Huawei HCIE-Security (Huawei Certified Internetwork Expert-Security) (H12-731中文版) - H12-731 中文 Exam Practice Test
某网络 IPsec 状态信息如下, [USG A] display ike sa
current ike sa number: 2
---------------------------------------------------------------------------------------
conn-id peer flag phase vpn
----------------------------------------------------------------------------------------
40006 <unnamed> NONE v1:2 public
40004 1.1.1.2 RD|ST v1:2 public
2012-08-08 15:05:15 USG %%01IKE/4/WARNING (I): phase2: proposal or pfs dh-gro up mismatch, please check ipsec proposal and pfs dh-group configuration.
*0.1921499990 USG IKE/7/DEBUG: got NOTIFY of type NO_PROPOSAL_CHOSEN
以下哪个选项是可能的故障原因 ?
current ike sa number: 2
---------------------------------------------------------------------------------------
conn-id peer flag phase vpn
----------------------------------------------------------------------------------------
40006 <unnamed> NONE v1:2 public
40004 1.1.1.2 RD|ST v1:2 public
2012-08-08 15:05:15 USG %%01IKE/4/WARNING (I): phase2: proposal or pfs dh-gro up mismatch, please check ipsec proposal and pfs dh-group configuration.
*0.1921499990 USG IKE/7/DEBUG: got NOTIFY of type NO_PROPOSAL_CHOSEN
以下哪个选项是可能的故障原因 ?
Correct Answer: B,D
Vote an answer
防火墙上查看会话表信息如下 :
[USG] display firewall session table verbose
icmp VPN: public --> public
Zone: trust --> untrust TTL: 00:00:20 Left: 00:00:15
Interface: GigabitEthernet0/0/4 Nexthop: 2.2.2.2 MAC: 00-00-00-00-00-00
<-- packets: 0 bytes: 0 --> packets: 5 bytes: 420
192.168.1.2:44012[1.1.1.3:6103] -->2.2.2.2:2048
以下描述正确的是 :
[USG] display firewall session table verbose
icmp VPN: public --> public
Zone: trust --> untrust TTL: 00:00:20 Left: 00:00:15
Interface: GigabitEthernet0/0/4 Nexthop: 2.2.2.2 MAC: 00-00-00-00-00-00
<-- packets: 0 bytes: 0 --> packets: 5 bytes: 420
192.168.1.2:44012[1.1.1.3:6103] -->2.2.2.2:2048
以下描述正确的是 :
Correct Answer: C,D
Vote an answer
某网络组网如下: PC----ADSL 路由器 -----USG-----LAN
USG 的关键配置如下 :
l2tp enable
interface Virtual-Template1
ppp authentication-mode pap
ip address 4.1.1.1 255.255.255.0
remote address pool 1
l2tp-group 1
mandatory-Icp
allow 12tp virtual-template 1
#
user-ma page user pc1
password admin@123
aaa
domain default
ip pool 1 4.1.1.1 4.1.1.99
假设其它配置完整正确,该配置在实际工作时出现问题的现象是 ?
USG 的关键配置如下 :
l2tp enable
interface Virtual-Template1
ppp authentication-mode pap
ip address 4.1.1.1 255.255.255.0
remote address pool 1
l2tp-group 1
mandatory-Icp
allow 12tp virtual-template 1
#
user-ma page user pc1
password admin@123
aaa
domain default
ip pool 1 4.1.1.1 4.1.1.99
假设其它配置完整正确,该配置在实际工作时出现问题的现象是 ?
Correct Answer: B
Vote an answer
某企业有如下需求:
Trust 区域中内网用户的是 192.160.1.0/24 网段,可以访问 Internet 。
下列配置正确的是 :
traffic-policy
profile trust_tountrust
bandwidth downstream
maximum-bandwidth 400000
bandwidth downstream
guaranteed-bandwidth 50000
bandwidth ip-car downstream
maximum-bandwidth per-ip 2000
rule name trust_to_untrust
source-zone trust
destination-zone untrust
source-address 192.160.1.0 24
action qos profile
trust_to_untrust
#
Trust 区域中内网用户的是 192.160.1.0/24 网段,可以访问 Internet 。
下列配置正确的是 :
traffic-policy
profile trust_tountrust
bandwidth downstream
maximum-bandwidth 400000
bandwidth downstream
guaranteed-bandwidth 50000
bandwidth ip-car downstream
maximum-bandwidth per-ip 2000
rule name trust_to_untrust
source-zone trust
destination-zone untrust
source-address 192.160.1.0 24
action qos profile
trust_to_untrust
#
Correct Answer: C,D
Vote an answer
USG 防火墙日志信息输出如下:
%2014-07-31 11:15:45 USG6600 %%01BLACKLIS/4/BIkListAddOk (I):
A blacklist entry was changed.
(SyslogId=100, IpVemion=IPv4, SrcIp=172.18.9.2, DstIp=any, SrcPort=any, DstPort=any, Protocol=any, Use=any, VfwId=0, Vfw=public, List_Type=blacklist, Reason=Login password incorrect, Action=Add, DstPort=any, Timeout=10 min)
%2014-07-31 11:15:44 USG6600 %%01HTTPD/4/FAIL (I): User admin (IP: 172.18.9.2 ID: 27) login failed
%2014-07-31 11:15:44 USG6600 %%01AAA/4/LOCK (I): The user was locked out. (User Name =admin, Lock Time=10, Lock Reason=password incorrect for 3 times)
以下描述正确的是 :
%2014-07-31 11:15:45 USG6600 %%01BLACKLIS/4/BIkListAddOk (I):
A blacklist entry was changed.
(SyslogId=100, IpVemion=IPv4, SrcIp=172.18.9.2, DstIp=any, SrcPort=any, DstPort=any, Protocol=any, Use=any, VfwId=0, Vfw=public, List_Type=blacklist, Reason=Login password incorrect, Action=Add, DstPort=any, Timeout=10 min)
%2014-07-31 11:15:44 USG6600 %%01HTTPD/4/FAIL (I): User admin (IP: 172.18.9.2 ID: 27) login failed
%2014-07-31 11:15:44 USG6600 %%01AAA/4/LOCK (I): The user was locked out. (User Name =admin, Lock Time=10, Lock Reason=password incorrect for 3 times)
以下描述正确的是 :
Correct Answer: C,D
Vote an answer