Regarding firewall and IDS, which of the following statements is correct?

The firewall cannot detect malicious operations or misoperations by insiders

The firewall is a bypass device, used for fine-grained detection

IDS is a straight line equipment and cannot be used for in-depth inspection

The firewall cannot detect malicious operations or misoperations by insiders

IDS cannot be linked with firewall

The following figure shows the configuration of the URL filtering configuration file. Regarding the configuration, which of the following statements is correct?

Assuming that the user visits the www.exzample.com website, which belongs to the categories of humanities and social networks at the same time, the user cannot access the website.

The firewall will first check the blacklist entries and then the whitelist entries.

Assuming that the user visits the www.exzample.com website, which belongs to the categories of humanities and social networks at the same time, the user cannot access the website.

The user visits the website www.exzample.com, and when the black and white list is not hit, the next step is to query the predefined URL category entry.

The default action means that all websites are allowed to visit. So the configuration is wrong here.

The whitelist rule of the firewall anti-virus module is configured as ("*example*, which of the following matching methods is used in this configuration?

Suffix matching155955cc-666171a2-20fac832-0c042c043

Regarding the processing flow of file filtering, which of the following statements is wrong?

After the file decompression fails, the file will still be filtered. .

The application identification module can identify the type of application that carries the file.

Protocol decoding is responsible for analyzing the file data and file transmission direction in the data stream.

The file type recognition module is responsible for identifying the true type of the file and the file extension based on the file data

Misuse detection is through the detection of similar intrusions in user behavior, or those that use system flaws to indirectly violate system security rules To detect intrusions in the system. Which of the following is not a feature of misuse detection 2

Effective detection of impersonation detection of legitimate users

In the penetration stage of an APT attack, which of the following attack behaviors will the attacker generally have?

The attacker sends a C&C attack or other remote commands to the infected host to spread the attack horizontally on the intranet.

Long-term latency and collection of key data.

Leak the acquired key data information to a third party of interest 155955cc-666171a2-20fac832-0c042c044

Through phishing emails, attachments with 0day vulnerabilities are carried, causing the user's terminal to become a springboard for attacks.

The attacker sends a C&C attack or other remote commands to the infected host to spread the attack horizontally on the intranet.

Which of the following attacks are attacks against web servers? (multiple choices)

Cross-site scripting attacks 2335

Which of the following is the correct configuration idea for the anti-virus strategy?

Configure security policy and reference AV Profile

In the security protection system of the cloud era, reforms need to be carried out in the three stages before, during and after the event, and a closed-loop continuous improvement should be formed.And development. Which of the following key points should be done in "things"? (multiple choice)

Fight back against hackers155955cc-666171a2-20fac832-0c042c045

Offensive and defensive situation

Fight back against hackers155955cc-666171a2-20fac832-0c042c045

Huawei NIP6000 products provide carrier-class high-reliability mechanisms from multiple levels to ensure the stable operation of equipment.Which of the following options belong to the network reliability? (multiple choice)

Power supply. 1+1 redundant backup

Which of the following options are common reasons for IPS detection failure? (multiple choices)

IPS policy is not submitted for compilation

False Policy IDs are associated with IPS policy domains

The IPS function is not turned on

IPS policy is not submitted for compilation

False Policy IDs are associated with IPS policy domains

The IPS function is not turned on

Bypass function is closed in IPS

Regarding the file filtering technology in the USG6000 product, which of the following options is wrong?

It can identify the type of files transmitted by itself, and can block, alert and announce specific types of files.

It can identify the application that carries the file, the file transfer direction, the file type and the file extension.

Even if the file type is modified, it can also identify the true type of the file

It can identify the type of files transmitted by itself, and can block, alert and announce specific types of files.

It supports filtering the contents of compressed files after decompression. "

Based on the anti-virus gateway of streaming scan, which of the following descriptions is wrong?

The detection rate is higher than the proxy-based scanning method

Rely on state detection technology and protocol analysis technology

The performance is higher than the agent-based method

The cost is smaller than the agent-based approach

The detection rate is higher than the proxy-based scanning method

Regarding the strong statement of DNS Request Flood attack, which of the following options is correct?

In the process of source authentication, fire prevention will trigger the client to send DINS request via TCP report to verify the legitimacy of the source IP, but in a certain process It will consume the TCP connection resources of the OINS cache server.

The DNS Request Flood attack on the cache server can be redirected to verify the legitimacy of the source

For the DNS Reguest Flood attack of the authorization server, the client can be triggered to send DINS requests in TCP packets: to verify The legitimacy of the source IP.

In the process of source authentication, fire prevention will trigger the client to send DINS request via TCP report to verify the legitimacy of the source IP, but in a certain process It will consume the TCP connection resources of the OINS cache server.

Redirection should not be implemented on the source IP address of the attacked domain name, and the destination P address of the attacked domain name should be implemented in the wild.

Regarding the anti-spam response code, which of the following statements is wrong?

The response code is specified as 127.0.0.1 in the second system.

The response code will vary depending on the RBL service provider.155955cc-666171a2-20fac832-0c042c046

USG treats mails that match the answer code as spam.

If the response code is not returned or the response code is not configured on the USG, the mail is released.

The response code is specified as 127.0.0.1 in the second system.

The configuration command to enable the attack prevention function is as follows; n [FW] anti-ddos syn-flood source-detect [FW] anti-ddos udp-flood dynamic-fingerprint-learn [FW] anti-ddos udp-frag-flood dynamic fingerprint-learn [FW] anti-ddos http-flood defend alert-rate 2000 [Fwj anti-ddos htp-flood source-detect mode basic Which of the following options is correct for the description of the attack prevention configuration?(multiple choice)

The firewall has enabled the SYN Flood source detection and defense function

The threshold for HTTP Flood defense activation is 2000.

The firewall has enabled the SYN Flood source detection and defense function

The firewall uses the first packet drop to defend against UDP Flood attacks.

HTTP Flood attack defense uses enhanced mode for defense

The threshold for HTTP Flood defense activation is 2000.

Regarding the description of keywords, which of the following is correct? (multiple choice)

Keywords are the content that the device needs to recognize during content filtering.

Keywords include predefined keywords and custom keywords.

Keywords are the content that the device needs to recognize during content filtering.

Keywords include predefined keywords and custom keywords.

The minimum length of the keyword that the text can match is 2 bytes. ,

Custom keywords can only be defined in text mode.

IPS is an intelligent intrusion detection and defense product. It can not only detect the occurrence of intrusions, but also can respond in real time through certain response methods.Stop the occurrence and development of intrusions, and protect the information system from substantial attacks in real time. According to the description of PS, the following items are wrong?

IPS must use bypass deployment in the network

IPS is an intrusion detection system that can block real-time intrusions when found

IPS must use bypass deployment in the network

Common IPS deployment modes are in-line deployment,

The following commands are configured on the Huawei firewall:[USG] firewall defend ip-fragment enableWhich of the following situations will be recorded as an offensive behavior? (multiple choice)

DF, bit is down, and MF bit is also 1 or Fragment Offset is not 0, 155955cc-666171a2-20fac832-0c042c047

DF bit is 0, and Fragment Offset + Length> 65535.

DF, bit is down, and MF bit is also 1 or Fragment Offset is not 0, 155955cc-666171a2-20fac832-0c042c047

DF bit is 023, MF bit is 1 or Fragment Offset is not 0,

DF bit is 0, and Fragment Offset + Length> 65535.

The DF bit is 1, and Fragment Ofset + Length <65535.

For the description of the Anti DDOS system, which of the following options is correct? C

The management center mainly completes the processing of attack events, controls the drainage strategy and cleaning strategy of the cleaning center, and responds to various attack events and attack flows.View in categories and generate reports.

The detection center is mainly to pull and clean the attack flow according to the control strategy of the security management center, and re-inject the cleaned normal flow back to the customer.User network, send to the real destination.

The management center mainly completes the processing of attack events, controls the drainage strategy and cleaning strategy of the cleaning center, and responds to various attack events and attack flows.View in categories and generate reports.

The main function of the Green Washing Center is to detect and analyze DDoS attack traffic on the flow from mirroring or splitting, and provide analysis data to The management center makes a judgment.

The firewall can only be used for inspection equipment

Regarding the global configuration of file filtering configuration files for Huawei USG6000 products, which of the following descriptions is correct?

When the number of compression layers of a file is greater than the configured "Maximum Decompression Layers", the firewall cannot filter the file.

File filtering, content filtering and anti-virus detection cannot be performed when the file is damaged. At this time, the documents can be released or blocked according to business requirements.

When the file extension does not match, if the action is "Allow" or "Alarm", file filtering, content filtering and anti-virus are performed according to the file type Detection.

When the number of compression layers of a file is greater than the configured "Maximum Decompression Layers", the firewall cannot filter the file.

When the file type cannot be recognized, file filtering, content filtering and anti-virus detection are not performed.

In Huawei USG6000 products, IAE provides an integrated solution, all content security detection functions are integrated in a well-designed In the high-performance engine. Which of the following is not the content security detection function supported by this product?

Application recognition and perception

URL classification and filtering

Intrusion prevention 155955cc-666171a2-20fac832-0c042c048

Which of the following options does not belong to the basic DDoS attack prevention configuration process?

System related configuration application, fingerprint learning.

The system starts traffic statistics.

System related configuration application, fingerprint learning.

The system starts attack prevention.

The system performs preventive actions.

Regarding the network intrusion detection system (NIDS), which of the following statements is wrong?

Use the newly received network packet as the data source;

It is mainly used for real-time monitoring of the information of the critical path of the network, listening to all packets on the network, collecting data, and analyzing suspicious objects

Use the newly received network packet as the data source;

Real-time monitoring through the network adapter, and analysis of all communication services through the network;

Used to monitor network traffic, and can be deployed independently.

Cloud sandbox refers to deploying the sandbox in the cloud and providing remote detection services for tenants. The process includes:

Prosecution in the cloud sandboxFor the ordering of the process, which of the following options is correct?

What content can be filtered by the content filtering technology of Huawei USG6000 products?(multiple choice)

Keywords contained in the content of the uploaded file

Keywords contained in the downloaded file

Keywords contained in the content of the uploaded file

Keywords contained in the downloaded file

Regarding the sequence of file filtering technology processing flow, which of the following is correct?(1) The security policy is applied as permit(2) Protocol decoding(3) File type recognition(4) Application recognition(5) File filtering

(1)(2)(3)(4)(5)155955cc-666171a2-20fac832-0c042c049

Which of the following statements about IPS is wrong?

The signature set can contain either predefined signatures or custom signatures. 832335

The priority of the coverage signature is higher than that of the signature in the signature set.

When the "source security zone" is the same as the "destination security zone", it means that the IPS policy is applied in the domain.

Modifications to the PS policy will not take effect immediately. You need to submit a compilation to update the configuration of the IPS policy.

The signature set can contain either predefined signatures or custom signatures. 832335

Due to differences in network environment and system security strategies, intrusion detection systems are also different in specific implementation. From the perspective of system composition, the main Which four major components are included?

Incident extraction, intrusion analysis, intrusion response and remote management.

Event extraction, intrusion analysis, reverse intrusion and remote management.

Incident extraction, intrusion analysis, intrusion response and on-site management.

Incident recording, intrusion analysis, intrusion response and remote management.

Incident extraction, intrusion analysis, intrusion response and remote management.

Huawei H12-724 Practice Test 1 - Free Online Exam Questions 1-40

If the user's FTP operation matches the FTP filtering policy, what actions can be performed? (multiple choice)

Block

Declare

Alarm

Execution

Comment (0)

Huawei H12-724 Practice Test 1

Question

Huawei H12-724 Practice Tests

Practice Tests