Which of the following descriptions about the black and white lists in spam filtering is wrong? c

The priority of the blacklist is higher than that of the whitelist.

Set local blacklist and whitelist: Both blacklist and whitelist can be configured at the same time, or only one of them can be configured.

In the "Whitelist" text box, enter the P address and mask of the SMTP Server to be added to the whitelist. You can enter multiple IP addresses, one IP address Address one line. v

Enter the IP address and mask of the SMITP Server to be added to the blacklist in the "Blacklist" text box, you can enter multiple IP addresses, one IP Address one line.

The priority of the blacklist is higher than that of the whitelist.

For the URL is htpt://www.abcd. com:8080/news/education. aspx?name=tom&age=20, which option is path?

htttp://www.abcd. com:8080/news/education. aspx

/news/education. aspx?name=tom&age=20

Which of the following options are correct for the configuration description of the management center ATIC? (multiple choice)

The drainage task needs to be configured on the management center, and when an attack is discovered, it will be issued to the cleaning center.

It is necessary to configure the protection object on the management center to guide the abnormal access flow in etpa

The drainage task needs to be configured on the management center, and when an attack is discovered, it will be issued to the cleaning center.

It is necessary to configure the protection object on the management center to guide the abnormal access flow in etpa

Port mirroring needs to be configured on the management center to monitor abnormal traffic.155955cc-666171a2-20fac832-0c042c0411

The reinjection strategy needs to be configured on the management center to guide the flow after cleaning. Q:

The network-based intrusion detection system is mainly used to monitor the information of the critical path of the network in real time, listen to all packets on the network, collect data, and divide Analyze the suspicious object, which of the following options are its main features? (multiple choices)

Good concealment, the network-based monitor does not run other applications, does not provide network services, and may not respond to other computers, so Not vulnerable to attack.

The monitoring speed is fast (the problem can be found in microseconds or seconds, and the hostbased DS needs to take an analysis of the audit transcripts in the last few minutes

Good concealment, the network-based monitor does not run other applications, does not provide network services, and may not respond to other computers, so Not vulnerable to attack.

The monitoring speed is fast (the problem can be found in microseconds or seconds, and the hostbased DS needs to take an analysis of the audit transcripts in the last few minutes

It can detect the source address and destination address, identify whether the address is illegal, and locate the real intruder.

Analysis is the core function of intrusion detection. The analysis and processing process of intrusion detection can be divided into three phases; build an analyzer to perform analysis on actual field data.Which of the analysis, feedback and refinement is the function included in the first two stages?

Data processing, data classification, post-processing

Data analysis, data classification, post-processing

Data processing, data classification, post-processing

Data processing, attack classification, post-processing

Data processing, data classification, attack playback

The results of the RBL black and white list query on the firewall are as follows: Based on the above information only, which of the following statements is correct? (multiple choice)

Mail with source address 10.17.1.0/24 will be released

Mail with source address 10.18.1.0/24 will be released

Mail with source address 10.17.1.0/24 will be blocked

Mail with source address 10.18.1.0/24 will be blocked

Mail with source address 10.17.1.0/24 will be released

Mail with source address 10.18.1.0/24 will be released

Which of the following options is not a special message attack?

ICMP redirect message attack) 0l

Regarding worms and viruses, which of the following statements is correct?

The target of the worm infection is other computer systems on the network.

Worms exist in a parasitic way155955cc-666171a2-20fac832-0c042c0413

Viruses mainly rely on system vulnerabilities to spread

The target of the worm infection is other computer systems on the network.

The virus exists independently in the computer system.

Which of the following options will not pose a security threat to the network?

Open company confidential files

Failure to update the virus database in time

Regarding computer viruses, which of the following options is correct?

Computer viruses are latent, they may be latent for a long time, and only when they encounter certain conditions will they begin to carry out sabotage activities

Patching the system can completely solve the virus intrusion problem

Computer viruses are latent, they may be latent for a long time, and only when they encounter certain conditions will they begin to carry out sabotage activities

Computer viruses are contagious. They can spread through floppy disks and CDs, but they will not spread through the Internet.

All computer viruses must be parasitic in files and cannot exist independently

Regarding the description of file reputation technology in anti-virus engines, which of the following options is correct?

File reputation is to perform virus detection by calculating the full text MD5 of the file to be tested and matching it with the local reputation MD5 cache

Local reputation MD5 cache only has static cache, which needs to be updated regularly

File reputation database can only be upgraded by manual upgrade

File reputation is to perform virus detection by calculating the full text MD5 of the file to be tested and matching it with the local reputation MD5 cache

File reputation database update and upgrade can only be achieved through linkage with sandbox

Since the sandbox can provide a virtual execution environment to detect files in the network, the sandbox can be substituted when deploying security equipment Anti-Virus, IPS, spam detection and other equipment.

True155955cc-666171a2-20fac832-0c042c0414

Which of the following options is not a cyber security threat caused by weak personal security awareness?

Increasing the cost of enterprise network operation and maintenance

Disclosure of personal information

Threats to the internal network

Increasing the cost of enterprise network operation and maintenance

In the anti-virus policy configuration of Huawei USG6000 product, what are the response methods of HTTP protocol? (multiple choice)

All access to the client is prohibited

The user needs of a university are as follows:

The environment is large, and the total number of two-way traffic can reach 800M. Huawei USG6000 series firewall is deployed at its network node.

At the same time, some pornographic websites in the student area are prohibited.The external network has been configured as an untrust zone and the internal network has been configured as a trust zone on the firewall. How to configure the firewall to meet the above requirements?155955cc-666171a2-20fac832-0c042c0415

You can directly turn on the AV, IRS protection functions, and URL filtering functions in the global environment to achieve the requirements

The environment is large, and the total number of two-way traffic can reach 800M. Huawei USG6000 series firewall is deployed at its network node.

The intranet is divided into student area, server area, etc., users are most concerned about the security of the server area to avoid attacks from various threats.

At the same time, some pornographic websites in the student area are prohibited.The external network has been configured as an untrust zone and the internal network has been configured as a trust zone on the firewall. How to configure the firewall to meet the above requirements?155955cc-666171a2-20fac832-0c042c0415

You can directly turn on the AV, IRS protection functions, and URL filtering functions in the global environment to achieve the requirements

To the untrust direction, only enable AV and IPS protection functions for the server zone to protect the server

In the direction of untrust to the intranet, only the AV and IPS protection functions are turned on for the server area to protect the server

Go to the untrust direction to open the URL filtering function for the entire campus network, and filter some classified websites

For special message attacks, which of the following option descriptions is correct?

Special control packet attack is a potential attack and does not have direct destructive behavior

The attacker probes the network structure by sending special control messages to launch a real attack.

Special control message attacks do not have the ability to detect the network structure. Only scanning attacks can detect the network.

When the Anti DDoS system finds the attack flow, the state will redirect the attack flow to the cleaning device. After the cleaning device is cleaned, it will flow back.Note to the original link, which of the following options does not belong to the method of reinjection?

Policy routing back annotation,

When configuring the URL filtering configuration file, www.bt.com is configured in the URL blacklistitem:At the same time, set it in the custom URL category.A URL is set as bt.com, and the action of customizing URL classification is a warning. Regarding the above configuration, which of the following statements are correct? (More select)

Users can visit www.videobt.com website.

When users visit www.bt. com, they will be blocked.

Users can visit www.videobt.com website.

The user can visit the www.bt.com website, but the administrator will receive a warning message.

User cannot access all the sites ending with bt com.

When users visit www.bt. com, they will be blocked.

Regarding the statement of the mail protocol, which of the following is correct? (multiple choice)

Using POP3, the client software will download all unread mails to the computer, and the mail server will delete the mails.

With IMAP, users can directly operate on the mail on the server, without downloading all the mails locally to perform various operations.

Using POP3, the client software will download all unread mails to the computer, and the mail server will delete the mails.

Use JIMAP; the client software will download all unread mails to the computer, and the mail server will delete the mails.

With IMAP, users can directly operate on the mail on the server, without downloading all the mails locally to perform various operations.

Using POP3, users can directly operate on the mail on the server without sending all mails to the local to perform various operations.

Which of the following are typical intrusions? "Multiple choice)

Computer is infected by U disk virus

Abnormal power interruption in the computer room

Regarding the enhanced mode in HTTP Flood source authentication, which of the followingdescriptions are correct? Multiple choices

Enhanced mode refers to the authentication method using verification code.

Some bots have a redirection function, or the free proxy used during the attack supports the redirection function, which leads to the failure of the basic mode of defense Effective, enhanced mode can effectively defend.

Enhanced mode refers to the authentication method using verification code.

Some bots have a redirection function, or the free proxy used during the attack supports the redirection function, which leads to the failure of the basic mode of defense Effective, enhanced mode can effectively defend.

The enhanced mode is superior to the basic mode in terms of user experience.

Enhanced mode supports all HTTP Flood source authentication fields. "WWQQ: 922333

Regarding the mail content filtering configuration of Huawei USG6000 products, which of the following statements is wrong?.

When a POP3 message is detected, if it is judged to be an illegal email, the firewall's response action only supports sending alarm information, and will not block the email o

Mail filtering will only take effect when the mail filtering configuration file is invoked when the security policy is allowed.

When a POP3 message is detected, if it is judged to be an illegal email, the firewall's response action only supports sending alarm information, and will not block the email o

When an IMAP message is detected, if it is judged to be an illegal email; the firewall's response action only supports sending alarm messages and will not block the email.

The attachment size limit is for a single attachment, not for the total size of all attachments.

Regarding the enhanced mode in HTTP Flood source authentication, which of the followingdescriptions are correct? Multiple choices

Enhanced mode refers to the authentication method using verification code.

Some bots have a redirection function, or the free proxy used during the attack supports the redirection function, which leads to the failure of the basic mode of defense Effective, enhanced mode can effectively defend.

Enhanced mode refers to the authentication method using verification code.

Some bots have a redirection function, or the free proxy used during the attack supports the redirection function, which leads to the failure of the basic mode of defense Effective, enhanced mode can effectively defend.

The enhanced mode is superior to the basic mode in terms of user experience.

Enhanced mode supports all HTTP Flood source authentication fields. "WWQQ: 922333

Regarding the mail content filtering configuration of Huawei USG6000 products, which of the following statements is wrong?.

When a POP3 message is detected, if it is judged to be an illegal email, the firewall's response action only supports sending alarm information, and will not block the email o

Mail filtering will only take effect when the mail filtering configuration file is invoked when the security policy is allowed.

When a POP3 message is detected, if it is judged to be an illegal email, the firewall's response action only supports sending alarm information, and will not block the email o

When an IMAP message is detected, if it is judged to be an illegal email; the firewall's response action only supports sending alarm messages and will not block the email.

The attachment size limit is for a single attachment, not for the total size of all attachments.

Huawei H12-724 Practice Test 2 - Free Online Exam Questions 41-80

Question 1 / 40

For the description of URPF technology, which of the following options are correct? (multiple choice)

The main function is to prevent network attacks based on source address spoofing.

In strict mode, it does not check whether the interface matches. As long as there is a route to the source address, the message can pass.

The loose mode not only requires corresponding entries in the forwarding table, but also requires that the interface must match to pass the URPF check.

Use URPF's loose mode in an environment where routing symmetry cannot be guaranteed.

Comment (0)

Huawei H12-724 Practice Test 2

Question

Huawei H12-724 Practice Tests

Practice Tests