Huawei HCIE-Security (Huawei Certified Internetwork Expert-Security) - H12-731-ENU Exam Practice Test

A. ARP detection mode only supports detection of direct links.

B. The firewall continuously sends ARP request packets to the target network segment, and when it receives ARP response packets, it considers the link to be normal.

C. The ICMP detection method can be used to detect the reliability of chromium paths across network segments.

D. The firewall continuously sends ICMP packets to the specified destination address, and if no ICMP echo reply is received for 3 seconds (default), the link is considered to be faulty.

A. The business round-trip path may be inconsistent, and fast session backup is not enabled.

B. The backup channel is faulty, causing some session backups to fail.

C. Ospf Cost Adjustment not enabled

D. The tcp-mss value is not set correctly.

A. When the link status detection is enabled, and the incoming and outgoing messages are forwarded by the primary and standby USGs respectively, the USG does not enable rate-determining backup, and the TCP service can pass smoothly.

B. The default priority of the Active group is 65001, and the default priority of the Standby group is 65000.

C. The firewall is connected to the router upstream and connected to the Layer 2 switch downstream. OSPF+VRRP can be used to achieve load balancing.

D. The slot numbers of the physical cards of the two devices can be different.

A. FW1 is mainly used to prevent external illegal traffic from accessing the DMZ service area and to prevent attack traffic from inside the SSL tunnel.

B. DDos cleaning and detection equipment must be placed in the external network interface area to ensure that attack traffic is detected first.

C. Deploy IPS devices in the DMZ area bypass. If the defense function is realized, it is necessary to pass policy routing or static routing in the DMZ area switch to allow data to pass through the IPS devices.

D. FW2 mainly prevents internal illegal traffic from accessing the DMZ service area and illegally accessing the Internet.

A. Packet filtering policy that allows icmp packets to be forwarded through the firewall

B. undo ip ttl-expires enable

C. undo firewall defend tracert enable

D. Packet filtering policy that allows udp packets to be forwarded through the firewall

A. The default route is used for BGP diversion

B. This default route is used for traffic back injection

C. This default route is used to send probe traffic for attack prevention

D. The default route is used for static route diversion

A. GRE

B. L2TP

C. SSL VPN

D. IPsec VPN

A. Allow the 192.168.5.2/24 address segment to log in to the firewall via Web.

B. Allow the IP address 192.168.5.2/24 to log in to the firewall through Telnet.

C. Allow the firewall to log in to the device at 192.168.5.1 through Telnet.

D. Allow the firewall to log in to the device at 192.168.5.1 through the Web.

A. Security hardening of solutions and products.

B. Black-box penetration testing of solutions and products.

C. Open-box penetration testing of solutions and products.

D. Risk assessment of existing systems in the network.

A. FALSE

B. TRUE

A. If the preemption time is set too long, the switch operation will not be performed immediately when the USG fails.

B. hrp auto-sync config , which will manually back up the commands configured on the primary USG to the secondary USG.

C. The preemption operation is always started only after the failure recovery or the restart of the primary USG is completed.

D. The vrrp vrids of the interfaces corresponding to the heartbeat lines on the two USGs may be different.

A. Session state detection based on TCP connection three-way handshake.

B. The firewall does not support the stateful inspection mechanism when deployed as a Layer 2 device.

C. ICMP packets will not be checked for status.

D. Establish a connection for this UDP data stream when processing UDP protocol packets.

E. The non-first packet forwarding is based on the session table, which can only be forwarded if it matches the session table.

A. The defense technology of reverse source detection mechanism and TCP proxy mode must enable state detection mechanism.

B. When the SYN packet rate reaches the alarm value alert-rate-number, the device can perform source authentication check on SYN packets.

C. Only when the rate of SYN packets reaches the alarm value alert-rate-number, the device can check the SYN packets by the TCP proxy.

D. The use of TCP proxy mode can be used in scenarios where the round-trip paths are inconsistent.

A. SOX Act

B. Commercial Bank Information Technology Risk Technology Guidelines

C. ISO2700X Information Security Series

D. Regulations on Classified Protection of Information System Security