HCIA-Security V4.0 H12-711_V4.0-ENU Exam Questions

dumps2023-11-13T09:09:58+08:00

H12-711_V4.0 exam is the new one for Huawei HCIA-Security v4.0 certification. There are 60 questions in the real Huawei H12-711_V4.0 exam, and you have 90 minutes to finish the questions. The required passing score for the Huawei H12-711_V4.0 exam is 600. The available languages are Chinese and English. We have cracked the latest Huawei HCIA-Security V4.0 H12-711_V4.0-ENU exam questions, which are valuable in your preparation. Free Huawei H12-711_V4.0-ENU exam questions are below.

Page 1 of 28

1. Which of the following does not belong to Layer 2 VPN?

L2F

PPTP

L2TP

IPsec

2. When deploying dual-machine hot backup on the firewall, which of the following protocols needs to be used to achieve overall status switching of the VRRP backup group?

VRRP

VGMP

HRP

OSPF

3. In inter-domain packet filtering, which of the following applies to the Inboud direction?

Untrust>Trust

Local>Trust

DME>Untrust

Local>DNZ

4. Which of the following statements is correct regarding IPsec SA?

IPsec SA is one-way

IPsec SA is bidirectional

Used to generate encryption keys

Used to generate secret algorithms

5. After enabling the GRE keepalive function, by default, the device will periodically send keepalive messages to the peer every how many seconds?

6. Regarding the description of the preemption function of VGMP management, which of the following is incorrect?

By default, the preemption function of the VGMP management group is enabled.

By default, the preemption delay time of the VGMP management group is 40s.

Preemption means that when the original failed master device recovers, its priority will be restored. At this time, its status can be preempted as the master again.

When the VRRP backup group is added to the VGMP management group, the original preemption function on the VRRP backup group becomes invalid.

7. In the USG series firewall, you can use which of the following function to provide well-known application services for non-well-known ports?

Port mapping

MAC and IP address binding

Packet filtering

Long connection

8. Regarding the anti-virus response method of the firewall gateway for the HTTP protocol, which of the following statements is incorrect?

When the gateway device blocks the HTTP connection, it pushes the web page to the client and generates logs.

Response methods include announcement and blocking

In the alarm mode, the device only generates logs and sends them out without processing the files transmitted by the HTTP protocol.

Blocking means that the device disconnects from the HTTP server and blocks file transfers

9. Which of the following options is not a hashing algorithm?

MD5

SHA1

SM1

SHA2

10. Which of the following protocols cannot be encrypted by SSL VPN?

HTTP

UDP

PPP

Page 2 of 28

11. The intrusion prevention system is based on which of the following for attack identification?

Port number

Agreement

IP address

Feature library

12. Which of the following statements about VPNs is false?

Virtual private networks are less expensive than dedicated lines

VPN technology must involve encryption technology

VPN technology is a technology that multiplexes logical channels on actual physical lines.

The emergence of VPN technology allows employees on business trips to remotely access internal corporate servers

13. Which of the following technologies can hide the internal network of a private network while preventing external attacks on internal servers?

IP spoofing

NAT _

VRRP

Address filtering

14. Regarding Internet user management, which of the following is incorrect?

Each user group can include multiple users and user groups

Each user group can belong to multiple parent user groups

The system has a default user group by default, which is also the system's default authentication domain.

Each user belongs to at least one user group and can also belong to multiple user groups.

15. Which of the following does not include the steps of the security assessment method?

Manual audit

Penetration testing

Questionnaire survey

Data analysis

16. Regarding the description of an intrusion detection system, which of the following is incorrect?

The intrusion detection system can dynamically collect a large amount of key information through the network and computer, and can analyze and judge the current status of the entire system environment in a timely manner.

Once the intrusion detection system discovers behavior that violates security policies or there are traces of the system being attacked, it can implement blocking operations.

Intrusion detection system includes all software and hardware systems used for intrusion detection

The intrusion detection system can be linked with firewalls and switches to become a powerful "assistant" of the firewall to better and more accurately control traffic access between domains.

17. Regarding security policy configuration commands, which of the following is correct?

It is forbidden to access the ICMP packets from the trust zone to the untrust zone and the destination address is the 10.1.10.10 host.

Prohibit access from the trust zone to all host ICMP messages in the untrust zone with the destination address 10.1.0.0/16 network segment

Forbid all host ICMP messages from the trust zone to access the untrust zone and whose source address is the 10.1.0.0/16 network segment.

Prohibit access from the trust zone to all host ICMP messages from the untrust zone with the source address 10.2.10.10.

18. As shown in the figure, in transmission mode, which of the following positions should the AH Header be inserted into?

19. In Huawei SDSec solution, which layer of equipment does the firewall belong to?

Analysis layer

Control layer

Execution layer

Monitoring layer

20. Check the HRP status information of the firewall as follows:

HRP S [USG_B] display hrp stateBbs.hh010.com The firewall's config state is: StandbyCurrent state of virtual routers configured as standby: GigabitEthernet1/0/0 vrid 1: standbyGigabitEthernet1/0/1Vrid 2: standby

Based on the above information, which of the following descriptions is correct:

The status of this firewall VGMP group is Active

The VRRP group status of the G1/0/0 and G1/0/1 interfaces of this firewall is standby.

The HRP heartbeat interfaces of this firewall are G1/0/0 and G1/0/1

This firewall must be in preemption state

Page 3 of 28

21. Regarding the comparison between windows and linux, which of the following statements is incorrect?

It is difficult for newbies to get started with Linux and they need some learning and guidance.

Windows can be compatible with most software and play most games.

Linux is open source, you can do whatever you want

Windows is open source, you can do whatever you want

22. Which of the following protocols does not belong to the protocol type that ASPF can detect?

MSTP

FTP

DNS

PPTP

23. Compared with traditional five-tuple information, which of the following elements is a new element of next-generation firewall?

Destination address

Source port

Application

Agreement number

24. Which of the following is true regarding firewall security policies?

By default, security policies can control unicast messages and broadcast messages.

By default, security policies can control multicast

By default, the security policy only controls unicast packets.

By default, security policies can control unicast packets, broadcast packets and multicast packets.

25. Which of the following attacks is not a malformed packet attack?

Teardrop attack

Smurf attack

TCP fragmentation attack

ICMP unreachable message attack

26. Which of the following descriptions of the VGMP protocol is incorrect?

VGMP adds multiple VRRP backup groups on the same firewall to a management group, and the management group manages all VRRP backup groups uniformly.

VGMP ensures that the status of all VRRP backup groups in the management group is consistent by uniformly controlling the status switching of each VRRP backup group.

The VGMP group device in the Active status will regularly send hello messages to the peer. The stdandby end is only responsible for monitoring hello messages and will not respond.

By default, when the standby end does not receive a hello message from the peer end within three hello message cycles, it will consider that the peer end is faulty and switch itself to the Active state.

27. Regarding NAT configuration, which of the following is incorrect?

Configure source NAT in transparent mode. The firewall does not support easy-ip mode.

The IP address in the address pool can overlap with the public IP address of the NAT server.

When there is VoIP service in the network, there is no need to configure NAT AL

The firewall does not support NAPT conversion of ESP and AH packets.

28. Regarding the difference between packet filtering firewalls and application proxy firewalls, which of the following descriptions is incorrect?

Applying proxy firewall can speed up intranet users' access to commonly used websites.

Packet filtering firewalls are usually implemented below the transport layer, and application proxy firewalls are usually implemented above the session layer.

Application layer proxy firewall can provide user authentication.

Packet filtering firewalls do not have data forwarding capabilities and must be deployed in conjunction with routers.

29. Regarding the description of vulnerability scanning, which of the following is incorrect?

Vulnerability scanning is a network-based technology that remotely monitors the security performance vulnerabilities of a target network or host. It can be used to conduct simulated attack experiments and security audits.

Vulnerability scanning is used to detect whether there are vulnerabilities in the target host system. Generally, it scans the target host for specific vulnerabilities.

Vulnerability scanning is a passive prevention measure that can effectively avoid hacker attacks.

Vulnerability scanning can be performed based on the results of ping scan and port scan

30. In which of the following stages does the L2TP protocol allocate IP addresses?

Link establishment phase

LCP Negotiation Phase

CHAP stage

NCP negotiation stage

Page 4 of 28

31. Which of the following descriptions about the VGMP group is correct?

The priority of VRRP in the VGMP group will change as VGMP changes.

VGMP is a protocol used to control the status of VRRP groups

The default priority of USG6000 is 65000

The default priority of USG9000 is 45000

32. How many bits are the keys used by DES encryption technology, and how many bits are used by 3DES encryption technology.

56168

64168

64128

56128

33. Which of the following does not include the trigger authentication method for firewall access user authentication?

MPLS VPN

SSL VPN

IPsec VPN

L2TP VPN

34. Regarding Windows logs, which of the following descriptions is incorrect?

System logs are used to record events generated by operating system components, mainly including crashes and data of drivers, system components and application software.

The system log of windows server 2008 is stored in Application.evtx

Application logs contain events recorded by applications or system programs, mainly recording events related to program operation.

The security log of windows server 2008 is stored in security.evtx

35. Which of the following is not a stand-alone anti-virus technology?

Configure anti-virus technology on the network firewall

Use virus detection tools

Patch the system

36. There are various security threats during the use of the server.

Which of the following options is not a server security threat?

Natural disaster

DDos attack

Hacker attack

Malicious programs

37. Which of the following descriptions of common hashing algorithms is incorrect?

Hashing algorithms can transform inputs of any length into fixed-length outputs.

SHA-1 has faster calculation speed and higher security than the MD5 algorithm.

The SM3 algorithm is a domestic encryption algorithm. It is used for digital signature and verification, message authentication code generation and verification, and random number generation in cryptographic applications. It can meet the security needs of a variety of cryptographic applications.

SHA-2 is an enhanced version of SHA-1, and its security performance is much higher than SHA-1

38. In IPsec VPN transmission mode, which part of the data packet is encrypted?

Network layer and upper layer data messages

Original IP header

New IP header

Transport layer and upper layer data messages

39. Which of the following is an "information destruction incident" in the classification of network security incidents?

Software and hardware failure

Information counterfeiting

Network scanning plagiarism

Listen to Trojan attacks

40. Which of the following options is not an identifier of IPsec SA?

SPI

Destination address

Source address

Security Protocol

Page 5 of 28

41. Regarding NAT technology, which of the following descriptions is correct?

The internal server of the NAT network cannot be accessed by external network users, so if you deploy a server that needs to provide external services, you must assign an independent public network address to the server.

NAT reduces the difficulty of network monitoring

NAT technology can only achieve one-to-one address conversion and cannot achieve address reuse.

NAT can hide the intranet IP address

42. Which of the following is the difference between Network Address Port Translation (NAPT) and Network Address Only Translation (No-PAT)?

After No-PAT conversion, for external network users, all packets come from the same IP address.

No-PAT only supports protocol port conversion at the transport layer

NAPT only supports protocol address translation at the network layer

No-PAT supports protocol address translation at the network layer

43. Which of the following is not a symmetric encryption algorithm?

IDEA

RSA

AES

3DES

44. Which of the following descriptions of HWTACACS protocol features is incorrect?

Use UDP protocol

Separation of authentication and authorization

In addition to the standard HWTACACS message header, the entire message body is encrypted.

Suitable for security control.

45. When deploying IPsec VPN tunnel mode, use the AH protocol for packet encapsulation.

In the new IP packet header field, which of the following parameters does not require data integrity check?

Source IP address

Destination IP address

TTL

Identification

46. Data analysis technology is to find and match keywords or key phrases in the acquired data stream or information stream, and analyze the correlation of time.

Which of the following is not an evidence analysis technique?

Password deciphering, data decryption technology

Document digital summary analysis technology

Techniques for discovering connections between different pieces of evidence

Spam tracking technology

47. Regarding SSL VPN technology, which of the following statements is incorrect?

SSL VPN technology can be perfectly suitable for NAT traversal scenarios

The encryption of SSL VPN technology only takes effect on the application layer

SSL VPN requires a dial-up client

SSL VPN technology expands the network scope of enterprises

48. Usually we divide servers into two categories: general servers and functional servers. Which of the following options meets this classification standard?

Divided by application level

Classification by purpose

Divide by appearance

Divided by architecture

49. When IPsec VPN uses transport mode to encapsulate packets, which of the following is not within the certification scope of the ESP security protocol?

ESP Header

IP Header

ESP Iail

ICP Header

50. Which of the following descriptions of digital fingerprints in digital signatures is incorrect?

The receiver needs to use the sender's public key to decrypt the digital signature and obtain the digital fingerprint.

It is the data obtained by the sender after calculating the plaintext information through the HASH algorithm.

The receiver will use the sender's public key to calculate the generated data fingerprint and compare it with the received digital fingerprint.

Digital fingerprint is also called information summary.

Page 6 of 28

51. Which of the following is the username/password for the first login of the USG series firewall?

Username admin Password Admin@123

User name admin password admin@123

User name admin Password admin

User name admin Password Admin123

52. Which of the following is not an asymmetric encryption algorithm?

MD5

DSA _

RSA

53. What is the port number of the SMTP protocol?

109

54. Which of the following options does not belong to the log type of the Windows operating system?

Business log

Application logs

Security log

System log

55. Which of the following is not part of the digital certificate?

Public key

Private key

Validity period

Issuer

56. Regarding NAT technology, which of the following descriptions is incorrect?

In Huawei firewalls, source NAT technology refers to translating the source address in the IP header of the connection initiated.

In Huawei firewall, Easy IP directly uses the public network address of the interface as the translated address, and there is no need to configure a NAT address pool.

In Huawei firewall, NAT No-PAT technology needs to be implemented by configuring a NAT address pool.

In Huawei firewall, the only NAT technology with port translation is NAP

57. Which of the following configurations can implement the NAT ALG function?

nat alg protocol

alg protocol

nat protocol

detect protocol

58. Bank A is a rural commercial bank that mainly provides financial services to users such as residents and rural industrial and commercial households within the jurisdiction of this province.

Currently, Bank A’s network needs to undergo a Class A Guarantee Assessment. Which of the following Class A Guarantee ratings is applicable to Bank A?

Level 3 guaranteed level

Level 1 equal protection

Class 4 security protection and above

Level 2 equal protection

59. In the TCP/IP protocol stack, which of the following protocols works at the application layer?

ICMP

IGMP

RIP

ARP

60. Which of the following information is not included in the backup content of status information backup in dual-system hot backup?

NAPI related entries

lPv4 session table

IPSEC tunnel

Routing table

Page 7 of 28

61. Which of the following attacks is not a special message attack?

ICMP redirect message attack

ICMP unreachable message attack

IP address scanning attack

Oversized ICMP message attack

62. The attacker sends a SYN message with the same source address and destination address, or the source address is a loopback address, to the target host (the source port and destination port are the same), causing the attacker to send a SYN-ACK message to its own address.

What kind of attack does this behavior belong to?

SYN flood attack

TCP spoofing attack

Smurf attack

Land attack

63. Which of the following is not the default security zone of the firewall?

Untrust Zone

DMZ Zone

Trust Zone

ISP Zone

64. As shown in the figure, there are two Server Map entries generated after configuring NAT Server. Regarding the information presented in the figure, which of the following descriptions is incorrect?

*Type: Nat Server. ANY→1.1.1.1[192.168.1.1] Type: Nat Server Reverse. 192.168.1.1[1.1.1.1] →ANY

The second Server Map function is that when 192.168.1.1 accesses any address, the source address will be converted to 1.1.1.1 after passing through the firewall.

The function of the first Server Map is that when any address accesses 192.168.1.1, the destination IP will be converted to 1.1.1.1 after passing through the firewall.

The Server Map with the Reverse logo can be deleted using the command.

These two Server Map entries are static, that is, after the NAT Server is configured, the two Server Maps will be automatically generated and will exist permanently.

65. Which of the following options belongs to Layer 2 VPN technology?

SSL VPN

L2TP VPN

GRE VPN

IPsec VPN

66. The administrator connects to the firewall through the G1/0/0 interface (the interface has been added to the Trust zone). If the administrator is allowed to log in to the firewall through G1/0/0 for configuration management, how should the administrator configure the traffic allowed in the security policy? direction?

Allow traffic from Trust Zone to Untrust Zone

Allow traffic from Trust Zone to Local Zone

Release traffic from Local Zone to Local Zone

Allow traffic from Trust Zone to Trust Zone

67. Which of the following options is not a certificate saving file format supported by USG6000 series devices?

PKCS#12

DER

PEM

PKCS#

68. As shown in the figure, when using the Client - Initiated VPN method to establish an L2TP VPN, which of the following is the destination of the PPP packet?

Access users

LNS

LAC

Server

69. When the company network administrator configures dual-machine hot backup, configure the status of VRRP backup group 1 as Active, and configure the virtual IP address as 10.1.1.1/24, then the command that needs to be typed in the blank space is?

rule name c Source-zone untrust Destination-zone trust Destination-address 202.106.1.132 Action permit

rule name d Source-zone untrust Destination-zone trust Destination-address 10.10.1.132 Action permit

security-policy Rule name a Source-zone untrust Source-address 202.106.1.132 Action permit

rule name b Source-zone untrust Destination-zone trust Source-address 10.10.1.1 32 Action permit

70. Which of the following types of firewalls has the highest processing efficiency when processing non-first packet data flows?

Proxy firewall

Packet filtering firewall

Stateful Monitoring Firewall

Software firewall

Page 8 of 28

71. Which of the following measures can prevent IP spoofing attacks?

Filter specific ports on the border firewall

Set up a route to a specific IP on the border firewall

Deploy target IP address filtering on the border router

Source IP address filtering on the border firewall

72. What is the agreement number of the AH agreement?

73. Intrusion prevention equipment can effectively defend against which of the following attacks?

Transport layer

Application layer

Network layer

Physical layer

74. Some applications, such as Oracle database applications, have no data flow transmission for a long time, causing the firewall session connection to be interrupted, resulting in business interruption. Which of the following is the optimal solution?

Configure a long connection for a certain business

Enable ASPF function

Optimize security policies

Enable shard caching

75. Vulnerabilities, also called vulnerabilities, refer to defects and deficiencies in computer systems in specific matters of hardware, software, protocols, or system security policies.

Which of the following descriptions of vulnerability characteristics is incorrect?

A vulnerability is a security risk that exposes computers to hacker attacks.

The vulnerability can be exploited remotely.

The vulnerability cannot be patched

Vulnerabilities are unknown beforehand and discovered afterward.

76. Electronic evidence preservation is directly related to the legal validity of evidence. Only preservation that complies with legal procedures can ensure its authenticity and reliability. Which of the following is not an evidence preservation technology?

Encryption technology

Digital certificate technology

Digital signature technology

Message mark tracking technology

77. If there is an incident of foreign criminals using the Internet to steal our country’s national secrets, what kind of early warning will the country activate?

Orange Alert

Yellow Alert

Blue Alert

Red Alert

78. When configuring a GRE Tunnel interface, the Destination address generally refers to which of the following parameters?

Local tunnel interface IP address

Local external network export IP address

Peer's external network egress IP address

Peer tunnel interface IP address

79. When a network security incident occurs, investigate intrusions, viruses or Trojans, and patch and strengthen the host.

Which stage of network security emergency response does the above action belong to?

Recovery phase

Detection phase

Eradication phase

Inhibition stage

80. Regarding IKE SA, which of the following descriptions is incorrect?

IKE SA is two-way

IKE is an application layer protocol based on UDP

IKE SA serves IPsec SA

The encryption algorithm used in user data packets is determined by IKE S

Page 9 of 28

81. Which of the following descriptions of the main implementation methods of single sign-on is incorrect?

Accept PC message mode

Query the AD server security log mode

Query syslog server mode

Firewall monitors AD authentication messages

82. On the USG series firewall, after configuring the web redirection function, the authentication page cannot be popped up. Which of the following is not a cause of the fault?

The authentication policy is not configured or the authentication policy configuration is incorrect.

The web authentication function is not enabled

The browser SSL version does not match the SSL version of the firewall authentication page.

The port number of the authentication page service is set to 8887

83. Which of the following security threats is an application security threat?

Man-in-the-middle attack

User identity is not verified

Viruses and Trojans

Network intrusion

84. Which of the following is the default backup method for dual-system hot backup?

Automatic backup

Manual batch backup

Session quick backup

Configuration of the active and standby FW after the device restarts

85. Which of the following methods is required to log in when the device is powered on for the first time?

Console

SSH

Telnet

FTP

86. Among the following options, which one is not a private IP address?

192.168.254.254/16

172.32.1.1/24

10.32.254.254/24

10.10.10.10/8

87. Which of the following SSL VPN functions can and can only access all TCP resources?

Network expansion

File sharing

WEB proxy

Port forwarding

88. Regarding the description of VGMP group management, which of the following is incorrect?

All changes in the active/standby status of a VRRP backup group need to be notified to the VGMP management group to which it belongs.

The interface types and numbers of the heartbeat interfaces of the two firewalls can be different, as long as they can ensure Layer 2 interoperability.

Regularly send hello messages between VGMP of the active and standby firewalls

The active and standby devices understand each other's status through heartbeat line exchange messages, and back up relevant commands and status information.

89. "Implementing security monitoring and management of information and information systems to prevent illegal use of information and information systems" is to achieve which characteristic of information security?

Confidentiality

Controllability

Non-repudiation

Completeness

90. Manual audit is a supplement to tool evaluation. It does not require the installation of any software on the target system being evaluated and has no impact on the operation and status of the target system.

Manual audit does not include which of the following options?

Manual detection of the host operating system

Manual inspection of the database

Manual inspection of network equipment

Manual inspection of the administrator’s equipment operation process

Page 10 of 28

91. Which of the following is not a requirement for firewall dual-machine hot backup?

The firewall hardware model is the same

Firewall software versions are consistent

The interface types and numbers used are consistent

The firewall interface IP addresses are consistent

92. Response _

1-3-2-7-5-6-4

1-3-2-7-6-5-4

1-2-3-7-6-5-4

1-7-3-2-6-5-4

93. In the information assurance stage, from which of the following perspectives do we need to consider information security issues?

Management

Security system

Business

Technology

94. HRP (Huawei Redundancy Protocol) protocol is used to synchronize data such as key firewall configurations and connection status to the backup firewall. Which of the following options does not fall within the scope of synchronization?

Security policy

NAT strategy

Blacklist

IPS signature set

95. Which of the following is incorrect regarding the description of operating systems?

The operating system is the interface between the user and the computer

The operating system is responsible for managing all hardware resources of the computer system and controlling the execution of software.

The interface between the operating system and the user is a graphical interface

The operating system itself is also software

96. Digital signature technology encrypts which of the following data to obtain a digital signature?

User data

Receiver’s public key

Sender’s public key

Digital fingerprint

97. In the digital signature process, which of the following is mainly used to perform the HASH algorithm to verify the integrity of data transmission?

User Data

Symmetric key

Receiver’s public key

Receiver’s private key

98. Which of the following is used to encrypt digital fingerprints in digital signature technology?

Sender’s public key

Sender’s private key

Receiver’s public key

Receiver’s private key

99. Regarding the description of Internet user and VPN access user authentication, which of the following is incorrect?

Internet users and VPN access users share data, and user attribute checks (user status, account expiration time, etc.) also take effect on VPN access.

The process for Internet users using local authentication or server authentication is basically the same. Users are authenticated through the authentication domain, and the user triggering method is also the same.

After VPN users access the network, they can access the network resources of the corporate headquarters. The firewall can control the accessible network resources based on the user name.

After VPN access users pass authentication, they will be listed in the user online list at the same time.

100. Which of the following does not belong to system security?

Security of services running in the system

Security database

Operating system security

Database system configuration security

Page 11 of 28

101. Regarding NAT address translation, which of the following statements is incorrect?

Configure a NAT address pool in source NAT technology. You can configure only one IP address in the address pool.

Address translation can provide FTP, WWW, Telnet and other services within the LAN according to user needs.

Some application layer protocols carry IP address information in the data. When performing NAT on them, the IP address information in the upper layer data must be modified.

For some non-TCP, UDP protocols (such as ICMP, PPTP), NAT conversion cannot be performed

102. Which of the following does not belong to the common application scenarios of digital certificates?

FTP

HTTPS

IPSEC VPN

SSL VPN

103. Regarding the description of the four-way handshake when disconnecting a TCP connection, which of the following is incorrect?

The active closing party sends the first FIN to perform active closing, and the other party receives this FIN and is closed.

When the passive shutdown receives the first FIN, it will send back an ACK and randomly generate an acknowledgment sequence number.

The passive closing party needs to send an end-of-file character to the application, and the application closes its connection and causes a FIN to be sent.

After the passive closing party sends FIN, the active closing party must send back a confirmation and set the confirmation sequence number to the received sequence number plus 1

104. Search the blacklist

Which of the following sequences is correct?

1->3->2->4

3->2->1->4

3->4->1->2

4->3->1->2

105. Which of the following traffic matching the authentication policy will trigger authentication?

Access to the device or traffic initiated by the device

DHCP, BGP, OSPF, LDP messages

Traffic of visitors accessing HTTP services

DNS message corresponding to the first HTTP service data flow

106. Which of the following options does not include the surveyed objects of the questionnaire survey in the security assessment method?

Network system administrator

Security Administrator

Technical person in charge

107. The results seen through display ike sa are as follows. Which of the following statements is incorrect?

IKE SA has been established

IPsec SA has been established

The neighbor address is 2.2.2.1

IKE uses the V1 version

108. When an access user uses Client-Initiated VPN to establish a tunnel with the LNS, how many PPP connections can one tunnel carry?

109. Regarding GRE encapsulation and decapsulation, which of the following descriptions is incorrect?

During the encapsulation process, the original data packet is forwarded to the Tunnel interface by searching for a route, and then GRE encapsulation is initiated.

Encapsulation process. After being encapsulated by the GRE module, the data packet will enter the IP module for the next step of processing.

During the decapsulation process, after the destination receives the GRE message, it searches for a route and delivers the data packet to the Tunnel interface before starting GRE decapsulation.

Decapsulation process. After being decapsulated by the GRE module, the data packet will enter the IP module for the next step of processing.

110. Which of the following options does not belong to the electronic evidence of communication?

Telephone recording

Chat history

System log

Page 12 of 28

111. When a Layer 2 switch forwards data, which of the following entries is used to determine the destination port?

ARP entry

MAC address table entry

Routing table entry

Access control list

112. Which of the following security measures does the monitor correspond to?

Intrusion detection system

Encrypted VPN

Access control system

Firewall

113. Which of the following is not a system requirement for configuring dual-machine hot standby?

FW software versions must be the same

FW models must be the same

FW hard disk configuration must be the same

FW board types must be the same

114. When IPsec VPN uses tunnel mode to encapsulate packets, which of the following is not within the encryption scope of the ESP security protocol?

ESP Header

TCP Header

Raw IP Header

ESP Tail

115. Which of the following does not belong to the user authentication method in the USG firewall?

Certification-free

Password authentication

Single sign-on

Fingerprint authentication

116. Which of the following attacks is not a cyber attack?

IP spoofing attack

Smurf attack

MAC address spoofing attack

ICMP attack

117. Regarding the Server Map table generated by NAT No-PAT, which of the following descriptions is correct?

The function of the Server Map generated by NAT No-PAT is equivalent to the security policy, that is, the packets matching the Server Map table can directly pass through the firewall without matching the security policy.

There are two Server Maps generated by NAT No-PAT by default. One is a reverse Server Map table. It is mainly used for address translation without the need to configure additional NAT and security policies when external network users actively access the private network users. for a visit.

The Server Map generated by NAT No-PAT is static. That is, after NAT No-PAT is configured, the Server Map table will be automatically generated and will exist permanently.

There are two Server Maps generated by NAT No-PAT by default. One is the forward Server Map table. Its main function is to ensure that when a specific private network address accesses the public network, it directly hits the table entry for address translation, improving efficiency.

118. The visitor logs in to the AD domain, and the AD server returns a login success message to the user and issues a login script.

Which of the following is the correct order?

1-2-3-4

4-1-3-2

3-2-1-4

1-4-3-2

119. Which of the following descriptions of key exchange in IPsec is incorrect?

During the out-of-band shared key process, the administrator needs to manually configure static secret and verification keys.

Out-of-band shared keys have low security and poor scalability.

Internet Key Exchange IKE protocol is built on the framework defined by the Internet Security Alliance and the key management protocol ISAKM

It is an application layer protocol based on TC

IKE uses the DH (Diffie-Hellman) algorithm to securely distribute keys on insecure networks.

120. Regarding the description of IP spoofing, which of the following is incorrect?

IP spoofing attacks are launched by taking advantage of the normal trust relationship between hosts based on IP addresses.

After a successful IP spoofing attack, the attacker can use any forged IP address to imitate a legitimate host to access key information.

The attacker needs to disguise the source IP address as a trusted host and send a data segment with SYN annotation to request a connection.

Hosts with trust relationships based on IP addresses can log in directly without entering password verification.

Page 13 of 28

121. As shown in the figure, GRE VPN is established between FW_A and FW_B, and PC_A and PC_B are accessed through GRE VPN. When encapsulating data packets, which of the following should the destination address be encapsulated into?

2.2.2.2

1.1.1.1

10.1.1.2

192.168.2.1

122. Which of the following options does not belong to the quintuple range?

Source IP

Source MAC

Destination IP

Destination port

123. Regarding vulnerability scanning, which of the following is incorrect?

Vulnerabilities are unknown beforehand and discovered afterward.

Vulnerabilities can generally be patched

Vulnerabilities are security risks that expose computers to hacker attacks

Vulnerabilities can be avoided

124. Which of the following options is the protocol number of GRE?

125. Which of the following statements about electronic evidence sources is incorrect?

Fax materials and mobile phone recordings are electronic evidence related to communication technology.

Movies and TV series are electronic evidence related to network technology.

Database operation records and operating system logs are computer-related electronic evidence•

Operating system logs, e-mail, and chat records can all be used as sources of electronic evidence.

126. Which of the following behaviors is relatively safer when connecting to Wi-Fi in public places?

Connect to an unencrypted Wi-Fi hotspot

Connect to a paid Wi-Fi hotspot provided by the operator and only browse the web

Connect to unencrypted free Wi-Fi for online shopping

Connect to encrypted free Wi-Fi for online transfer operations

127. Regarding the single sign-on supported by the firewall, which of the following is not included?

RADIUS single sign-on

ISM single sign-on

AD single sign-on

HWTACACS single sign-on

128. When any of the following situations occurs in the VGMP group, the VGMP group will not actively send VGMP messages to the peer/

Enable dual-machine hot backup function

Manually switch the active and standby status of the firewall

Firewall service interface failure

Changes in session table entries

129. Which of the following descriptions about the transmission of information through the heartbeat in the dual-machine hot standby center is incorrect?

The two firewalls periodically send heartbeat messages to each other to detect whether the peer device is alive.

Heartbeat link detection messages are used to synchronize configuration commands and status of the two firewalls.

Configuration consistency check messages are used to check whether the key configurations of two firewalls are consistent.

VGMP messages are used to determine the status of the peer device to determine whether switching is required.

130. Which of the following options correctly describes the sequence of the four phases of the Information Security Management System (ISMS)?

Plan->Check->Do->Action

Check->Plan->Do->Action

Plan->Do->Check->Action

Plan->Check->Action->Do

Page 14 of 28

131. Which of the following descriptions of the ESP protocol in IPsec is incorrect?

ESP encrypts the payload in the data and then encapsulates it into the data packet to ensure the confidentiality of the data.

ESP can only provide encryption functions and does not support authentication.

The protocol number of OESP is 50.

ESP supports verifying data integrity.

132. The configuration command for the NAT address pool is as follows: nat address-group 1 section 0 202.202.168.10 202.202.168.20 mode no-pat. Among them, the meaning of the no-pat parameter is:

No address translation

Port reuse

Do not convert the source port

Conversion destination port

133. The attacker sends an ICMP reply request and sets the destination address of the request packet to the broadcast address of the victim network.

What kind of attack does this behavior belong to?

IP spoofing attack

Smurf attack

ICMP redirect attack

SYN flood attack

134. Regarding the characteristics of the TCP/IP protocol stack, which of the following descriptions is incorrect?

When the device receives data, it will remove the protocol header according to the TCP/IP model and analyze the payload information. This action is called decapsulation.

The communication process of the network is carried out at the peer-to-peer level of the protocol stack, such as network layer and network layer communication, data link layer and data link layer communication.

When the device encapsulates data, the TCP/IP protocol sets a verification mechanism for the data at each layer.

When the device sends data, it will add specific protocol header information to the data according to the ICP/IP model. This action is called encapsulation.

135. Which of the following descriptions of Huawei firewall security zones is correct?

Different security zones of the firewall have the same priority.

Different interfaces of the firewall can be in the same zone.

The zones that come with the firewall can be deleted.

The same interface on the firewall can belong to different zones.

136. Which of the following descriptions about patches is incorrect?

A patch is a small program made by the original author of the software to address the discovered vulnerabilities.

Not patching will not affect the operation of the system, so whether to patch or not is irrelevant.

Patches are generally updated continuously.

Computer users should promptly download and install the latest patches to protect their systems

137. In the information security system construction and management cycle, which of the following behaviors needs to be implemented in the "Check" link?

Safety management system design

Safety management system implementation

Risk assessment

Safety management system operation monitoring

138. SSL does not support which of the following encryption algorithms?

RC4

DES

3DES

AES

139. IPsec can use which of the following protocols to complete the automatic distribution of keys for encryption and authentication processes?

IKE

ESP

SPI

140. Which of the following descriptions of investigation and evidence collection is correct?

Evidence is not necessarily required during the investigation process

Evidence obtained through wiretapping is also valid

It is best to involve law enforcement agencies in all investigations and evidence collection processes

Documentary evidence is necessary in computer crimes

Page 15 of 28

141. Which of the following descriptions about the heartbeat interface is incorrect?

It is recommended to configure at least 2 heartbeat interfaces. - One heartbeat interface is used as the main interface, and the other heartbeat interface is used as the backup.

The interface MTU value is greater than 1500 and cannot be used as a heartbeat interface.

The heartbeat interface can be connected directly or through a switch or router.

The MGMT interface (GigabitEthernet0/0/0) cannot be used as a heartbeat interface

142. Which of the following is a correct description of the firewall log when the firewall hard disk is in place?

Administrators can view network threat detection and defense records in the announcement content log.

Administrators can use threat logs to understand users’ security risk behaviors and the reasons for being alerted or blocked.

Administrators can learn user behavior, searched keywords, and the effectiveness of audit policy configurations through user activity logs.

Administrators can learn the security policies that traffic hits through the policy matching log, which can be used to locate faults when problems occur.

143. Evidence appraisal needs to address the integrity verification of evidence and determine whether it meets the admissible standards. Regarding the standards for evidence appraisal, which of the following descriptions is correct?

The relevance standard means that if the electronic evidence can have a substantial impact on the facts of the case to a certain extent, the court should rule that it is relevant.

The objectivity standard means that the acquisition, storage, and submission of electronic evidence must be legal and not seriously infringe on basic rights such as national interests, social welfare, and personal privacy.

The legality standard is to ensure that there is no change in the content of electronic evidence from the initial acquisition to the submission for use as litigation evidence.

The fairness standard means that only evidence materials obtained by legal subjects through legal means have evidence capacity.

144. In Linux system, which of the following commands is used to query IP address information?

displayip

ifconfig

ipconfig

display ip interface brief

145. A business impact analysis (BIA) does not include which of the following?

Business priorities

Incident handling priority

Impact Assessment

Risk identification

146. Which of the following descriptions about firewall logs is incorrect?

Administrators can learn the security policies that traffic hits through the policy matching log, which can be used to locate faults when problems occur.

Administrators can learn user behavior, search keywords, and the effectiveness of audit policy configurations through user activity logs.

Among the log levels, Emergency is the most serious level.

According to the severity or urgency of the information, logs can be divided into 8 levels. The more serious the information, the greater the log level value.

147. Which of the following is an attack method that exploits program vulnerabilities, constructs special SQL statements and submits them to obtain sensitive information?

SQL injection attack

Worm attack

Phishing attack

Buffer overflow attack

148. After a network attack incident occurs, according to the plan, the isolation area is set up, the data is summarized, and the losses are estimated. Which stage of the network security emergency response does the above action belong to?

Preparation stage

Detection phase

Inhibition phase

Recovery phase

149. Regarding the description of ARP spoofing attack, which of the following is incorrect?

The ARP implementation mechanism only considers normal business interactions and does not perform any verification on abnormal business interactions or malicious behaviors.

ARP spoofing attacks can only be achieved through ARP replies and cannot be achieved through ARP requests.

When a host sends a normal ARP request, the attacker will respond first, causing the host to establish an incorrect IP and MAC mapping relationship.

ARP static binding is a solution to ARP spoofing attacks. It is mainly used in scenarios where the network size is small.

150. Which of the following does not include the design principles of questionnaire surveys?

Completeness

Publicity

Concreteness

Consistency

Page 16 of 28

151. When A and B communicate with each other for data communication, if an asymmetric encryption algorithm is used for encryption, when A sends data to B, which of the following keys will be used to encrypt the data?

A’s public key

A’s private key

B’s public key

B’s private key

152. Which of the following is not a type of digital certificate?

Local certificate

Terminal certificate

Self-signed certificate

Device local certificate

153. Which of the following is a core part of the P2DR model?

Policy strategy

Protection

DetectionDetection

Response

154. On Huawei USG series devices, the administrator wants to erase the configuration file. Which of the following commands is correct?

clear saved-configuration

reset saved-configuration

reset current-configuration

reset running-configuration

155. As shown in the figure, a TCP connection is established between client A and server B. Which of the following should the sequence numbers of the two "?" packets in the figure be?

a+1: a

a: a+1

b+1: b

a+1: a+1

156. As shown, nat server global 202.106.1.1 inside10.10.1.1 is configured on the firewall. Which of the following is the correct configuration for the inter-zone rules?

Rule namec. source-zone untrust. destination-zone trust. destination-address 202.106.1.132, action permit

Rule nameD, source- zone untrust. destination- zone trust. destination- address10.l0.1.132, action permit

Rule nameB, source- zone untrust, destination- zone trust, source- address10.10.1.1 32, action permit

Rule nameB, source- zone untrust, destination- zone trust, source- address202.106.1.132, action permit

157. In the USG series firewall, which of the following commands can be used to query the NAT conversion results?

display nat translation

display firewall session table

display current nat

display firewall nat translation

158. Regarding the description of SSL VPN, which of the following is correct?

Can be used without a client

The IP layer can be encrypted

There is a NAT traversal problem

No authentication required

159. The protocol field in the IP header identifies the protocol used by the upper layer. Which of the following field values indicates that the upper layer protocol is UDP?

160. As shown in the figure, a TCP connection has been established between PC1 and PC2. PC1 issued a FIN request for this connection, and PC2 responded with an ACK. Which of the following descriptions is correct?

The TCP connection from PC1 to PC2 has been completely closed.

The TCP connection from PC1 to PC2 is in a semi-closed state, and PC1 can still send data to PC2.

The TCP connection from PC1 to PC2 is in a semi-closed state, and data can no longer be sent through this connection.

The TCP connection from PC1 to PC2 is in a semi-closed state, and PC2 can still send data to PC1.

Page 17 of 28

161. Among the application data types defined by the SNMPvI management information structure, the unit of the clock (Time Ticks) type is which of the following?

0.1 seconds

0.01 seconds

1 second

1 millisecond

162. Firewall GE1/0/1 and GE1/0/2 both belong to the DMZ zone. If you want the area connected to GE1/0/1 to be able to access the area connected to GE1/0/2, which of the following is correct? ?

You need to configure the security policy from Local to DMZ

No configuration required

Inter-zone security policy needs to be configured

Need to configure DMZ to local security policy

163. Regarding the characteristics of Telnet service, which of the following descriptions is incorrect?

TeInet can be used to log in to the host remotely, and the Telnet account password can be obtained through brute force cracking.

By default, Huawei firewall prohibits remote users from logging in using Telnet.

Through the Telnet service, users can connect to the remote host on the local computer.

Telnet is a remote login service protocol that uses port 23 of the UP protocol.

164. Regarding firewall security policy, which of the following options is incorrect?

If the security policy is permit, the discarded packets will not accumulate the "number of hits"

When configuring the security policy name, the same name cannot be reused

Adjust the order of security policies. There is no need to save the configuration file. It will take effect immediately.

The number of security policy entries for Huawei USG series firewalls cannot exceed 128.

165. Regarding the characteristics of firewalls, which of the following descriptions is correct?

Firewalls can accurately detect which computer the attack comes from

Firewalls can effectively solve the problem of intranet network attacks.

A firewall can prevent unauthorized information from the external network from being sent to the internal network.

Firewalls can replace anti-virus systems

166. When configuring NAT Server on the USG series firewall, a server-map table will be generated. Which of the following does not belong to the content of this performance?

Destination IP

Destination port number

Agreement number

Source IP

167. Which of the following does not belong to the method used in the Detection link in the P2DR model?

Real-time monitoring

Detection

Call the police

Shut down service

168. Which of the following is not the business scope of the National Internet Emergency Center?

Emergency handling of security incidents

Early warning and notification of security incidents

Provide security evaluation services for government departments, enterprises and institutions

Cooperate with other institutions to provide training services

169. As shown in the figure, which of the following is the encapsulation mode of the IPsec VPN shown in the figure?

Wrong pattern

Common mode

Transmission mode

Tunnel mode

170. Which of the following statements about L2TP VPN is incorrect?

Suitable for employees on business trips to dial up to access the intranet

Data will not be encrypted

Can be used in conjunction with IPsec VPN

Belongs to three-layer VPN technology

Page 18 of 28

171. Which of the following is not a key technology of anti-virus software?

Shelling technology

Self-protection

Format disk

Real-time upgrade of virus database

172. Which of the following is not an encryption algorithm in VPN?

3DES

DES

AES

RIP

173. Which of the following passwords is a strong password?

1001

tLzXsqc735!

admin123

he110world

174. Which of the following options does the firewall use to process the matched authentication data flow?

Portal certification

No certification

WeChat authentication

Not authenticated

175. Regarding the characteristics of DNS, which of the following descriptions is incorrect?

The function of DNS is to convert difficult-to-remember IP addresses into easy-to-remember character forms.

DNS uses TCP protocol, and the port number is 53.

DNS domain name hijacking resolves the target domain name to the wrong IP address by forging a domain name resolution server and other means, causing users to access the wrong website.

DNS is managed hierarchically. The highest level is the root domain, followed by the top-level domain name. CN is the top-level domain name, representing China.

176. What is the authentication range of the AH protocol in tunnel mode?

177. Regarding root CA certificates, which of the following descriptions is incorrect?

The issuer is CA

The certificate subject name is CA

The public key information is the public key of the CA

The signature is generated by CA public key encryption

178. Which of the following VPNs cannot be used in site-to-Site scenarios?

SSL VPN

L2TP VPN

IPsec VPN

GRE VPN

179. An employee of a company accesses the company's internal Web server through a firewall and can open the website's web page using a browser. However, the Ping command is used to test the reachability of the Web server and it shows that it is unreachable. What are the possible reasons?

The security policy deployed on the firewall allows the TCP protocol, but does not allow the ICMP protocol.

The web server is down

The security policy deployed on the firewall allows the HTTP protocol, but does not allow the ICMP protocol.

The interface connecting the firewall to the server is not added to the security zone.

180. Which of the following is not a function that can be achieved by public key technology?

Data integrity

The security of the public key itself

Identity verification

Privacy of data

Page 19 of 28

181. As shown in the figure, some packets were captured on a terminal device using packet capture software. Regarding the packet information, which of the following statements is correct?

The terminal initiated a TCP connection termination request to 192.168.1.1.

The terminal uses Telnet to log in to other devices.

The terminal initiated a TCP connection establishment request to 192.168.1.1.

The terminal uses Http to log in to other devices.

182. Regarding the ordering of PKI work processes, which of the following is correct?

1-2-6-5-7-4-3-8

1-2-7-6-5-4-3-8

6-5-4-1-2-7-3-8

6-5-4-3-1-2-7-8

183. Which of the following tools can be used to penetrate web applications?

Nmap

Sparta

Burp Suite

Superscan

184. Which of the following descriptions about dual-machine hot backup is incorrect?

Whether it is a Layer 2 or Layer 3 interface, whether it is a business interface or a heartbeat interface, it needs to be added to the security zone.

The default preemption delay is 60s

The proactive preemption function is enabled by default.

The dual-machine hot backup function requires license support

185. How many IPsec SAs need to be established to encapsulate IP packets using the AH+ESP protocol?

186. Firewalls are divided according to protection objects. Windows Firewall belongs to ()

Software firewall

Hardware firewall

Stand-alone firewall

Network firewall

187. Which of the following is not a major form of computer crime?

Inject Trojans into the target host

Hack the target host

Using a computer to conduct a personal survey

Use scanning tools to collect network information without permission

188. Which of the following services encrypts transmission by default?

ssh

ftp

telnet

http

189. Evidence preservation is directly related to the legal effect of evidence. Which of the following is not an evidence preservation technology?

Digital certificate technology

Encryption Technology

Data mining technology

Digital signature technology

190. IPSEC VPN technology does not support NAT traversal when encapsulated by ESP security protocol, because ESP encrypts the message header.

True

False

Page 20 of 28

191. Which of the following is a potential threat in the network?

Scan

Deception

SQL injection

Denial of service attack

192. Regarding the description of firewall, which of the following is correct?

Firewalls cannot transparently access the network.

Adding a firewall to a network will inevitably change the topology of the network.

To avoid single points of failure, the firewall only supports side-by-side deployment.

Depending on the usage scenario, the firewall can be deployed in transparent mode or in three-way mode.

193. Use iptables to write a rule that does not allow the network segment 172.16.0.0/16 to access the device. Which of the following rules is written correctly?

iptables -t fiter -A INPUT -s 172.16.0.0/16 -p all -j DROP

iptables -t fiter -P INPUT -s 172.16.0.0/16 -p all -j DROP

iptables -t fiter -P INPUT -s 172.16.0.0/16 -p all -j-ACCEPT

iptables -t fiter -P INPUT -d 172.16.0.0/16 -p all -j-ACCEPT

194. The administrator wants to clear the current session table.

Which of the following commands is correct?

display session table

display firewall session table

reset firewall session table

clear firewall session table

195. Information security prevention includes both management and technical measures. Which of the following measures does not belong to the prevention method of information security technology?

Provide information security training to employees

Scan the server for vulnerabilities

Authentication of employees’ identities

Turn on the anti-virus function on the firewall

196. Regarding the description of risk assessment, which of the following options is incorrect? (Single choice)

Risk assessment requires monitoring the operation of the system.

Risk assessment requires asset collection and risk assessment method training.

Risk assessment requires assessing risks and classifying risk levels.

Risk assessment requires identification of threats, vulnerabilities, and scanning for security vulnerabilities.

197. Which of the following options is not included in the HRP active and standby configuration consistency check?

NAT strategy

Whether the heartbeat interface with the same serial number is configured

Next hop and outgoing interface of static route

Authentication strategy

198. As shown in the figure, what is the range of the AH protocol authentication range in transmission mode?

199. In cryptography applications, which technology uses public key encryption and private key decryption?

Symmetric key

Asymmetric key

Digital signature

200. Which of the following options is not a passive method of obtaining information?

Port scanning

Port Mirroring

Collect logs

Capture packets

Page 21 of 28

201. What is the corresponding early warning level for major network security incidents that occur?

Red Alert

Orange Alert

Yellow Alert

Blue Alert

202. Which of the following operations cannot improve the anti-virus capability of the system?

It is not easy for users to open files from unknown sources.

Organize the hard drive to free up space.

Regularly upgrade anti-virus software.

Apply security patches regularly

203. Which of the following does not belong to the levels classified in network security incidents?

Major cybersecurity incidents

Special cybersecurity incidents

General cybersecurity incidents

Larger network security incidents

204. When configuring NAT Server on the USG system firewall, a server-map table will be generated. Which of the following is not included in this performance?

Destination IP

Destination port number

Agreement number

Source IP

205. Send an ABP broadcast to the entire network, requesting the MAC address of host C.

as the picture shows. When host A accesses host C, it checks that there is no MAC address entry for the destination address in the ARP entry. Which of the following methods does host A use to find the destination MAC address?

Send an ABP broadcast to the entire network, requesting the MAC address of host

Send an ARP broadcast to the subnet, requesting the gateway's MAC address.

Find the routing table of host

Send an ARP broadcast to the subnet. Request the MAC address of host

206. Which of the following NAT technologies belongs to the destination NAT technology?

Easy-ip

NAT No-PAT

NAPT

NAT Server

207. When deploying IPsec VPN, which of the following is the main application scenario of tunnel mode?

Between host and host

Between the host and the security gateway

Between security gateways

Between the host and the server

208. Which of the following descriptions of the iptables table functions is incorrect?

NAT table: function of address translation.

Raw table: determines whether the data packet is processed by the status tracking mechanism.

Mangle table: modify security policy

Filter table: Policies that are allowed or not allowed in the data packet.

209. Which of the following information is not included in the DHCP binding table?

Port number

VLAN ID

MAC address

IP address

210. Which of the following does not belong to the Linux operating system?

CentOS

RedHat

Ubuntu

MAC OS

Page 22 of 28

211. Regarding Client-Initialized L2TP VPN, which of the following statements is incorrect?

After the remote user accesses the Internet, he or she can directly initiate an L2TP tunnel connection request to the remote LNS through the client software.

The LNS device receives the user's L2TP connection request and can authenticate the user based on the user name and password.

LNS assigns private IP addresses to remote users

Remote users do not need to install VPN client software

212. Which of the following descriptions about L2TP is incorrect?

L2TP should be used in remote corporate scenarios to provide access services for employees on business trips to remotely access corporate intranet resources.

Whether traveling employees access the Internet through traditional dial-up or Ethernet, L2TP VPN can provide them with remote access services.

PPP messages can be transmitted directly over the Internet

L2TP is a tunnel technology used to carry PPP packets

213. Regarding the description of an intrusion prevention system (IPS), which of the following is incorrect?

The IDS device needs to be linked with the firewall to block intrusions.

IPS devices cannot be deployed in bypass mode in the network

IPS devices can be connected in series at the network edge and deployed online.

Once the IPS device detects an intrusion, it can block it in real time

214. Which of the following descriptions of the AH protocol in IPsec VPN is incorrect?

Support message encryption

Support data source verification

Support data integrity verification

Supports packet replay prevention

215. Which of the following descriptions about the automatic backup mode in dual-system hot backup is incorrect?

Every time a command that can be backed up is executed on one FW, the configuration command will be immediately synchronized and backed up to another F

The administrator needs to manually enable it.

The active device will periodically back up the status information that can be backed up to the standby device.

Able to automatically back up configuration commands in real time and periodically back up status information, suitable for various dual-machine hot standby networks.

216. Which of the following is not a firewall log format?

Binary format

netflow format

ASCII encoding format

Syslog format

217. Regarding the command to view the number of security policy matches, which of the following is correct?

display firewall session table

display security-policy all

display security-policy count

count security-policy hit

218. The administrator wants to know the current session table. Which of the following commands is correct?

clear firewall session table

reset firewall session table

display firewall session table

display session table

219. Which of the following descriptions of symmetric encryption technology is incorrect?

The system overhead is small.

Good scalability.

High efficiency and simple algorithm.

Suitable for encrypting large amounts of data.

220. In VRRP, if the virtual group device receives an ARP request message sent by the terminal device.

Which of the following processing methods is correct?

Responded by the Master device.

Master will respond when looking at Backup.

Responded by the Backup device.

Neither Master nor Backup will respond. Because the destination IP address of the AP request message received is the virtual IP address.

Page 23 of 28

221. In some scenarios, both the source IP address and the destination IP address need to be translated. Which of the following technologies is used in this scenario?

Bidirectional NAT

Source NAT

NAT-Server

NAT ALG

222. A. Types of CL do not include which of the following?

Layer 7 ACL

Advanced ACL

Basic ACL

Layer 2 ACL

223. Regarding the description of the data packet during iptables transmission, which of the following options is incorrect?

When a packet enters the network card, it first matches the PREROUTING chain

If the destination address of the data packet is the local machine, the system will send the data packet to the INPUT chain.

If the destination address of the data packet is not the local machine, the system sends the data packet to the OUTPUT chain.

If the destination address of the data packet is not the local machine, the system sends the data packet to the FORWARD chain.

224. The company administrator uses the ping command to test the network connectivity. If he needs to specify the source address of the ehco-request message, what parameters does he need to append?

-i

-a

-c

-f

225. Which of the following descriptions about certificate application is incorrect?

When the certificate expires and the key is leaked, the PKI entity must replace the certificate. The certificate can be updated by re-applying, or it can be updated automatically using the SCEP or CMPv2 protocol.

Normally, a PKI entity will generate a pair of public and private keys. The public key and its own identity information are sent to the CA to generate a local certificate.

The PKI entity supports sending a certificate registration request message to the CA through the SCEP protocol to apply for a local certificate.

PKI can only apply for local certificates online, which has a high security factor.

226. Establish L2TP session

1->2->3->5->4

1->5->3->2->4

2->1->5->3->4

2->3->1->5->4

227. Which of the following is not a block cipher algorithm among symmetric encryption algorithms?

RC5

RC4

RC6

RC2

228. Which of the following options is the port number used by L2TP messages?

500

1701

4500

229. Which of the following is the number range of Layer 2 ACL?

3000~3999

2000~2999

1000~1999

4000~4999

230. Which of the following attack types does DDoS attack belong to?

Snooping Scanning Attack

Malformed message attack

Special message attack

Traffic-based attack

Page 24 of 28

231. After the firewall detects a virus, in which of the following situations will the virus be released?

Hit application exception

The protocol is not supported by the firewall

Source IP hits the whitelist

Hit virus exception

232. IP

Which of the following describes the packaging sequence?

1234

1243

1342

1423

233. Applying for special funds for emergency response and purchasing emergency response software and hardware equipment belong to which stage of the complete network emergency response?

Preparation stage

Inhibition phase

Response phase

Recovery phase

234. A certain basic ACL rule is configured as follows, rule permit source 1.1.1.0 0.0.0.255. Which of the following descriptions is correct?

Packets with source address 1.1.255.255 and destination address 2.2.2.2 are allowed to pass.

Packets with source address 1.1.1.255 and destination address 2.2.2.2 are allowed to pass.

Packets with source address 1.1.1.10 and destination address 2.2.2.2 are discarded.

Packets with source address 1.1.1.1 and destination address 2.2.2.2 are discarded.

235. USG firewall NAT configuration is as follows:

When FTP Server responds to Client A, it is converted to address 1.1.1.5 in address 1.

Source NAT configuration can only be converted for internal network users (10.1.1.0/24) to access the external network.

When changing the IP address of the FTP Server host to 1.11.3. Client A host can still access the FTP Server

Client A accesses FTP Server 1.1.1.1, the destination address is converted to 10.1.1.2, and the source address remains unchanged.

236. Intrusion detection covers various authorized and unauthorized intrusion behaviors. Which of the following behaviors does not fall within the scope of intrusion detection?

Impersonate other users

The administrator accidentally deleted the configuration

Planting worms and Trojans

Leakage of data information

237. In the MPS 2.0, which item stipulates that "spam should be detected and protected at key network nodes, and the upgrade and update of the spam protection mechanism should be maintained"?

Malicious code prevention

Communication transmission

Centralized management and control

Border protection

238. In a stateful inspection firewall, when the stateful inspection mechanism is turned on, when the second message (SYN+ACK) of the three-way handshake reaches the firewall, if there is no corresponding session table on the firewall, which of the following descriptions is correct?

The firewall does not create a session table, but allows packets to pass through.

If the firewall security policy allows the packet to pass, create a session table

The packet must not pass through the firewall

The packet must pass through the firewall and a session can be established.

239. In Huawei SDSec solution, which of the following is an analysis layer device?

CIS

Agile Controller

switch

Firehunter

240. Under the control of external users, attacking network security by stealing local information or gaining control of the local machine belongs to which of the following attacks?

Phishing attack

Buffer overflow attack

Denial of service attack

Trojan horse attack

Page 25 of 28

241. Among the following options, which two attacks use similar attack methods, both of which generate a large number of useless response messages, occupy network bandwidth, and consume device resources?

Fraggle and Smurf

Land and Smurf

Fraggle and Land

Teardrop

242. Which of the following is not an abnormality in the file type identification results?

File extension mismatch

The file type cannot be recognized

File corruption

The file is compressed

243. When AntiDos statistics detect attack traffic, it will divert the attack traffic to the cleaning device. After the cleaning device completes cleaning, it will inject the traffic back to the original link. Which of the following options does not belong to the back-injection method?

Policy routing back injection

GRE back injection

MPLS LSP reinjection

BGP back-injection

244. Which of the following levels of protection is generally adopted for extremely important systems in important national fields and departments?

Exclusive control protection level

Mandatory protection level

Autonomous protection level

Supervision protection level

245. Which of the following services provides encrypted transmission by default?

FTP

HITP

SSH

Telnet

246. Which of the following descriptions of signature filters is incorrect?

There is a priority relationship between signature filters, and the one configured first takes precedence.

The action priority of the signature filter is higher than the default action of the signature.

The actions of the signature filter are divided into alarm, blocking and default actions of using signatures.

If multiple values are configured in a filter condition of the signature filter, there is an "AND" relationship between the multiple values.

247. In the DNS system, which type of server can serve as a proxy for the authorization server to relieve the pressure on the authorization server?

Top-level domain name server

Recursive server

Root server

Cache server

248. In the implementation steps of the IS027001 project, which of the following does not belong to the system design and release phase?

System integration and information security management system document preparation

Determine risk treatment measures and implement rectification plans

Convene a project summary meeting during the information security management phase

Determine risk tolerance and risk appetite

249. What is the security level of the DMZ zone of Huawei firewall?

250. Which of the following descriptions of firewall characteristics is correct?

A firewall can prevent unauthorized information from the external network from being sent to the internal network.

The firewall is a comprehensive security device with a variety of security features and can defend against zero-day vulnerabilities.

Firewalls can protect against all external network threats

The firewall has an anti-virus function, so there is no need to deploy an anti-virus system in the network where the firewall is deployed.

Page 26 of 28

251. Sort the firewall security zones according to their priority. Which of the following is the correct sorting?

Local Trust>DMZ>Untrust

Trust>Local>Untrust) DMZ

Trust>Loca1>DMZ>Untrust

Trust>DNZ>Local>Untrust

252. Which of the following descriptions about the difference between the HWTACACS protocol and the RADIUS protocol is incorrect?

The HWTACACS protocol uses the TCP protocol, making network transmission more reliable.

RADIUST protocol supports authorization of configuration commands

Separation of authentication and authorization of HITACACS protocol

The RADIUS protocol only encrypts the password field in the authentication message.

253. Which of the following is an advantage of public key encryption?

Encrypting large amounts of data takes less time

The algorithm is very simple

The encrypted message is shorter

The private key cannot be deduced from the public key

254. Which of the following is not a feature of GRE VPN?

Expand the working range of networks with limited hop count

Solve the problem of message transmission across heterogeneous networks

Ability to encapsulate multicast messages

Ensures the safe transmission of user business data on the Internet

255. Which of the following descriptions about digital signatures is incorrect?

A digital signature is data obtained by encrypting a digital fingerprint with the sender's own private key.

Digital signature technology proves that the information has not been tampered with

Use the public key to decrypt the digital signature to obtain the digital fingerprint

Digital signature technology proves the identity of the recipient

256. What is the absolute number for logging in through the Console port?

257. As shown in the figure, when R1 receives a data packet accessing PC2, which of the following route prefixes will be matched?

192.168.1.88/30

192.168.1.96/29

192.168.0.0/16

192.168.1.0/24

258. Which of the following attacks cannot be prevented by a firewall?

Scanning and snooping

Virus Trojan

Malformed message

DoS attack

259. Which of the following descriptions about GRE security is correct?

The Key identification position in the GRE header is 1, indicating that the authentication function is enabled.

The GRE key is encapsulated in the header of the original IP message.

Huawei firewall enables authentication function by default

Both parties establishing a tunnel do not need to agree on a key in advance.

260. Encryption technology uses mathematical methods to convert plain text into cipher text to achieve the purpose of protecting data.

Which of the following does not belong to the data protection role of encryption technology?

Confidentiality

Identification

Non-repudiation

Scalability

Page 27 of 28

261. Which of the following does not include the fragmented packets that a packet filtering firewall can filter?

Non-fragmented packets

First fragmented message

Forged ICMP error messages

Subsequent fragmented messages

262. Which of the following descriptions of bidirectional NAT technology is incorrect?

In the process of implementing intra-domain NAT, you only need to convert the destination address of the packets sent to the internal server from the public network address to the private network address. There is no need to convert the source address from the private network address to the public network address.

When the internal server needs to access the external network, it is necessary to configure a route from the internal server to the public network address.

When both communicating parties access each other, the destination address is the address after NAT translation.

Intra-domain NAT refers to the scenario where intranet users and servers are deployed in the same security zone, but still hope that intranet users can only access the server's public address.

263. Which of the following descriptions of the firewall DMZ zone is correct?

Solve the problem of insufficient firewall zone division.

The DMZ area solves the problem of server placement very well

The priority is 75.

This area is used to define the area where intranet end users are located.

264. Which of the following malicious codes can be hidden in a program?

Worm

Viruses

Backdoor

Trojan horse

265. In the security policy matching process, which of the following items belongs to the file content of the security configuration?

User

Intrusion Prevention

Source safe zone

Service

266. Which of the following descriptions about the VGIP group status is incorrect?

Initialize is the initialization state. When the dual-machine hot standby function is not enabled on the device, the VGIP group is in this state.

When the device does not receive VGMP messages from the peer device and cannot learn the priority of the peer VGMP group, the device's VGIP group status is initialize.

When the device's own VGP group priority is greater than the VGP group priority of the peer device, the device's VGP group status is active.

When the device's own VGP group priority is lower than the peer device's VGP group priority, the device's VGP group status is standby.

267. Which of the following descriptions about digital certificates is incorrect?

Generally, the key of a digital certificate has a validity period.

The simplest certificate contains a public key, name, and digital signature of the certificate authority.

Digital certificates cannot solve the problem in digital signature technology of being unable to determine that the public key is the designated owner.

A digital certificate contains the owner's public key and related identity information.

268. A small company has only one public network address that is not fixed. The administrator accesses the Internet by using NAT. Which of the following NAT technologies is most suitable for the company's Internet access needs?

Destination NAT

Easy IP

NAT No-PAT

Bidirectional NAT

269. Which of the following descriptions of IPsec SA is incorrect?

There are two ways to establish IPsec SA: manual method and IKE method

Establishing IPsec SA manually is more secure than IK

When using IKE to establish SA, SPI is randomly generated

When using IKE to establish an SA, the key is generated through the DH algorithm and dynamically refreshed.

270. As shown in the figure, in tunnel mode, the New IP Header should be in which of the following positions?

Page 28 of 28

271. The security zone division of Huawei firewall is based on which of the following options?

According to IP address

Divided according to interfaces

HCIA-Security V4.0 H12-711_V4.0-ENU Exam Questions

HCIA-Security V4.0 H12-711_V4.0-ENU Exam Questions

Share this post

Leave a Reply Cancel reply

Related Posts