H12-723_V3.0 HCIP-Security Exam Actual Questions

dumps2022-06-20T02:52:48+08:00

H12-723_V3.0 exam is also one of the required tests for HCIP-Security Certification. I collected Huawei H12-723_V3.0 exam information for you to study. In the real Huawei H12-723_V3.0 exam, there are 60 questions, and you have 90 minutes to take it. The required passing score for the Huawei Certification H12-723_V3.0 exam is 600. The exam cost is $160. The available languages are English and Chinese. Our Huawei H12-723_V3.0 exam actual questions are good material. Free HCIP-Security H12-723_V3.0 exam actual questions are below.

Page 1 of 11

1. Which of the following options describe the 802.1X access process correctly? (Multiple Choice)

During the whole authentication process, the terminal exchanges information with the server through EAP packets.

The terminal and the 802.1X switch exchange EAP packets, and the 802.1X switch and the server use Radius packets to exchange information.

802.1X authentication does not require security policy checking.

Use the MD5 algorithm to verify the information.

2. The products and systems provided by BYOD solutions cover many fields such as terminal, network, security, application, and management, including: serialized BYOD equipment, wireless network system, network access security, VPN gateway, terminal security client software, Authentication system, mobile device management (MDM), mobile eSpace UC, etc.

True

False

3. The terminal automatically connects to the enterprise Wi-Fi.

1-2-3-4

4-2-3-1

3-2-1-4

2-3-1-4

4. The CA receives the certificate registration request message from the PKI entity.

1-3-5-4-2-6-7-8

1-3-5-6-7-4-8-2

1-3-2-7-6-4-5-8

1-3-2-4-8-6-5-7

5. Regarding the use of user isolation technology in a WLAN networking environment, which of the following statements is false?

User isolation between groups means that users in different groups cannot communicate, but internal users in the same group can communicate

Isolation within a user group means that users within the same group cannot communicate with each other

The user isolation function means that the Layer 2 packets between all wireless users associated with the same AP cannot be forwarded to each other

Intra-group isolation and inter-group isolation cannot be used at the same time

6. When using local guest account authentication, Portal authentication is usually used to push the authentication page to the guest.

Before user authentication, when the admission control device receives the HTTP request sent by the user for a resource other than the Portal server authentication URL, how does the admission control device handle it?

Discard packets

The URL address redirects to the Portal authentication page

Direct release

Send the authentication information to the authentication server

7. The administrator issues notices to users in the form of announcements, such as the latest software and patch installation notices, etc. Which of the following options for announcements is false?

Announcements can be issued by department.

Terminals must have a proxy client installed to receive announcements.

If the system issues an announcement and the proxy client is not online, it will not receive the announcement information after going online in the future.

Announcements can be issued by account.

8. When managing guest accounts, you need to create a guest account policy and set the account creation method. For the account creation method, which of the following descriptions is wrong?

When adding accounts individually, you can choose to create them individually.

If there are many users, you can choose to create them in batches.

If the number of users is relatively large, you can choose database synchronization.

In order to facilitate management and improve user experience, self-registration can be used.

9. In the WLAN network with the WIDS function enabled, which of the following statements are correct regarding the determination of illegal devices? (Multiple Choice)

All Ad-hoc devices will be directly judged as illegal devices

APs not connected to this AC are illegal APs

STAs not accessed by this AC are illegal STAs

It is not the STA that the AC accesses, and it is necessary to check whether the access AP is legal.

10. When deploying wired 802.1X authentication, if the admission control device is deployed at the aggregation layer, this deployment method has the characteristics of high security performance, many management devices, and complex management.

True

False

Page 2 of 11

11. Which of the following options is correct for describing the effect of each role in the Portal authentication system?

The client is Any Office software.

The role of the Portal server is to receive client authentication requests, provide free portal services and authentication interfaces, and exchange client authentication information with the access device.

The role of the RADIUS server is to redirect all HTTP requests from users in the authentication network segment to the Portal server.

The role of the admission control device is to complete user authentication, authorization and accounting.

12. Which of the following options are correct for the description of MAC authentication and MAC bypass authentication? (Multiple Choice)

MAC authentication is an authentication method that controls users' network access rights based on interfaces and MAC addresses. It does not require users to install any client software.

MAC bypass authentication first performs 802.1X authentication on the access authentication device. If the device does not respond to 802.1X authentication, MAC authentication is used to verify the legitimacy of the device.

During the MAC authentication process, the user needs to manually enter the username or password.

During the MAC bypass authentication process, the MAC address is not used as the username and password to automatically access the network.

13. Regarding the deployment scenarios of hardware SACG certification, which of the following descriptions are correct? (Multiple Choice)

SACG authentication is generally used in the scenarios where a stable network is used for wired access control.

SACG authentication is generally used in the scenario of wireless admission control of a new network.

SACG is generally deployed in a bypass mode without changing the original network topology.

SACG essentially controls access users through 802.1X technology.

14. It is difficult for a single traditional network strategy to cope with the current complex situations such as user diversification, location diversification, terminal diversification, application diversification, and insecure experience.

True

False

15. A network uses Portal authentication, and the user finds that there is no place to enter the username/password in the pushed Web page when accessing.

This failure may be caused by which of the following reasons?

There is no corresponding user on Agile Controller-Campus.

The switch AAA configuration is incorrect.

The switch does not enable the Portal function.

Push page error on Portal server.

16. In an agile network, users may need to access servers such as DNS, DHCP, and Portal before authentication. When the traffic of the user accessing the server passes through the firewall, the firewall queries the Agile controller-campus server for information about the agile security group corresponding to the traffic. Since the user has not passed the authentication at this time, the Agile controller-campus server will inform the firewall that the user belongs to the "Unknown Agile Security Group (Unknown)", which will cause the user's traffic to match the "Unknown Agile Security Group (Unknown)" before the firewall refreshes the user's identity.

As a result, the correct permissions cannot be obtained immediately after the user authentication is passed. How to solve this problem?

Turn off state detection on the F

Configure TSM on the F

Set up the security front domain. When an unauthenticated user accesses the server in the pre-security domain, the FW directly forwards the traffic.

Allow traffic to the server on the F

17. Mobile smartphone and tablet users establish an IPSec encrypted tunnel with AE through the Any Office client. After passing the authentication and compliance check, they can access the enterprise business.

True

False

18. Typical application scenarios of terminal security include: desktop management, illegal outreach and computer peripheral management.

True

False

19. The standard 802.1X client that comes with the Web client and the operating system only has the function of identity authentication, and does not support the execution of inspection-type policies and monitoring-type policies. Any Office client supports all inspection-type policies and monitoring-type policies.

True

False

20. MAC authentication means that in the 802.1X authentication environment, when the terminal does not respond to the 802.1X authentication request from the access control device after accessing the network, the access control device automatically obtains the terminal's MAC address and sends it as a credential for accessing the network to the RADIUS server for verification.

True

False

Page 3 of 11

21. When allocating various services according to the user group, account and terminal IP address range, if the same service (except the announcement service) is allocated to the user group, account and terminal IP address range, the business assigned to the highest priority will take effect.

Which of the following is true about the order of priority?

Account > User Group > Terminal IP Address Range

Terminal IP Address Range > Account > User Group

Account > Terminal IP Address Range > User Group

User Group > Terminal IP Address Range > Account

22. The multi-level defense system is mainly reflected in the network level and the system level. Which of the following options are used for the security defense at the network level? (Multiple Choice)

Software SACG

Hardware SACG

802.1X switch

Authentication Server

23. Site refers to the terminal environment when the end user uses the AC-Campus to access the controlled network for office work.

Which of the following options is correct about the site?

Different sites can have different security policies.

LSite has nothing to do with safety.

There can only be one site within the company.

site and location have nothing to do with it.

24. Identity authentication determines whether to allow access by identifying the identity of the access device or user.

True

False

25. For the description of the account blacklist, which of the following options is incorrect?

The automatic account lockout and manual account lockout functions cannot be enabled at the same time.

For automatic account lockout, within a limited time, the account will be automatically locked if the number of incorrect passwords entered by the end user during authentication exceeds the limit.

For a manually locked account, the administrator needs to manually add the account to the list of locked accounts.

If the manually locked account is deleted from the list, the lock of the account will be released.

26. All components of Agile Controller-Campus support Windows system and Linux system.

True

False

27. Free Mobility determines access rights and QoS policies according to the 5W1H conditions of user access. For 5W1H, which of the following descriptions are correct? (Multiple Choice)

Who, determine the ownership of the access device (company standard, BYOD, etc.)

Whose, determine the identity of the access person (employee, visitor, etc.).

How, determine the access method (wired, wireless, etc.).

What, determine the access device (PC, iOS, etc.)

28. Which of the following network security threats exist only in WLAN networks?

Brute-force cracking

Pan-squeeze attack

DoS Denial of Service Attack

Weak IV attack

29. After the user is authenticated successfully, which of the following actions can be performed on the user on the Agile Controller-Campus? (Multiple Choice)

Provide remote assistance to users who use Any Office access.

Force users to go offline.

Audit the user's online and offline records.

Deactivate/disable and assign roles to mobile certificate accounts.

30. In Portal authentication, which of the following parameters must be configured on the switch? (Multiple Choice)

Portal server IP

Portal page URL

shared-key

Portal protocol version

Page 4 of 11

31. The terminal uses Portal authentication to access the network, but cannot jump to the authentication page. The possible reasons do not include which of the following options?

The Portal authentication parameters configured on the Agile Controller-Campus are inconsistent with the access control device.

The authentication port number configured in the Portal template of the access device is 50100, which is the default on the Agile Controller-Campus.

SC does not start.

When the page is customized, the preset template is used.

32. Which of the following options describes the SACG launch process incorrectly?

The communication between the terminal and the Agile Controller-Campus server adopts SSL encryption

Authentication fails, end users can only access resources in the domain before authentication

If the security check is passed, the Agile Controller-Campus server notifies SACG to switch the IP address of the end user to the isolation domain

The message from the Agile Controller-Campus server to the SACG carries the domain parameters

33. The traditional access authority control strategy is implemented through ACI or VLAN, which cannot be decoupled from the IP address, and the maintenance workload is heavy when the IP address changes. The agile network can achieve decoupling from IP addresses because of the introduction of the concept of security groups.

True

False

34. When using the test-aaa command on the access control device to test the connectivity with the Radius server, the running result shows a timeout, which may be caused by incorrect account or password configuration.

True

False

35. When the Agile Controller-Campus acts as a RADIUS server for authentication, what ports need to be configured for authentication on the admission control device?

1812

1813

8443

8080

36. Which of the following options is not a challenge posed by mobile office?

The mobile office platform is safe, reliable and quick to go online.

Users can access the network safely and quickly.

Unified management of terminals and refined control.

Deployment of Network Gateways.

37. In the Windows environment, after the Agile Controller-Campus is successfully installed, how to manually start the Management Center (MC)? (Multiple Choices)

Double-click the "Start Server" shortcut on the desktop to start it.

Choose Start > All Programs > Huawei > MCServer > Start Server.

Choose Start > All Programs > Huawei > Agile Controller > Server Startup Config to manually start the required components.

Choose Start > All Programs > Huawei > MCServer > Server Startup Config to manually start the required components.

38. When configuring the antivirus software policy, if you set the "Violation Level of Antivirus Software Required for Not Installed or Not Running" to "Normal", and check the "Prohibit access to the network if serious violations occur" option.

When a user uses Any office for authentication and the authentication is passed, but the security check shows that the anti-virus software is not enabled, can the user access the network?

Can access the network and access network resources.

Can not access the network.

The network can be accessed, but it needs to be repaired before accessing network resources.

Can access the network, but requires re-authentication to access network resources.

39. Which of the following methods can be used for enterprise terminal security to be protected?

Admission Control

Encrypted Access

Business isolation

Audit Billing

40. Which of the following options is the main function of the SC component in Agile Controller-Campus?

As the management center of the Agile Controller-Campus, it is responsible for formulating the overall strategy.

As the management interface of Agile Controller-Campus, configure and monitor the system.

It is integrated with standard RADIUS server, Porta server, etc., responsible for linking with network access devices to implement user-based network access control policies.

As the security defense server of Agile Controller-Campus, it is responsible for analyzing and calculating the security events reported by iRadar.

Page 5 of 11

41. Import the user information of the AD server on the Agile Controller-Campus to implement user access authentication. If the user does not find the user information on the Agile Controller-Campus, which of the following actions will be performed next?

Return the authentication failure information directly.

Discard user information.

Send the user's information to the AD server for verification.

Synchronize the database again.

42. VIP experience guarantee, which two aspects are mainly used to guarantee the experience of VIP users? (Multiple Choice)

Bandwidth

Forwarding Priority

Permissions

Strategy

43. Which of the following options is not included in the user access authentication technology?

Authentication

Isolation Repair

Security Check

Admission Control

44. In the WLAN wireless access scenario, which of the following network security technologies belong to user access security? (Multiple Choice)

AP Certification

Link Authentication

User Access Authentication

Data encryption

45. Regarding the authentication process using LDAP accounts, which of the following descriptions are correct? (Multiple Choice)

If the account has been synchronized to the Agile Controller-Campus, verify the account on the Agile Controller-Campus. If the account exists, send the password corresponding to the account to the AD/LDAP server for verification. After the password verification is passed, it returns to the Agile Controller-Campus to authorize the user according to the configured authorization rules.

The account has been synchronized to the Agile Controller-Campus, and the Agile Controller-Campus will continue to send the account to AD/LDAP for verification. If the account exists on the AD/LDAP server, the Agile Controller-Campus sends the password corresponding to the account to the AD/LDAP server for verification. After the verification is successful, the authentication passes.

If the Agile Controller-campus authentication account does not exist, continue to send the account to AD/LDAP for authentication. If the account exists on the AD/LDAP server, incrementally synchronize the account to the Agile Controller-Campus. After the synchronization is successful, the Agile Controller-Campus sends the password corresponding to the account to the AD/DAP server for verification. After the verification is successful, the authentication passes.

If the Agile Controller-Campus verifies that the account exists, verify the account on the Agile Controller-Campus. If the account does not exist, send the account to AD/LDAP to verify the password. After the password verification is passed, return to the Agile Controller-Campus to authorize the user according to the configured authorization rules.

46. MAC bypass authentication means that after the terminal connects to the network, the access control device automatically obtains the terminal's MAC address, and sends it to the RADIUS server for verification as a credential for accessing the network.

True

False

47. After the account assigned by the administrator to the guest is connected to the network, the audit action that the administrator can perform on the guest does not include which of the following options?

Visitor online and offline records

Force users to log off

Account deactivation/reset password

Send a warning message to the user

48. In a company's visitor reception hall, there are a large number of terminal users temporarily accessing the Internet. The administrator hopes that users can access the Internet without providing any account and password.

Which of the following authentication methods can be used to access?

Local account authentication

Anonymous Authentication

AD account authentication

MAC authentication

49. The Agile Controller-Campus system includes four parts: Management Center (MC), Service Manager (SM), Service Controller (SC) and Client, and Network Access Device (NAD) as part of the solution is linked with the service controller implement user-based access control and free mobility.

True

False

50. Regarding the application scenarios of Agile Controller-Campus centralized deployment and distributed deployment, which of the following options are correct? (Multiple Choice)

If most end users work in one area and a few end users work in branch offices, centralized deployment is recommended.

If most end users work in one area and a few end users work in branch offices, distributed deployment is recommended.

If end users work in different regions, a distributed deployment solution is recommended.

If end users work in different regions, a centralized deployment solution is recommended.

Page 6 of 11

51. Security authentication mainly implements security inspection of access users through security policies, terminal host security management is mainly implemented by inspection policies, and end user behavior management is mainly implemented by monitoring policies. If users need to formulate policies according to their own wishes, they can be used custom strategy.

True

False

52. During Portal authentication, after entering the account and password authentication through the web browser, it will prompt "Authenticating...", and the status will last for a long time, and then it will show that the authentication is successful.

Which of the following might cause this phenomenon?

Multiple Agile Controller servers have added the same terminal IP address to the Portal "Access Terminal IP Address List" at the same time, and some Agile Controller servers and terminals cannot communicate normally.

The Portal template is configured with an incorrect password.

There are too many authorization rules on the Agile Controller-Campus, and it takes a lot of time to find them.

The belt curtain of the terminal equipment is insufficient, resulting in a relatively large delay.

53. In a WLAN network, intra-group isolation and inter-group isolation can be used simultaneously.

True

False

54. In the Agile Controller-Campus solution, which device is usually used as the hardware SACG?

Router

Switch

Firewall

IPS

55. When a visitor needs to access the network through an account, which of the following methods can be used to access? (Multiple Choice)

Create a new account

Use existing social media accounts

No authentication, no account required

Scan the public QR code

56. Which of the following options is correct about the Portal gateway access process?

The Portal gateway initiates a Radius Challenge request message, including the username and password information

The ACL delivered by the server to the access gateway is carried in Portal protocol packets

Issue policies while performing identity authentication

The Portal server needs to pass the security check result to the access gateway device

57. In the comprehensive defense system of terminal security, the use of PPT-PDCA model can effectively achieve terminal security defense. Which of the following options does not belong to the PPT model?

Technology

Process c. Organization

Planning

58. The traditional campus network is based on IP as the core network. If there are mobile office users, which of the following options is not a problem faced by mobile office users when deploying access authentication?

The user distribution range is large, and the admission control requirements are high.

Access control policy deployment workload is heavy.

Access rights are difficult to control.

Inconsistent user experience.

59. Which of the following options is not included in the mobile terminal life cycle?

Get

Deployment c. Run

Uninstall

60. During the process of establishing a CAPWAP tunnel between the AP and the AC, the AP negotiates with the AC to establish a CAPWAP tunnel. In this process, the CAPWAP tunnel uses DTLS to encrypt and transmit UDP packets.

What are the encryption methods supported by DTLS? (Multiple Choice)

Certificate encryption

AES encryption

PSK encryption

Plaintext encryption

Page 7 of 11

61. Which of the following options is not included in the authentication technology that can be used when performing terminal access control?

802.1X authentication

SACG authentication

Bypass Authentication

Portal Authentication

62. There are three roles in XMPP protocol: server, gateway and client. Corresponding to the free mobility solution, the Agile Controller-Campus serves as the server, the Huawei USG6000 series firewall serves as the gateway, and the agile switch serves as the client.

True

False

63. In order to increase the security of the AP, the AP that will go online can be authenticated on the AC.

What are the authentication methods currently supported by Huawei AC? (Multiple Choice)

MAC authentication

Password Authentication

Not certified

SN authentication

64. Portal page push rules have priorities, and rules with higher priorities are first matched with the user's authentication information. If the configured rules do not match, the default rules are used.

True

False

65. The following is the 802.1X access control switch configuration:

[S5720]dot1x authentication-method eap

[S5720-GigabitEthernet0/0/1] port link-type access

[S5720-GigabitEthernet0/0/1] port default vlan 11

[S5720-GigabitEthernet0/0/1] authentication dot1x

Assuming that GE0/0/1 is connected to user 1 and user 2 through the HUB, which of the following options is correct?

After user 1 is authenticated, user 2 can access network resources without authentication.

User 1 and User 2 must be authenticated separately before they can access network resources.

GE0/0/1 do not need to enable dot1X

Neither user 1 nor user 2 can pass authentication and access network resources.

66. Using the Agile Controller-Campus for guest management, users can obtain the applied account in various ways, but which of the following methods is not included?

SMS

E-mail

Web Printing

Voicemail

67. Jailbroken mobile terminals, mobile terminals with non-compliant applications installed, or terminals with non-compliant lock screen passwords, etc., are insecure for enterprises to access the corporate network for office work. How about the Any Office mobile office system fixing the problem?

Directly discard data sent by non-compliant devices.

Certification of non-compliant equipment.

Check the terminals that do not comply with the regulations, and prohibit unsafe devices from accessing the network.

Send alarm information and notify the administrator to deal with it.

68. For the convenience of visitors, different authentication and registration pages can be pushed for different visitors. Different matching conditions need to be limited when configuring the push page strategy. Which of the following options can be used as limited matching conditions? (Multiple Choice)

The IP address of the terminal

Location information of the access device

Priority of Guest Accounts

SSID of the access network

69. In terminal security management, the black and white list mode is used to check the installation of terminal host software. Which of the following situations are compliant?

The terminal host does not have the software in the whitelist installed, nor the software in the blacklist.

The terminal host installs all the software in the white list, but does not install the software in the black list.

Some software in the whitelist is installed on the terminal host, but the software in the blacklist is not installed.

The terminal host installs all the software in the whitelist, and installs some software in the blacklist.

70. The terminal host access control function does not take effect. The following is the viewing information on SACG:

<FW> display right-manager role-id rule

Advanced ACL 3099 ， 5 rules ， not bingding with vpn-instance

Ad's step is 1

rule 1000 permit ip (1280 times matched)

rule 1001 permit ip destination 172.18.11.2210 (581 times matched)

rule 1002 permit ip destination 172.18.11.223 0 (77 times matched)

rule 1003 permit ip destination 172.19.0.0 0.0.255.255 (355 书 times matched)

rule 1004 deny ip (507759 times matched)

Which of the following statements is correct?

172.18.11.221 is the server for the isolated domain.

Open the escape route.

172.18.11.223 is the post domain server.

End-host traffic is blocked by the default AC

Page 8 of 11

71. Which of the following devices is suitable for using MAC authentication to access the network?

Windows system host for office use

Linux system host for testing

Mobile clients, such as smartphones, etc.

Network Printer

72. For hardware SACC access control, if the terminal can access the post-authentication domain resources without passing the authentication, which of the following may cause this phenomenon? (Multiple Choices)

Authentication traffic is filtered by SAC

No hardware SACG device is added to the TSM system.

SACG enables default interzone packet filtering.

Misconfigured privileged I

73. If a common account is used for authentication, which of the following options is incorrect?

Users can use Any Office for authentication.

Users cannot use the web method for authentication.

Users can use Web Agent for authentication.

Users can authenticate through the built-in 802.1X client.

74. Regarding uninstalling Agile Controller-Campus in Windows system and Linux system, which of the following descriptions is correct?

Use an ordinary account to execute sh uninstall.sh in the Agile Controller/Uninstall directory to start the uninstaller.

Use the root account to execute sh uninstall.sh in the Agile Controller directory to start the uninstaller.

On the Windows platform, choose Start > All Programs > Huawei > Agile Controller > Server Startup config.

On the Windows platform, choose Start > All Programs > Huawei > Agile Controller > Uninstall.

75. In enterprises with strict terminal host access control management, administrators hope to bind terminal hosts and accounts to prevent terminal users from accessing the controlled network from unauthorized terminal hosts at will.

Which of the following is true about the description of binding end hosts and accounts?

When Any Office logs in with an account for the first time, the terminal host is automatically bound to the current account, but the automatic binding process requires administrator approval.

When other accounts need to be authenticated on the bound terminal host, they do not need to seek authorization from the person in charge of the asset that was bound for the first time.

Binding the terminal host and account is only applicable to the scenario where the terminal user is authenticated through the Any Office, and not applicable to the scenario where the authentication is performed through the Web Agent plug-in and the Web client.

There is only one terminal host to which the account is bound, which cannot be configured by the administrator.

76. Regarding the way SACG equipment is connected to the network, which of the following options are correct? (Multiple Choice)

SACG equipment is required to communicate with the terminal at Layer 2.

The SACG is usually attached to the core switch device and uses policy routing to divert traffic.

SACG supports side-hook on non-Huawei devices.

SACG devices are required to communicate with the Agile Controller-Campus at Layer 2.

77. Regarding the description of software SACG and hardware SACG, which of the following is correct?

Hardware SACG uses Any Office for admission control.

Software SACG uses Any Office for admission control.

Hardware SACG saves cost than software SAC

Hardware SACG is more secure.

78. Secure Email is the killer application provided by Any Office solution for enterprise office OA. It provides powerful email business capabilities and rich email strategies.

Which of the following descriptions are correct about secure mail? (Multiple Choice)

Through the mail client, you can connect to the Notes or Exchange mail system.

Support automatic encryption of mail transmission, and the transmission encryption method supports a full range of IPSec/TLS protocols.

Online browsing of attached documents is not supported.

Support standard protocols such as IMAP4/SMTP/EAS to send and receive emails, and support real-time email push.

79. The user accesses the network through the network access device, and the third-party RADIUS server authenticates and authorizes the user.

Which of the following options is incorrect about the certification process?

Configure RADIUS authentication and accounting on the RADIUS server.

Configure the Agile Controller-Campus for local data source authentication, receive packets sent by the device, and perform authentication.

Configure RADIUS authentication and accounting on the device side.

Configure RADIUS authentication and authorization on the Agile Controller-Campus.

80. The use of the 802.1X authentication scheme generally requires the terminal to install specific client software.

What are the options for large-scale deployment of client software? (Multiple Choices)

Enable the Guest VLAN so that users can obtain the installation package in the Guest VLA

Configure the Free-rule and web push functions on the switch to push the installation package to users.

Copy the installation package to each other through the U disk.

Installed by the administrator for each user.

Page 9 of 11

81. For the scenario where the authentication server is deployed in a distributed manner, which of the following descriptions are correct? (Multiple Choice)

The enterprise network is relatively scattered, there are multiple branches, and the user scale of the branch is relatively large.

There are less than 2,000 branch users and the headquarters and branch networks are relatively stable.

The terminal security management business between the branch and the headquarters is relatively independent, and the headquarters provides supervision and advice on the terminal security management business of the branch.

It is difficult to guarantee the network quality between the branch and the headquarters, and the network between the headquarters and the branch may be interrupted, making it impossible for the terminals of the branch to connect to the headquarters data center.

82. Regarding the description of the security domain in Agile Controller-Campus, which of the following options are correct? (Multiple Choice)

The user domain is generally composed of various terminal users. The terminals in this area are characterized by a large number, wide distribution, and strong flow.

The business domain is a platform for carrying business traffic. According to the needs of the enterprise, the business is logically divided by security technology, so as to realize the security of the network.

The network domain is the security protection area that all kinds of enterprises are most concerned about, and it carries the important and core information assets of the enterprise.

The service domain is the area that provides security services for the enterprise intranet. This area is generally composed of systems that provide security services such as antivirus servers, patch management servers, and terminal security servers.

83. In WPA2, the security of WPA2 is better than that of WPA because of the adoption of a more secure encryption technology - TKIP/MIC.

True

False

84. In 84.802.1X authentication, if the authentication point is on the switch at the aggregation layer, in addition to the conventional configurations such as RADIUS, AAA, and 802.1X, what special configurations are required?

Both the aggregation layer and the access layer switches need to enable the 802.1X function.

The access layer switch needs to configure transparent transmission of 802.1X packets.

The aggregation layer switch needs to be configured with transparent transmission of 802.1X packets.

No special configuration is required.

85. There are two ways for the business manager to download patches. When using hierarchical deployment, you can download patches directly from Microsoft's patch server; when using non-hierarchical deployment, you can download patches through the management center or directly through Microsoft's patch server downloads the patch.

True

False

86. There are two types of accounts on the Agile Controller-Campus: one is a local account and the other is an external account.

Which of the following is not a local account?

Ordinary account

Guest Accounts

Anonymous account

Mobile certificate account

87. Regarding the method and type of authentication, which of the following descriptions is correct?

Users can support local authentication and digital certificate authentication through the web method.

Users can support two types of authentications: digital certificate authentication and system authentication through web agent.

Users can support local authentication, digital certificate authentication and system authentication through the agent mode.

Users can support two authentication types: digital certificate authentication and local authentication through web agent.

88. Security domain division refers to dividing the intranet into several logical areas with appropriate granularity based on the type of intranet services and security requirements in order to better ensure the security of the intranet.

Which of the following options is not part of a security domain in Agile Controller-Campus?

User Domain

Network Domain

Business Domain

Attack Domain

89. Regarding patch management and Windows patch checking strategy, which of the following statements is false?

Both the patch management and Windows patch checking policies can check whether the specified Windows operating system patch has been installed on the terminal host.

The Windows patch check policy focuses on checking whether the terminal host has installed the Windows operating system patches.

When the specified Windows operating system patch is not installed on the terminal host, the terminal host is prohibited from accessing the controlled network according to the Windows patch check policy.

Patch management focuses on checking whether the specified patch is installed on the terminal host, and performing access control on the terminal host.

90. In the Agile Controller-Campus admission control technology framework, which of the following options is correct regarding the description of RADIUS?

PADIUS is used to transfer username, password and other information between the client and the 802.1X switch.

PADIUS is used to transfer username, password and other information between the 802.1X switch and the AAA server.

PADIUS is used by the Portal server to push Web pages to users.

PADIUS is used by the server to deliver security policies to SACG devices.

Page 10 of 11

91. Which of the following options belongs to the application scenario of MAC-first Portal authentication?

The user uses the Portal page for authentication.

Users follow WeChat for authentication.

The user authenticates using the NAC client.

When a user authenticates using Portal for the first time, the RADIUS server caches the MAC address used by the terminal. If the terminal goes offline and then goes online again within the cached validity period, the RADIUS server directly searches the cache for the terminal's MAC address for authentication.

92. A network uses 802.1X to authenticate access users, and the admission control device is deployed at the aggregation layer. After the deployment is complete, the test-aaa command is used on the admission control device to test successfully, but the user cannot access the network.

Which of the following may be the cause of the failure? (Multiple Choice)

The aggregation layer device is not configured with a RADIUS authentication template.

The switch is not added to the Agile Controller-Campus as a NAS device.

The port on the access device does not have the 802.1X function enabled.

Layer 2 links are used between the access device and the aggregation device, and the 802.1X transparent transmission function is not enabled.

93. View the policy delivered by the Agile Controller-Campus server on the switch, as follows:

<SW>display acl all

Total nonempty ACL number is 3

Advanced ACL Auto PGM_OPEN_POLICY_3999 ， 0 rule

Acl's step is 5

Ucl-group ACL Auto_PGM_U2 9996 ， 1 rule

Acl's step is 5

rule 1 permit ip source ucl-group name Common_user destination ucl-group name Mail Server (match-counter 0)

Ucl-group ACL Auto_PGM_U1 9997 ， 2 rules

Acl's step is 5

rule 1 permit ip source ucl-group name VIP destination ucl-group name Mail_Server (match-counter 0)

rule 2 permit ip source ucl-group name VIP destination ucl-group name Internet_WWW (match-counter 0)

Ucl-group ACL Auto_PGM 9998 ， 1 rule

Acl's step is 5

rule 1 deny ip source ucl-group 0 (match-counter 0)

Lid-group ACL Auto_PGM_PREFER_POLICY 9999 ， 0 rule

Acl's step is 5

For this strategy, which of the following options are correct? (Multiple Choice)

Users of Common_user can access the resources of Internet_WW

VIP users can access the resources of Internet_WW

VIP can access the resources of Mail_Server.

Common_user users can access Mail_Server resources.

94. An enterprise uses hardware SACG access for admission control. The configuration command is as follows, where Key: Admin@123

[USG] right-manager server-group

[USG-rightm] local ip 10.1.10.2

[USG-rightm] server ip 10.1.31.78 shared-key Adnln@123

[USG2100-rightm] right-manager server-group enable

Assuming all other configurations are correct, which of the following options is correct only based on the above configuration?

After the configuration is complete, the SACG can be successfully linked with the Agile Controller-Campus.

After the configuration is complete, the SACG cannot be successfully linked with the Agile Controller-Campus.

The pre-authentication domain ACL can be issued.

The linkage fails but the terminal can access the pre-authentication domain server.

95. Regarding the definition of WIPS/WIDS, which of the following statements is correct?

WIDS is a wireless intrusion prevention system

WIPS is Wireless Intrusion Detection System

WIDS is a Wireless Intrusion Control System

WIPS is a Wireless Intrusion Prevention System

96. Deploy the Agile Controller-Campus on the Windows platform and use the SQL Server database.

Which of the following descriptions are correct about the HA function of Agile Controller-Campus? (Multiple Choice)

When the management center MC is deployed, HA is supported, and HA active/standby switchover based on the Keepalived technology is provided.

When the Service Manager SM is deployed, it supports HA and provides HA active/standby switchover based on the Keepalived technology.

When deploying the service controller SC, it supports HA and provides a backup solution in the resource pool mode. N+1 SCs need to be deployed.

When deploying the database DB, HA is supported, and the SQL Server database mirroring technology is used. It is necessary to deploy the main DB+mirror DB+witness D

97. There is a Layer 3 forwarding device between the authentication client and the admission control device. If the Layer 3 authentication mode of Portal authentication is used, the device can also obtain the MAC address of the authentication client, so the IP address and MAC address can be used as Information that identifies the user.

TRUE

FALSE

98. Which of the following options is correct for the description of the business mobility logic architecture?

The business management plane focuses on administrators, authentication servers, and policy servers.

The points of concern on the network device plane include user terminals and static resources.

User plane concerns include authentication points and policy enforcement points.

Business Free Mobility logical architecture includes management subsystem, authentication and authorization subsystem and business policy subsystem.

99. Which of the following options is correct for the isolation scope scope description?

The isolation domain refers to the area that the terminal host can access before passing the identity authentication, such as the area where the DNS server, external authentication source, service controller (SC), and service manager (SM) are located.

Quarantine domain refers to the area that is allowed to access when the end user has passed the identity authentication but not the security authentication, such as the area where the patch server and virus database server are located.

Isolation domain refers to the area that end users can access after passing the identity authentication and security authentication, such as the area where the ERP system, financial system, and database system are located.

End users can access the quarantine domain with or without authentication

100. Visitor management can authorize visitors based on visitor account, time, location, terminal type, and access method, and can also push personalized pages to visitors based on time, location, and terminal type.

TRUE

FALSE

Page 11 of 11

101. Which of the following options is correct for the description of visitor management? (Multiple choice)

Guest registered account can be configured without approval

Guest login can only be configured as a web page

Anonymous account authentication cannot be performed on the visitor authentication page

The guest account approval information can be notified to the guest via SMS

102. How to check whether the MC service has been started?

Check whether the TMCServer service is started in the Task Manager.

Check whether the TMCServerDaemon service is started in the task manager.

Check whether the TMCServer and TMCServerDaemon services are started in the task manager.

On the server, choose Start > All Programs > Huawei > Agile Controller > Server Controller, and check whether the MC status is Running.

103. Which of the following options is not supported by Free Mobility?

Intranet users access the data center/Internet.

When traveling users access intranet resources, the traveling users access the intranet through VP

Team work together.

Realize mutual communication between devices.

104. When using the test-aaa command on the access control device to test the connectivity with the Radius server, the operation result shows success, but the user cannot access normally. The possible reason does not include which of the following options?

The access layer switch does not enable the EAP transparent transmission function.

In the wireless 802.1X scenario, the access control device is not configured with a security profile.

In the AD authentication scenario, the service controller is not added to the AD domain.

The user account or password is incorrectly configured.

H12-723_V3.0 HCIP-Security Exam Actual Questions

H12-723_V3.0 HCIP-Security Exam Actual Questions

Share this post

Leave a Reply Cancel reply

Related Posts