H12-725_V4.0 HCIP-Security V4.0 Exam Online Dumps

dumps2024-03-29T09:45:18+08:00

H12-725_V4.0 exam is a related one for HCIP-Security V4.0 certification, which is for people who want to be senior engineers in network security. There are 60 single-answer questions, multiple-answer questions, true or false, short response items, drag and drop items in the real Huawei H12-725_V4.0 exam, and you have 90 minutes to answer all the questions. The required passing score for the Huawei H12-725_V4.0 exam is 600. The available languages are Chinese and English. The exam cost is $300. We provide the latest H12-725_v4.0 exam online dumps, which can guarantee you success. Free Huawei HCIP-Security H12-725_V4.0 exam online dumps are available below.

Page 1 of 17

1. Shutdown the business interface of the standby machine;

1-8-3-2-7-4-5-6

8-1-3-2-4-7-5-6

8-1-3-2-7-4-5-6

1-8-3-4-2-7-5-6

2. Bandwidth channels define specific bandwidth resources and are the basis for bandwidth management.

Which of the following is a resource that can be defined in a bandwidth channel?

Bandwidth policy

Daily traffic quota

Egress bandwidth restrictions

Strategic exclusivity

3. Which of the following parameters is not a condition for global routing policy classification?

Bandwidth

Port number

Quality

Weight

4. In a NAT traversal scenario, if a NAT device is detected, the destination port number of the ISAKMP message will become which of the following?

4500

500

5. Which of the following descriptions about GRE over IPSec is incorrect?

The IP header added during the IPSec encapsulation process, that is, the source address is the interface address of the IPSec gateway to which the IPSec security policy is applied, and the destination address is the interface address of the IPSec peer to which the IPsec security policy is applied.

When gateways use GRE over IPSec to connect, GRE encapsulation is performed first, and then IPSec encapsulation is performed.

The IP header added during the GRE encapsulation process, that is, the source address is the source address of the IPSec tunnel, and the destination address is the destination address of the IPSec tunnel.

The data flow that IPSec needs to protect is the data flow from the GRE starting point to the GRE ending point.

6. Which of the following descriptions of the characteristics of SSL VPN is incorrect?

SSL VPN supports few authentication types and is difficult to integrate with the original identity authentication system.

SSL VPN can support various IP applications

SSL VPN can parse intranet resources to the application layer and publish applications in a granular manner

Since the SSL VPN login method uses a browser, the automatic installation and configuration of the client is realized, so that users can quickly log in with their devices anytime and anywhere, and it also relieves the pressure of network administrators in maintaining the client.

7. Which of the following is not an intranet resource that SSL VPN can provide to mobile office users?

File resources

UDP resources

Web resources

IP resources

8. As shown in the figure, which of the following is the UDP defense principle shown in the figure?

Fingerprint learning

Load Check

Relevant defense

Session check

9. Which of the following is a method to prevent Tracert packet attacks?

Discard IP packets with time offset

Discard the detected ICMP messages or UDP messages that have expired, or the destination port is unreachable.

Users can configure the maximum length of ICP packets allowed to pass according to actual network needs. When the length of the actual IP packet exceeds this value, the packet will be discarded.

Discard ICMP unreachable messages and record attack logs

10. Which of the following is not the responsibility of the Anti-DDos defense system management center?

Security report analysis

Device Management

Issue defense strategies

Carry out traffic diversion

Page 2 of 17

11. Which of the following descriptions of URL classification is incorrect?

Custom URL classification requires manual configuration by the administrator.

The predefined URL categories are preset at the factory and do not require the administrator to manually load them.

Predefined URL categories cannot be created, deleted, or renamed

Predefined URL categories have higher priority than custom URL categories

12. Which of the following descriptions of keywords in content filtering is incorrect?

Regular expression matching is more flexible and efficient than text matching, but the configuration needs to follow the regular expression rules.

Keywords include predefined keywords and custom keywords

Predefined keywords are keywords that are manually defined by the administrator and can be identified

The minimum length of keywords that can be matched by text and regular expressions is 3 bytes.

13. If the administrator needs to set some signature actions to be different from the signature filter, you can configure exception signatures.

Which of the following is not an exception signature action?

release

Block and isolate high-source IP addresses

Block after alarm and exceeding the threshold

Block and isolate the destination IP

14. Which of the following descriptions of IPS top definition signatures is incorrect?

The content of predefined signatures is not fixed and can be created, modified or deleted.

When the action of the predefined signature is blocking, block the packets that hit the signature and record the log.

When the action of the predefined signature is release, the packets that hit the signature will be released and no log will be recorded.

When the action of the predefined signature is alarm, the packets that hit the signature will be released, but the log will be recorded.

15. IPS (Intrusion Prevention System) is an application layer security device that can identify network attacks based on which of the following?

Port number

Destination IP address

Feature library

Source IP address

16. Which of the following commands can be used to check the CPU and memory utilization of the current process on the Linux host?

iostat

top

df-h

free

17. In order to determine whether the Linux host has been added to a path other than the system default or normal business program registration, which environment variable of the Linux system can be checked?

$HOSTNAME

$SHELL

$HOME

$PATH

18. Which of the following descriptions of HWTACACS protocol features is incorrect?

Use shared key encryption, but only encrypt the password field in the authentication message.

Supports authorized use of configuration commands on the device, mostly used for device authentication

Based on TCP transport layer protocol, network transmission reliability is high

Authentication, authorization and accounting functions are separated, so authentication, authorization and accounting services can be deployed on different servers respectively.

19. When configuring authentication rules on iMaster NCE-Campus, which of the following types of authentication methods is not supported as a matching condition?

Device Management Certification

Wireless user authentication

User access authentication

MAC authentication

20. Which authentication method is generally used in situations where new networks are built, users are concentrated, and information security requirements are strict?

Portal certification

802.1x authentication

MAC priority Porta1 authentication

MAC authentication

Page 3 of 17

21. Which of the following statements about the features of the firewall hot standby system version upgrade is incorrect?

When a bug occurs in the live network fire protection system version, the system version needs to be upgraded.

When the existing network fire protection system version does not support certain features, the system version needs to be upgraded.

Version upgrade has requirements for the device model and version before the upgrade

When upgrading the dual-machine hot audio version, the rule of thumb is to upgrade the Active device first, and then upgrade the Standby device.

22. Which of the following descriptions of outbound traffic in the firewall virtual system is correct?

Traffic flowing from the private network interface to the public network interface is limited by the bandwidth in the inbound direction.

Traffic flowing from the public network interface to the private network interface is limited by the bandwidth in the inbound direction.

Traffic flowing from the private network interface to the public network interface is limited by the outbound bandwidth.

Traffic flowing from the public network interface to the private network interface is limited by the outbound bandwidth.

23. Which of the following descriptions about virtual system offloading is incorrect?

When the interface works at Layer 2, VLAN-based traffic distribution is used.

When the interface works at Layer 3, the interface-based offloading method is adopted.

Through offloading, packets entering the device can be sent to the correct virtual system for processing.

When using interface-based offloading, the management port can be assigned to a designated virtual system.

24. Which of the following is not an implementation process of bandwidth management?

Bandwidth channel

Traffic Analysis

Interface speed limit

Bandwidth policy

25. Which of the following descriptions of policy routing execution actions is incorrect?

Unable to forward traffic to other virtual systems according to policy routing

Policy routing is not required and forwarding is performed according to the existing routing table.

Use the intelligent routing function to select one outbound interface from multiple outbound interfaces to send messages.

Send the packet to the specified next-hop device or send the packet from the specified outbound interface

26. Which of the following prevention technologies can Huawei firewalls adopt?

Source detection

Fingerprint prevention

The first packet is discarded

Current limiting

27. Which of the following is the correct ordering of URL matching methods?

Exact matching > Suffix matching > Prefix matching > Keyword matching

Prefix matching > Suffix matching > Keyword matching > Exact matching

Keyword matching > Suffix matching > Suffix matching > Exact matching

Keyword matching>Prefix matching>Suffix matching>Exact matching

28. Which of the following descriptions of the email content filtering operating mechanism is incorrect?

The firewall first needs to identify the traffic to be filtered based on matching conditions.

When a POP3 or IMAP message is detected, if it is determined to be an illegal email, the firewall's response action can be to send an alarm message or block the email.

Email content filtering is only detected in the outbound direction

After the firewall filters out email traffic, it then checks the email address and attachment size to identify illegal emails.

29. Which of the following is not an abnormality in the file type identification results?

File extension mismatch

The file type cannot be recognized

File corruption

The file is compressed

30. The administrator has defined two keywords that need to be identified on the firewall. The keyword administrator has defined two keywords that need to be identified on the firewall. The weight value of keyword X is 2 and the weight value of keyword Y is 3. The alarm threshold for content filtering is defined as 5 and the blocking threshold is 10. If the device detects that the keyword X exists once and the keyword Y twice exists in the webpage browsed by the user.

Regarding the weight value and the behavior of users accessing web pages, which of the following statements is correct?

The weight value is 8 and you can access the web page

The weight value is 10 and the web page cannot be accessed.

The weight value is 8 and the web page cannot be accessed.

The weight value is 10 and you can access the web page

Page 4 of 17

31. WAF device’s working mode does not include which of the following?

Forward proxy

Reverse proxy

Bridge mode

Transparent proxy

32. WAF devices can effectively and accurately resist CC attacks. Which of the following descriptions of CC attacks is incorrect?

CC attack is a type of DDoS attack

The attack cost of CC attacks is relatively high, and launching an attack requires a large amount of bandwidth resources.

CC attacks can use proxy servers to launch attacks, making it difficult to trace the source of the attack.

CC attacks are mainly used to attack web servers, causing server resources to be exhausted and even shut down.

33. There is a log message in the firewall device, as shown below:

Jun 1 2022 14:27:01 FV3 %%01UPDATE/3/1LOAD_FALL (1) [182]: Failed to load the signature database. (SyslogId=0, Module-IP-RIPUTATION, Slot=11, CFU=0, LoadVersion=, Duration (s) =0, Reason="No SDB version is available for loading").

Which of the following does the "UPDATE" field in this log represent?

Summary of log information

Log description information

Log level

The functional module that generated the log

34. Which item does the authentication protocol of Portal authentication not include?

EAP protocol

HTTP protocol

Portal protocol

HTTPS protocol

35. The LDAP protocol is based on the Client/Server structure to provide binding and query of directory information. All directory information is stored on the LDAP server. In the LDAP protocol, the directory is organized according to a tree structure. The directory is composed of entries, and the entries are attribute sets with distinguished names (DN).

Which of the following is a domain name attribute of LDAP?

36. Use iNaster NCE-Campus as the Portal server and deploy Portal authentication on the Huawei wireless controller. Which configuration is not necessary?

URL template

Certification Template

Portal authentication template

MAC authentication template

37. In the MAC address authentication scenario, the user does not need to manually enter the user name and password. Which of the following is used as the authenticated user name?

Account number

IP address

Interface number

MAC address

38. Which of the following descriptions about Huawei IPS equipment upgrade is correct?

Upgrading the signature database of Huawei IPS does not require license authorization.

Upgrading the system version of Huawei IPS will take effect without restarting the device.

Upgrading the signature database of Huawei IPS requires restarting the device to take effect.

Upgrade the Huawei IPS signature database to take effect without restarting the device.

39. Which of the following descriptions of policy routing matching rules is incorrect?

When configuring multiple policy routing rules, the policy routing list is arranged in the order of configuration by default.

If multiple values can be configured in a matching condition, and there is an "OR" relationship between the multiple values, as long as the attributes of the message match any one value, the attributes of the message are considered to match this condition.

Each policy route contains only one matching condition

There is a default policy route default in the system by default. The default policy route is at the bottom of the policy list and has the lowest priority. All matching conditions are any and the action is no policy routing.

40. Which of the following parameters is not a condition for link quality check?

Delay

Bandwidth

Jitter

Packet loss rate

Page 5 of 17

41. Which of the following is not a functional feature of AH?

Integrity check

Anti-replay

Data source verification

Data encryption

42. Which of the following is a probe protocol that health checks cannot support?

RADIUS

CHCMP

DNS

UDP

43. Which of the following descriptions about guaranteed bandwidth and maximum bandwidth is incorrect?

Guaranteed bandwidth and maximum bandwidth can be set on a per-IP/user basis

If the traffic is greater than the maximum bandwidth, directly discard the traffic exceeding the maximum bandwidth.

If the traffic is less than the guaranteed bandwidth, this part of the traffic will compete freely with the same type of traffic in other bandwidth channels on the outbound interface for bandwidth resources.

Guaranteed bandwidth and maximum bandwidth settings for IP or users can achieve more detailed bandwidth restrictions

44. Which of the following descriptions about deploying a firewall virtual system is incorrect?

A resource class can be bound to multiple virtual systems at the same time

You can view the created virtual systems and allocated resources in the "Virtual System List"

Configure the resource class first, and then enable the virtual system for binding

Resource class r0 is bound to the root system by default and cannot be deleted or modified.

45. As shown in the figure, the firewall load balancing network is used, and the upstream and downstream devices are switches.

Which of the following descriptions of the firewall VGMP group status in this scenario is correct?

Firewall A: Active, Firewall B: Standby

Firewall A: Master, Firewall B: Backup

Firewall A: Master, Firewall B: Master

Firewall A: Active, Firewall B: Active

46. Which of the following is not part of the consistency check of dual-machine hot standby?

Interface address

NAT configuration

Bandwidth Policy

Security policy

47. As shown in the figure, the firewall is deployed as a gateway dual-machine hot standby, and the upstream and downstream devices are switches.

To achieve round-trip traffic load balancing, at least how many VRRP backup groups need to be configured in this scenario?

48. When a visitor accesses the corporate network through Portal authentication, in order to ensure a good visitor experience, the visitor is required to open the wireless network range for a short period of time. When re- entering, there is no need to enter the username and password again and they can directly access the network.

Which of the following access methods can meet the above requirements?

MAC bypass authentication

MAC authentication

MAC priority Portal authentication

802.1X authentication

49. When using an LDAP server as the authentication server, if you want to perform user authentication, which of the following operations needs to be performed on the data of the LDAP server?

Query class

Delete class

Writing class

Update class

50. When using an LDAP server as the authentication server, which of the following protocols is used for the interaction between the device and the server?

RADIUS protocol

HTTP protocol

LDAP protocol

EAP protocol

Page 6 of 17

51. If you want to control users’ forum postings, user logins, etc., which of the following HTTP behavior controls should be configured?

POST operation

Redirect

File upload

File download

52. A user uses SSL to access network resources on the intranet. The administrator has enabled file sharing and web proxy services for the user, and has allowed the traffic of the service on the firewall. However, after the user enters the address of the virtual gateway on the PC, the web page fails. I cannot see the list of file shares and web proxies. Which of the following options may cause this failure?

The virtual gateway’s external NAT port is wrong.

Has the virtual IP address been obtained from the virtual network card of the user's PC?

The administrator does not have the authorization to configure file sharing and web proxy for the user

The route between the firewall and the client is unreachable

53. How many levels of bandwidth policies does the firewall support?

54. Which of the following resources belongs to the quota resources allocated to the virtual system?

Number of strategies

VLAN

Interface

Safe area

55. Which of the following descriptions about bandwidth resource allocation is incorrect?

Which type of bandwidth resource limits a data flow is subject to depends on the outgoing interface or incoming interface of the traffic.

The public network interface refers to the interface connecting to the Internet

Bandwidth resources in the resource category are divided into three categories: inbound bandwidth, outbound bandwidth and overall bandwidth.

In the cross-virtual system forwarding scenario, the Virtual-if interface defaults to the public network interface.

56. When a visitor comes to the enterprise, while facilitating visitor access, it is necessary to control the visitor's access behavior.

For this kind of visitor scenario, which of the following authentication methods is generally recommended?

MAC bypass authentication

Portal authentication

802.1X authentication

MAC authentication

57. Which of the following descriptions of the RADIUS and HWTACACS protocols is incorrect?

All use shared keys to encrypt transmitted user information

Both have good flexibility and scalability

The structure adopts client/server model.

All support the authorization of configuration commands on the device.

58. Which of the following descriptions about Portal authentication is incorrect?

Portal authentication can be triggered in two ways: active authentication and passive authentication. Active authentication is initiated by the client, and passive authentication is initiated by the authentication server.

Under normal circumstances, the client does not need to install additional software and authenticates directly on the Web page, which is simple and convenient.

The Portal server can be an independent entity outside the access device (external Portal server), or it can be an embedded entity that exists within the access device (built-in Portal server)

The Portal authentication system mainly includes four basic elements, client, access device, Portal server and authentication server

59. Among the following descriptions of IPS signature types, which signature type has the highest action priority?

Exception signature

Custom signature

Predefined signature

Signature filter

60. In the URL filtering process, which of the following actions is performed as the first step?

Detect HTTP message anomalies

Match black and white lists

Remote query

Match URL classification

Page 7 of 17

61. Which of the following attacks does not expose network topology information?

Tracert message attack

Attacker side of IP packets with routing record entries

Scanning attack

Teardrop

62. Which of the following descriptions of the ATIC system architecture is incorrect?

ATIC software consists of three parts: management server, collector and controller

A management center can centrally manage multiple detection and cleaning equipment distributed in multiple regions.

Seco Manager uses B/S architecture as the management center

ATIC management server mainly manages detection and cleaning center equipment

63. Which of the following descriptions of Web Link in web proxy is incorrect?

There is a page compatibility issue, and images may be misaligned.

The URL will not be rewritten, which will expose the real address of the intranet server.

There are certain security risks

Depends on IE controls and cannot be used normally in non-IE environments

64. Which of the following descriptions of smart DNS is incorrect?

By configuring the smart DNS function, the firewall can intelligently modify the resolution address in the DNS response message so that the user can obtain the most appropriate resolution address, that is, an address that belongs to the same ISP network as the user.

Intelligent DNS supports weighted polling to achieve link load balancing

Smart DNS does not need to be combined with other technologies and can be used alone

Smart DNS is divided into two scenarios: single-server smart DNS and multi-server smart DN

65. Each bandwidth policy that references a bandwidth channel is independently constrained by the bandwidth channel, that is, traffic that meets the matching conditions of the bandwidth policy has exclusive access to the maximum bandwidth resource.

Which of the following options belongs to this bandwidth channel reference method?

Broadband sharing

Bandwidth multiplexing

Broadband exclusive

Dynamic equalization

66. Which of the following descriptions about dual-machine hot standby is incorrect?

In a load-sharing network, the configuration command can be backed up from "Configure Standby Device" to "Configure Primary Device"

In an active-standby backup network, configuration commands and status information are backed up from the active device to the standby device.

In load-sharing mode networking, traffic is processed by two devices, which can bear greater peak traffic than active-standby backup mode or mirroring mode networking.

In a load-sharing network, both firewalls are active devices. Therefore, if the two active devices are allowed to back up each other's commands, it may cause the problems of mutual overwriting or conflict between the commands of the two devices.

67. As shown in the figure, the primary and secondary backup networking based on VRRP is wrong. In the following description of this scenario, which one is wrong?

In order to ensure the consistency of link switching, the firewall implements device status management based on VGMP groups.

The configuration and status information of firewall A is backed up to firewall B in real time through the GE0/0/3 interface.

Dual-machine hot backup can improve network reliability

The firewall GE0/0/1 interface is the heartbeat interface, and the connected line is the heartbeat line.

68. In which of the following access authentication methods, the terminal must obtain an IP address before authentication?

802.1×Authentication

Portal

MAC authentication

MAC bypass authentication

69. In Huawei's admission control solution, after the access device receives the CoA-Roquest message or DM-Requst message from the RADTUS server, which RADIUS attribute in the message is used to identify the user?

called-Station-ld

Filter-ld

NAS-IP-Address

calling-Station-ld

70. In the 802.1X authentication scenario, the access device directly encapsulates the EAPoL packet sent by the 802.1X client into a RADIUS packet, without processing the data in the EAP.

Which of the following authentication methods meets the above description?

EAP termination

MAC-based authentication

Interface-based authentication

EAP relay

Page 8 of 17

71. Common Vulnerability Scoring System (CVSS) is a widely used open standard for vulnerability scoring and adopts a modular scoring system. Which of the following does not include?

Environmental dimension

Time dimension

Basic dimensions

Spatial dimensions

72. Malicious URLs refer to URLs that contain malicious information. Which of the following is not the source of malicious URLs?

Malicious URLs reported by the sandbox

Malicious URLs reported by the intrusion prevention function

URLs included in local reputation

Malicious URLs reported by the anti-virus function

73. As shown in the figure, which one of the following descriptions of dual-machine hot standby based on transparent mode is incorrect?

Since the service interface of the firewall works on the second layer, it cannot run services related to IP addresses.

In this network, the firewall is transparently connected to the original switch network without changing the network topology.

It is recommended that this network work in load sharing mode to share user traffic

By default, the status of any VLAN will not be adjusted based on the VGMP group status.

74. Which of the following descriptions about the characteristics of Eth-Trunk is incorrect?

Eth-Trunk can be a Layer 2 interface or a Layer 3 interface.

Eth-Trunk is a logical interface

There are at least 2 Eth-Trunk member links

There is at least 1 active Eth-Trunk link

75. Which of the following descriptions of virtual interfaces is incorrect?

Mutual access between virtual systems is achieved through virtual interfaces

The link layer and protocol layer of the virtual interface are always UP

The virtual interface of the root system is Virtual-if1

The format of the virtual interface is "Virtual-if+interface number"

76. Which of the following descriptions about the restrictions on the use of virtual systems is incorrect?

As long as the system software is upgraded in the root system

If the interface has been configured with an IP address, it will be cleared when assigned to a virtual

Management ports cannot be assigned to virtual systems

The virtual system administrator can log in to the device through the Console port.

77. When IPSec uses certificate authentication, it is necessary to verify the legitimacy of the peer certificate. Which of the following is not a factor that needs to be considered to verify the legitimacy of the certificate?

Whether the certificate is applied for in the same way

Whether the certificate is within the validity period

Whether the certificate is located in the CRL repository

Whether the certificate is issued by the same CA

78. As shown in the figure, IPSec tunnels are established between the headquarters and branches. To achieve IPSec traffic load sharing, at least how many IPSec tunnels need to be established?

79. An enterprise has multiple branches. The exit IP address of the headquarters is fixed, but the exit IP addresses of the branches are random. An IPSec VPN needs to be established between the headquarters and branches. In order to reduce management and maintenance costs, which of the following is appropriate? How to configure IPSec VPN?

Headquarters and branches adopt a point-to-point approach

Both the headquarters and branches adopt the strategic model approach

The headquarters adopts the policy template method, and the branches adopt the point-to-point method.

The headquarters and branches adopt IKE v2 method

80. Which of the following descriptions about HTTP Flood defense is incorrect?

If the free proxy used during the attack supports the redirection function, the basic mode defense will be ineffective.

The source authentication defense method is to defend against HTTP

Defense based on enhanced mode can determine whether the TTP access is initiated by a real user by asking the user to enter a verification code.

Defense based on basic mode cannot effectively prevent access from non-browser clients

Page 9 of 17

81. Which of the following descriptions of cleaning centers is incorrect?

Back-injection methods include: policy routing back-injection, static route back-injection, VPN back-injection and Layer 2 back-injection.

The cleaning device supports rich and flexible attack prevention technologies, but cannot defend against CC attacks and ICMP Flood attacks.

There are two methods of traffic diversion: static traffic diversion and dynamic traffic diversion.

The cleaning center completes functions such as diversion and cleaning of abnormal traffic, and reinjection of cleaned traffic.

82. When a firewall performs email filtering, which of the following email transfer protocols does it support?

SMTPS

SMTP

P0P3

IMAP

83. IPS devices work based on specific intrusion prevention mechanisms. Which of the following is the correct ranking of intrusion prevention mechanisms?

Feature matching->Reorganize application data->Protocol identification and protocol parsing->Response processing

Reorganize application data->Protocol identification and protocol parsing->Feature matching->Response processing

Reorganize application data->Feature matching->Protocol identification and protocol parsing->Response processing

Protocol identification and protocol parsing->Reorganize application data->Feature matching->Response processing

84. When using iMaster NCE-Campus as the Portal server, in order to allow iMaster NCE-Campus to match the corresponding Portal page according to the user's IP address.

When configuring the URL template on the access device, which of the following URL parameters need to be configured?

ssid

device-mac

user-mac

user-ipaddress

85. To implement the access control function through Huawei iMaster NCE-Campus controller, which of the following is not required for authentication and authorization configuration?

Certification results

Authorization results

Certification rules

Authorization rules

86. Which of the following descriptions about 802.1× authentication is incorrect?

In EAP termination mode, EAP messages are directly encapsulated into RADIUS

The 802.1X authentication method is divided into EAP relay method and EAP termination method. In comparison, EAP relay method supports more authentication methods.

The 802.1X authentication system uses the EAP protocol to realize information exchange between the client, device and authentication server.

In the 802.1X authentication method, the client must support the 802.1x protocol.

87. Which of the following is not a function of the Anti-DDoS Management Center?

Performance management

Strategic Management

Alarm management

Traffic detection

88. Which of the following descriptions of the network expansion process in SSL VPN is incorrect?

The remote user's local PC will automatically generate a virtual network card. The virtual gateway randomly selects an IP address from the address pool and assigns it to the remote user's virtual network card.

The remote user sends a service request message to the server on the enterprise intranet, and the message reaches the virtual gateway through the SSL VPN tunnel.

In reliable transmission mode, SSL VPN uses SSL protocol to encapsulate messages and uses UDP protocol as the transmission protocol

After the network expansion function is triggered, an SSL VPN tunnel needs to be established between the remote user and the virtual gateway first.

89. Use IKE v1 main mode to establish an IPSec VPN. After detecting the presence of a NAT device, which of the following ISAKMP messages will be followed by port number conversion?

Message 5

Message 6

Message 3

Message 4

90. As shown in the figure, enterprise A and enterprise B need to communicate securely, and an IPSec tunnel is established between firewall A and firewall B. Which of the following security protocols and encapsulation modes can meet the needs of this scenario?

AH, tunnel mode

ESP, tunnel mode

ESP, transmission mode

AH+ESP, transmission mode

Page 10 of 17

91. The network architecture of an enterprise is as shown in the figure below. Portal authentication is deployed on SW2. Its authentication-free template is as shown in the figure. Which of the following descriptions is correct?

At this time, the terminal can open the authentication interface.

At this time, the terminal can ping its own gateway.

At this time, the terminal can perform DNS resolution normally.

At this time, the terminal can be redirected to the authentication interface by entering the URL in the browser.

92. Which of the following descriptions about virtual system resource allocation is incorrect?

Unreasonable resource allocation may cause other virtual systems to be unable to obtain resources and the business to be unable to operate normally.

Quota resources automatically allocate a fixed number of resources directly according to system specifications.

When the administrator manually allocates resources to the virtual system, he first needs to configure the C resource class and specify the guaranteed value and maximum value of each resource item in the resource class, and then bind the source class to the virtual system

Each virtual system can share and seize the entire machine resources, but they can be allocated manually.

93. Which of the following descriptions of BFD detection characteristics is incorrect?

Reduce application interruption time and improve network reliability

Establish a session between the two devices to monitor the bidirectional forwarding path

Provide a detection time of less than 1 second to speed up network convergence

Fault detection can only be performed on the bidirectional forwarding path of the directly connected physical link between network devices.

94. The figure shows the defense principle of HTTP Flood. Which source detection technology is shown in the figure?

302 redirect mode

Basic mode

URI monitoring

Enhanced mode

95. Which of the following descriptions of abnormal file type identification results is incorrect?

The file type cannot be recognized means that the file type cannot be recognized and there is no file extension.

Unrecognized file type means that neither the file type nor the file extension can be recognized.

File extension mismatch means that the file type and file extension are inconsistent.

File corruption refers to the inability to identify the file type due to the file being damaged.

96. To check whether there is an abnormal task plan (not set by the user) on the Linux host, which of the following commands can be used?

crontab -u mysql

crontab -e

crontab -r

crontab -l

97. According to the provisions of the "National Cyber Security Incident Emergency Plan", when national secret information, important sensitive information and relevant educational records are lost or stolen, tampered with or counterfeited, and pose a particularly serious threat to national security and social stability Which level of emergency response should be initiated?

First level response

Secondary response

Special response

Level 3 response

98. System starts traffic statistics

3-4-2-1

4-2-3-1

2-4-3-1

4-3-2-1

99. The "Stuxnet" virus is a worm that attacks industrial control systems.

Which of the following is the correct ranking of the Stuxnet virus attack process?

Reconnaissance of organizational structure and personnel information->Social engineering penetration->Looking for infection targets->Using USB flash drives for lateral spread->Launching attacks

Find infection targets -> Reconnaissance of organizational structure and personnel information -> Social engineering penetration -> Use USB flash drives to spread horizontally -> Launch attacks

Reconnaissance of organizational structure and personnel information->Social engineering penetration->Use USB flash drives to spread horizontally->Find infection targets->Launch attacks

Social engineering penetration -> Reconnaissance of organizational structure and personnel information -> Use USB flash drives to spread horizontally -> Find infection targets -> Launch attacks

100. On a Linux host, which of the following files can be viewed to count all user names and login methods in the current system?

/etc/passwd

/etc/profile

/etc/shadow

/etc/rc.local

Page 11 of 17

101. Which of the following is not a URL matching method?

Exact match

Fuzzy matching

Prefix matching

Suffix matching

102. Which of the following is not a feature of ESP?

Data source verification

Data encryption

Data integrity

Data is available

103. The RADIUS protocol supports authentication, authorization and accounting functions. Which of the following messages does the RADIUS server issue authorization through?

Access-Request

Access-Accept

Accounting-Response

Accounting-Request

104. Huawei iMaster NCE-Campus can be used as an authentication server to authorize authenticated users. Which of the following is not an authorizable parameter of iMaster NCE-Campus?

ACL

VLAN

DSCP

IP address

105. Which vulnerability in the TCP port does the "WannaCry" ransomware exploit to launch network attacks on Windows systems?

139

443

3389

445

106. Which of the following descriptions about URL black and white lists is incorrect?

Black and white lists can be used in conjunction with URL classification

Generally, large web pages will embed links to other web pages. If only the main web page is added to the whitelist, the embedded web pages under the main web page will not be accessible normally.

The black and white list has the highest matching priority, higher than custom URL categories and predefined URL categories.

The priority of the blacklist is higher than that of the whitelist

107. Which of the following does not belong to the process of remote users accessing intranet resources through SSLVPN?

User authentication

User login

Resource access

Access billing

108. As shown in the figure, the firewall is active and backup in a backup network. By checking the HRP status on firewall A, the following information is obtained:

Which of the following is not a possible cause?

The heartbeat cable is not included in the safe area

The peer does not enable dual-machine hot backup function

The peer does not specify a heartbeat port

All business interfaces on firewall B are faulty

109. The signature filter of IPS is a collection of signatures that meet specified filtering conditions. Which of the following does the signature filter's filter criteria not include?

Threat Category

Signature ID

Operating system

Agreement

110. If an Anti-DDoS defense solution is deployed in the network, which of the following is not a necessary configuration of the management center?

Configure defense strategy

Add Anti-DDoS devices

Configure protection objects

Configure traffic steering

Page 12 of 17

111. Which of the following descriptions of inbound traffic in the firewall virtual system is correct?

Traffic flowing from the public network interface to the private network interface is limited by the outbound bandwidth.

Traffic flowing from the public network interface to the private network interface is limited by the bandwidth in the inbound direction.

Traffic flowing from the private network interface to the public network interface is limited by the bandwidth in the inbound direction.

Traffic flowing from the private network interface to the public network interface is limited by the outbound bandwidth.

112. In the Portal authentication scenario, when iMaster NCE-Campus is used as the Portal server and the Huawei wireless controller is the access device, which of the following port numbers is used by the wireless controller to process Portal protocol packets by default?

50200

1813

2000

1812

113. There are two methods for processing MAC authentication user passwords: PAP and CHAP. When using the PAP method, the device arranges the MAC address, shared secret key, and random value in order, and then encapsulates the password after HASH processing with the MD5 algorithm. In which of the following attribute names?

PAP-Password

PAP-Challenge

CHAP-Password

User-Password

114. Huawei iMaster NCE-Cam p us is a Web-based centralized management and control system of the ClouCampus solution. It supports user access management and can serve as multiple types of authentication servers. But which of the following types of servers cannot be used?

HWTACACS server

RADIUS server

AD server

Portal server

115. An enterprise uses high-end modular switches as core switches in its business network. Recently, a switching board of the modular switch failed, causing some business traffic to be interrupted. Which type of security event does this fault belong to?

Catastrophic events

Equipment and facility failure events

Cyber attacks

Information destruction incident

116. Which of the following does the filter condition of the IPS device signature filter not include?

Source of attack

Object

Threat categories

Agreement

117. If an attacker forges a large number of users to launch a DDoS attack on a business server, which of the following is an effective measure for false source attacks?

Source Authentication Technology

CDN caching

Load balancing technology

Intelligent DNS scheduling

118. For normal TCP packets, which of the following situations may occur in the flag bit?

RST and FIN are 1 at the same time

FIN and URG are 1 at the same time

SYN and ACK are 1 at the same time

SYN and RST are 1 at the same time

119. Mobile office users access the enterprise's internal Web server through a Web proxy. Which of the following descriptions is correct?

The mobile office user establishes an HTTP session with the virtual gateway, and the virtual gateway also establishes an HTTP session with the internal web server.

The mobile office user establishes an HTTP session with the virtual gateway, and the virtual gateway establishes an HTTPS session with the internal web server.

The mobile office user establishes an HTTPS session with the virtual gateway, and the virtual gateway establishes an HTTP session with the internal web server.

The mobile office user establishes an HTTPS session with the virtual gateway, and the virtual gateway also establishes an HTTPS session with the internal web server.

120. Which of the following descriptions of quota control strategies is incorrect?

The quota control policy can only limit the amount of users’ Internet traffic.

The quota control strategy consists of two parts: detection and control.

Quota control policy can limit the maximum bandwidth

Quota control policy can detect Internet traffic in real time

Page 13 of 17

121. Which of the following descriptions about Eth-Trunk is incorrect?

The total bandwidth of an Eth-Trunk interface is the sum of the bandwidths of all members. In this way, the bandwidth of the interface can be increased.

Each physical interface that makes up an Eth-Trunk interface is called a member interface.

In the Eth Trunk interface, if a member port status is Down, traffic can still rely on other ports for transmission.

Manual mode can not only detect link disconnection, but also detect link failures and misconnections.

122. Which of the following is the function of Message1 and Message2 during the main mode negotiation in the first phase of IKEv1 negotiation?

Negotiate IPSec SA

Mutual identity authentication

Use the DH algorithm to exchange key-related information and generate the key

Negotiate the IKE security proposal used between peers

123. Which of the following is not a method of IKE verifying remote peers?

Digital certificate authentication

AD certification

Pre-shared key authentication

Digital Envelope Authentication

124. When configuring the Portal page push policy on iMaster NCE-Campus, which of the following is not supported as a matching condition?

User IP address

Operating system version number

SSID

Browser type

125. In 802.1X authentication, in order to support the EAP relay mode, the RADIUS protocol adds some new attributes. Which of the following RADIUS attributes is used to encapsulate EAP messages?

NAS-Identifier

Message-Authenticator

NAS-Message

EAP-Message

126. The business form of an enterprise is complex, and multiple protocols are used to communicate between modules. In order to ensure the security of communication data and prevent third parties from stealing key data information, which of the following communication protocols should be avoided as much as possible?

SSH

SFTP

HTTPS

HTTP

127. Which of the following is the correct ordering of Huawei's intrusion prevention feature configuration process?

Configure intrusion prevention file->Upgrade signature database->Configure signature->Verification and inspection

Upgrade signature database->Configure intrusion prevention files->Deploy signature->Verification and inspection

Configure signature->Upgrade signature database->Configure intrusion prevention file->Verification and inspection

Upgrade signature database->Configure signature->Configure intrusion prevention file->Verification and inspection

128. Which of the following is a signature included in the intrusion prevention signature database?

Exception signature

Custom signature

Predefined signature

Signature filter

129. Which of the following descriptions of black box testing in penetration testing is incorrect?

Test coverage is low. Generally only 30% of the code can be covered

It can improve the quality of the code and discover hidden problems in the code.

Closer to users’ actual usage scenarios

The testing process is relatively simple, and there is no need to understand the code structure and characteristics inside the program.

130. The keyword group "Keyword" is called in the content filtering configuration file on the firewall for the upload direction of HTTP applications. The action is blocking and is called in the security policy.

The following regular expression is configured in the key group "Keyword". "b.*d", which text can internal employees post on the forum at this time?

boring

Bad

Beside

abroad

Page 14 of 17

131. Which of the following does not belong to the single packet attack type?

Special message attack

Malformed message attack

DoS attack

Scanning and snooping attacks

132. Which of the following is not a malformed message attack?

WinNuke attack

Ping

Oversized ICMP message attack

IP spoofing attack

133. A certain enterprise's network is as shown in the figure. Which of the following is a suitable reinjection method?

Policy routing back injection

Static routing back injection

Second level reinjection

GRE VPN backnote

134. Which of the following descriptions of Web rewriting in Web proxies is incorrect?

It may cause incomplete fonts

The intranet server address can be hidden, which is more secure.

May cause image misalignment

Depends on IE control

135. The entire IPSec protocol framework contains multiple protocols. Which of the following protocols does not belong to the IPSec protocol framework?

ESP

IKE

TLS

136. If the IPSec security protocols supported by both peers are inconsistent, which of the following consequences will result?

Poor IPSec service quality

IPSec SA cannot be established

IKE SA cannot be established

No data flow triggers IKE negotiation

137. ESP (Encapsulating Security Payload) is a protocol of IPSec that is used to provide confidentiality and anti-replay services for IP, including confidentiality of data packet content and limited traffic confidentiality. Which of the following is the protocol number of ESP?

500

4500

138. IKEv1 negotiation phase 1 supports two negotiation modes. How many bidirectional exchanges does the main mode include?

139. Which of the following descriptions of health examinations is incorrect?

Health check supports DNS detection protocol

The firewall can sense network connectivity in real time through the health check results.

The health check function does not support use in conjunction with policy routing.

In addition to detecting link connectivity, health check can also detect link delay, jitter and packet loss rate in real time

140. Which of the following descriptions about firewall session persistence is incorrect?

This function supports use in conjunction with the global routing strategy

If this function is not enabled, it may cause session re-establishment when the link is overloaded.

You can use display

When this function is turned on, the traffic of both new users and original users is always forwarded from the overloaded link, but the session is kept uninterrupted.

Page 15 of 17

141. Which of the following is the correct user name format for a firewall virtual system?

Virtual system name@@administrator name

Administrator name@@virtual system name

Administrator name@virtual system name

Virtual system name@administrator name

142. Which of the following descriptions of source detection technology is incorrect?

SYN Flood attack source detection technology can verify the real source of the client

For HTTP Flood attack, if the number of HTTP request messages with the same destination address received by the firewall exceeds the threshold, HTTP message source authentication will be started.

This technology can detect source IP addresses and discard packets from false source IP addresses.

Source detection technology can defend against UDP Flood attacks

143. As shown in the figure below, the administrator has performed the configuration related to Protall authentication on the network access device. Which of the following authentication protocols does the administrator use in Protall authentication?

CHAP

HTTP/HTTPS

Portal

PAP

144. Which of the following descriptions of the AH and ESP protocols is correct?

All support data source verification

All support encryption

All support NAT traversal

Verify IP headers

145. In SSL VPN, the firewall performs access authorization and access control based on which of the following dimensions?

IP address

Port number

MAC address

role

146. If the regular expression is "abc.de", which of the following will not match the regular expression?

abcdde

abc.de

abcde

abc+de

147. In IPSec, if the Security ACL does not match the actual data flow to be protected, which of the following consequences will occur?

IKE SA cannot be established

IPSec VPN services are blocked

No data flow triggers IKE negotiation

IPSec SA cannot be established

148. Which of the following DDoS attack types can be prevented by current limiting technology?

DNS

HTTP

ICMP

SYN

149. Which of the following descriptions of the file filtering process is correct?

If all parameters of the file can match all file filtering rules, the module will execute the action of this file filtering rule.

The file filtering module will match the application type, file type and transmission direction of the files identified by the previous module with the file filtering rule query table configured by the administrator from top to bottom.

There are two types of actions to be performed: alarm and blocking.

If the file type is a compressed file, then after file filtering and detection, the file will be sent to the file decompression module for decompression and the original file will be decompressed. If decompression fails, the file will no longer be filtered.

150. Firewall application behavior control technology cannot control which of the following application behaviors?

HΤΤΡ

SSH

FTP

Page 16 of 17

151. Which of the following attacks uses return timeout messages with a TTL of 0 to spy on the structure of the target network?

HTTP

Tracert attack

UDP

ICMP redirect attack

152. In order to prevent internal employees from making inappropriate remarks on the Internet, which of the following content security filtering technologies can be deployed on fire prevention training 9

Content filtering

File filtering

Email filtering

Application behavior

153. As shown in the figure, BFD and static routing are associated with each other. Which of the following configurations is correct?

Option A

Option B

Option C

Option D

154. In a virtual system, which of the following ownership relationships is recorded in the traffic diversion table?

MAC address and virtual system

IP address and virtual system

IP address and security policy

Security policy and virtual system

155. After NAT traversal is enabled, when a NAT device is detected between two gateways, the ESP message will be encapsulated in a UDP header. Which of the following is the source and destination port number of the UDP header?

Source port: 4500, destination port: 4500

Source port: 4500, destination port: 500

Source port: 500, destination port:

Source port: 500, destination port: 4500

156. Which of the following tools is commonly used for port scanning during penetration testing?

Aircrack

Tracert

Nmap

Wireshark

157. Which of the following descriptions about the difference between web link and web rewriting is incorrect?

Web Link does not perform encryption or adaptation, but simply "forwards" remote users' Web resource requests.

Since Web Link eliminates encryption and adaptation links, the business processing efficiency is higher than that of Web rewriting.

Web Link relies on IE controls than Web Rewrite and cannot be used normally in non-IE environments.

Web Link requires encryption and adaptation, so it is more secure.

158. Which of the following descriptions about firewall bandwidth policies is correct?

In the same group of parent-child policies, the same bandwidth channel can be referenced

By default, there is a default bandwidth policy on the firewall. The configured conditions are all (any) and the action is flow limiting.

If bandwidth management is used together with the source NAT function, the address before translation should be specified when configuring the address/matching conditions of the bandwidth policy.

For maximum bandwidth and connection limit, the child policy can be larger than the parent policy

159. Which of the following is not a matching condition for policy routing?

Source safe zone

Source IP address

Source port number

DSCP priority

160. Which of the following commands can display the IPSec SA negotiation results and IPSec policy configuration information?

display ike sa

display ipsec statistics

display ipsec sa

display ike peer

Page 17 of 17

161. As shown in the figure, FW_A establishes an IPSec tunnel with FW_B, and executes the display ike sa command on FW_A. The following information is obtained:

< FW A > display ike sa Current ike sa number:0

Which of the following is not a possible reason for IPSec tunnel establishment failure?

The route to the IKE peer is unreachable

The ACLs at both ends do not overlap.

The "remote gateway" of the local end does not match the "local address" of the opposite end.

Inconsistent encryption algorithms

162. In the 802.1x authentication scenario of a certain WLAN network, the authorized static ACL configuration on the authentication device is as follows. Which of the following network segments can be accessed by authenticated customers?

10.1.3.0/24

10.1.2.0/24

10.1.1.0/24

10.1.4.0/24

H12-725_V4.0 HCIP-Security V4.0 Exam Online Dumps

H12-725_V4.0 HCIP-Security V4.0 Exam Online Dumps

Share this post

Leave a Reply Cancel reply

Related Posts