Huawei HCIE-Security (Huawei Certified Internetwork Expert-Security) 認定 H12-731-ENU 試験問題:

1. Which of the following statements about BFD is correct?

A) The BFD protocol specifies that the sending interval and receiving interval are in milliseconds.
B) BFD can detect indirect links.
C) Implement link detection based on ICMP echo request or ARP request.
D) Can be linked with policy routing, OSPF, DHCP, FRR, static routing, etc.

2. Which of the following statements about Unified Threat Management is true?

A) With the development of UTM technology, UTM devices gradually begin to completely replace traditional firewalls.
B) Solve the problem of current serial device deployment, such as firewall devices, IPS devices, AV devices, etc. are connected in series on a link.
C) The unified threat management device integrates firewall, IPS, AV, AS, Internet behavior management and other functions.
D) In the use of users, the management and investment of network equipment is reduced, and network management personnel only need to master the use and management skills of a single device.

3. When the Linux host passes through the tracert of the USG firewall for a certain destination IP address, it is found that * is displayed from the hop of the firewall, but the network is confirmed to be no problem. In order to make the firewall itself and the devices behind the firewall truly display the IP address , Which of the following must be configured on the firewall?

A) undo firewall defend tracert enable
B) Packet filtering policy that allows icmp packets to be forwarded through the firewall
C) Packet filtering policy that allows udp packets to be forwarded through the firewall
D) undo ip ttl-expires enable

4. IPsec tunnel communication is used between the headquarters and branch offices, in order to ensure the security of data transmission on the Internet. The administrator uses the dual-system hot backup function to improve the reliability of the communication between the headquarters and the branch offices, so as to avoid the failure of one USG in the headquarters and the failure of the branch offices to access the headquarters.
According to the following network diagram, which of the following statements is correct?

A) USG A , USG_B must enable NAT traversal.
B) Only IPsec dual-system hot backup in active/standby backup mode can be used.
C) USG A , USG_B and USG_C only need to configure the route of the Internet, and there is no need to configure the route between the branch intranet and the headquarters intranet in USG_A , USG_B and USG_C.
D) Only ESP and Tunnel mode encapsulation can be used.

5. By viewing the configuration information of a USG firewall running normally on the live network, the following information is obtained:
#
ip service-set http 8080 type object
service 0 protocol tcp destination-port 8080
#
security-policy
rule name untrust_to_dmz1
source-zone untrust
destination-zone dmz
service ftp
destination-address 192.168.5.3
32
action permit
rule name un trust_to_dmz2
source-zone untrust
destination-zone dmz
service service-set http_8080
destination-address 192.168.5.2
32
action permit
#
Which of the following statements is incorrect:

A) External network users can use non-21 port to establish ftp connection with the server whose address is 192.168.5.3.
B) External network users can use port 21 to establish an ftp connection with the server whose address is 192.168.5.3.
C) External network users can access the destination port 8080 of the server whose address is 192.168.5.2.
D) External network users can use port 80 to access the www service of the server whose address is 192.168.5.2.

質問と回答：