HCIE-Security (Huawei Certified Internetwork Expert-Security)

Question 1

With the continuous advancement of informatization and information security assurance in our country, strengthening and standardizing the management of information security service qualifications has become an important basic work in information security management.
Which of the following are the qualification certifications provided by China Information Security Certification Center?

A. Security Deployment Service Qualification Certification

B. Emergency Treatment Service Qualification Certification

C. Safety R&D Service Qualification Certification

D. Risk Assessment Service Qualification Certification

Correct Answer: B,D

Question 2

The WeChat voice (TCP) service of a site experienced a large delay, and the delay reached 3 seconds. As its egress NAT gateway, the firewall is configured with easy-ip nat mode (single egress), with link state detection disabled, TCP aging time of 30 seconds, small business traffic, and nearly 50,000 sessions to the voice server. Through the session, you can see a large number of packets of one-way access to the voice server.
What is the correct cause and solution for this failure?

A. If there is no inconsistency between the round-trip paths on the link, you can enable the link status detection function, and the aging time is default, which can solve this problem.

B. After the firewall session is aging, the port after the NAT of the new connection is inconsistent with the port used to establish the connection with the server, resulting in no response from the server. The client needs to re-establish the connection after timeout before sending data.

C. The aging time of the TCF session is too short, and it takes time for the firewall to create a new session.

D. The solution could increase the TCP aging time to 600 seconds.

Correct Answer: A,B

Question 3

For the description of NAT Server, which is correct?

A. NAT Server cannot be configured on the virtual firewall for users of the root firewall.

B. If the public network address of the NAT Server and the corresponding public network interface address are not in the same network segment, you do not need to configure black hole routing.

C. If the public network address of the NAT Server and the corresponding public network interface address are in the same network segment, you do not need to configure black hole routing.

D. If the public network address of the NAT Server is the interface address, if the black hole route of this address is configured, the service access to the firewall itself will be abnormal.

Correct Answer: C

Question 4

A company has the following requirements:
The intranet users in the Trust area are on the 192.160.1.0/24 network segment and can access the Internet.
Which of the following configurations are correct:
traffic-policy
profile trust_tountrust
bandwidth downstream
maximum-bandwidth 400000
bandwidth downstream
guaranteed-bandwidth 50000
bandwidth ip-car downstream
maximum-bandwidth per-ip 2000
rule name trust_to_untrust
source-zone trust
destination-zone untrust
source-address 192.160.1.0 24
action qos profile
trust_to_untrust
#

A. This configuration will implement speed limit for Internet addresses to actively access the intranet segment.

B. This configuration will enable Trust intranet users to actively access the Internet outside the Internet and limit the total maximum download bandwidth to 400M.

C. This configuration will achieve an overall upload bandwidth of 50M for intranet 192.168.1.0/24 users.

D. This configuration will implement the download traffic in the direction from Trust to Untrust, and the maximum bandwidth per IP is 2M.

Correct Answer: B,D

Question 5

In the dual-system hot-standby network, the management group status on the two USGs is Active. What is the possible reason?

A. set a long preemption delay

B. Backup channel interface not configured

C. The physical line of the heartbeat has failed

D. Fast session backup not set

Correct Answer: C

Question 6

IPsec tunnel communication is used between the headquarters and branch offices, in order to ensure the security of data transmission on the Internet. The administrator uses the dual-system hot backup function to improve the reliability of the communication between the headquarters and the branch offices, so as to avoid the failure of one USG in the headquarters and the failure of the branch offices to access the headquarters.
According to the following network diagram, which of the following statements is correct?

A. USG A , USG_B and USG_C only need to configure the route of the Internet, and there is no need to configure the route between the branch intranet and the headquarters intranet in USG_A , USG_B and USG_C.

B. Only ESP and Tunnel mode encapsulation can be used.

C. Only IPsec dual-system hot backup in active/standby backup mode can be used.

D. USG A , USG_B must enable NAT traversal.

Correct Answer: B,C

Question 7

The USG firewall is directly connected to other devices at Layer 3. During commissioning, it was found that the IP address of the peer directly connected to the firewall cannot be pinged, and it has been confirmed that there is no problem with the peer device. What are the possible reasons?

A. The intra-domain packet filtering policy of the corresponding domain of the firewall is not enabled

B. The packet filtering from the firewall local to the corresponding security domain is not enabled

C. The firewall interface is not added to the security domain

D. Routing configuration error on firewall

Correct Answer: B,C

Question 8

On the USG stateful inspection firewall, if the administrator sets the security policy for data packets from Trust to Untrust to permit, and the security policy for data packets in the opposite direction to deny, the final result is:

A. Terminals in the Trust zone can actively initiate connections to terminals in the Untrust zone, and even the packets returned by Untrust can pass normally.

B. Terminals in the Untrust zone cannot actively initiate connections to terminals in the Trust zone, but the returned packets in the Trust zone can pass normally.

C. Terminals in the Untrust zone cannot actively initiate connections to terminals in the Trust zone, and can only passively connect to connections initiated by users in the Trust zone.

D. Terminals in the Trust zone can actively initiate connections to terminals in the Untrust zone, but the packets returned by Untrust cannot pass normally.

Correct Answer: A,C

Question 9

Which statement is true about certificate OCSP and CRL technology?

A. OCSP can obtain the revocation status of the certificate in real time.

B. CRL is more time-sensitive than OCSP.

C. OCSP must frequently download the certificate list on the client side to keep the list updated.

D. The CDP (CPL Distribution Points) information automatically obtained from the client certificate will not be stored in the configuration file, so when the USG restarts, the automatically obtained CDP information will not be saved.

E. The OCSP protocol obtains the revocation status of a certificate in an online manner to check whether the other party's certificate is revoked.

Correct Answer: A,D,E

Question 10

Huawei NIP5000 products are based on signature security.

A. TRUE

B. FALSE

Correct Answer: B

Question 11

For internal network security, which of the following options are recommended for planning deployment priorities?

A. Enable NAT function

B. Firewall and switch virtualization to achieve business isolation

C. Enable DDoS function

D. Physical separation of computing network and storage network

E. Application three-tier architecture plane isolation

Correct Answer: B,D,E

Question 12

Which statement about MTU and PMTU is correct?

A. The device will check the MTU on the inbound interface, and if the packet size exceeds the MTU value, it will be discarded.

B. In an IP network, interfaces with different MTU values may be passed from the source address to the destination address, and the largest MTU value is the PMTU of the path.

C. PMTU detection is to obtain the PMTU value of the specified destination IPv4 address through detection, and then use the MTU value to send packets.

D. MTU (Maximum Transfer Unit) refers to the size of the largest data packet that can be transmitted in the network, in bytes.

Correct Answer: C,D

Question 13

When the firewall runs GRE, which three parameters must be configured on the tunnel interface?

A. source IP address of the tunnel

B. The protocol number of the tunnel is GRE

C. Checksum enable for GRE

D. Destination IP address of the tunnel

E. key

Correct Answer: A,B,D

Huawei HCIE-Security (Huawei Certified Internetwork Expert-Security) - H12-731-ENU Exam Practice Test

Latest Update

Useful Links

Contact Us