HCIE-Security (Huawei Certified Internetwork Expert-Security) (H12-731-ENU) Free Practice Test

Question 1

In Agile Controller, what is the correct statement about the screen saver check policy ?

A. You can check if the screen saver is enabled on the terminal

B. Only supports Windows OS

C. Can check if the screen saver password is enabled

D. Screen saver settings cannot be fixed automatically

Correct Answer: A,B,C

Question 2

The description of the basic forwarding processing flow of the USG stateful inspection firewall is correct:

A. When the data packets enter the firewall, the blacklist matching is performed first, and then the session table matching is performed.

B. For the first packet, first perform single-packet-based attack defense detection, and then perform packet filtering.

C. When the source address network address translation is required, NAT is performed first, and then the inter-zone policy matching detection is performed.

D. When the destination address NAT is required, NAT is performed first, and then the inter-zone policy matching detection is performed.

Correct Answer: B,D

Question 3

In the Remote Access VPN scenario, the remote PC uses the Secoway VPN Client and the firewall to establish a VPN. Which of the following statements is correct?

A. use l2tp over ipsec dial by default

B. use l2tp dialing by default

C. Tunnel mode is used by default

D. Default use transfer mode

Correct Answer: B,C

Question 4

Which of the following statements about hot standby is correct?

A. The slot numbers of the physical cards of the two devices can be different.

B. The default priority of the Active group is 65001, and the default priority of the Standby group is 65000.

C. When the link status detection is enabled, and the incoming and outgoing messages are forwarded by the primary and standby USGs respectively, the USG does not enable rate-determining backup, and the TCP service can pass smoothly.

D. The firewall is connected to the router upstream and connected to the Layer 2 switch downstream. OSPF+VRRP can be used to achieve load balancing.

Correct Answer: B,D

Question 5

View the session table information on the firewall as follows:
[USG] display firewall session table verbose
icmp VPN: public --> public
Zone: trust --> untrust TTL: 00:00:20 Left: 00:00:15
Interface: GigabitEthernet0/0/4 Nexthop: 2.2.2.2 MAC: 00-00-00-00-00-00
<-- packets: 0 bytes: 0 --> packets: 5 bytes: 420
192.168.1.2:44012[1.1.1.3:6103] --> 2.2.2.2:2048
The following descriptions are correct:

A. NAT destination address one-to-one address mapping is configured on the firewall.

B. The device at address 1.1.1.3 is pinging the public address 2.2.2.2.

C. NAPT source address many-to-one address mapping is configured on the firewall.

D. The device at address 192.160.1.2 is pinging the public address 2.2.2.2.

Correct Answer: C,D

Question 6

According to the following networking, a customer uses the following configuration on the cleaning equipment. The following statement is correct:
ip route-static 0.0.0.0 0 10.1.2.1

A. The default route is used for static route diversion

B. This default route is used to send probe traffic for attack prevention

C. The default route is used for BGP diversion

D. This default route is used for traffic back injection

Correct Answer: B

Question 7

In the scenario of dual-system hot backup of firewalls, IPsec VPN does not support real-time backup of tunnels.

A. FALSE

B. TRUE

Correct Answer: A

Question 8

With the continuous advancement of informatization and information security assurance in our country, strengthening and standardizing the management of information security service qualifications has become an important basic work in information security management.
Which of the following are the qualification certifications provided by China Information Security Certification Center?

A. Emergency Treatment Service Qualification Certification

B. Risk Assessment Service Qualification Certification

C. Safety R&D Service Qualification Certification

D. Security Deployment Service Qualification Certification

Correct Answer: A,B

Question 9

In the process of IPsec negotiation failure, turn on the debug switch of IKE and display the following information: got NOTIFY of type NO_PROPOSAL CHOSEN or drop message from ABCD due to notification type NO_PROPOSAL CHOSEN , what should I do?

A. If the negotiation is not successful in the first stage, it may be that the ike proposal does not match.

B. If the negotiation is not successful in the second phase, it may be that the ACL does not match.

C. If the negotiation is not successful in the first phase, the pre-share-key may be configured incorrectly.

D. If the negotiation is not successful in the second phase, it may be that the ipsec proposal does not match.

Correct Answer: A,D

Welcome to TestSimulate

Huawei HCIE-Security (Huawei Certified Internetwork Expert-Security) (H12-731-ENU) Free Practice Test