Regarding the 3 abnormal situations of the file type recognition result, which of the following option descriptions is wrong?

Unrecognized file type means that the file type cannot be recognized, and the file extension cannot be recognized.

File extension mismatch means that the file type is inconsistent with the file extension.

Unrecognized file type means that the file type cannot be recognized and there is no file extension.

File damage means that the file type cannot be identified because the file is damaged.

Unrecognized file type means that the file type cannot be recognized, and the file extension cannot be recognized.

Regarding intrusion prevention, which of the following option descriptions is wrong

Intrusion prevention technology, after discovering an intrusion, the firewall must be linked to prevent the intrusion

Intrusion prevention is a new security defense technology that can detect and prevent intrusions.

Intrusion prevention is a security mechanism that detects intrusions (including buffer overflow attacks, Trojan horses, worms, etc.) by analyzing network traffic

Intrusion prevention can block attacks in real time.

Intrusion prevention technology, after discovering an intrusion, the firewall must be linked to prevent the intrusion

Abnormal detection is to establish the normal behavior characteristic profile of the system subject through the analysis of the audit data of the system: check if the audit data in the system If there is a big discrepancy with the normal behavior characteristics of the established subject, it is considered an intrusion. Nasu must be used as the system subject? (multiple choice)

A key program and file in the system

Which of the following options is correct for the description of the Anti DDoS system configuration?

Add protection objects on the management center.

Configure drainage and re-injection on the testing equipment.

Configure port mirroring on the cleaning device.

Add protection objects on the management center.

Configure drainage and re-injection on the management center.

Which of the following options is not a defense against HTTP Flood attacks?

HTTP Flood source authentication

URI source fingerprint learning function

The administrator has made the following configuration:

The signature set Protect_ all includes the signature ID3000, and the overall action of the signature set is to block.

The action of overwriting signature ID3000 is an alarm.

The action of signing iD3000 is an alarm

The action of signing ID3000 is to block

Unable to determine the action of signature ID3000

The signature set is not related to the coverage signature

Which three aspects should be considered in the design of cloud platform security solutions?(multiple choice)

How to do a good job in management, operation and maintenance

Regarding the anti-spam local black and white list, which of the following statements is wrong?

The black and white list is matched by the sender's dns suffix

The black and white list is matched by extracting the destination IP address of the SMTP connection

The black and white list is matched by the sender's dns suffix

The black and white list is matched by extracting the source IP address of the SMTP connection 155955cc-666171a2-20fac832-0c042c0419

If the source IP address of the SMTP connection matches the blacklist, the connection will be blocked

Which of the following options is not a feature of Trojan horses?

Not self-replicating but parasitic

Trojans self-replicate and spread

The ultimate intention is to steal information and implement remote monitoring

Regarding the sequence of the mail transmission process, which of the following is correct?

The sender SMTP Server encapsulates the mail information in an SMTP message and sends it to the receiver SMTP Server according to the destination address of the mail 3. The sender SMTP Server encapsulates the mail information in an SMTP message according to the destination address of the mail and sends it to the receiver POP3/MAP Senver 4. The recipient sends an email.

The sender PC sends the mail to the designated SMTP Server.

The sender SMTP Server encapsulates the mail information in an SMTP message and sends it to the receiver SMTP Server according to the destination address of the mail 3. The sender SMTP Server encapsulates the mail information in an SMTP message according to the destination address of the mail and sends it to the receiver POP3/MAP Senver 4. The recipient sends an email.

In order to protect the security of data transmission, more and more websites or companies choose to use SSL to encrypt transmissions in the stream. About using Huawei NIP6000 The product performs threat detection on (SSL stream boy, which of the following statements is correct?

After the process of "decryption", "threat detection", and "encryption"

NIP0OO does not support SSL Threat Detection.

The traffic after threat detection is sent directly to the server without encryption

NIP can directly crack and detect SSL encryption.

After the process of "decryption", "threat detection", and "encryption"

If a company wants to detect image files, Shellcode code files and PDF files, which of the following types of sandboxes can be used? (More 155955cc-666171a2-20fac832-0c042c0420 select)

Heavyweight sandbox (virtual execution)

The administrator of a certain enterprise wants employees of Yangzhi to visit the shopping website during working hours. So a URL filtering configuration file is configured to divide the predefined The shopping website in the category is selected as blocked. But employee A can still use the company's network to shop online during lunch break. Then what are the following possible reasons some?

The shopping website does not belong to the predefined shopping website category

The administrator did not submit the configuration after completing the configuration.

The administrator has not applied the URL pass-through configuration file to the security policy.

The administrator has not set the time to vote every day from 9:00 to 18:00

The shopping website does not belong to the predefined shopping website category

The administrator did not submit the configuration after completing the configuration.

The administrator has not applied the URL pass-through configuration file to the security policy.

Which of the following features does Huawei NIP intrusion prevention equipment support? (multiple choice)

Application identification and control

Regarding the processing process of file overwhelming, which of the following statements is correct?

If all the parameters of Wenzhu can match all file filtering rules, then the module will execute the action of this file filtering rule.

The file filtering module will compare the application type, file type, and transmission direction of the file identified by the previous module with the file filtering rules configured by the administrator.Then the lookup table performs matching from top to bottom.

If all the parameters of Wenzhu can match all file filtering rules, then the module will execute the action of this file filtering rule.

There are two types of actions: warning and blocking.

If the file type is a compressed file, then after the file filtering check, the female file will be sent to the file decompression module for decompression and decompression.Press out the original file. If the decompression fails, the file will not be re-filed.

Anti-DDoS defense system includes: management center, detection center and cleaning center.

True155955cc-666171a2-20fac832-0c042c0421

Regarding HTTP behavior, which of the following statements is wrong?

When the uploaded or downloaded file size, POST operation content size reaches the blocking threshold, the system will only block the uploaded or downloaded file, POST operate.

HTTP POST is generally used to send information to the server through a web page, such as forumposting x form submission, username I password login.

When the file upload operation is allowed, the alarm threshold and blocking threshold can be configured to control the size of the uploaded file.

When the size of the uploaded or downloaded file and the size of the content of the POST operation reach the alarm threshold, the system will generate log information to prompt the device management And block behavior.

When the uploaded or downloaded file size, POST operation content size reaches the blocking threshold, the system will only block the uploaded or downloaded file, POST operate.

For Huawei USG600 products, which of the following statements about mail filtering configuration is correct?

You can control the size of the attachment of the received mail

Cannot control the number of received email attachments

When the spam processing action is an alert, the email will be blocked and an alert will be generated

You can control the size of the attachment of the received mail

Cannot perform keyword filtering on incoming mail

For the basic mode of HTTP Flood source authentication, which of the following options are correct?(multiple choice)

The basic mode can effectively block the access from the Feng Explor client.

The bot tool does not implement a complete HTTP protocol stack and does not support automaticredirection, so the basic mode can effectively defend against HTTP Flood attacks.hit.

The basic mode can effectively block the access from the Feng Explor client.

The bot tool does not implement a complete HTTP protocol stack and does not support automaticredirection, so the basic mode can effectively defend against HTTP Flood attacks.hit.

When there is an HTTP proxy server in the network, the firewall will add the IP address of theproxy server to the whitelist, but it will recognize the basic source of the zombie host.The certificate is still valid.

The basic mode will not affect the user experience, so the defense effect is higher than the enhanced mode.

What are the typical technologies of anti-virus engines (multiple choice)

First package detection technology

File reputation detection technology 5

First package detection technology

File reputation detection technology 5

The administrator has defined two key words that need to be recognized on the firewall: the weight of the keyword x is 2, and the weight of the key y is 3: defined The alarm interval value from the content is 5, and the blocking threshold value is 10. If the device detects that there is a secondary key space x in the webpage created by the user, the two keywords are Y; Regarding the weight value and monthly household visits to Heshun Street, is the following statement correct?

The weight value is 8, you can visit the web page

The weight value is 10, and the page cannot be accessed

The weight value is 8, the page cannot be accessed

The weight value is 10, you can ask the web page before

Tianyu Nei answered the role of safety filtering technology, which of the following is still correct?(multiple choice)

File filtering can reduce the risk of malicious code execution and virus infection in the internal network by blocking the transmission of fixed types of files, and it can also prevent Prevent employees from leaking company confidential documents to the Internet.

Content filtering can prevent the disclosure of confidential information and the transmission of illegal information

The application behavior control function can finely control common HTTP behaviors and FTPbehaviors.

Mail filtering refers to the management and control of mail sending and receiving, including preventing the flooding of spam and anonymous emails, and controlling the sending and receiving of illegal emails.

File filtering can reduce the risk of malicious code execution and virus infection in the internal network by blocking the transmission of fixed types of files, and it can also prevent Prevent employees from leaking company confidential documents to the Internet.

Content filtering can prevent the disclosure of confidential information and the transmission of illegal information

The application behavior control function can finely control common HTTP behaviors and FTPbehaviors.

Mail filtering refers to the management and control of mail sending and receiving, including preventing the flooding of spam and anonymous emails, and controlling the sending and receiving of illegal emails.

In the following options, which of the two attacks use similar attack methods, they will generate a large number of useless response packets, occupying network bandwidth, Consume equipment resources?

Fraggle and Land155955cc-666171a2-20fac832-0c042c0423

With the continuous development of the network and the rapid development of applications, companies are making users more and more frequently start to transfer files on the network.Virus threats are becoming more and more serious. Only by rejecting the virus outside the network can data security and system stability be guaranteed. So, which of the following are What harm might be caused by illness? (multiple choices)

Threaten the security of the user's host and network.

Some viruses can be used as intrusion tools, such as Trojan horse viruses,

Control the host computer's accumulated limit and the user's data, and some viruses may even cause damage to the host's hardware.

Threaten the security of the user's host and network.

Some viruses can be used as intrusion tools, such as Trojan horse viruses,

Control the host computer's accumulated limit and the user's data, and some viruses may even cause damage to the host's hardware.

Can easily pass the defense of Huawei USG6000 products

Which of the following options describes the IntelliSense engine IAE incorrectly?

The security detection of the IAE engine is parallel, using a message-based file processing mechanism, which can receive file fragments and perform security checks.

lAE's content security detection functions include application identification and perception, intrusion prevention, and Web application security.

Full English name: intelligent Awareness Engine.

The core of C.IAE is to organically centralize all content security-related detection functions.

The security detection of the IAE engine is parallel, using a message-based file processing mechanism, which can receive file fragments and perform security checks.

Huawei H12-724 Practice Test 3 - Free Online Exam Prep & Questions

Which of the following behaviors is a false positive of the intrusion detection system?

Huawei H12-724 Practice Test 3

Question

Huawei H12-724 Practice Tests

Practice Tests