HCIP-Security-CISN(Huawei Certified ICT Professional - Constructing Infrastructure of Security Network) (H12-721-ENU) Free Practice Test

Question 1

In the headquarters-branch IPsec VPN network, when the headquarters is configured, when the headquarters adopts the IPSec policy template, which of the following are mandatory items? (Multiple choice)

A. policy enable

B. ipsec policy-template template-name sec-number

C. ipsec policy policy-name sec-number isakmp template template-name

D. proposal proposal-name

Correct Answer: B,C,D

Question 2

When the performance difference between servers is large, which of the following algorithms can be used for load balancing?

A. Simple polling algorithm

B. The minimum connection algorithm

C. Weighted polling algorithm

D. Source IP hash algorithm

Correct Answer: C

Question 3

Which of the following options can be used as a match criterion for a rule in a bandwidth policy? (Multiple Choice)

A. Socket

B. URL classification

C. Source security area/inbound interface

D. DSCP priority

Correct Answer: B,C,D

Question 4

In dual-system hot backup, the backup channel must be the main interface on the interface board. Which type is not supported?

A. GigabitEthernet

B. E1

C. Ethernet

D. vlan-if

Correct Answer: B

Question 5

In hot standby, what is the number of cycles does not receive the HRP HELLO packet from the peer end, the Slave peer considers the peer end to be faulty?

A. One

B. Two

C. Three

D. Five

Correct Answer: C

Question 6

IP-Link sends a probe packet to the specified IP address. By default, if three probes fail, the link to this IP address is considered to be faulty.

A. False

B. True

Correct Answer: B

Question 7

When the administrator assigns interface G1/0/0 to virtual system vsysa, it finds that the allocation fails. Which of the following reason is impossible?

A. This interface is a Layer 2 interface and cannot be directly assigned to a virtual system.

B. The interface is not in the UP state.

C. The interface has been added to the security zone of other virtual systems.

D. The G1/0/0 port has been allocated to other virtual systems.

Correct Answer: B

Question 8

If the firewall works at Layer 2 and is directly connected to the intranet or connected through a Layer 2 switch, which of the following cannot be used as a matching condition for the policy route?

A. Inbound interface

B. IP address

C. MAC address

D. DSCP priority

Correct Answer: C

Question 9

In an Eth-Trunk interface, load balancing can be implemented by configuring different weights on member links.

A. False

B. True

Correct Answer: B

Question 10

Which of the following are correct about interface bandwidth?

A. When traffic enters the interface, traffic that exceeds the predefined interface bandwidth is discarded

B. The bandwidth of the inbound interface is limited. If the traffic is greater than the bandwidth of the inbound interface, the traffic is queued according to the forwarding priority set in the bandwidth channel to ensure that packets with higher priority are sent preferentially.

C. The bandwidth of the inbound interface is limited. If the traffic is greater than the bandwidth of the inbound interface, the traffic is queued according to the remarked DSCP priority set in the bandwidth channel to ensure that packets with higher priority are sent preferentially.

D. When traffic exits the interface, the interface bandwidth is used to mark the priority of the traffic, which serves as the basis for subsequent queue scheduling.

Correct Answer: B

Question 11

When using the Radius server to authenticate users, you need to configure the corresponding username and password on both the Radius server and the firewall.

A. False

B. True

Correct Answer: A

Question 12

Which of the following information is involved in the process of the first stage main mode negotiation in IKE v1 negotiation? (Multiple Choice)

A. IPSec proposal set

B. DH key exchanges public information

C. IKE proposal set

D. Both parties' identity information

Correct Answer: B,C,D

Question 13

Which of the following statements about IKE v1 main mode and aggressive mode is correct?

A. All negotiation packets in the first phase of the main mode are encrypted

B. All negotiation packets in the first phase in aggressive mode are encrypted

C. Whether the negotiation is successful or not, it will enter the fast mode

D. Bare mode uses DH algorithm

Correct Answer: D

Question 14

Which is wrong with SSL VPN session recovery?

A. Use session recovery to reduce the huge overhead incurred during the SSL handshake.

B. After the session times out, the client and server need to re-authenticate.

C. Session recovery simplifies the entire SSL handshake phase and enables fast data transfer.

D. Session recovery only takes effect after the session is established between the client and the server.

Correct Answer: B

Question 15

To improve the reliability of traffic forwarding, the ISP routing function can be used together with the health check function to ensure that traffic is not forwarded to the failed link. When the result of the health check indicates that the link is faulty, the corresponding ISP routing table entry will be deleted, so the traffic does not match the route, and is thus prevented from being forwarded to the failed link.

A. False

B. True

Correct Answer: B

Welcome to TestSimulate

Huawei HCIP-Security-CISN(Huawei Certified ICT Professional - Constructing Infrastructure of Security Network) (H12-721-ENU) Free Practice Test