H12-721 HCNP-Security-CISN (Huawei Certified Network Professional - Constructing Infrastructure of Security Network) Question and Answers

If the file server type is NFS, the user UID and GID attributes do not allow the user to upload, delete, or rename files.

If the type of the file server is SMB, the currently logged-in user has only read permission for the file share resource, but no write permission.

Only the viewing function is enabled in the SSL file sharing function configuration of the C firewall.

Some TCP connections between the virtual gateways of the D file server are blocked by the firewall

IP address scanning attack is an attacker that uses an ICMP packet (such as ping and tracert) to detect the target address.

IP address scanning attack is an attack method used by an attacker to detect a target address by using TCP/UDP packets.

IP address scanning attack defense detects the rate of address scanning behavior of a host. If the rate exceeds the threshold, it is blacklisted.

If the USG starts the blacklist function and is associated with IP address scanning attack prevention, when the scanning rate of a certain source exceeds the set threshold, the excess threshold will be discarded, and the packets sent by this source will be less than the subsequent time. Threshold, can also be forwarded

TRUE

FALSE

TRUE

FALSE

connected user's firewall interface is configured in trusted mode

The firewall interface connected to the DHCP server is configured as untrusted mode.

DHCP relay packets received on the interface in the untrusted mode are discarded.

The DHCP relay packet received in the D trusted mode and passed the DHCP snooping check.

All negotiation packets in the first phase of the aggressive mode are encrypted.

All the negotiation packets of the first phase in the main mode are encrypted.

barbarian mode uses DH algorithm

will enter the fast mode regardless of whether the negotiation is successful or not.

is used for detection of IKE neighbor status

PDUs are sent periodically between B IKE PEERs.

After the DPD function is enabled, the IPSec packet is not received within the interval specified by the interval, and the DPD sends a DPD request to the peer and waits for the response. Text

DPD sends the query only before the encrypted message is sent and the timer expires.

TRUE

FALSE

working on layer 2 cannot be routed

must use L2TP Over IPSec to use

has no authentication function

no encryption

TRUE

FLASE

vrrp vrid 1 vitual-ip ip address master

vrrp vitual-ip ip address vrid 1 master

vrrp vitual-ip ip address master vrid 1

vrrp master vitual-ip address vrid 1

L2TP protocol uses the TCP protocol

supports private address allocation and does not occupy public IP addresses.

and PPP configurations support authentication and work with Radius to support flexible local and remote AAA After combining with IPSec,

supports encryption of packets.

local ike policy does not match the peer ike policy.

local ike remote namet and peer ikename do not match

local ipsec proposal does not match the peer ipsec proposal.

The local security acl or the peer security acl does not match.

display firewall session table Current total sessions: 1 ftp VPN: public-->public 202.152.26.3:3327-->10.1.1.4:21

display firewall session table Current total sessions:3 ftp VPN: public 202.152.26.3:3327--> 202.152.26.123:21[10.1.1.3:21] ftp VPN:public-->public 202.152.26.3:3327 -->202.152.26.123:21[10.1.1.4:21] ftp VPN: public-->public 202.152.26.3:3327-->202.152.26.123:21[10.1.1.5:21]

display firewall session table Current total sessions: 1 ftp VPN: 202.152.26.3:3327-->202.152.26.123:21

display firewall session table Current total sessions: 3 ftp VPN: ftp VPN: public 202.152.26.3:3327--> 202.152.26.123:21[10.1.1.3:21] ftp VPN: public-->public 202.152. 26.3:3327-->10.1.1.4:21 ftp VPN:public-->public 202.152.26.3:3327-->10.1.1.4:21 ftp VPN:public-->public 202.152.26.3:3327-->10.1. 1.5:21

exchange D-H public value and various auxiliary data

SA suggested strategy

authentication

encryption transformation strategy

Ping of Death attack

Super large ICMP packet attack

Tracert packet attack

ICMP unreachable packet attack

The first packet of this data flow enters from the Trust zone interface and is sent from the Untrust zone interface.

This data stream has been NAT translated

uses NPAT conversion technology

firewall has virtual firewall function enabled

The HRP preemption time configured on the firewall is smaller than the convergence time of OSPF.

is not configured to adjust the COST value of OSPF according to the HRP status.

The session fast backup function is not configured on the USG. The packets cannot be forwarded normally if the back and forth paths are inconsistent.

does not enable hrp track on the upstream and downstream interfaces of the firewall.

hot standby

link-group

Eth-trunk

ip-link

Configure the nat policy. The reference rule is to allow the source and destination of the intranet to be all ACLs.

Configure the IKE peer, use the name authentication, and remote-address is the outbound interface address of the headquarters.

Configure the nat policy. The reference rule is to protect the data flow from the enterprise intranet to the headquarters intranet in the first deny ipsec, and then permit the data flow from the intranet to the internet.

Configure an ipsec policy template and reference ike peer

TRUE

FALSE

username and password are inconsistent with aaa configuration

Ins name configuration error

tunnel password is not configured

is not enabled l2tp

HRP

VRRP

VGMP

IGMP

fragment cache

fragmentation

slice direct forwarding

slice defense

supports interface state management across switches

supports interface state management across interface boards

supports remote interface state management

support interface board hot swap

RST message

FIN message

ACK message

SYN message

utm bypass enable

undo utm bypass enable

ips bypass enable

undo ips bypass enable

MAC

Vlan

interface

DHCP Server IP

TRUE

FALSE