HCIP-Security-CSSN H12-722_V3.0 Exam Dumps

dumps2022-06-20T06:21:01+08:00

Huawei H12-722_V3.0 exam dumps are online, which are valuable for you to study for the H12-722_V3.0 exam. In the real Huawei HCIP-Security-CSSN H12-722_V3.0 exam, there are 60 questions, and you have 90 minutes to finish the test. The required passing score for the Huawei H12-722_V3.0 exam is 600 (the total score is 1000). The exam cost is $160. The available languages are Chinese and English. Free Huawei certification H12-722_V3.0 exam dumps are below.

Page 1 of 11

1. If the user's FTP operation matches the FTP filtering policy, what actions can be performed? (Multiple choice)

block

Announcement

Alert

to execute

2. Which of the following statements about firewalls and IDS is true?

Firewalls are bypass devices for fine-grained detection

IDS is an in-line device and cannot perform in-depth detection

The firewall cannot detect malicious operations or mis operations by insiders

IDS cannot be linked with the firewall

3. Which of the following types of DDoS attacks fall into?

Single-packet attack

Traffic-based attack

Malformed Packet attack

Snooping Scanning attack

4. Part of the reason why APT attacks have become difficult to defend against is that they exploit zero-day exploits. This zero-day vulnerability usually takes a lot of time to research and analyze and develop corresponding defense methods.

TRUE

FALSE

5. The figure below shows the configuration of the URL filtering configuration file. Which of the following statements about this configuration is correct?

The firewall will check blacklist entries before checking whitelist entries.

Assuming that the user visits the www.exzample.com website, which belongs to both the humanities and social networking categories, the user cannot access the website at this time.

The user visits the website www.exzample.com. When the black and white list is not hit, the user will query the predefined URL category entry.

The default action means that all sites are allowed access. Hence the configuration is wrong here.

6. The firewall anti-virus module whitelist rule is configured as "*example*". Which of the following matching methods is used in this configuration?

Prefix matching

Suffix matching

Keyword matching

Exact matching

7. UDP is a connectionless protocol. A large number of UDP flood attacks that change sources and ports will cause the performance of network devices that rely on session forwarding to degrade or even exhaust the session table, resulting in network paralysis. Which of the following is not a defense against UDP flood attacks?

UDP fingerprint learning

Linked Defense

Current limiting

The first packet is discarded

8. Regarding the processing flow of file filtering, which of the following statements is false?

After the file decompression fails, the file will still be filtered.

The application identification module can identify the application type that carries the file.

Protocol decoding is responsible for parsing out the file data and file transfer direction in the data stream.

The file type identification module is responsible for identifying the real type of the file and the extension of the file according to the file data

9. Huawei WAF products are mainly composed of front-end execution, back-end central systems and databases. The database mainly stores the front-end detection rules and configuration files such as black and white lists.

TRUE

FALSE

10. Misuse detection through the detection of similar intrusion behaviors in user behavior, or the detection of those behaviors that use system defects to indirectly violate system security rules, intrusion activities in the system are found. Which of the following is not a feature of misuse detection?

easy to implement

Accurate detection

Effective detection of impersonation detection of legitimate users

Easy to upgrade

Page 2 of 11

11. Huawei NIP6000 products have zero-setting network parameters and plug-and-play functions, because the interface and interface pair only work at layer 2, and no IP address needs to be set.

TRUE

FALSE

12. In the penetration stage of APT attack, which of the following attack behaviors will the attacker generally have?

Long-term latency and key data collection.

Leak the key data information obtained to the third party of interest.

Through phishing emails with attachments of 0day vulnerabilities, the user's terminal becomes a springboard for attacks.

The attacker sends C&C attacks or other remote commands to the infected host, so that the attack spreads laterally in the intranet.

13. What aspects of information security are at risk from unauthorized access? (Multiple choice)

Confidentiality

Integrity

Availability

Recoverability

14. Network attacks are mainly divided into two categories: single-packet attacks and traffic-based attacks. Single-packet attacks include scanning and snooping attacks, malformed packet attacks and special packet attacks.

TRUE

FALSE

15. Which of the following attacks are attacks against web servers? (Multiple choice)

Website Phishing and Spoofing

Website Trojans

SQL Injection

Cross-site scripting attacks

16. Submit

3 -> 1 -> 4 -> 2 -> 5

3 -> 2 -> 4 -> 1 -> 5

3 -> 2 -> 1 -> 4 -> 5

3 -> 1 -> 2 -> 4 -> 5

17. In the security protection system in the cloud era, it is necessary to carry out reforms in the three stages before, during and after the event, and form a closed-loop continuous improvement and development.

Which of the following key points should be fulfilled in "during things"? (Multiple choice)

Vulnerability Intelligence

Defense in Depth

Offensive and defensive posture

Fight back against hackers

18. Huawei NIP6000 products provide a carrier-class high reliability mechanism from multiple levels to ensure the stable operation of the equipment. Which of the following belong to networking reliability? (Multiple choice)

Dual-system hot backup

Power 1+1 redundant backup

Hardware Bypass

Link-group

19. Which of the following are common reasons for IPS detection failure? (Multiple choice)

IPS policy is not submitted for compilation

Incorrect Policy IDs associated with IPS policy domains

The IPS function is not turned on

Bypass function is disabled in IPS

20. Regarding the file filtering technology in the USG6000 product, which of the following descriptions is wrong?

It can identify the application hosting the file, the file transfer direction, the file type and the file extension.

Even if the file type is modified, it can identify the real type of the file.

It can identify the type of files transmitted by itself, and can block, alert and announce specific types of files.

It supports filtering the content after decompression of the compressed file.

Page 3 of 11

21. For an antivirus gateway based on flow scanning, which of the following descriptions is wrong?

Relying on state detection technology and protocol analysis technology

The performance is higher than the proxy-based method

The overhead is smaller than the proxy-based method

The detection rate is higher than the proxy-based scanning method

22. For the description of the DNS Request Flood attack, which of the following statement is correct?

The DNS Request Flood attack against the cache server can use redirection to verify the legitimacy of the source.

For the DNS Request Flood attack on the authorized server, the client can be triggered to send a DNS request in a TCP packet to verify the legitimacy of the source I

During the source authentication process, the firewall will trigger the client to send a DNS request in a TCP packet to verify the validity of the source IP, but it will consume the TCP connection resources of the DNS cache server to a certain extent.

Redirection can be implemented not only for the source IP address accessing the attacked domain name, but also for the destination IP address accessing the attacked domain name.

23. Regarding anti-spam response codes, which of the following statements is false?

The response code will vary depending on the RBL service provider.

USG treats emails matching the response code as spam.

If the response code is not returned or the reply code is not configured on the USG, the mail is released.

The response code is uniformly specified as 127.0.0.1.

24. The configuration command to enable the attack defense function is as follows:

[FW] anti-ddos syn-flood source-detect

[FW] anti-ddos udp-flood dynamic-fingerprint-learn

[FW] anti-ddos udp-frag-flood dynamic-fingerprint-learn

[FW] anti-ddos http-flood defend alert-rate 2000

[FW] anti-ddos http-flood source-detect mode basic

Which of the following about the description of the attack defense configuration is correct? (Multiple Choice)

The firewall has enabled the SYN Flood source detection defense function.

The firewall uses the first packet drop to defend against UDP flood attacks.

HTTP flood attack defense uses enhanced mode for defense.

The threshold for HTTP flood defense to start is 2000.

25. After the application behavior control configuration file is referenced, it will take effect immediately, and no configuration submission is required.

TRUE

FALSE

26. Regarding the description of keywords, which of the following are correct? (Multiple choice)

Keywords are the content that the device needs to recognize when filtering content.

Keywords include predefined keywords and custom keywords.

The shortest length of the keyword that the text can match is 2 bytes.

Custom keywords can only be defined in text.

27. IPS is an intelligent intrusion detection and defense product. It can not only detect the occurrence of intrusion, but also suspend the occurrence and development of intrusion behaviors in real time through a certain response method, and protect the information system from substantial attacks in real time.

Which of the following statements about IPS is false?

IPS is an intrusion detection system that can block intrusions in real time.

IPS makes IDS and firewall unified.

IPS must be deployed in bypass mode in the network.

The common IPS deployment mode is in-line deployment.

28. Configure the following commands on the Huawei firewall:

[USG] firewall defend ip-fragment enable

Which of the following would be recorded as aggressive behavior? (Multiple choice)

The DF bit is 1, and the MF bit is also 1 or the Fragment Offset is not 0,

The DF bit is 0, the MF bit is 1 or the Fragment Offset is not 0,

The DF bit is 0, and Fragment Offset + Length > 65535.

The DF bit is 1, and Fragment Offset + Length < 65535.

29. Huawei USG6000 products can identify the real type of common files and filter and check the content. Even if the file is hidden in a compressed file, or the extension is changed, the firewall cannot escape the eyes of the firewall.

TRUE

FALSE

30. For the description of the AntiDDoS system, which of the following options is correct?

The detection center mainly pulls and cleans the attack traffic according to the control strategy of the security management center, and injects the cleaned normal traffic back to the customer network and sends it to the real destination.

The management center mainly completes the processing of attack events, controls the traffic diversion strategy and cleaning strategy of the cleaning center, and classifies and views various attack events and attack traffic, and generates reports.

The main function of the cleaning center is to detect and analyze the DDoS attack traffic on the mirrored or split traffic, and provide the analysis data to the management center for judgment.

Firewalls can only be used as detection devices.

Page 4 of 11

31. Which of the following options are used to upgrade the anti-virus signature database of Huawei USG6000 products? (Multiple choice)

Local upgrade

Manual upgrade

Online upgrade

Automatic upgrade

32. Regarding the global configuration of file filtering configuration files for Huawei USG6000 products, which of the following descriptions is correct?

File filtering, content filtering, and anti-virus detection are not available when files are corrupted. At this time, files can be released or blocked according to business requirements.

When the file extension does not match, if the action is "Allow" or "Alert", file filtering, content filtering and anti-virus detection will be performed according to the file type.

When the number of compression layers of a file is greater than the configured "Maximum number of decompression layers", the firewall cannot filter the file.

When the file type cannot be identified, file filtering, content filtering and anti-virus detection are not performed.

33. In Huawei USG6000 products, IAE provides an integrated solution, and all content security detection functions are integrated in a well-designed high-performance engine. Which of the following is not a content security detection feature supported by this product?

Application recognition and perception

URL Classification and Filtering

Video Content Filtering

Intrusion Prevention

34. Which of the following options is not part of the basic DDoS attack prevention configuration process?

The system starts traffic statistics.

The system is associated with the configuration application for fingerprint learning.

The system starts attack defense.

The system performs preventive actions.

35. Which of the following statements about network intrusion detection systems (NIDS) is false?

It is mainly used for real-time monitoring of network critical path information, listening to all packets on the network, collecting data, and analyzing suspicious objects

Use newly received network packets as data source;

Real-time monitoring through network adapters, and analysis of all communication traffic through the network;

Used to monitor network traffic and can be deployed independently.

36. Cloud sandbox for detection

Which of the following order of the process is correct?

1-3-4-2

1-4-2-3

1-4-3-2

3-1-4-2

37. What content can the content filtering technology of Huawei USG6000 filter? (Multiple choice)

Keywords included in the content of the uploaded file

Keywords contained in the downloaded file

File Type

Direction of file upload

38. Which of the following regarding the order of the document filtering technology processing flow is correct?

(1) The security policy is applied as permit

(2) Protocol decoding

(3) File type identification

(4) Application identification

(5) File filtering

(1) (2) (3) (4) (5)

(1) (4) (2) (3) (5)

(1) (2) (4) (3) (5)

(1) (3) (2) (4) (5)

39. Which of the following statements about IPS is false?

Override signatures take precedence over signatures in the signature set.

When the "source security zone" and "destination security zone" are the same, it means that the IPS policy is applied in the domain.

Modifications to the IPS policy will not take effect immediately, and you need to submit a compilation to update the configuration of the IPS policy.

The signature set can contain both predefined signatures and custom signatures.

40. Due to the difference of network environment and system security strategy, the specific implementation of intrusion detection system is also different.

What are the four main components of the system?

Event extraction, intrusion analysis, reverse intrusion and remote management.

Event extraction, intrusion analysis, intrusion response, and field management.

Event recording, intrusion analysis, intrusion response and remote management.

Event extraction, intrusion analysis, intrusion response, and remote management.

Page 5 of 11

41. For the description of URPF technology, which of the following are correct? (Multiple choice)

The main function is to prevent network attacks based on source address spoofing.

In strict mode, the interface is not checked for matching. As long as there is a route for the source address, the packet can pass.

In loose mode, not only the corresponding entry is required in the forwarding table, but also the interface must match to pass the URPF check.

Use the loose mode of URPF in an environment where routing symmetry cannot be guaranteed.

42. Which of the following descriptions about black and white lists in spam filtering is incorrect?

Configure local blacklist/whitelist: You can configure both blacklist and whitelist, or you can configure only one of them.

Enter the IP address and mask of the SMTP Server to be added to the whitelist in the "Whitelist" text box. You can enter multiple IP addresses, one IP address per line.

In the "Blacklist" text box, enter the IP address and mask of the SMTP Server to be added to the blacklist. You can enter multiple IP addresses, one IP address per line.

The blacklist has higher priority than the whitelist.

43. Which of the following belong to the network layer attack of the TCP/IP protocol stack? (Multiple choice)

Address Scanning

Buffer overflow

Port Scan

IP spoofing

44. For URL is http://www.abcd.com:8080/news/education.aspx?name=tom&age=20, which option is path?

http://www.abcd.com:8080/news/education.aspx

http://www.abcd.com:8080

/news/education.aspx

/news/education.aspx?name=tom&age=20

45. The process of requesting resources from the server by the browser carrying the cookie is shown in the figure below. Which of the following steps contains Session ID information in the message?

③④

①③④

⑤⑥

② ④

46. SQI injection attacks generally have the following steps:

① Elevation of rights

② Get the data in the database

③ Determine whether there are loopholes in the webpage

④ Determine the database type

Which of the following order of these steps is correct?

③④①②

③④②①

④①②③

④②①③

47. Which of the following description about the configuration of the management center ATIC is correct? (Multiple choice)

A traffic diversion task needs to be configured on the management center. When an attack is found, it will be sent to the cleaning center.

You need to configure protection objects on the management center to guide abnormal access traffic.

Port mirroring needs to be configured on the management center to monitor abnormal traffic.

The reinjection policy needs to be configured on the management center to guide the cleaned traffic.

48. The USG6000V software logical architecture is divided into three planes: management plane, control plane and _______.

Configuration plane

Business plane

Log plane

Data forwarding plane

49. The network-based intrusion detection system is mainly used for real-time monitoring of network critical path information, listening to all packets on the network, collecting data, and analyzing suspicious objects. Which of the following options are its main features? (Multiple choice)

Good concealment, network-based monitors do not run other applications, do not provide network services, and cannot respond to other computers, so they are not easily attacked.

The monitoring speed is fast, and problems can be found in microseconds or seconds. The host-based IDS relies on the analysis of audit records in the last few minutes.

Many monitors are required.

It can detect the source address and destination address, identify whether the address is illegal, and locate the real intruder.

50. Malicious code usually uses RootKit technology to hide itself. RootKit can hide itself and specified files by loading special drivers and modifying the kernel of the system.

TRUE

FALSE

Page 6 of 11

51. Analysis is the core function of intrusion detection. The analysis and processing process of intrusion detection can be divided into three stages; build an analyzer, analyze, feedback and refine the actual field data.

Which of these features is included in the first two phases?

Data analysis, data classification, post-processing

Data processing, data classification, post-processing

Data processing, attack classification, post-processing

Data processing, data classification, attack playback

52. The query result of the RBL black and white list on the firewall is as follows:

Based on the above information alone, which of the following statements is true? (Multiple Choice)

Mail with source address 10.17.1.0/24 will be blocked

Mail with source address 10.18.1.0/24 will be blocked

Mail with source address 10.17.1.0/24 will be released

Mail with source address 10.18.1.0/24 will be released

53. Content filtering is a security mechanism for filtering the content of files or applications through Huawei USG6000 products. By deeply identifying the content contained in the traffic, the device can block or alert the traffic containing specific keywords.

TRUE

FALSE

54. Which of the following options is not a special packet attack?

ICMP redirection packet attack

Oversized ICMP Packet Attack

Tracert packet attack

IP fragmentation packet attack

55. Which of the following statements about worms and viruses is true?

Worms are parasitic

Viruses mainly rely on system vulnerabilities to infect

The worm infects other computer systems on the network

Viruses exist independently in computer systems

56. Information security is the protection of information and information systems against unauthorized access, use, disclosure, interruption, modification, destruction and thereby providing confidentiality, integrity and availability.

TRUE

FALSE

57. When you suspect that your company's network has been hacked, you conduct a technical investigation.

Which of the following options is NOT an action that occurs in the early stages of an attack?

Planting malware

Vulnerability Attacks

Web Application Attacks

Brute force

58. Which of the following options will not pose a security threat to the network?

Hacking

Weak personal security awareness

Opening confidential company documents

The virus database is not updated in time

59. Regarding computer viruses, which of the following description is correct?

Patching the system can completely solve the problem of virus intrusion

Computer virus is latent, it may be latent for a long time, and it will only start to carry out sabotage activities when it encounters certain conditions

Computer viruses are contagious and can spread continuously through floppy disks and CD-ROMs, but not through networks

All computer viruses must be parasitic in the file and cannot exist independently

60. Regarding the description of file reputation technology in anti-virus engines, which of the following options is correct?

The local reputation MD5 cache is only a static cache and needs to be updated regularly

The file reputation database can only be upgraded by manual upgrade

File reputation is to perform virus detection by calculating the MD5 of the full text of the file to be tested and matching it with the local reputation MD5 cache

The update and upgrade of the file reputation database can only be realized by linking with the sandbox

Page 7 of 11

61. Since the sandbox can provide a virtual execution environment to detect files in the network, when deploying security devices, the sandbox can replace Anti-Virus, IPS, spam detection and other devices.

TRUE

FALSE

62. When a virus is detected in an email, which of the following is not the corresponding action for detection?

Alert

Block

to declare

Delete attachments

63. Which of the following options is not a network security threat caused by a lack of personal security awareness?

Disclosure of personal information

Threats to the internal network

Disclosure of corporate information

Increase the cost of enterprise network operation and maintenance

64. In the anti-virus policy configuration of Huawei USG6000 products, what are the response methods of the HTTP protocol? (Multiple choice)

Alert

Block and push the page

Pop up a warning dialog

Block all access to this client

65. The most common form of traffic-based attack is to send a large number of seemingly legitimate packets to the target host through the flood method, which eventually leads to the exhaustion of network bandwidth or device resources. Which of the following is not included in traffic attack packet?

TCP packet

UDP packet

ICMP packet

FTP packet

66. Buffer overflows, Trojan horses, and backdoor attacks are all attacks at the application layer.

TRUE

FALSE

67. At the same time, some pornographic websites in the student area are prohibited.

The external network has been configured as the untrust zone and the internal network is configured as the trust zone on the firewall. How to configure the firewall to meet the above requirements? (Multiple choice)

You can directly enable AV, IPS protection, and URL filtering globally to achieve the requirements

In the direction of untrust, only enable AV and IPS protection functions for the server area to protect the server

In the direction of untrust going to the intranet, AV and IPS protection functions are only enabled for the server area to protect the server

Go to the untrust direction to enable the URL filtering function for the entire campus network, and filter some classified websites

68. For special packet attacks, which of the following descriptions is correct?

Special control packet attack is a potential attack behavior and does not have direct destructive behavior.

The attacker probes the network structure by sending special control packets to launch the real attack.

Special control packet attacks do not have the ability to detect the network structure. Only scan-type attacks can detect the network.

Special control packet attacks can only use ICMP to construct attack packets.

69. When the AntiDDoS system finds attack traffic, it will divert the attack traffic to the cleaning device. After the cleaning device completes the cleaning, it will re-inject the traffic to the original link. Which of the following options is not a method of re-injection?

Policy routing re-injection

GRE re-injection

MPLS LSP re-injection

BGP re-injection

70. Viruses can destroy computer systems, tamper with and damage business data: spyware collects, uses, and disseminates sensitive information of enterprise employees. These malicious software seriously interfere with the normal business of enterprises. Desktop antivirus software solves the problem of viruses and spyware globally.

TRUE

FALSE

Page 8 of 11

71. When configuring the URL filtering configuration file, configure www.bt.com in the URL blacklist item, and set a URL as *bt.com in the custom URL classification, and customize the action of the URL classification for warning.

Which of the following statements about the above configuration is true? (Multiple Choice)

Users can visit www.videobt.com website.

Users can access the www.bt.com website, but the administrator will receive a warning message.

Users cannot access all websites ending with bt.com.

Users will be blocked when they visit www.bt.com.

72. Which of the following statements about the email protocol is true? (Multiple choice)

With POP3, the client software will download all unread mail to the computer, and the mail server will delete the mail.

With IMAP, the client software will download all unread mail to the computer, and the mail server deletes the mail.

With IMAP, the user can directly operate the mail on the server, and it is not necessary to download all the mail to the local and then perform various operations.

With POP3, the user can directly operate the mail on the server, and it is not necessary to download all the mail to the local and then perform various operations.

73. Which of the following are typical intrusion behaviors? (Multiple choice)

The computer is infected by a USB flash drive virus

The power supply of the computer room is abnormally interrupted

Tampering with Web pages

Copy/View Sensitive Data

74. In Huawei USG6000 products, after creating or modifying a security configuration file, the configuration content will not take effect immediately. You need to click "Submit" in the upper right corner of the interface to activate it.

TRUE

FALSE

75. For the enhanced mode in HTTP Flood source authentication, which of the following descriptions are correct? (Multiple choice)

Enhanced mode refers to the way to use verification code authentication.

Some bots have the redirection function, or the free proxy used in the attack process supports the redirection function, which causes the defense of the basic mode to fail, and the enhanced mode can effectively defend.

Enhanced mode is better than Basic mode in terms of user experience.

Enhanced mode supports all HTTP flood origin authentication scenarios.

76. Regarding the email content filtering configuration of Huawei USG6000 products, which of the following statements is incorrect?

Mail filtering will take effect only when the mail filtering configuration file is invoked under the condition that the security policy is allowed.

When a POP3 message is detected, if it is determined to be an illegal email, the firewall's response action only supports sending alarm information, and will not block the email.

When an IMAP message is detected, if it is determined to be an illegal email, the firewall's response action only supports sending alarm information, and will not block emails.

Attachment size limits are for individual attachments, not for the total size of all attachments.

77. Which of the following behaviors is a false positive by an intrusion detection system?

Unable to detect new worms

Attempts to log in to the system are logged

Use Ping for network detection and be alerted as an attack

Web-based attacks are not detected by the system

78. Regarding the three abnormal situations of the file type identification result, which of the following description is wrong?

File extension mismatch means that the file type does not match the file extension.

Unrecognized file type means that the file type cannot be recognized and there is no file extension.

File corruption refers to the inability to identify the file type due to corruption of the file.

Unrecognized file type means that the file type cannot be recognized and the file extension cannot be recognized.

79. Regarding intrusion prevention, which of the following descriptions is false?

Intrusion prevention is a new security defense technology that can both detect and prevent intrusions.

Intrusion prevention is a security mechanism that detects intrusion behaviors (including buffer overflow attacks, Trojan horses, worms, etc.) by analyzing network traffic.

Intrusion prevention can block attacks in real time.

Intrusion prevention technology, after discovering intrusion behavior, it must be linked to the firewall to prevent intrusion

80. Anomaly detection establishes the outline of the normal behavior characteristics of the system subject through the analysis of the system audit data: during detection, if the audit data in the system is significantly different from the normal behavior characteristics of the established subject, it is considered an intrusion behavior. Which of the following can be used as the main body of the system? (Multiple choice)

Host

A group of users

Single User

A critical program and file in the system

Page 9 of 11

81. Which of the following description about the AntiDDoS system configuration is correct?

Configure drainage and reinjection on the detection device.

Configure port mirroring on the cleaning device.

Add protection objects on the management center.

Configure drainage and reinjection on the management center.

82. Which of the following threats cannot be detected by IPS?

Viruses

Worms

Spam

DoS

83. When using the misuse check technology, if the normal user behavior is successfully matched with the intrusion signature knowledge base, there will be a false positive.

TRUE

FALSE

84. The anti-tampering technology of Huawei WAF products works based on the cache module. Assuming that when user A visits website B, website B has signs of page tampering, the workflow for the WAF anti-tampering module has the following steps:

① WAF uses the page in the cache to return to the client;

② WAF compares the server page content with the page content in the cache for watermarking;

③ After the learning is completed, the page content is stored in the cache;

④ When a user accesses a web page, WAF obtains the page content of the server;

⑤ WAF starts the learning mode to learn the content of the page the user visits the website;

Which of the following order of these steps is correct?

③④②⑤①

⑤①②④③

②④①⑤③

⑤③④②①

85. Which of the following is not a defense against HTTP flood attacks?

HTTP Flood Origin Authentication

HTTP Source Statistics

URI source fingerprint learning function

Baseline Learning

86. The action of overwriting the signature ID3000 is an alarm.

Which of the following judgments is correct?

The action of the signature ID3000 is an alarm

The action of signature ID3000 is to block

Unable to judge the action of signature ID3000

The signature set has nothing to do with the overlay signature

87. The status code in the HTTP response message expresses the type of the response message, and there are many possible values.

Which of the following status codes indicates that the resource requested by the client does not exist?

400

404

200

503

88. Which three aspects should be considered in the design of cloud platform security solutions? (Multiple choice)

Infrastructure Security

Tenant Security

How to do a good job in management operation and maintenance

Hardware Maintenance

89. Regarding anti-spam local black and white lists, which of the following statements is false?

The black and white list is matched by extracting the destination IP address of the SMTP connection

The black and white list is matched by the sender's dns suffix

The black and white list is matched by extracting the source IP address of the SMTP connection

If the source IP address of the SMTP connection matches the blacklist, block the connection

90. Which of the following options is not a feature of a Trojan horse?

Not self-replicating but parasitic

Trojans carry out self-replication and spread

Actively contagious

The ultimate intention is to steal information for remote monitoring

Page 10 of 11

91. The security management system is only optional, and anti-virus software or anti-hacking technology can well defend against network threats.

TRUE

FALSE

92. The recipient downloads the email.

1->2->3

1->2->4

1->3->4

1->4->3

93. Which of the following protocols can be used to construct attack packets for special control packet attacks? (Multiple choice)

ICMP protocol

UDP protocol

IP Protocol

FTP protocol

94. In order to protect the security of data transmission, more and more websites or enterprises choose to encrypt traffic through SSL.

Which of the following statements about using Huawei NIP6000 products to perform threat detection on SSL traffic is correct?

The NIP000 does not support SSL traffic threat detection.

The traffic after threat detection is sent directly to the server without encryption.

NIP can directly crack and detect SSL encryption.

go through the process of "decryption", "threat detection", and "encryption".

95. If an enterprise wants to detect image files, Shellcode code files and PDF files, which of the following types of sandboxes can be used? (Multiple choice)

PDF heuristic sandbox

PE heuristic sandbox

Web heuristic sandbox

Heavyweight Sandbox (Virtual Execution)

96. An enterprise administrator wants to prevent employees from accessing shopping websites during business hours. Therefore, a URL filtering configuration file is configured, and shopping websites in the predefined categories are selected as blocked. However, employee A can still use the company network to shop online during his lunch break.

Which of the following are the possible reasons? (Multiple Choice)

The administrator did not set the time period to 9:00-18:00 every day.

The shopping site does not belong to the predefined shopping site category.

The configuration is not committed after the administrator configuration is complete.

The administrator has not applied the URL filtering profile to the security policy.

97. Which of the following features does Huawei NIP intrusion prevention equipment support? (Multiple choice)

Virtual Patching

Mail Detection

SSL Traffic Inspection

Application Identification and Control

98. Regarding the processing flow of file filtering, which of the following statements is correct?

The file filtering module will match the application type, file type, and transmission direction of the file identified by the previous module with the file filtering rule query table configured by the administrator from top to bottom.

If all parameters of the file can match all file filtering rules, the module will execute the action of this file filtering rule.

There are two types of actions: alarm and block.

If the file type is a compressed file, after the file filtering detection, the file will be sent to the file decompression module for decompression, and the original file will be decompressed. If the decompression fails, the file will not be filtered again.

99. Anti-DDoS defense system includes: management center, detection center and cleaning center.

TRUE

FALSE

100. Which of the following statements is false about HTTP behavior?

HTTP POST is generally used to send information to the server through a web page, such as forum posting, form submission, username/password login.

When the file upload operation is allowed, the alarm threshold and blocking threshold can be configured to control the size of the uploaded file.

When the size of the uploaded or downloaded file and the content of the POST operation reach the alarm threshold, the system will generate log information to prompt the device administrator and block the behavior.

When the size of the uploaded or downloaded file and the content of the POST operations reach the blocking threshold, the system will only block uploaded or downloaded files and POST operations.

Page 11 of 11

101. For Huawei USG6000 products, which of the following statements about email filtering configuration is correct?

Cannot control the number of email attachments received

When the processing action for spam is, alert, the email will be blocked and an alert will be generated

You can control the size of the attachment of the received email

Cannot filter received emails by keyword

102. AntiDDoS seven-layer defense can work from the interface-based defense, global-based defense and defense object-based defense dimensions.

TRUE

FALSE

103. For the basic mode in HTTP Flood source authentication, which of the following options are correct? (Multiple choice)

Basic mode effectively blocks access from non-browser clients.

The bot tool does not implement a complete HTTP protocol stack and does not support automatic redirection, so the basic mode can effectively defend against HTTP flood attacks.

When there is an HTTP proxy server in the network, the firewall will add the IP address of the proxy server to the whitelist, but the basic source authentication of the zombie host is still valid.

The basic mode will not affect the user experience, so the defense effect is higher than that of the enhanced mode.

104. What are the typical technologies of anti-virus engines? (Multiple choice)

First Packet Detection Technology

Heuristic Detection Technology

Decryption Technology

File reputation detection technology

105. In the big data intelligent security analysis platform, it is necessary to collect data from the data source, and then complete a series of actions such as data processing, detection and analysis.

Which of the following options is NOT an action that needs to be done in the data processing part?

Data preprocessing

Threat determination

Distributed Storage

Distributed Index

106. Which of the following files can the sandbox detect? (Multiple choice)

WWW file

PE file

Image file

Mail

107. The administrator defines two keywords to be identified on the firewall. The weight of keyword x is 2, and the weight of keyword y is 3. The alarm threshold for content filtering is defined as 5, and the blocking threshold is 10. If the device detects that the keyword x exists once in the webpage browsed by the user, the keyword twice is Y. Which of the following statements is correct about the weight value and the behavior of users visiting web pages?

The weight value is 8, and the webpage can be accessed.

The weight value is 10, and the webpage cannot be accessed.

The weight value is 8, and the webpage cannot be accessed.

The weight value is 10, and the webpage can be accessed.

108. Regarding the role of content security filtering technology, which of the following descriptions are correct? (Multiple choice)

File filtering reduces the risk of malicious code execution and virus infection on the internal network by blocking certain types of file transfers, as well as preventing employees from leaking confidential company files to the Internet.

Content filtering can prevent the disclosure of confidential information and the transmission of illegal information.

The application behavior control function can finely control common HTTP behaviors and FTP behaviors.

Mail filtering refers to the management and control of mail sending and receiving behavior, including preventing the flood of spam and anonymous mail, and controlling illegal sending and receiving.

109. Fraggle attack means that both the source and destination address of TCP are set to the IP address of a certain victim. This behavior will cause the victim to send a SYN-ACK message to its own address, which in turn sends an ACK message back and creates an empty connection, causing system resources to be occupied or the destination host to crash.

TRUE

FALSE

HCIP-Security-CSSN H12-722_V3.0 Exam Dumps

HCIP-Security-CSSN H12-722_V3.0 Exam Dumps

Share this post

Leave a Reply Cancel reply

Related Posts