections between the virtual gateways of the D file server are blocked by the firewall

Question 18

As shown in the following figure, the BFD for OSPF network is as follows: 1. OSPF is running between the three devices: FW_A, FW_B, and FW_C. The neighbors are in the FULL state. The association between BFD and OSPF is complete. BFD is complete. To establish a BFD session, the following instructions are correct?

Options:

A.

When link a fails, BFD first senses, and FWA and FWB will converge immediately.

B.

link switching is switched in seconds

C.

FWA processes the neighbor Down event and recalculates the route. The new route is link b.

D.

When link a finds a fault, OSPF automatically converges and notifies BFD.

Question 19

A data flow has established a session in the firewall. If the packet filtering policy corresponding to the data is modified, how should the firewall execute?

Options:

A.

When the new packet arrives at the firewall, it immediately performs filtering according to the latest policy and refreshes the session table.

B.

immediately performs filtering according to the latest policy, does not refresh the session table

C.

The session is not aged, the new policy is not executed, and the previously established session is matched.

D.

modification will fail, you need to clear the session to modify

Question 20

What are the scenarios in which the USG series firewall service port sends gratuitous ARPs when the following configurations are performed?

Options:

A.

routing mode + switch

B.

routing mode + router

C.

exchange mode + switch

D.

exchange mode + router

Question 21

What type of message is the VRRP hello message?

Options:

A.

unicast message

B.

broadcast message

C.

multicast packet

D.

UDP packet

Question 22

The administrator can create vfw1 and vfw2 on the root firewall to provide secure multi-instance services for enterprise A and enterprise B, and configure secure forwarding policies between security zones of vfw1 and vfw2.

Options:

A.

TRUE

B.

FALSE

Question 23

In IPSec VPN, which one is incorrect about the difference between the barbaric mode and the main mode?

Options:

A.

main mode does not support NAT traversal in pre-shared key mode, but aggressive mode support

B.

main mode negotiation message is 6, and barb mode is 3

C.

In the NAT traversal scenario, the peer ID cannot use the IP address.

D.

main mode encrypts the exchange of identity information, while barbaric mode does not encrypt identity information

Question 24

IP address scanning attack defense not only prevents ICMP packet detection target addresses, but also prevents TCP/UDP scanning detection target addresses.

Options:

A.

TRUE

B.

FALSE

Question 25

When using manual IPSec negotiation, NAT traversal is also required if there is a NAT device on the network.

Options:

A.

TRUE

B.

FALSEx

Question 26

When the user's SSL VPN has been successfully authenticated, the user cannot access the Web-link resource. On the Web server, view the information as follows: netstat -anp tcp With the following information, which of the following statements is correct?

Options:

A.

intranet server does not open web service

B.

virtual gateway policy configuration error

C.

The connection between the virtual gateway and the intranet server is incorrect.

D.

Virtual gateway and intranet server are unreachable

 

Question 27

Avoid DHCP server spoofing attacks. DHCP snooping is usually enabled. What is the correct statement?

Options:

A.

connected user's firewall interface is configured in trusted mode

B.

The firewall interface connected to the DHCP server is configured as untrusted mode.

C.

DHCP relay packets received on the interface in the untrusted mode are discarded.

D.

The DHCP relay packet received in the D trusted mode and passed the DHCP snooping check.

Question 28

In the active/standby mode of the USG dual-system hot standby, the service interface works at Layer 3, and the upstream and downstream routers are connected to the router. The administrator can view: USG_A status is HRP_M[USG_A], USG_B status is HRP_S[USG_B], current 15000+ session Table, every time a switchover occurs, all traffic is interrupted for a period of time, and seamless switching is impossible.

Options:

A.

Execute the command hrp preempt delay 64 to lengthen the delay of preemption.

B.

Check connectivity between heartbeat lines

C.

does not configure session fast backup

D.

no hrp enable

Question 29

Static fingerprint filtering function, different processing methods for different messages, the following statement is correct?

Options:

A.

TCP/UDP/custom service can extract fingerprints based on the payload (ie the data segment of the message)

B.

DNS packet extracts fingerprints for Query ID

C.

HTTP message extracts fingerprint for universal resource identifier URI

D.

ICMP message extracts fingerprint by identifier

Question 30

The preemption function of the VGMP management group is enabled by default, and the delay time is 60s.

Options:

A.

TRUE

B.

FALSE

Question 31

In the case of IPSec VPN NAT traversal, you must use IKE's aggressive mode.

Options:

A.

TRUE

B.

FLASE

Question 32

On the USG, you need to delete sslconfig.cfg in the hda1:/ directory. Which of the following commands can complete the operation?

Options:

A.

cd hda 1:/remove sslconfig.cfg

B.

cd hda 1:/delete sslconfig.cfg

C.

cd hda 1:/rmdir sslconfig.cfg

D.

cd hda 1:/mkdir sslconfig.cfg

Page: 1 / 25
Total 245 questions