Valid H12-731-ENU HCIE-Security Exam Questions

Planning for H12-731-ENU HCIE-Security (Written) (Huawei Certified Internetwork Expert- Security) exam? Valid H12-731-ENU HCIE-Security Exam Questions have been released on December 11, 2018, which contain real H12-731-ENU exam questions with accurate answers to ensure your success in Huawei H12-731-ENU Exam.

Try H12-731-ENU free questions

Please try H12-731-ENU free questions to test the high quality of Valid H12-731-ENU HCIE-Security Exam Questions now. There are 20 free questions of the full H12-731-ENU exam questions. After you check all Huawei H12-731-ENU free questions, you will find you want to get the full version of HCIE-Security H12-731-ENU exam.

Begin to Test:

1. The correct statement about UDP Flood and TCP Flood attack prevention is: (Multiple Choice)

The UDP protocol is connectionless and therefore cannot be implemented by source probe.

Prevent UDP Flood by analyzing the rules and characteristics of a host sending UDP packets, this rule and feature is called fingerprint learning.

The fingerprint learning function of UDP packets learns all fields of the packet data segment.

UDP and TCP protocols can be implemented through proxy technology.

Question 1 of 20

2. In the process of IPsec negotiation failure, open the IKE debugging switch and display the following information: got NOTIFY of type INVALID_ID_INFORMATION or drop message from A.B.C.D due to notification type INVALID_ID_INFORMATION, what does it mean? (Multiple Choice)

A. The IKE proposals at both ends do not match.

B. IPsec proposals at both ends do not match

C. The ACL configurations on both ends do not match.

D. The LOCAL-ID-TYPE at both ends is inconsistent

Question 2 of 20

3. What are the intrusion prevention implementation mechanisms included? (Multiple Choice)

Blacklist matching

Protocol identification and protocol analysis

Feature matching

Response processing

Question 3 of 20

4. What is the correct statement about MTU and PMTU? (Multiple Choice)

MTU (Maximum Transfer Unit) refers to the size of the largest data message that can be transmitted in the network, in bytes.

The device checks the MTU on the inbound interface. If the packet size exceeds the MTU value, it will be discarded.

In an IP network, the source address to the destination address may pass through interfaces with different MTU values, and the largest MTU value is the PMTU of the path.

Detecting PMTU is obtained by detecting the PMTU value of the specified destination IPv4 address, and then using the MTU value to send the message.

Question 4 of 20

5. In NGFW, to use the RBL blacklist, which of the following key options do network administrators need to configure? (Multiple Choice)

DNS server

Answer code

RBL server IP address

SMTP server IP address

Question 5 of 20

6. Regarding the relationship between the two technologies of 802.1X and RADIUS, which of the following description is correct?

802.1X and RADIUS are different names for the same technology.

802.1X is a technical system that includes RADIU

802.1X and RADIUS are different technologies, but they are often used together to complete access control for end users.

802.1X and RADIUS are two completely different technologies that are usually not used together.

Question 6 of 20

7. What are the main aspects of host hardening?

Operating system hardening

Database hardening

Account password security

Network management system hardening

Vulnerability scanning

Question 7 of 20

8. What functions does content filtering contain in Huawei USG firewall?

File content filtering

Apply content filtering

File extension filtering

Mail filtering

Question 8 of 20

9. The internal network IP address of a Web server deployed in an enterprise DMZ is 10.1.1.3 and the port is 8080. The public network address is 1.1.1.2 and the external port number is 80.

Configure the following command on the firewall:

[USG6600] security-policy

[[USG6600-policy-security] rule name untrust_to_mz

[USG6600-policy-security-rule-untrust_to_mz] source-zone untrust

[USG6600-policy-security-rule-untrust_to_mz] destination-zone dmz

[USG6600-policy-security-rule-untrust_to_mz] destination-address 1.1.1.2 32

[USG6600-policy-security-rule-untrust_to_mz] service http

[USG6600-policy-security-rule-untrust_to_mz] action permit

[USG6600] nat server webserver protocol tcp global 1.1.1.2 www inside 10.1.1.3 8080

The external network PC cannot access the Web Server 10.1.1.3 inside the enterprise. Please analyze the reasons. The most likely reasons are:

The firewall does not open the default packet filtering policy from the untmut area to the dmz area.

Firewall untrust to DMZ zone security policy should be configured as service 8080

Firewall untrust to DMZ zone security policy should be configured as destination-address 10.1.1.3 32

The firewall should be configured as nat server webserver protocol tcp global 1.1.1.2 80 inside 10.1.1.3 8080

Question 9 of 20

10. In the terminal security management, the whitelist + blacklist mode is adopted. Which of the following is a formal behavior?

The software in the whitelist is not installed on the terminal host, and the software in the blacklist is not installed.

The terminal host installs all the software in the whitelist, and the software in the blacklist is not installed.

The terminal host installs some software in the whitelist, and the software in the blacklist is not installed.

The terminal host installs all the software of the whitelist terminal, and also installs some software in the blacklist.

Question 10 of 20

11. Hundreds of people in a medium-sized enterprise network access the Internet through the company's firewall, and the company deployed an enterprise portal in the firewall DMZ. As an IT security officer, which standard you should follow to procure and deploy Internet access audit products?

Order No. 82 of the Ministry of Public Security

ISO27002

State Office issued 28

NIST800-53

Question 11 of 20

12. The three servers have a centralized networking solution. As shown in the figure, the administrator finds that only one of the three Agile Controllers in the resource pool is alive.

In this case, which of the following descriptions is correct?

The three database servers are not working properly. Only one of the three Agile Controllers in the resource pool is alive. In this case, the Agile Controller services are all transferred to the surviving Agile Controller and function properly. Terminal authentication, access control, software distribution, patch installation, and asset management are not affected.

After the Agile Controller is started, each Agile Controller immediately reads the database and caches it on the local hard disk. If all the databases become unavailable due to the fault, the Agile Controller continues to maintain the operation of the Agile Controller service by using the cache that is saved at that time.

At this point, you can try to restart the surviving Agile Controller and repair the database server on reboot.

The escape channel on the firewall is now open.

Question 12 of 20

13. Border network security, which of the following options are there for planning deployment recommendations?

Security domain isolation

IPS real-time intrusion prevention

Turn on device virtualization

Deploy VPN

Turn on DDoS function

Question 13 of 20

14. Which of the following statement of NAT Server is correct?

If the public network address of the NAT server is on the same network segment as the corresponding public network interface address, you do not need to configure blackhole routing.

If the public network address of the NAT server is not in the same network segment as the corresponding public network interface address, you do not need to configure blackhole routing.

If the public network address of the NAT server is the interface address, if the blackhole route of the address is configured, the service access to the firewall itself will be abnormal.

It is not possible to configure the NAT Server for users of the root firewall on the virtual firewall.

Question 14 of 20

15. Regarding the way of the SAC device access the network, which of the following description is correct?

The SACG device requires interworking with the Layer 2 terminal.

SACG is usually hanged on the core switch device and is routed by policy routing.

SACG supports hanging on non-Huawei devices.

The SACG device requires interworking with the Layer 2 of the Agile Controller.

Question 15 of 20

16. The USG firewall is directly connected to Layer 3 of other devices. During the commissioning, it is found that the peer IP address that is directly connected from the firewall ping is unreachable, and there is no problem with the peer device. What are the possible reasons for the analysis?

Routing configuration error on the firewall

The firewall interface is not joined to the security domain.

Packet filtering from the firewall local to the corresponding security domain is not enabled.

The intra-zone packet filtering policy of the corresponding domain of the firewall is not enabled.

Question 16 of 20

17. What is the online application certificate method supported by the firewall PKI?

HTTP

LDAP

TFTP

SCEP

FTP

Question 17 of 20

18. Which of the following statement of SACG certification is correct?

SACG certification is generally used for existing wired networks.

SACG certification is generally used to build new wireless networks.

SACG is generally deployed in side-mounted deployment manner and does not change the original network topology.

SACG essentially controls access users through 802.1X technology.

Question 18 of 20

19. What protocols and ports do you need to open for the firewall to use the IPsec function?

The protocol is an IP packet of AH and ES

The source port is UDP packets of 500 and 4500.

The destination port is UDP packets of 500 and 4500.

The destination port is a UDP packet of 1701.

Question 19 of 20

20. The firewall is deployed between the wireless user's mobile terminal and the WAP gateway. The mobile terminal is in the trust zone and the WAP gateway is in the untrust zone. The configuration is as follows:

[USG] ad 3000

[USG-acl-adv-3000] rule permit ip destination 202.10.10.2 0

[USG-acl-adv-3000] quit

[USG] fir-all zone trust

[USG-zone-trust] destination-nat 3000 address 200.10.10.2

[USG-zone-trust] quit

Which of following description is correct?

This configuration can also be applied to the server address mapping scenario.

The command firewall zone trust should be changed to firewall interzone trust untrust outbound.

The firewall converts the destination address of the packet accessing the 202.10.10.2 gateway address to 200.10.10.2

The command firewall zone trust should be changed to firewall interzone untrust trust.

Question 20 of 20

Get H12-731-ENU Full Version

After read all H12-731-ENU free questions, please go on for the full version of Valid H12-731-ENU HCIE-Security Exam Questions. HCDAtest offers 206 real exam questions and answers as a full to help you pass HCIE-Security exam.

Valid H12-731-ENU HCIE-Security Exam Questions from HCDAtest are the best materials for Huawei H12-731-ENU exam. Any Questions, please contact me freely: [email protected].

HCDA Test Preparations

Latest Huawei Exam Dumps | New HCIA, HCIP and HCIE Tests

Tag Archives: H12-731-ENU exam questions

Valid H12-731-ENU HCIE-Security Exam Questions

Try H12-731-ENU free questions

Get H12-731-ENU Full Version

Recent Posts

Tags