Huawei HCIP-Security H12-721_V3.0 Exam Questions

dumps2022-06-15T01:28:48+08:00

Huawei HCIP-Security H12-721_V3.0 exam information is helpful for you to take the test. In the real Huawei certification H12-721_V3.0 exam, there are 60 questions, and you have 90 minutes to complete the test. The required passing score for the H12-721_V3.0 exam is 600. The available languages are English and Chinese. The exam cost is $160. We provide real Huawei certification H12-721_V3.0 exam questions, which are valuable for you to pass the test. Free Huawei HCIP-Security H12-721_V3.0 exam questions are below.

Page 1 of 11

1. Users cannot access intranet resources when using the network extension function. Which of the following is not the possible cause of the failure?

Has a virtual IP address been obtained on the virtual network card of the user PC?

The route between the firewall and the intranet server is unreachable.

User connection timed out.

The virtual IP address conflicts with the FW interface address, intranet server address, and DHCP address pool address.

2. In a dual-system hot-standby network, when configuring an HRP heartbeat interface, if the address of the peer heartbeat interface is specified, which of the following types of VGMP Hello packets are sent between firewalls?

Unicast message

Broadcast message

Multicast message

UDP packets

3. The dual-system hot backup networking diagram is shown below. The gateway address of PC1 in the figure should be the interface IP address of the active device, that is, 10.100.10.2/24.

TRUE

FALSE

4. The bandwidth management function only supports limiting the number of connections initiated by a specified IP.

TRUE

FALSE

5. When using the Radius server to authenticate users, it is necessary to configure the corresponding user name and password on both the Radius server and the firewall.

TRUE

FALSE

6. As shown in the figure, the firewall dual-system hot-standby networking environment. In this networking environment, which of the following commands can ensure that the device can automatically adjust the priority of the VGMP management group and automatically perform the active-standby switchover?

hrp ospf-cost adjust-enable

hrp preempt delay 60

hrp interface GigabitEthernet 0/0/2

hrp auto-sync config

7. Which of the following description of the working process of network expansion is wrong?

After the network extension function is triggered, an SSL VPN tunnel needs to be established between the remote user and the virtual gateway.

The local PC of the remote user will automatically generate a virtual network card. The virtual gateway randomly selects an IP address from the address pool and assigns it to the virtual network card of the remote user.

After the remote user virtual network card obtains the private network IP address, the route to the intranet server needs to be manually configured to access intranet resources normally.

The remote user sends a service request packet to the server on the intranet. The packet flows through the SSL VPN tunnel to the virtual gateway.

8. In the IDC room, a Huawei USG6000 series firewall can be used to divide into several virtual systems, and then the root firewall administrator can generate virtual system administrators to manage each virtual system.

TRUE

FALSE

9. The two FWs are interconnected through IPSec. Execute display ike sa on FW_A. The result is as follows. Which of the following statements is correct? (Multiple choice)

FW_A is the initiator of IKE secure channel negotiation

FW_B is the initiator of IKE secure channel negotiation

SA between firewalls has been established successfully

SA between firewalls has not been established successfully

10. In dual-system hot backup, how many cycles does the Slave consider that the peer is faulty when it does not receive the HRP HELLO message sent by the peer?

Page 2 of 11

11. Which of the following resource allocation methods does Huawei USG6000 product resource allocation support? (Multiple choice)

Quota allocation

Automatic allocation

Manual distribution

Indefinite allocation

12. The networking of an enterprise is shown in the figure. Dual-system hot backup is configured on USG_A and USG_B, and USG_A is the master device. The administrator wants to configure SSL VPN on the firewall so that branch office employees can access the headquarters through SSL VPN. What should be the virtual gateway address of the SSL VPN?

202.38.10.2/24

202.38.10.3/24

202.38.10.1/24

10.100.10.2/24

13. GRE Over IPSec tunnel can realize the transmission of IPX packets.

TRUE

FALSE

14. Huawei UMA products can be deployed in a logical series connection. Which of the following statements regarding the logical mode of this deployment method is correct?

Logical mode: person -> slave account -> authorization -> master account -> target system.

Logical mode: person -> master account -> authorization -> slave account -> target system.

Logical mode: authorization -> slave account -> person -> master account -> target system.

Logical mode: target system -> slave account -> authorization -> master account -> person.

15. Global route selection means that when there are multiple equal-cost routes to the destination network, the Huawei USG6000 firewall can dynamically select the outgoing interface according to the link bandwidth, weight, priority set by the administrator or the automatically detected link quality to realize the reasonable utilization of link resources and improvement of user experience.

TRUE

FALSE

16. When the traffic is finally sent from the outgoing interface, it is limited by the bandwidth of the outgoing interface. If the traffic is greater than the bandwidth of the outgoing interface, which of the following will the traffic be queued to ensure that high-priority packets are sent first?

Remark DSCP priority

Forwarding Priority

Bandwidth Policy Matching Order

QoS

17. Regarding server load balancing, which of the following technologies can be used to sense changes in server status and ensure that user requests will not be sent to faulty servers?

VGMP Hello message

VRRP packets

DPD

Service Health Check

18. As shown in the figure, BFD is bound to a static route, and the administrator has made the following configuration on firewall A:

[USG6000_A] bfd

[USG6000_A-bfd] quit

[USG6000_A] bfd as bind peer-ip 1.1.1.2

[USG6000_A-bfd-session-aa] discriminator local 10

[USG6000_A-bfd-session-aa] discriminator remote 20

[USG6000_A-bfd-session-aa] commit

[USG6000_A-bfd-session-aa] quit

Which of the following statements about this configuration is true? (Multiple Choice)

The command "bfd as bind peer-ip 1.1.1.2" is used to create a BFD session binding policy for link status detection

The [USG6000_A] bfd configuration in this command is incorrect, it should be changed to [USG6000_A] bfd enable to enable the BFD function

[USG6000_A-bfd-session-aa] commit is an optional configuration. If not configured, the system will submit the configuration by default and generate BFD session log information, but will not create a session table

The command on the firewall also needs to bind the BFD session to the static route: [USG6000_A] ip route-static 0.0.0.0 0 1.1.1.2 track bfd-session aa

19. Use the web page to log in to the SSL VPN gateway, and it will automatically log out after a period of time. The possible reason is that the session of the VPN gateway has timed out.

TRUE

FALSE

20. Which of the following scenarios can achieve bandwidth multiplexing? (Multiple choice)

Multiple flows are matched to the same bandwidth policy, and bandwidth multiplexing can be achieved between multiple flows.

Multiple bandwidth policies refer to the bandwidth channel in the way of policy sharing, so that bandwidth multiplexing can be achieved among multiple flows that match the bandwidth policy.

Bandwidth multiplexing can be achieved between multiple flows that match multiple child policies in the parent-child policy.

Multiple bandwidth policies refer to the bandwidth channel in a policy-exclusive manner, and bandwidth multiplexing can be achieved among multiple flows that match the bandwidth policy.

Page 3 of 11

21. Which statements about virtual interfaces are correct? (Multiple choice)

The virtual interface may cause the protocol layer DOWN because the IP address is not configured.

The virtual interface must be added to the security zone to work.

The virtual interface may not be configured with an IP address.

A virtual interface is a logical interface for which an IP address needs to be configured.

22. To ensure that traffic transmission is not affected by server or link failures, the administrator has configured the health check of the link, but after the configuration is completed, it is found that the status of the health check is still Down. What are the possible reasons? (Multiple choice)

The TRUE end device has not released the corresponding protocol and port

The security policy does not allow traffic

The link for the health check fails

The health check is not called on the interface

23. Regarding the configuration commands in the intelligent routing below, which of the following are correct? (Multiple choice)

#

multi-interface

mode priority-of-link-quality

priority-of-link-quality parameter delay jitter loss

priority-of-link-quality protocol tcp-simple

add interface GigabitEthernet1/0/1

add interface GigabitEthernet1/0/2

The bandwidth-based load sharing method is used

The parameters of link quality detection are delay, jitter and packet loss rate

The TCP protocol used for detection

3 links are selected for load balancing

24. The following figure shows the application scenario of L2TP over IPSec. The client uses the pre-shared-key method for IPSec authentication. How should the IPSec security policy be configured on the LNS side? (Multiple choice)

Negotiate using IKE v1 main mode

Negotiate using IKE v2

Configure IPSec security policy

Configure IPSec Policy Template

25. What algorithm can session persistence be based on?

Least Connection algorithm

Source IP hash algorithm

Simple polling algorithm

Weighted Round Robin algorithm

26. In order to prevent applications such as Email and ERP from being affected during normal working hours, an enterprise hopes that the minimum bandwidth available for such traffic is not less than 60Mbps. Which of the following configuration meets the requirements?

time-range work_time period-range 09: 00: 00 to 18: 00: 00 working-day traffic-policy profile profile_email bandwidth guaranteed-bandwidth whole both 60000 rule name policy_email source-zone trust destination-zone untrust application app BT application app YouKu time-range work_time action qos profile profile_email

time-range work_time period-range 00: 00: 00 to 09: 00: 00 working-day traffic-policy profile profile_email bandwidth guaranteed-bandwidth whole both 60000 rule name policy_email source-zone trust destination-zone untrust application app LotusNotes application app OWA time-range work_time action qos profile profile_email

time-range work_time period-range 09: 00: 00 to 18: 00: 00 working-day traffic-policy profile profile_email bandwidth guaranteed-bandwidth whole both 60000 rule name policy_email source-zone trust destination-zone untrust application app LotusNotes application app OWA time-range work_time action qos profile profile_email

time-range work_time period-range 09: 00: 00 to 18: 00: 00 working-day traffic-policy profile profile_email bandwidth maximum-bandwidth whole both 60000 rule name policy_email source-zone trust destination-zone untrust application app LotusNotes application app OWA time-range work_time action qos profile profile_email

27. Which of the following information is included in the main mode negotiation process in the first phase of IKE v1 negotiation? (Multiple choice)

IKE Proposal Set

IPSec Proposal Set

DH key exchange public information

Identity information of both parties

28. Which of the following log categories does the firewall log, content log, policy hit log, mail filtering log, URL filtering log and audit log all belong to?

Session log

Packet Loss Log

Business log

System log

29. As shown in the figure below, the firewall GE0/0/0 interface is directly connected to the PC host through a network cable.

Which of the following commands can work together to complete the backup operation of the system configuration file vrpcfg.cfg? (Multiple choice)

Complete the following commands on the firewall: [USG] ftp server enable Info: Start FTP server [USG] aaa [USG-aaa] local-user ftpuser password simple Ftppass# [USG-aaa] local-user ftpuser service-type ftp [USG-aaa] local-user ftpuser ftp-directory hda1:/

Complete the following commands on the firewall: <USG> ftp 192.168.0.2 Trying 192.168.0.2 Press CTRL+K to abort Connected to 192.168.0.2. 220 FTP Server ready. User （ 192.168.0.2: （ none)): ftpuser 331 Password required for ftpuser. Password: 230 User ftpuser logged in. [ftp] get vrpcfg .cfg

Complete the following commands on the PC: C:Documents and SettingsAdministrator> ftp 192.168.0.1 Connected to 192.168.0.1. 220 FTP service ready. User （ 192.168.0.1: （ none)): ftpuser 331 Password required for ftpuser. Password: 230 User logged in. ftp> get vrpcfg.cfg

Complete the following commands on the PC: C:Documents and SettingsAdministrator> ftp 192.168.0.1 Connected to 192.168.0.1. 220 FFP service ready. User （ 192.168.0.1: （ none)): ftpuser 331 Password required for ftpuser. Password: 230 User logged in. ftp> put vrpcfg.cfg

30. Which of the following statements about IPsec is false?

In transport mode, ESP does not validate IP packet headers

AH can only verify data packets and cannot encrypt them

ESP can support NAT traversal

AH protocol uses 3DES algorithm for data authentication

Page 4 of 11

31. If using SSL VPN to provide file sharing function, all files under the shared directory are visible to end users.

Which of the following statements regarding the configuration of file share paths is correct?

The format of SMB type resource is: //IP address (hostname)/shared folder. The SMB type resource path can be a multi-level shared folder directory.

The format of NFS type resource is: //IP address (hostname)/dir1/dir2/shared folder. An NFS type resource path can only have a first-level shared folder directory.

Select SMB for file sharing resources under Windows system.

Select SMB for file sharing resources under Linux system.

32. Which of the descriptions of the virtual system is incorrect?

There are two types of virtual systems on the NGFW: root system and virtual system.

A special virtual system that exists by default on the NGFW is called the root system.

The logical devices that are divided and run independently on the NGFW are called virtual systems.

If the virtual system function is not enabled, the root system does not exist.

33. Which of the following devices can detect unknown malicious files transmitted in the network in a virtual environment?

eSight

LogCenter

FireHunter

WAF

34. Regarding the server load balancing technology, the commands executed on the firewall and the output obtained are as follows:

Which of the following statement is correct?

The load balancing policy enables the service health check function, and the detection packets used are TCP packets.

The load balancing policy uses a weighted round-robin algorithm.

The load balancing policy adopts the weighted least connection algorithm.

The real servers of the load balancing policy are all in the mandatory unavailable state.

35. After completing the configuration of intelligent routing, it is found that the traffic is not forwarded according to the configuration. What measures can the administrator take? (Multiple choices)

Reconfigure the intelligent routing strategy

Wait for the session table to age

Manually clear session table information through the command line reset firewall session table

Submit the configuration for it to take effect

36. When configuring the IPSec VPN certificate authentication method, if you choose the "RSA signature" authentication method, which of the following steps need to be configured? (Multiple choice)

Upload the CA certificate

Upload the local certificate

Upload the peer device certificate

Create a public-private key pair for the local device

37. When the BFD session state is "Init", which of the following statements is true?

The session has just been created

The local end wants to make the session enter the Up state

The session has been established successfully

The session is in an administrative Down state

38. Which of the following is the possible cause of the failure?

The route between the gateway and the intranet server is unreachable.

The user is not assigned to the resources of the web proxy.

The security policy does not allow traffic from the extranet to the intranet server.

The SSL VPN one-arm deployment is attached to the firewall. It is necessary to use NAT to map the private network address of the SSL VPN gateway to the public network address. The address mapping is incorrect.

39. IP-Link will send a detection packet to the specified IP address. By default, when the detection fails for 3 times, the link to this IP address is considered to be faulty.

TRUE

FALSE

40. Which of the following is not the purpose of bandwidth management?

Limit bandwidth

Guaranteed number of connections

Limit the number of connections

Guaranteed bandwidth

Page 5 of 11

41. Users use SSL VPN to access intranet resources, and use server authentication to authenticate users. In order to distinguish company users in different regions, different user domains are established for users in different regions. When a user uses SSL VPN for authentication, the authentication prompts that the password is incorrect.

Which of the following are the possible causes of this failure? (Multiple Choice)

The user entered the wrong username and password.

The user entered the username without entering the user domain.

The administrator has configured the wrong user domain.

Username and password do not exist.

42. Which of the following VPN encapsulation protocols do not provide encryption function? (Multiple choice)

ESP

L2TP

GRE

43. Use digital certificate for identity authentication in IPSec VPN. If IKE v1 main mode is used for negotiation, certificate verification is completed in message 5 and message 6.

TRUE

FALSE

44. The action no-qos in the bandwidth policy means that the traffic is not restricted.

TRUE

FALSE

45. When configuring L2TP Over IPSec graphically, select the IPSec point-to-point scenario for deployment.

TRUE

FALSE

46. In order to prevent the link from being overloaded and causing link congestion, the administrator can set the overload protection threshold on the interface. When the bandwidth usage of a link reaches the threshold, the traffic of the established session is still forwarded through this link, but the traffic of the subsequent newly established session is no longer forwarded through this link.

TRUE

FALSE

47. Regarding virtual service technology, which of the following statements are correct?

For multiple real servers, the real servers need to be in the same network segment and the same security zone

For multiple real servers, the real servers may not be in the same network segment, but must be in the same security zone

For multiple real servers, the real servers may not be in the same security zone, but must be in the same network segment

For multiple real servers, the network segment and security zone where the real servers are located will not affect the load balancing function

48. When creating a virtual system, a VPN instance with the same name will be automatically generated.

And the system will automatically create a logical interface for it. Which value does the logical interface number start from?

49. Which of the following commands are not commonly used in IPSec troubleshooting?

display ipsec statistics

display ipsec session

display ike sa

display ipsec sa

50. Regarding the authentication method adopted by the SSL VPN virtual gateway, which of the following descriptions is false?

Local authentication means that the username and password of the SSL VPN user are stored locally on the firewall, and user authentication is completed on the firewall.

Server authentication means that the username and password of the SSL VPN user are stored on the remote server, and user authentication needs to be completed on the server.

Certificate anonymous authentication means that the firewall verifies the user's identity only by verifying the validity of the client certificate and password.

Certificate challenge authentication refers to the combination of validating client certificates with local or server authentication.

Page 6 of 11

51. The virtual system instance bound by ip binding vpn-instance vpn-instance name under the interface is generated with the creation of the virtual system.

TRUE

FALSE

52. Which of the following are limiting elements of bandwidth management? (Multiple choice)

Number of connections

Bandwidth

P2P protocol data flow limit

1M protocol data flow limit

53. Which statement about bandwidth limitations is false?

The public network interface refers to the interface connecting the Huawei USG6000 to the Internet.

Inbound traffic refers to the traffic flowing from the public network interface to the private network interface. Limited by the bandwidth in the inbound direction.

Outbound traffic refers to the traffic flowing from the private network interface to the public network interface. Limited by outbound bandwidth.

All traffic of the virtual system = inbound traffic + outbound traffic + traffic from private network interface to private network interface + traffic from public network interface to public network interface.

54. An IPSec tunnel can use GRE over IPSec to transmit multicast packets.

TRUE

FALSE

55. A server health detection mechanism is enabled on the USG firewall of an enterprise to detect the running status of the three real servers (Server A, Server B, and Server C) in the backend. When the USG fails to receive a response from Server B for many times When sending packets, the use of Server e will be prohibited and the traffic will be distributed to other servers according to the configured policy.

TRUE

FALSE

56. When dual-system hot backup is deployed on Huawei USG6000 series devices, which of the following status information will not be backed up by the firewall by default? (Multiple choice)

IPSec Tunnel and Sequence Number

Sessions to the firewall itself

Port mapping table in PAT mode

TCP semi-connected session without 3-way handshake

57. Which of the following statements about interface bandwidth is correct?

When the traffic enters the interface, the traffic that exceeds the predefined interface bandwidth is discarded

When the traffic exits the interface, the interface bandwidth is used to mark the priority of the traffic, which is used as the basis for subsequent queue scheduling.

Limited by the bandwidth of the inbound interface, if the traffic is larger than the bandwidth of the inbound interface, the traffic will be queued according to the re-marking DSCP priority set in the bandwidth channel to ensure that high-priority packets are sent first.

Limited by the bandwidth of the inbound interface, if the traffic is larger than the bandwidth of the inbound interface, the traffic will be queued according to the forwarding priority set in the bandwidth channel to ensure that high-priority packets are sent first.

58. Load balancing realizes the function of distributing user traffic accessing the same IP address to different servers. What are the main technologies used? (Multiple choice)

Virtual service technology

Server Health Check

Dual-machine hot-standby technology

Load Balancing Algorithm

59. An enterprise has deployed the LogCenter log event management system, which of the following requirements can be used to meet? (Multiple choice)

NAT traceability

Report Analysis

Smart Configuration

Wireless broadband cluster equipment management

60. After the link-group is configured on the device, enter the display link-group 1 command, and the following information is displayed:

<USG> display link-group 1

link group 1, total 2, fault 0

GigabitEthernet0/0/1: invalid

GigabitEthernet0/0/2: fault

What conclusions can be drawn from this? (Multiple choice)

GigabitEthernet0/0/2 interface fails

GigabitEthernet0/0/1 interface fails

GigabitEthernet0/0/2 is forcibly converted to the fault state due to the failure of other interfaces in the group

GigabitEthernet0/0/1 is forcibly converted to the fault state due to the failure of other interfaces in the group

Page 7 of 11

61. Which of the following log categories do all the threat logs, content logs, policy hit logs, mail filtering logs, URL filtering logs, and audit logs output by the firewall belong to?

Session log

Packet Loss Log

Business log

System log

62. In dual-system hot backup, the backup channel must be the main interface on the interface board. Which type is not supported?

Ethernet

GigabitEthernet

vlan-if

63. Regarding server load balancing technology, which of the following is correct? (Multiple choice)

The IP address of the real server can be the same as the IP address of the virtual firewall.

After configuring the server load balancing function, you need to configure the IP address of the virtual server when configuring the interzone security policy. When configuring routing, you need to configure the IP address of the real server.

After configuring the service health check function, you need to configure the security policy between the FW and the security zone where the real server is located to allow probe packets to pass, otherwise the health check will fail.

The IP address of the real server cannot be the same as the IP address of the virtual firewall.

64. Regarding the description of IKE, which of the following is correct? (Multiple choice)

IKE is a protocol carried by UDP and is the signaling protocol of IPSec

IKE negotiates SAs for IPSec, and passes the established parameters and SAs to IPSec

IPSec uses the SA negotiated by IKE to encrypt or authenticate packets

IPSec must use IKE for key exchange

65. Which of the following is part of the quota distribution? (Multiple choice)

SSL VPN Virtual Gateway

Safe Area

Interface

vlan

66. Regarding the matching order of the bandwidth policy, which of the following is correct? (Multiple choice)

Match according to the ID number from small to large

Match from top to bottom according to the arrangement order on the interface

For multi-level policies, traffic matches the child policy first, and then matches the parent policy

For multi-level policies, traffic matches the parent policy first, and then matches the child policy

67. Regarding the IKE DPD statement, which of the following is false?

Used for IKE neighbor state detection.

DPD packets are sent regularly between IKE peers.

Periodic detection mode of DPD: If the current time since the last IPSec packet received from the peer end exceeds the DPD idle time, the local end will actively send a DPD request message to the peer end.

The on-demand detection mode of DPD only sends a query before sending encrypted packets and when the last received IPSec packet from the peer has exceeded the idle time of DP

68. There is the following bandwidth policy configuration command on Huawei USG6000 products:

[USG] traffic-policy

[USG-policy-traffic] profile class1

[USG-policy-traffic-profile-class1] bandwidth maximum-bandwidth whole both 1000

[USG-policy-traffic-profile-class1] quit

[USG-policy-traffic] rule name policy1

[USG-policy-traffic-rule-policy1] source-zone trust

[USG-policy-traffic-rule-policy1] destination-zone untrust

[USG-policy-traffic-rule-policy1] source-address 192.168.1.0 mask 255.255.255.0

[USG-policy-traffic-rule-policy1] destination-address 192.168.2.0 mask 255.255.255.0

[USG-policy-traffic-rule-policy1] action cos profile class1

Which of the following statements is true? (Multiple Choice)

Class1 defines the overall current limit, and the current limit is 1000kbps

The traffic matching Policy1 is released directly without current limiting

The data flow of the host of 192.168.1.0/24 accessing 192.168.2.0/24 will be limited

Traffic matching Policy1 will perform traffic control on each source IP

69. Each bandwidth policy that references a bandwidth channel is independently constrained by the bandwidth channel, that is, the traffic that meets the matching conditions of the bandwidth policy exclusively enjoys the maximum bandwidth resources.

Which of the following options belongs to the way this bandwidth channel is referenced?

Bandwidth multiplexing

Dynamic Average

Policy Sharing

Strategic Exclusivity

70. In an Eth-Trunk interface, traffic load balancing can be achieved by configuring different weights on each member link.

TRUE

FALSE

Page 8 of 11

71. What are the load balancing algorithms supported by Huawei USG6000 firewall? (Multiple Choice)

Source IP hash algorithm

Simple Polling Algorithm

Weighted Round Robin Algorithm

Ratio

72. A large enterprise has three departments, marketing department, R&D department and sales department. Each business department has its own internal resources. The company hopes that when employees of each department use SSL VPN to access intranet resources, they can provide different services according to their needs. How to solve this problem when employees in a department are assigned different access rights to resources and are isolated from each other?

Assign different roles to employees in different departments.

Solve the problem through the single-arm networking of the firewall.

Through the firewall dual-arm networking solution.

Create multiple virtual gateways on the firewall, and each business department independently uses its own virtual gateway to provide SSL VPN access services to the outside world.

73. After enabling the intelligent routing session hold function, when an intelligent routing interface goes down, all the traffic of the interface will be forwarded on other intelligent routing interfaces. What will happen when the interface is up again?

The interface cannot forward traffic

The traffic on this interface increases very slowly

The interface cannot participate in intelligent routing

The physical status of the interface is UP, and the protocol status is error-down. It needs to be manually added to intelligent routing.

74. An enterprise branch and the headquarters want to transmit multicast packets. As shown in the figure, FW_B is the gateway of the branch, and the FW_B is used to establish an IPSec VPN with the headquarters (using pre-shared key authentication). Which of the following parts need to configure on FW_B? (Multiple choice)

Configure routing and set the next hop of traffic that needs to be transmitted through the GRE over IPSec tunnel to 12.1.1.1/24

Apply the IPSec security framework on the GRE Tunnel interface

Configure the security policy and refer to the rule as permit: 192.168.0.0/24->Internet data flow

Configure routing and set the next hop of traffic that needs to be transmitted through the GRE over IPSec tunnel to the tunnel interface address

75. Web Link is relatively high in security and applicability due to encryption and adaptation.

TRUE

FALSE

76. In order to ensure the normal forwarding of large business traffic, the network administrator of a company uses two firewalls to implement dual-system hot backup. As shown in the figure, after the configuration is completed, it is found that when firewall A fails, the data stream being transmitted before the failure suffers severe packet loss, but the newly transmitted data stream can work normally after the failure.

What are the possible reasons for this phenomenon?

The HRP preemption time configured on the firewall is less than the OSPF convergence time

The function of adjusting the COST value of OSPF based on HRP status is not configured

The fast session backup function is not configured on the USG, and packets cannot be forwarded normally when the round-trip paths are inconsistent.

HRP track is not enabled on the upstream and downstream interfaces of the firewall

77. For the SVN single-arm networking scenario, which of the following descriptions is correct? (Multiple choice)

In the single-arm networking mode, the SVN arm is mounted on the firewall, router or switch, and both the intranet and the Internet communicate with the SVN through this network port.

In order for users to access the SVN device, the IP address of the SVN must be the IP address of the public network.

The nat server needs to be configured on the firewall to map the SVN address to a public IP of the firewall.

The port number that needs to be mapped to SVN on the firewall is 445.

78. Health check can send detection packets of corresponding protocols according to different types of destination devices. Which of the following are included in the protocol packets supported by the firewall? (Multiple choice)

ICMP

TCP

UDP

SSH

79. Which statements about virtual system administrators are correct? (Multiple choice)

After the virtual system function is enabled, the existing administrator on the device will become the administrator of the root system.

After the virtual system is created, the root system administrator can create one or more administrators for the virtual system.

The virtual system administrator can enter the configuration interface of the root system to configure and view services.

The format of the virtual system administrator username is unified as "administrator name@virtual system name".

80. When users use the port forwarding function, they cannot access intranet resources. Which of the following is not the possible cause of the failure?

Port forwarding is not enabled.

Whether the user connection times out.

The security policy does not allow traffic.

Whether the virtual IP address is obtained on the virtual network card of the user P

Page 9 of 11

81. Huawei Any Office provides an effective balancing solution for the contradiction between the personal needs of corporate employees and compliance with corporate policies. What is the problem that mobile security and management essentially solves? (Multiple choice)

Data non-disclosure (Privacy)

Integrity

Identity and device identification (Identity)

Device can be managed (Compliance)

82. In the route selection method based on link priority, if overload protection is not enabled, what will happen when the link of the primary link is congested?

The backup link is automatically enabled to share traffic.

The traffic is distributed to the backup link according to the default overload protection threshold.

The backup link is not enabled, and the primary link continues to forward traffic.

Active and standby links share traffic according to the link priority ratio.

83. There is the following bandwidth policy configuration command on Huawei USG6000 products:

[USG] traffic-policy

[USG-policy-traffic] profile class1

[USG-policy-traffic-profile-class1] bandwidth maximum-bandwidth whole both 1000

[USG-policy-traffic-profile-class1] bandwidth connection-limit whole both 20

[USG-policy-traffic-profile-class1] quit

[USG-policy-traffic] rule name policy1

[USG-policy-traffic-rule-policy1] source-zone untrust

[USG-policy-traffic-rule-policy1] destination-zone dmz

[USG-policy-traffic-rule-policy1] destination-address 10.10.10.0 mask 255.255.255.0

[USG-policy-traffic-rule-policy1] action cos profile class1

[USG-policy-traffic-rule-policy1] quit

[USG-policy-traffic] rule name policy2

[USG-policy-traffic-rule-policy2] source -zo ne dmz

[USG-policy-traffic-rule-policy2] destination-zone untrust

[USG-policy-traffic-rule-policy2] destination-address 10.10.10.5 mask 255.255.255.255

[USG-policy-traffic-rule-policy2] action no-qos

Which of the following statements is true? (Multiple Choice)

When accessing the host whose destination address is 10.10.10.5, the number of connections will be limited

Access to the host whose destination address is 10.10.10.5 will not be restricted by the bandwidth policy

When accessing the destination network segment 10.10.10.0/24, it will be limited by the maximum number of connections of 20

When accessing the destination network segment 10.10.10.0/24, it will not be limited by the maximum number of connections of 20

84. Regarding the configuration of the firewall interface binding to the VPN instance, which of the following is correct?

ip binding vpn-instance vpn-id

ip binding vpn-instance vpn-instance-name

ip binding vpn-id

ip binding vpn-id vpn-instance-name

85. Which of the following is the way to divert the virtual system? (Multiple choice)

The interface works at Layer 2 and uses interface-based offloading.

The interface works at Layer 2 and uses vlan-based offloading

The interface works at Layer 3 and uses routing-based offloading.

The interface works at Layer 3 and uses interface-based offloading.

86. Which of the following encryption methods does IPsec VPN use to encrypt the communication data flow?

Public key encryption

Private key encryption

Symmetric Key Encryption

Pre-Shared Key Encryption

87. The USGA and USGB are configured with static BFD sessions. Which of the following statements is correct about the process of establishing and tearing down BFD sessions? (Multiple Choice)

USG A and USG B each start the BFD state machine. The initial state is Down, and they send BFD packets in the Down state. The value of Your Discriminator is 0.

After the local BFD state of USG 0 is Init, if it continues to receive packets in the Down state, it will reprocess and update its local state.

After USG B receives the BFD packet in the Init state, the local state switches to Up.

After the state transition of "DOWN => INIT" occurs between USG A and USG B, a timeout timer is started. If the timer expires and no BFD packets in the Init or Up state are received, the local state automatically switches back to Down.

88. Regarding the Radius protocol, which of the following statements is correct? (Multiple choice)

Use UDP protocol to transmit Radius packets

The authentication and authorization port number can be 1812

When using the Radius protocol to transmit the user account and password, the account should be encrypted

The authentication and authorization port number can be 1645

89. Using HRP technology, all configuration information of the standby firewall can be synchronized by the main firewall through HRP without any configuration, and the configuration information will not be lost after restarting.

True

False

90. Based on the configuration information of the ISP routing on the following firewall, which of the following options are correct? (Multiple choice)

A total of 2 csv files are configured.

There are two ISP routing files.

The china-unicom.csv file is bound to two outgoing interfaces on the firewall.

Both outgoing interfaces of china-unicom.csv have routes delivered in the routing table.

Page 10 of 11

91. There is a fixed management interface GigabitEthernet 0/0/0 on the main panel of Huawei USG6300 firewall, which is used for device management.

True

False

92. Which of the following statements is true about IKE v1 main mode and aggressive mode?

All negotiation packets in the first phase of aggressive mode are encrypted

All negotiation packets in the first phase in main mode are encrypted

Aggressive mode uses DH algorithm

Whether the negotiation is successful or not, it will enter the fast mode

93. After the dual-system hot backup of the firewall is configured, on the web configuration interface, choose "System > High Reliability > Dual-system Hot Backup", and click the "Check" button corresponding to "Check HRP Configuration Consistency". A window as shown in the figure pops up. Which of the following configurations can solve the problem (assuming that the heartbeat interface has been added to the DMZ area)?

security-policy rule name trust_local source-zone trust local destination-zone trust local action permit

security-policy rule name trust_dmz source-zone trust dmz destination-zone trust dmz action permit

security-policy rule name untrust_dmz source-zone untrust dmz destination-zone untrust dmz action permit

security-policy rule name local_dmz source-zone local dmz destination-zone local dmz action permit

94. As shown in the figure, remote users use Web proxy to access intranet resources, which of the following options is wrong for Web proxy analysis? (Multiple choices)

The web proxy in the figure is implemented by web link.

To implement the Web proxy function, the remote user must first establish an HTTPS session with the FW virtual gateway.

After the remote user establishes the HTTP session with the FW virtual gateway, establishes the HTTPS session with the Web Server.

The implementation of the web link has an encryption function, so it can ensure that remote users can securely access intranet resources.

95. In the networking environment of dual-system hot backup and IP-Link linkage (as shown in the figure below), in the configuration of the active firewall, which of the following is the key configuration to realize the linkage between IP-Link and dual-system hot backup?

hrp mirror IP-Link 1

hrp track IP-Link 1

hrp track IP-Link 1 enable

IP-Link check enable

96. In the system view of the USG, you need to delete the sslconfig.cfg file in the hda1:/ directory. Which of the following commands can complete this operation?

cd: hda1:/ remove sslconfig.cfg

cd: hda1:/ delete sslconfig.cfg

cd: hda1:/ rmdir sslconfig.cfg

cd: hda1:/ mkdir sslconfig.cfg

97. Divide the overall maximum bandwidth by the number of online IP to obtain the maximum bandwidth per IP. Which of the following options is part of this bandwidth allocation?

Bandwidth reuse

Dynamic Average

Policy Sharing

Strategic Exclusivity

98. If the firewall works at Layer 2 and is directly connected to the intranet or connected through a Layer 2 switch, which of the following options cannot be used as a matching condition for policy routing?

IP address

MAC address

Incoming interface

DSCP priority

99. In IPSec VPN, which of the following message information does not exist?

AH header

AH packet trailer

ESP header

ESP packet trailer

100. When IPSec VPN uses digital certificate for authentication, which of the following is not required to verify whether the digital certificate is legal?

Certificate Signing

CRL certificate serial number

Certificate public key

Certificate Validity Period

Page 11 of 11

101. For the services supported by SSL VPN, which of the following descriptions is correct? (Multiple choice)

Web proxy service realizes clientless page access. An HTTP session is established between the remote user and the firewall virtual gateway, and then the firewall virtual gateway establishes an HTTPS session with the Web Server.

The file sharing service provides users with access to the shared resources of different system servers in the form of web pages.

Port forwarding is to achieve access to specified resources on the intranet by obtaining UDP packets with the specified destination IP address and port on the client.

Network extension service The remote client will automatically install a virtual network card to obtain a virtual IP address, and can use various services just like in a local area network, and can freely access any intranet resources.

102. The above information indicates that the USG forces the real server to be in an unhealthy state, and the real server 4.4.4.4 is currently in an unhealthy state.

True

False

103. When configuring the time for the IP-Link group to send detection packets, the larger the interval value is, the more the load on the device CPU can be reduced, but the sensitivity of link detection is reduced.

True

False

104. Which of the following states indicates that the BFD session has been successfully established?

Down

Init

Admin Up

105. The USG6000 firewall is configured with the load balancing function for the three FTP servers. The addresses and weights of the three real servers respectively are 10.1.1.3/24 (weight 16), 10.1.1.4/24 (weight 32), and 10.1.1.5/24 (weight 16), the virtual server address is 202.152.26.123/24. A PC that host address is 202.152.26.3/24 initiates access to the FTF server. Run the display firewall session table command on the firewall. Which of the following conditions indicates that the negative balancing function has been successfully implemented?

<USG> display firewall session table Current total sessions: 1 ftp VPN: public --> public 202.152.26.3:3327 --> 10.1.1.4:21

<USG> display firewall session table Current total sessions: 3 ftp VPN: public --> public 202.152.26.3:3327 -->202.152.26.123:21 [10.1.1.3:21] ftp VPN: public --> public 202.152.26.3:3327 -->202.152.26.123:21 [10.1.1.4:21] ftp VPN: public --> public 202.152.26.3:3327 -->202.152.26.123:21 [10.1.1.5:21]

<USG> display firewall session table Current total sessions: 1 ftp VPN: public --> public 202.152.26.3:3327 -->202.152.26.123:21

<USG> display firewall session table Current total sessions: 3 ftp VPN: public --> public 202.152.26.3:3327 -->10.1.1.3:21 ftp VPN: public --> public 202.152.26.3:3327 -->10.1.1.4:21 ftp VPN: public --> public 202.152.26.3:3327 -->10.1.1.5:21

Huawei HCIP-Security H12-721_V3.0 Exam Questions

Huawei HCIP-Security H12-721_V3.0 Exam Questions

Share this post

Leave a Reply Cancel reply

Related Posts