H12-731-ENU by Huawei Valid Free Exam Practice Test

Question 1

Which of the following is correct for the functional comparison of NIP5000 and NIP5000D:

A. NIP5000 can analyze, limit and block specific application protocol traffic; NIP5000D can only analyze application traffic. B. NIP5000 is generally connected directly, and NIP5000D is generally connected by bypass. C. Regarding DDOS, NIP5000 supports two defense modes: automatic defense and no defense, while NIP5500D can only support automatic defense. D. The NIP5000 can be directly connected to the female, while the NIP5000D must be linked through the firewall to achieve the blocking action.

Correct Answer: A,B,D

Question 2

For the admission control of the existing wired network, the SACG authentication scheme is recommended. What are the advantages?

A. Client installation is not required. B. Can support all types of terminals. C. No need to change the existing network topology. D. Fault escape can be achieved with proper policy configuration.

Correct Answer: C,D

Question 3

The following HWTACACS configuration has been made on the firewall:
<sysname> system-view
[sysname] hwtacacs-server template server1
[sysname-hwtacacs-server1] hwtacacs-server authentication 3.3.3.3 10000
[sysname-hwtacacs-server1] hwtacacs-server accounting 3.3.3.3 10010
Please point out the problem in this configuration:

A. The authorization server is not configured. B. Authentication and accounting servers should not use the same IP address. C. The port number used by the configured authentication server is incorrect. D. The port number used to configure the accounting server is incorrect.

Correct Answer: A

Question 4

Which of the following options fall under the scope of visitor management?

A. The guest uses the account to authenticate B. Visitor online behavior audit C. Guest Account Creation D. Visitors register on the registration page E. Visitor page customization F. Guest Account Approval

Correct Answer: B,C,E,F

Question 5

Use NGFW for SSL VPN connection, use certificate authentication, certificate can be selected, but after clicking login, you cannot log in to the resource page. After using debug check on NGFW, it prompts that the certificate is wrong.
<NGFW>debugging ssl error
<NGFW>terminal debugging
<NGFW>terminal monitor
*0.10012266 USG2130 SSL/7/error:
SSL 3.0, Alert, write, fatal bad certificate
But check that the certificate is complete and the contents of the certificate are correct.
What are the possible reasons for this certificate validation error?

A. When the certificate expires, the system clock is not the current time, but is configured within the certificate's validity period. B. The system clock is correct, but the certificate has expired. C. A browser that does not support SSL3.0 is used. D. The certificate is within the validity period, but the system clock is wrong, and the system clock is not within the validity period.

Correct Answer: B,D

Question 6

Regarding the authentication mode of 802.1X, which of the following descriptions are correct?

A. 802.1X authentication mode is divided into interface-based and MAC-based. B. From the point of view of the authentication requirements for all access users, the MAC-based mode is more secure than the port-based mode. C. From the point of view of the authentication requirements for all access users, the port-based mode is more secure than the MAC-based mode. D. Under the same interface, port-based and MAC-based modes can be enabled at the same time.

Correct Answer: A,B

Question 7

Regarding SACG's built-in ACL, which of the following statements are correct?

A. The administrator needs to customize the ACL (number 3100~3999) rules to control the permissions of different access users. B. The default ACL rule group number can only be 3099. C. Since SACG needs to use ACL3099~3999 to receive the rules issued by the TSM system, it is necessary to ensure that these ACLs are not referenced by other functions before configuring TSM linkage. D. The default ACL rule group number can be arbitrarily specified.

Correct Answer: B,C

Question 8

A company has the following requirements:
The intranet users in the Trust area are on the 192.160.1.0/24 network segment and can access the Internet.
Which of the following configurations are correct:
traffic-policy
profile trust_tountrust
bandwidth downstream
maximum-bandwidth 400000
bandwidth downstream
guaranteed-bandwidth 50000
bandwidth ip-car downstream
maximum-bandwidth per-ip 2000
rule name trust_to_untrust
source-zone trust
destination-zone untrust
source-address 192.160.1.0 24
action qos profile
trust_to_untrust
#

A. This configuration will enable Trust intranet users to actively access the Internet outside the Internet and limit the total maximum download bandwidth to 400M. B. This configuration will implement the download traffic in the direction from Trust to Untrust, and the maximum bandwidth per IP is 2M. C. This configuration will implement speed limit for Internet addresses to actively access the intranet segment. D. This configuration will achieve an overall upload bandwidth of 50M for intranet 192.168.1.0/24 users.

Correct Answer: A,B

Question 9

Which statement about MTU and PMTU is correct?

A. PMTU detection is to obtain the PMTU value of the specified destination IPv4 address through detection, and then use the MTU value to send packets. B. MTU (Maximum Transfer Unit) refers to the size of the largest data packet that can be transmitted in the network, in bytes. C. The device will check the MTU on the inbound interface, and if the packet size exceeds the MTU value, it will be discarded. D. In an IP network, interfaces with different MTU values may be passed from the source address to the destination address, and the largest MTU value is the PMTU of the path.

Correct Answer: A,B

Question 10

Intranet users can access the Internet normally, and dual links are used for master and backup backup.
For Internet users, the FTP server can be accessed through the public network address. Two public network addresses are announced, 200.1.1.200 and 202.1.1.200.
Which of the following configuration is correct?

A. [USG] nat server s1 zone untrust1 protocol global 200.1.1.200 ftp inside 192.168.1.254 ftp [USG] nat server s2 zone untrust2 protocol global 202.1.1.200 ftp inside 192.168.1.254 ftp B. [USG] nat server s1 protocol tcp global 200.1.1.200 ftp inside 192.168.1.254 ftp [USG] nat server s2 protocol tcp global 202.1.1.200 ftp inside 192.168.1.254 ftp C. [USG] ip-link check enable [USG] ip-link 1 destination 202.1.1.2 interface GigabitEthernet 0/0/2 mode icmp [USG] ip route-static 0.0.0.0 0.0.0.0 200.1.1.2 [USG ] ip route-static 0.0.0.0 0.0.0.0 200.1.1.2 preference 70 track ip-link 1 D. USG] ip-link check enable [USG] ip-link 1 destination 200.1.1.2 interface GigabitEthernet 0/0/2 mode icmp [USG] ip route-static 0.0.0.0 0.0.0.0 200.1.1.2 track ip- link 1 [USG] ip route-static 0.0.0.0 0.0.0.0 200.1.1.2 preference 70

Correct Answer: A,D

Question 11

When the firewall runs GRE, which three parameters must be configured on the tunnel interface?

A. key B. source IP address of the tunnel C. The protocol number of the tunnel is GRE D. Checksum enable for GRE E. Destination IP address of the tunnel

Correct Answer: B,C,E

Question 12

Configure the firewall as follows:
[USG-policy-security] rule name Trust Local
[USG-policy-security-rule-Untrust Local] source-zone trust
[USG-policy-security-rule-Untrust Local] destination-zone local
[USG-policy-security-rule-Untrust Local] source-address 192.168.5.2 32
[USG-policy-security-rule-Untrust Local] destination-address 192.168.5.1 32
[USG-policy-security-rule-Untrust Local] service http
[USG-policy-security-rule-Untrust Local] service telnet
[USG-policy-security-rule-Untrust Local] action permit
Please select the correct description below:

A. Allow the 192.168.5.2/24 address segment to log in to the firewall via Web. B. Allow the firewall to log in to the device at 192.168.5.1 through the Web. C. Allow the firewall to log in to the device at 192.168.5.1 through Telnet. D. Allow the IP address 192.168.5.2/24 to log in to the firewall through Telnet.

Correct Answer: A,D

Question 13

Which of the following networking is not included in the common networking modes of the NIP5000?

A. Bypass deployment B. One-arm deployment C. In-Line Deployment D. Dual Arm Deployment

Correct Answer: D

Question 14

A network deploys the AntiDdos cleaning equipment at the network nodes in a bypass mode, and conducts bidirectional drainage and cleaning for the traffic drawn to the cleaning equipment.
The following networking is correct:

A.

B.

C.

D.

Correct Answer: A

Question 15

The following configuration, when the physical state of interface G0/0/1 goes down, what will happen to the switch switch?
PC ----------------- (G0/0/1) FW (G0/0/2) ---------------- Switch
#
interface GigabitEthernet0/0/1
link-group 1
interface GigabitEthernet0/0/2
link-group 1
#

A. The ARP entry of the Switch interface address will be aged out. B. The ARP entry of the Switch interface address is immediately deleted. C. No change. D. The firewall sends gratuitous ARP to the upstream device Switch to update the MAC address.

Correct Answer: B

Huawei HCIE-Security (Huawei Certified Internetwork Expert-Security) - H12-731-ENU Exam Practice Test