Huawei HCIE-Security (Huawei Certified Internetwork Expert-Security) 認定 H12-731-ENU 試験問題:

1. What protocols and ports need to be opened when the firewall uses the IPsec function?

A) UDP packet with destination port 1701.
B) UDP packets with destination ports 500 and 4500.
C) IP packets whose protocols are AH and ESP.
D) UDP packets with source ports 500 and 4500.

2. In the dual-system hot-standby network, the service interface works at Layer 3, the upstream and downstream are connected to the router, the firewall and the upstream and downstream run an OSPF process, which provides the dual-system hot-standby burden sharing network, and the firewall provides the NAT function. The following Incorrect planning deployment advice:

A) Enable HRP to adjust OSPF COST function.
B) Configure a static black hole route (network segment route) in the NAT address pool, import it into OSPF and advertise it.
C) For consistency of uplink and downlink status, the firewall's uplink and downlink interfaces are added to the same Link-Group.
D) Allows the packet filtering policy between the domain where the heartbeat port Eth-Trunk is located and the local domain, so as to allow heartbeat packets to pass.

3. When the firewall runs GRE, both the physical port and the tunnel port need to be added to the security zone.

A) TRUE
B) FALSE

4. For the description of NAT Server, which is correct?

A) NAT Server cannot be configured on the virtual firewall for users of the root firewall.
B) If the public network address of the NAT Server and the corresponding public network interface address are in the same network segment, you do not need to configure black hole routing.
C) If the public network address of the NAT Server is the interface address, if the black hole route of this address is configured, the service access to the firewall itself will be abnormal.
D) If the public network address of the NAT Server and the corresponding public network interface address are not in the same network segment, you do not need to configure black hole routing.

5. A company has the following requirements:
The intranet users in the Trust area are on the 192.168.1.0/24 network segment and can access the Internet. There are a total of 50 hosts (192.168.1.1-192.168.1.50) with a total curtain of 500M.
The following plans are reasonable:

A) The overall bandwidth is limited to 400M, and the maximum bandwidth per IP is 12M.
B) The overall bandwidth is limited to 500M, and the maximum bandwidth of 192.168.1.1-192.168.1.50 per IP is 12M.
C) The overall bandwidth is limited to 500M, and the maximum bandwidth of each IP is 12M.
D) The overall belt curtain is limited to 500M, the guaranteed belt curtain is 500M, and the maximum belt curtain per IP is 10M.

質問と回答：