H12-725_V4.0-ENU Dumps Help You Study Objectives

Category:

Comments:

0 Comments

Post Date:

February 27, 2024

By practicing with H12-725_V4.0-ENU exam-like questions, you can identify areas where you may need to focus your studies. Huawei H12-725_V4.0-ENU dumps can help you create a more targeted study plan and avoid wasting time studying topics you already know well. Taking H12-725_V4.0-ENU dumps can help you get used to the format and structure of the real exam. H12-725_V4.0-ENU dumps can help you feel more comfortable and confident on exam day, which can improve your chances of success. Practice Huawei H12-725_V4.0-ENU exam free dumps below.

Page 1 of 18

1. Which of the following authentication methods does SSLVPN support? (Multiple choice)

Certificate Challenge Certification

Server authentication

Certificate anonymous authentication

Local certification

2. In the dual-machine hot backup application scenario based on dynamic routing protocols, the firewall can use the hrp____ospf-cost enable command to start adjusting the OSPF Cost value according to the active and backup status of the firewall.

3. What is recorded in () is the ownership relationship between the IP address and the virtual system.

4. The bandwidth policy function of Huawei firewall supports multi-level configuration, that is, under one bandwidth policy, multiple bandwidth sub-policies can be configured. Currently, Huawei firewalls can support up to () level policies.

5. As shown in the figure, the firewall load balancing network is used, and the upstream and downstream devices are switches.

Which of the following descriptions of the firewall VGMP group status in this scenario is correct?

Firewall A: Active, Firewall B: Standby

Firewall A: Master, Firewall B: Backup

Firewall A: Master, Firewall B: Master

Firewall A: Active, Firewall B: Active

6. Nmap is a commonly used network scanning and sniffing tool. It can scan and discover the open UDP or TCP ports of the target host, but it cannot determine what operating system the target host uses.

True

False

7. Which of the following DDoS attack types can be prevented by current limiting technology?

DNS

HTTP

ICMP

SYN

8. Which of the following are resources that can be managed in the bandwidth channel? (Multiple choice)

Connection limit

Strategic exclusivity

Independent control of uplink and downlink bandwidth

Overall guaranteed bandwidth

9. In a Portal authentication scenario, when a user is offline but the access device, RADIUS server and Portal server do not sense that the user is offline, which of the following problems may occur? (Multiple choice)

There is a risk that illegal users may impersonate legitimate users’ IP addresses and MAC addresses to access the network.

If there are too many offline users, other users may not be able to access the network.

The user does not need to authenticate again when he goes online again.

The RADIUS server will still bill the user, causing incorrect billing.

10. As shown in the figure, the NAT policy configuration on the firewall is as follows:

[ FW-Policy-nat] display this nat-policy rule name no-nat source-zone trust destination-zone untrust source-address 10.1.2.0 mask 255.255.255.0 action no-nat rule name nat source-zone trust destination-zone untrust action source-nat easy-ip

Assuming that other configurations are correct, the IPSec VPN service can be accessed normally.

True

False

Page 2 of 18

11. When a visitor comes to the enterprise, while facilitating visitor access, it is necessary to control the visitor's access behavior.

For this kind of visitor scenario, which of the following authentication methods is generally recommended?

MAC bypass authentication

Portal authentication

802.1X authentication

MAC authentication

12. MAC priority Portal authentication, if the client's MAC address has expired on the RADIUS server, the RADIUS server will delete the saved client MAC address.

True

False

13. Among the following descriptions of IPS signature types, which signature type has the highest action priority?

Exception signature

Custom signature

Predefined signature

Signature filter

14. SSL VPN is based on B/S architecture and does not require client installation.

True

False

15. When configuring the SSLVPN port forwarding function, the security policy only needs to allow traffic between Untrust and Trust.

True

False

16. When administrators create a firewall virtual system, they also need to create a VPN instance with the same name to isolate routes.

True

False

17. Email content filtering can not only filter out anonymous emails, but also control the permissions of intranet users to send or receive emails by checking the email content.

True

False

18. UIRL's action modes are strict mode and () mode.

19. In the 802.1X authentication scenario, the access device directly encapsulates the EAPoL packet sent by the 802.1X client into a RADIUS packet, without processing the data in the EAP.

Which of the following authentication methods meets the above description?

EAP termination

MAC-based authentication

Interface-based authentication

EAP relay

20. A Linux host has deployed an Nginx application. By viewing Nginx related logs, the operation and maintenance engineer can obtain the complete URL information submitted by the user, and use this to determine whether the server has suffered a SQL injection attack.

True

False

Page 3 of 18

21. Which of the following descriptions of policy routing matching rules is incorrect?

When configuring multiple policy routing rules, the policy routing list is arranged in the order of configuration by default.

If multiple values can be configured in a matching condition, and there is an "OR" relationship between the multiple values, as long as the attributes of the message match any one value, the attributes of the message are considered to match this condition.

Each policy route contains only one matching condition

There is a default policy route default in the system by default. The default policy route is at the bottom of the policy list and has the lowest priority. All matching conditions are any and the action is no policy routing.

22. Which of the following is not part of the consistency check of dual-machine hot standby?

Interface address

NAT configuration

Bandwidth Policy

Security policy

23. If the administrator deploys the content filtering function on the firewall, which of the following security protections can be achieved? (Multiple choice)

Filter content searched by intranet users to prevent intranet users from searching for content that is not related to work.

Filter the content of Weibo posts and posts posted by intranet users to prevent intranet users from posting Weibo posts and posts containing illegal information.

Filter the contents of files downloaded by intranet users to prevent intranet users from downloading files containing illegal information.

Filter the contents of files uploaded by intranet users to prevent intranet users from uploading files containing company confidential information.

24. Single packet attacks, DoS and DDoS attacks can all cause denial of service.

True

False

25. As shown in the figure, mobile office users access the internal file server through the file sharing function.

Which of the following descriptions of this process are correct? (Multiple choice)

The file sharing function plays a role in protocol conversion when users on business trips access file resources on the intranet.

The request and response messages are transmitted directly through the firewall without any changes.

First, the user needs to log in to the virtual gateway and then initiate an HTTPS format request to access the file.

If it is the first time for a user to access file sharing resources, he must first pass the authentication of the file server.

26. WAF can protect HTTPS traffic. Its implementation principle is to decrypt, filter, and re-encrypt messages through the public key, private key, and certificate chain uploaded to the WAF device to detect and protect HTTPS encrypted messages.

True

False

27. In order to improve the reliability of traffic forwarding, the ISP routing function can be used together with the health check function to ensure that traffic is not forwarded to faulty links.

True

False

28. Which of the following descriptions of the Anti-DDoS solution networking mode are correct? (Multiple choice)

Straight-line deployment is simple, and it is connected in series in the network, so there is no need to consider single points of failure.

In a bypass deployment network, traffic does not pass through the cleaning center by default.

Bypass deployment supports dynamic traffic diversion to draw traffic to the cleaning center

Bypass deployment can draw traffic to the cleaning center for detection and cleaning through static traffic diversion.

29. Please match the following intelligent routing types with their corresponding concepts.

30. Attackers use address scanning attacks to determine which target systems are active on the target network.

True

False

Page 4 of 18

31. After the dual-machine hot standby system software version upgrade is completed, which of the following items need to be verified? (Multiple choice)

System software version

Firewall active and standby status

Dual-machine switching

Session table

32. Which of the following descriptions of HWTACACS protocol features is incorrect?

Use shared key encryption, but only encrypt the password field in the authentication message.

Supports authorized use of configuration commands on the device, mostly used for device authentication

Based on TCP transport layer protocol, network transmission reliability is high

Authentication, authorization and accounting functions are separated, so authentication, authorization and accounting services can be deployed on different servers respectively.

33. By checking the /var/log/secure log file of the Linux host, you can determine whether the host has been attacked by brute force cracking of the login password.

True

False

34. If the 802.1X client uses MD5 encryption, the authentication method of the device-side user can be configured as EAP or CHAP; if the 802.1X client uses PEAP authentication, the device-side user authentication method can be configured as ()

35. An enterprise uses high-end modular switches as core switches in its business network. Recently, a switching board of the modular switch failed, causing some business traffic to be interrupted. Which type of security event does this fault belong to?

Catastrophic events

Equipment and facility failure events

Cyber attacks

Information destruction incident

36. Which of the following descriptions of BFD detection characteristics is incorrect?

Reduce application interruption time and improve network reliability

Establish a session between the two devices to monitor the bidirectional forwarding path

Provide a detection time of less than 1 second to speed up network convergence

Fault detection can only be performed on the bidirectional forwarding path of the directly connected physical link between network devices.

37. Which of the following are content security filtering technologies? (Multiple choice)

Email filtering

Bandwidth limitations

Apply behavioral controls

URL filtering

38. Please match the following high reliability technologies with their applications.

39. As shown in the figure, if firewall A actively initiates IKE negotiation, you only need to configure the security policy on firewall A, and no configuration is required on firewall B.

True

False

40. After the two firewalls were deployed normally, a dual-master phenomenon occurred one day. This may be due to a heartbeat port failure.

True

False

Page 5 of 18

41. If 802.1x authentication is used, the user needs to install the client or use the system’s own client to initiate 802.1x authentication.

True

False

42. When configuring Portal page push policy on iMaster NCE-Campus, support using operating system and browser information as matching conditions. In order to implement iMaster NCE-Campus can identify this information of authenticated users, and the corresponding url-parameter needs to be configured in the URL template of the access device.

True

False

43. The security association is uniquely identified by a triplet, including the security parameter index SPI, source IP address and security protocol number.

True

False

44. iMaster NCE-Campus, as an authentication server, supports a variety of authorization results, including: ACL, VLAN, and DSCP values. For undefined parameters, authorization can be issued through custom authorization parameters.

True

False

45. Which of the following attacks uses return timeout messages with a TTL of 0 to spy on the structure of the target network?

HTTP

Tracert attack

UDP

ICMP redirect attack

46. When deploying an Anti-DDoS defense system in a straight line, reliability needs to be considered to prevent single points of failure.

True

False

47. Deploying multiple links at the enterprise exit can improve the reliability of the user network.

True

False

48. Policy routing can be associated with IP-Link or BFD to determine the availability of policy routing based on the status check results of IP-Link or BFD.

True

False

49. Which of the following are host inspection strategies in terminal security? (Multiple choice)

Firewall software

Temporary files

Antivirus software

Automatically saved passwords

50. Which of the following is not a method of IKE verifying remote peers?

Digital certificate authentication

AD certification

Pre-shared key authentication

Digital Envelope Authentication

Page 6 of 18

51. After NAT traversal is enabled, when a NAT device is detected between two gateways, the ESP message will be encapsulated in a UDP header. Which of the following is the source and destination port number of the UDP header?

Source port: 4500, destination port: 4500

Source port: 4500, destination port: 500

Source port: 500, destination port:

Source port: 500, destination port: 4500

52. When using AH-ESP to encapsulate packets in IPSec, perform ESP encapsulation first and then AH encapsulation.

True

False

53. Which of the following is not a parameter that needs to be configured for the IKE security proposal? (Multiple choice)

Negotiation mode

Authentication algorithm

Encryption algorithm

Encapsulation mode

54. Which of the following is not a malformed message attack?

WinNuke attack

Ping

Oversized ICMP message attack

IP spoofing attack

55. The three-layer IPS bypass deployment method usually places IPS on other network devices, such as switches, routers, etc.

Which of the following descriptions of the IPS Layer 3 bypass deployment methods are correct? (Multiple choice)

When deploying Layer 3 bypass, all bidirectional traffic entering and exiting the network device needs to be directed to the IPS for detection.

When deploying Layer 3 bypass, you only need to divert the unidirectional traffic from the external network to the internal network to the IPS for detection.

When deploying Layer 3 services, IPS cannot protect real-time traffic.

When deployed in Layer 3 bypass mode, IPS can protect real-time traffic.

56. Deploy Portal authentication on Huawei wireless controller. To ensure that the authentication terminal can jump to the page normally and open the Portal authentication page, what traffic should be allowed in the authentication-free template on the access device? (Multiple choice)

Traffic accessing the DNS server

Traffic accessing the Portal server

Traffic accessing the Internet

Traffic accessing the RADIUS server

57. Which of the following is not an implementation process of bandwidth management?

Bandwidth channel

Traffic Analysis

Interface speed limit

Bandwidth policy

58. The message is encapsulated using GRE over IPSec, and IPSec uses AH tunnel mode. Which of the following are the payload contents of GRE encapsulation? (Multiple choice)

Payload data

New IP header

AH head

Original message header

59. WAF is a common security device in enterprises. What are its application scenarios? (Multiple choice)

Sensitive word filtering

Access audit

Prevent web page tampering

Prevent CC attacks

60. If the IPSec security protocols supported by both peers are inconsistent, which of the following consequences will result?

Poor IPSec service quality

IPSec SA cannot be established

IKE SA cannot be established

No data flow triggers IKE negotiation

Page 7 of 18

61. During the MAC authentication process, the user terminal does not need to install any client software, and the user does not need to manually enter the user name and password.

True

False

62. After _____ is turned on, after the first intelligent routing of Internet user traffic selects a link, the firewall will generate the corresponding entry. If new traffic hits the entry, the firewall will follow the link recorded in the entry. Forward traffic to ensure that the user's traffic is always forwarded using the same link.

63. DNS filtering can release or block requests for different time periods or different users/groups by referencing configuration items such as time periods or users/groups, meeting the need for more refined and accurate control of employees' Internet access rights.

True

False

64. When using iMaster NCE-Campus as the Portal server, in the Portal server template on the AC, the destination port number used when the device actively sends packets to the Portal server should be configured as ().

65. In Huawei's HWTACACS authentication scheme, which of the following packets are HTACACS accounting packets? (Multiple choice)

Accounting Reply

Accounting Response

Accounting Request

Accounting Start

66. Which of the following descriptions about virtual system resource allocation is incorrect?

Unreasonable resource allocation may cause other virtual systems to be unable to obtain resources and the business to be unable to operate normally.

Quota resources automatically allocate a fixed number of resources directly according to system specifications.

When the administrator manually allocates resources to the virtual system, he first needs to configure the C resource class and specify the guaranteed value and maximum value of each resource item in the resource class, and then bind the source class to the virtual system

Each virtual system can share and seize the entire machine resources, but they can be allocated manually.

67. If server authentication is used, which of the following devices may be included in the network access control system architecture? (Multiple choice)

Data source server

User terminal

Authentication server

Network access equipment

68. The firewall is deployed in a three-layer dual-machine configuration. The uplink device is a router and the downlink device is a layer 2 switch. The firewall can monitor the directly connected business interface through hrp track interface or link-group.

True

False

69. Which of the following is not the responsibility of the Anti-DDos defense system management center?

Security report analysis

Device Management

Issue defense strategies

Carry out traffic diversion

70. When configuring policy routing traffic diversion, you need to configure it on both the traffic diversion device and the cleaning device.

True

False

Page 8 of 18

71. Which of the following descriptions of black and white lists in URL filtering are correct? (Multiple choice)

The priority of the whitelist is higher than the priority of the blacklist

If there are few URL filtering websites on the firewall, you can use either a black or white list or a custom URL classification.

If only the main webpage is added to the whitelist, the embedded webpages under the main webpage will not be accessible normally.

Black and white lists cannot be used in conjunction with URL classification

72. The application behavior control function of Huawei firewall can accurately control users' HTTP behavior, FTP behavior and IM behavior.

True

False

73. Which of the following is the correct user name format for a firewall virtual system?

Virtual system name@@administrator name

Administrator name@@virtual system name

Administrator name@virtual system name

Virtual system name@administrator name

74. Which of the following descriptions of black box testing in penetration testing is incorrect?

Test coverage is low. Generally only 30% of the code can be covered

It can improve the quality of the code and discover hidden problems in the code.

Closer to users’ actual usage scenarios

The testing process is relatively simple, and there is no need to understand the code structure and characteristics inside the program.

75. When using BGP traffic diversion in a CRE tunnel scenario, in order to avoid loops, the reinjection traffic can be directly sent to the reinjection route through the GRE tunnel.

True

False

76. Which of the following statements about the features of the firewall hot standby system version upgrade is incorrect?

When a bug occurs in the live network fire protection system version, the system version needs to be upgraded.

When the existing network fire protection system version does not support certain features, the system version needs to be upgraded.

Version upgrade has requirements for the device model and version before the upgrade

When upgrading the dual-machine hot audio version, the rule of thumb is to upgrade the Active device first, and then upgrade the Standby device.

77. Which of the following traffic diversion methods does Huawei Anti-DDoS defense system support? (Multiple choice)

Static routing traffic diversion

BGP drainage

Policy routing traffic diversion

GRE VPN traffic diversion

78. URL filtering is more granular than DNS filtering and can be controlled to the directory and file levels.

True

False

79. Which of the following descriptions of email protocols are correct? (Multiple choice)

Using POP3, users can directly operate emails on the server. There is no need to download all emails locally and then perform various operations.

Using POP3, the client software will download all unread emails to the computer. and the mail server will delete the email

Using IMAP, users can directly operate emails on the server without having to download all emails locally and then perform various operations.

Using IMAP, the client software will download all unread messages to the computer. And the mail server will delete the read mail

80. Which of the following descriptions of the working principles and functions of Huawei IPS are correct? (Multiple choice)

IPS direct path is deployed at the network exit, which can protect the network in real time without affecting the network topology.

The signature database of IPS devices needs to be updated frequently to identify the latest Trojans, viruses and other network attacks.

When the round-trip paths of data traffic are inconsistent, IPS cannot detect the traffic.

The actions that IPS can perform include operations such as release, notification, current limiting, isolation and redirection.

Page 9 of 18

81. IPSec VPN is a three-layer VPN and can provide encryption protection for the IP network layer.

True

False

82. When configuring authorization rules on iMaster NCE-Campus, multiple authentication methods are supported, including: user access authentication, HAC authentication, and device management authentication.

True

False

83. Constructing wrong query statements and obtaining key information from the error prompts returned by the database is a common method for implementing SQL injection attacks.

True

False

84. IPSec VPN does not support the encapsulation of non-IP unicast packets.

True

False

85. Which of the following descriptions of health examinations is incorrect?

Health check supports DNS detection protocol

The firewall can sense network connectivity in real time through the health check results.

The health check function does not support use in conjunction with policy routing.

In addition to detecting link connectivity, health check can also detect link delay, jitter and packet loss rate in real time

86. In file filtering, which of the following attributes can the firewall identify in the received files? (Multiple choice)

File transfer direction

File type

File extension

Application protocol that hosts the file

87. CVE (Common Vulnerabilities and Exposures) stands for Common Vulnerabilities and Exposures. It is a list of publicly disclosed network security vulnerabilities. Which of the following information does each CVE entry mainly contain? (Multiple choice)

Post the CNA of this CVE

The release date of this CVE

Brief description of the source of the vulnerability, attack method, etc.

Summary of links to relevant reference information about vulnerabilities, such as vendor vulnerability announcements, emergency response suggestions, etc.

88. There are two methods for processing MAC authentication user passwords: PAP and CHAP. When using the PAP method, the device arranges the MAC address, shared secret key, and random value in order, and then encapsulates the password after HASH processing with the MD5 algorithm. In which of the following attribute names?

PAP-Password

PAP-Challenge

CHAP-Password

User-Password

89. The mode IPSec security policy is suitable for scenarios where the peer IP address is not fixed (for example, the peer is an IP address obtained through PPPoE dial-up) or there are multiple peers. It is generally used for the configuration of the headquarters and can simplify the configuration workload.

90. A customer's current network uses Huawei wireless controllers to deploy Portal authentication. During the debugging process, engineers found that the terminal has been unable to successfully authenticate. What are the possible reasons for this problem? (Multiple choice)

The STA address learning function is turned off on the wireless controller.

The Portal key configured on the wireless controller is inconsistent with the authentication server

The Portal server detection function is enabled on the wireless controller, but this function is not enabled on the Portal server.

The Porta1 server destination port configured on the wireless controller is inconsistent with the listening port on the Porta1 server.

Page 10 of 18

91. Each bandwidth policy that references a bandwidth channel is independently constrained by the bandwidth channel, that is, traffic that meets the matching conditions of the bandwidth policy has exclusive access to the maximum bandwidth resource.

Which of the following options belongs to this bandwidth channel reference method?

Broadband sharing

Bandwidth multiplexing

Broadband exclusive

Dynamic equalization

92. Port scanning technology is a technology that scans and detects the running status of the host. Through port scanning, you can determine what services are enabled on the target host and provide an entry point for the next attack.

True

False

93. In Portal authentication mode, when a user is offline and the access device, RADIUS server, and Porta1 server do not sense that the user is offline, a series of problems will occur. Therefore, the access device must be able to detect in time that the user has gone offline, delete the user entry, and notify the RADIUS server to stop charging the user. So in the following description of how Portal users log out, which options are correct? (Multiple choice)

The authentication server forces the user to log off

Portal server forces users to log off

Access device controls user logout

The user initiates an active offline request

94. IPS devices can intercept viruses, Trojans or malicious codes that exploit unknown vulnerabilities to spread and attack, and protect key office data such as privacy, identity, and files.

True

False

95. Which control items of HTTP can a firewall control? (Multiple choice)

POST operation

Internet proxy

File upload

File deletion

96. Which of the following is the function of Message1 and Message2 during the main mode negotiation in the first phase of IKEv1 negotiation?

Negotiate IPSec SA

Mutual identity authentication

Use the DH algorithm to exchange key-related information and generate the key

Negotiate the IKE security proposal used between peers

97. Deploy firewall policies and switch ACLs to block traffic on specific destination ports to suppress the spread of viruses. This operation belongs to the suppression phase of emergency response.

True

False

98. In content filtering technology, if illegal information is identified through keywords, content transmission can only be blocked, thereby ensuring the security of the enterprise.

True

False

99. As shown in the figure, gateway 1 is behind the NAT device. In order to ensure that both gateway 1 and gateway 2 can initiate traffic access at will, there needs to be a mechanism to ensure that the NAT session of the NAT device will not time out, that is, NAT ()

100. Dual-machine hot standby system version upgrade is a common operation and maintenance operation in the existing network. After the upgrade is completed, which of the following information needs to be verified to determine the success of the upgrade? (Multiple choice)

Session table

Equipment operating status

Version information

License information

Page 11 of 18

101. Which of the following descriptions of policy routing execution actions is incorrect?

Unable to forward traffic to other virtual systems according to policy routing

Policy routing is not required and forwarding is performed according to the existing routing table.

Use the intelligent routing function to select one outbound interface from multiple outbound interfaces to send messages.

Send the packet to the specified next-hop device or send the packet from the specified outbound interface

102. A customer's current network uses Huawei wireless controller to deploy 802.1X authentication, and the authentication server is iMaster NCE-Campus. During the process of debugging the wireless network, engineers found that the terminal kept failing to authenticate. What are the possible reasons for this problem? (Multiple choice)

The network between the terminal and the authentication server is unreachable

The authorization key configured on the wireless controller is inconsistent with the authentication server configuration.

The service VLAN is not configured on the wireless controller.

The authentication template configured on the wireless controller is not bound to the access template.

103. For multi-level policies, the firewall first matches the parent policy, and then matches the sub-policy until it matches the sub-policy that can be matched at the last level.

True

False

104. Which of the following descriptions about the classification of bandwidth resources in virtual systems are correct? (Multiple choice)

Traffic flowing from the private network interface to the public network interface is limited by the outbound bandwidth.

In the scenario of cross-virtual system forwarding, the Virtual-if interface defaults to the public network interface.

The public network interface refers to the interface through which the firewall connects to the Internet.

Traffic flowing from the public network interface to the private network interface is limited by the bandwidth in the inbound direction.

105. In wireless networks, Portal authentication is used for visitors to access the network. When the authentication point is on a Huawei wireless controller, the security policy configured in the corresponding security-profilte template on the wireless controller is ____.

106. Which of the following descriptions about bandwidth resource allocation is incorrect?

Which type of bandwidth resource limits a data flow is subject to depends on the outgoing interface or incoming interface of the traffic.

The public network interface refers to the interface connecting to the Internet

Bandwidth resources in the resource category are divided into three categories: inbound bandwidth, outbound bandwidth and overall bandwidth.

In the cross-virtual system forwarding scenario, the Virtual-if interface defaults to the public network interface.

107. An engineer is deploying a wireless network. User access uses 802.1× authentication, the authentication point is a wireless controller, and the authentication server uses iMaster NCE-Campus.

Configure RADIUS authentication parameters on the wireless controller as follows. Which of the following configuration descriptions are correct? (Multiple choice)

The RADIUS authentication and accounting port numbers are 1812 and 1813 respectively.

The RADIUS server address is 10.23.103.1

Configure the accounting mode to RADIUS accounting

The device is billed by time, and the real-time billing function is not enabled.

108. As shown in the figure, the BFD and dual-machine hot standby linkage scenario is used. Which of the following configuration items for this scenario are correct? (Multiple choice)

Option A

Option B

Option C

Option D

109. In the Linux system, from which of the following files can the log information related to user login be viewed? (Multiple choice)

/var/1og/lastlog

/var/1og/faillog

/var/log/secure

/var/1og/wtmp

110. UDP Flood attack initiates large traffic access and occupies protocol stack resources, thereby achieving the purpose of the server refusing to provide services to normal users.

True

False

Page 12 of 18

111. A user uses SSL to access network resources on the intranet. The administrator has enabled file sharing and web proxy services for the user, and has allowed the traffic of the service on the firewall. However, after the user enters the address of the virtual gateway on the PC, the web page fails. I cannot see the list of file shares and web proxies. Which of the following options may cause this failure?

The virtual gateway’s external NAT port is wrong.

Has the virtual IP address been obtained from the virtual network card of the user's PC?

The administrator does not have the authorization to configure file sharing and web proxy for the user

The route between the firewall and the client is unreachable

112. In the URL predefined categories, the major categories include small categories. However, in security policies, the application of processing actions is always based on major categories.

True

False

113. WAF device’s working mode does not include which of the following?

Forward proxy

Reverse proxy

Bridge mode

Transparent proxy

114. Which of the following is a method to prevent Tracert packet attacks?

Discard IP packets with time offset

Discard the detected ICMP messages or UDP messages that have expired, or the destination port is unreachable.

Users can configure the maximum length of ICP packets allowed to pass according to actual network needs. When the length of the actual IP packet exceeds this value, the packet will be discarded.

Discard ICMP unreachable messages and record attack logs

115. The main difference between IMAP and POP3 is that with IMAP, the client software will download all unread emails to the computer, and the mail server will delete the emails. Using POP3, users can directly operate emails on the server without having to download all emails locally and then perform various operations.

True

False

116. Please match the following IPSec applications and scenarios one by one.

117. In the Linux system, the file "/var/log/" () records relatively comprehensive system log information, such as logs during system startup, logs during system operation, system error logs, etc.

118. IKE is an application layer protocol on top of TCP

True

False

119. IPS (Intrusion Prevention System) is an application layer security device that can identify network attacks based on which of the following?

Port number

Destination IP address

Feature library

Source IP address

120. If the firewall recognizes keywords when performing content filtering, which of the following response actions can it perform? (Multiple choice)

Operate according to weight

Alarm

Block

Allow

Page 13 of 18

121. The 802.1X protocol is a port-based network access control protocol. Its authentication messages and data messages can be separated through logical interfaces to improve security.

True

False

122. Which of the following is a signature included in the intrusion prevention signature database?

Exception signature

Custom signature

Predefined signature

Signature filter

123. In a point-to-multipoint scenario, and the headquarters address is fixed and the branch address is not fixed, it is recommended to use IPSec policy template method to establish VPN.

True

False

124. An engineer is deploying a wireless network. Portal authentication is used for guest access, the authentication point is the wireless controller, and the authentication server uses iMaster NCE-CGampus.

The content of the Portal server template configured on the wireless controller is as follows. Which of the following configuration descriptions are correct? (Multiple choice)

The port number for processing Portal protocol packets on the device is 50200.

The IP address for communication between the device and the Portal server is 10.10.10.254

The URL redirected to the user will contain the ssid name.

The IP address of the Portal server is 10.23.200.1

125. By configuring the smart () function, the firewall can intelligently modify the resolution address in the response message, so that the user can obtain the most appropriate resolution address, that is, the address that belongs to the same ISF network as the user.

126. According to the provisions of the "National Cyber Security Incident Emergency Plan", when national secret information, important sensitive information and relevant educational records are lost or stolen, tampered with or counterfeited, and pose a particularly serious threat to national security and social stability Which level of emergency response should be initiated?

First level response

Secondary response

Special response

Level 3 response

127. A certain URL parameter is: http://www.example.com:8088/news/edu.aspx?name=tom&age=20. Which of the following fields does this URL include? (Multiple choice)

host

port

query

Protocol

128. In Huawei's access control solution, when the RADIUS protocol is used to issue authorization, which of the following authorization parameters does iMaster NCE-Campus support? (Multiple choice)

VLAN

Interface

User group

ACL

129. In 802.1X authentication, in order to support the EAP relay mode, the RADIUS protocol adds some new attributes. Which of the following RADIUS attributes is used to encapsulate EAP messages?

NAS-Identifier

Message-Authenticator

NAS-Message

EAP-Message

130. Which of the following protocols work based on TCP? (Multiple choice)

NFS

HTTP

SMB

DHCP

Page 14 of 18

131. SSL VPN can realize Web access to the intranet file server by converting the file sharing protocol into the SSL-based Hypertext Transfer Protocol.

True

False

132. 802.1x authentication user logout methods include client active logout, access device controlled user logout, and server controlled user logout. When the server is used to control user offline, the RADIUS service can force the user to go offline through () messages.

133. The second-party access device added to iMaster NCE-Campus supports connection using the TACACS protocol.

True

False

134. Since the HTTP protocol is based on the TCP protocol, all HTTP Flood attacks can be prevented by using the method of preventing TCP Flood.

True

False

135. Which of the following options belong to the eradication phase of emergency response? (Multiple choice)

Deploy ACL on the enterprise's internal switches to limit the spread of viruses in the internal network

Strengthen cybersecurity education and publicity

Enable security auditing

Use anti-virus software to fully disinfect the terminal

136. Which of the following descriptions about the connection limit in bandwidth management are correct? (Multiple choice)

Even if the number of connections is limited, the traffic of P2P business cannot be reduced.

Can save session resources

Can limit the rate of new connections

Can assist the firewall in preventing DDoS attacks against intranet servers

137. Which of the following descriptions of virtual interfaces are correct? (Multiple choice)

The virtual interface must be configured with an IP address and added to the security zone, otherwise it will not work properly.

A virtual interface is a logical interface automatically created by the system when creating a virtual system.

The virtual interface of the root system is Virtua1-if1

The format of the virtual interface name is "Virtual-if+IP address"

138. Which of the following is not a functional feature of AH?

Integrity check

Anti-replay

Data source verification

Data encryption

139. Which of the following descriptions of smart DNS is incorrect?

By configuring the smart DNS function, the firewall can intelligently modify the resolution address in the DNS response message so that the user can obtain the most appropriate resolution address, that is, an address that belongs to the same ISP network as the user.

Intelligent DNS supports weighted polling to achieve link load balancing

Smart DNS does not need to be combined with other technologies and can be used alone

Smart DNS is divided into two scenarios: single-server smart DNS and multi-server smart DN

140. ESP (Encapsulating Security Payload) is a protocol of IPSec that is used to provide confidentiality and anti-replay services for IP, including confidentiality of data packet content and limited traffic confidentiality. Which of the following is the protocol number of ESP?

500

4500

Page 15 of 18

141. You can view the configuration information and interface status of Eth-Trunk through display eth-trunk, where STATC indicates static LACP mode and _____ indicates manual load balancing mode.

142. Which of the following mirroring methods does Huawei Anti-DDoS defense system support? (Multiple choice)

Policy routing traffic diversion

Use port mirroring on the egress device

Spectrometer splits light

BGP drainage

143. Compared with IPSec network layer control, SSL VPN is easier to provide fine-grained access control, and can provide more detailed control over user permissions, resources, services, and files.

True

False

144. In which of the following ways does a Flood attack cause denial of service? (Multiple choice)

Control network host permissions

Exhausting server resources

Exhausting network bandwidth

Exhausting network device resources

145. As a security management mechanism, AAA provides which of the following services in a modular manner? (Multiple choice)

Certification

Authorization

Access

Billing

146. Which of the following functions are virtualization that can be achieved by firewalls? (Multiple choice)

Routing virtualization

Configure virtualization

Resource virtualization

Security function virtualization

147. In SSL VPN, the firewall performs access authorization and access control based on which of the following dimensions?

IP address

Port number

MAC address

role

148. Which of the following descriptions of web proxy methods are correct? (Multiple choice)

The web rewriting method web link is more secure and more convenient to use.

Web Link will rewrite the URL and hide the intranet server address.

Web Link relies on IE controls and cannot be used normally in non-IE environments.

Web rewriting may cause problems such as misaligned images and abnormal font display.

149. How many levels of bandwidth policies does the firewall support?

150. If you want to control users’ forum postings, user logins, etc., which of the following HTTP behavior controls should be configured?

POST operation

Redirect

File upload

File download

Page 16 of 18

151. Which of the following parameters cannot be configured in the bandwidth channel of the firewall?

Maximum bandwidth per IP

Overall maximum bandwidth

Overall maximum number of concurrent connections limit

Source and destination safe area

152. When configuring authentication rules on iMaster NCE-Campus, which of the following types of authentication methods is not supported as a matching condition?

Device Management Certification

Wireless user authentication

User access authentication

MAC authentication

153. The entire IPSec protocol framework contains multiple protocols. Which of the following protocols does not belong to the IPSec protocol framework?

ESP

IKE

TLS

154. Which of the following descriptions of keywords in content filtering are correct? (Multiple choice)

Keywords are content that the device needs to identify when filtering content.

Keywords include predefined keywords and custom keywords

The minimum length of keywords that can be matched by text is 2 bytes

Custom keywords can only be defined in text mode

155. In the Portal authentication scenario, when iMaster NCE-Campus is used as the Portal server and the Huawei wireless controller is the access device, which of the following port numbers is used by the wireless controller to process Portal protocol packets by default?

50200

1813

2000

1812

156. The use of firewall virtual systems within an enterprise can isolate the networks between different departments and further improve the security factor.

True

False

157. In the 802.1X authentication system, if the EAP termination method is used between the access device and the authentication server. In this authentication method, the device not only has to extract client authentication information from the EAP message from the client, but also encapsulates this information through the standard RADIUS protocol. Which of the following EAP authentication methods cannot be supported? (Multiple choice)

MD5-Challenge

EAP-PEAP

EAP-TLS

EAP-TTLS

158. Which of the following descriptions about independent control and overall control of uplink and downlink bandwidth in the bandwidth channel are correct? (Multiple choice)

In addition to the fine-grained control method of independently controlling uplink and downlink bandwidth, the firewall also provides a bandwidth control method based on the sum of uplink and downlink traffic.

When the traffic transmission direction is in the same direction as the bandwidth policy, it is defined as downstream

When the traffic transmission direction is opposite to the bandwidth policy, it is defined as upstream.

The maximum bandwidth, guaranteed bandwidth and connection limit all support the separate configuration of uplink and downlink bandwidth.

159. In a dual-machine hot standby network, in order to ensure the consistency of link switching, Huawei firewall implements device status management based on VGMP groups.

True

False

160. Which of the following descriptions about firewall bandwidth policies is correct?

In the same group of parent-child policies, the same bandwidth channel can be referenced

By default, there is a default bandwidth policy on the firewall. The configured conditions are all (any) and the action is flow limiting.

If bandwidth management is used together with the source NAT function, the address before translation should be specified when configuring the address/matching conditions of the bandwidth policy.

For maximum bandwidth and connection limit, the child policy can be larger than the parent policy

Page 17 of 18

161. The protocol number of AH protocol is 50.

True

False

162. When deploying Eth-Trunk on the firewall heartbeat line, as long as the total bandwidth of the Eth-Trunk active links is greater than 30% of the bandwidth required for business traffic, the Eth-Trunk can be set as a Layer 2 interface.

True

False

163. For terminals that access the network through wired methods, MAC bypass authentication requires one more 802.1X authentication step than ordinary MAC authentication. When 802.1X authentication fails, MAC authentication will be tried again.

True

False

164. Huawei iMaster NCE-Cam p us is a Web-based centralized management and control system of the ClouCampus solution. It supports user access management and can serve as multiple types of authentication servers. But which of the following types of servers cannot be used?

HWTACACS server

RADIUS server

AD server

Portal server

165. Which of the following are characteristics of virtual systems? (Multiple choice)

Each virtual system has independent configuration and routing table entries

Each virtual system is managed by an independent administrator

Traffic between virtual systems is isolated from each other, making it safer

Fixed system resources need to be allocated to each virtual system

166. In order to prevent internal employees from making inappropriate remarks on the Internet, which of the following content security filtering technologies can be deployed on fire prevention training 9

Content filtering

File filtering

Email filtering

Application behavior

167. Which of the following is a probe protocol that health checks cannot support?

RADIUS

CHCMP

DNS

UDP

168. Which of the following descriptions of virtual interfaces is incorrect?

Mutual access between virtual systems is achieved through virtual interfaces

The link layer and protocol layer of the virtual interface are always UP

The virtual interface of the root system is Virtual-if1

The format of the virtual interface is "Virtual-if+interface number"

169. Please sort the following first-time authentication process for MAC priority Portal authentication.

170. System starts traffic statistics

3-4-2-1

4-2-3-1

2-4-3-1

4-3-2-1

Page 18 of 18

171. Which of the following descriptions about the Anti-DDos detection center are correct? (Multiple choice)

Traffic can be copied to the detection center by deploying traffic mirroring

The testing center only supports application-based packaging testing technology

The detection center will report the abnormal traffic to the management center after discovering it.

Traffic can be copied to the detection center by deploying a distribution device in the network

172. Which of the following descriptions of outbound traffic in the firewall virtual system is correct?

Traffic flowing from the private network interface to the public network interface is limited by the bandwidth in the inbound direction.

Traffic flowing from the public network interface to the private network interface is limited by the bandwidth in the inbound direction.

Traffic flowing from the private network interface to the public network interface is limited by the outbound bandwidth.

Traffic flowing from the public network interface to the private network interface is limited by the outbound bandwidth.

TAGS:

H12-725_V4.0-ENU, H12-725_V4.0-ENU exam dumps

Notify of

Label

Name*

Email*

Website

Label

Name*

Email*

Website

0 Comments

Oldest

Newest Most Voted

Inline Feedbacks

View all comments

Posts

Huawei Free Dumps

Get H12-725_V4.0-ENU Dumps Full Version

Q&As: 567
Versions: PDF and Software Download Now

About Dumpsinfo

Dumpsinfo is a good platform providing the latest exam information and dumps questions for all IT certification exams. You can study all the latest exam dumps questions online.

[email protected]

Mon - Sat 9:00am - 6:00pm

H12-725_V4.0-ENU Dumps Help You Study Objectives

Related

Posts

Valid H12-831_V1.0-ENU Exam Dumps are Your best Choice to Pass

Get Certified Easily with Online H19-401_V1.0 Dumps

Test Online H11-851_V3.0-ENU Dumps Questions to Be Certified

Valid H19-338_V3.0 Exam Dumps are Your best Choice to Pass

About Us

EMAIL

Services

Opening Hours