Regarding scanning and snooping attacks, which of the following descriptions is wrong?

When a worm virus breaks out, it is usually accompanied by an address scanning attack, so scanning attacks are offensive.

Scanning attacks include address scanning and port scanning.

It is usually the network detection behavior before the attacker launches the real attack.155955cc-666171a2-20fac832-0c042c0424

The source address of the scanning attack is real, so it can be defended by adding direct assistance to the blacklist.

When a worm virus breaks out, it is usually accompanied by an address scanning attack, so scanning attacks are offensive.

Which of the following options are common behavioral characteristics of viruses? (multiple choices)

Information collection characteristics

Regarding traditional firewalls, which of the following statements are correct? (multiple choice)

Lack of effective protection against application layer threats.

It cannot effectively resist the spread of viruses from the Internet to the intranet.

Unable to accurately control various applications, such as P2P, online games, etc. .

Lack of effective protection against application layer threats.

It cannot effectively resist the spread of viruses from the Internet to the intranet.

Ability to quickly adapt to changes in threats.

Unable to accurately control various applications, such as P2P, online games, etc. .

Regarding the description of intrusion detection technology, which of the following statements is correct?

It can detect all kinds of authorized and unauthorized intrusions.

It is impossible to detect violations of security policies.

It can detect all kinds of authorized and unauthorized intrusions.

Unable to find traces of the system being attacked.

is an active and static security defense technology.155955cc-666171a2-20fac832-0c042c0425

If the processing strategy for SMTP virus files is set to alert, which of the following options is correct?

Delete the content of the email attachment

Add announcement and generate log

The following figure is a schematic diagram of the detection file of the firewall and the sandbox system linkage. The Web reputation function is enabled on the firewall, and website A is set as a trusted website and website B is set as a suspicious website.Which of the following statements is correct

After the detection node detects the suspicious file, it not only informs the firewall in the figure of the result, but also informs other network devices connected to it.

The files obtained by users from website A and website B will be sent to the inspection node for inspection.

When a user visits website B, although the firewall will extract the file and send it to the detection node, the user can still access normally during the detection process Site B.

After the detection node detects the suspicious file, it not only informs the firewall in the figure of the result, but also informs other network devices connected to it.

Assuming that website A is an unknown website, the administrator cannot detect the traffic file of this website sC

Configure the following commands on the Huawei firewall:[USG] interface G0/0/1 [USG] ip urpf loose allow-defult-route acl 3000Which of the following options are correct? (multiple choice)

For loose inspection: if the source address of the packet exists in the FB of the firewall: the packet passes the inspection directly

For the case where the default route is configured, but the parameter allow-defult-route is not configured. As long as the source address of the packet is in the FIB table of the firewall If it does not exist, the message will be rejected.

For the situation where the default route is configured and the parameter allow-defult-route is matched at the same time, if the source address of the packet is in the FIB table of the firewall If the packet does not exist in the loose check mode, all packets will pass the URPF check and be forwarded normally.155955cc-666171a2-20fac832-0c042c0427

For loose inspection: if the source address of the packet exists in the FB of the firewall: the packet passes the inspection directly

For the case where the default route is configured, but the parameter allow-defult-route is not configured. As long as the source address of the packet is in the FIB table of the firewall If it does not exist, the message will be rejected.

For the situation where the default route is configured and the parameter allow-defult-route is matched at the same time, if the source address of the packet is in the FIB table of the firewall If the packet does not exist in the loose check mode, all packets will pass the URPF check and be forwarded normally.155955cc-666171a2-20fac832-0c042c0427

For the configuration of the default route, and at the same time matching the parameter allowdefult- route, if the source address of the message is in the FIB table of the firewall If it does not exist in the l0e check, the packet cannot pass the URPF check.

With regard to APT attacks, the attacker often lurks for a long time and launches a formal attack on the enterprise at the key point of the incident.Generally, APT attacks can be summarized into four stages:

Collecting Information & Intrusion

Remote control and penetrationRegarding the order of these four stages, which of the following options is correct?

In the construction of information security, the intrusion detection system plays the role of a monitor.It monitors the flow of key nodes in the information system.In-depth analysis to discover security incidents that are occurring. Which of the following are its characteristics?. c0O

IDS can be linked with firewalls and switches to become a powerful "assistant" of firewalls, which can better and more accurately control access between domains.

It is impossible to correctly analyze the malicious code doped in the allowed application data stream.

Unable to detect malicious operations or misoperations from internal killings.

There are several steps in a stored XSS attackThere are several steps in a stored XSS attack①The attacker hijacks the user session②The attacker submits an issue containing known JavaScript③User login④The user requests the attacker's question 5⑤The server responds to the attacker's JavaScript⑥ The user's browser sends a session token to the attacker⑦The attacker's JavaScript is executed in the user's browserFor the ordering of these steps, which of the following options is correct?

③②④⑥⑤⑦①155955cc-666171a2-20fac832-0c042c0428

What content can be filtered by the content filtering technology of Huawei USG6000 products?

The source of the video content

If you combine security defense with big data technology, which of the following statements are correct? (multiple choice)

In the learning process, you should start from collecting samples, analyze their characteristics and then perform machine learning.

In the detection process, the characteristics of unknown samples need to be extracted and calculated to provide samples for subsequent static comparisons.

Security source data can come from many places, including data streams, messages, threat events, logs, etc.

In the learning process, you should start from collecting samples, analyze their characteristics and then perform machine learning.

Machine learning only counts a large number of samples, which is convenient for security administrators to view.

In the detection process, the characteristics of unknown samples need to be extracted and calculated to provide samples for subsequent static comparisons.

Security source data can come from many places, including data streams, messages, threat events, logs, etc.

Use BGP protocol to achieve diversion, the configuration command is as follows [sysname] route-policy 1 permit node 1 [sysname-route-policy] apply community no-advertise [sysname-route-policy] quit [sysname]bgp100 155955cc-666171a2-20fac832-0c042c04 29 [sysname-bgp] peer [sysname-bgp] import-route unr [sysname- bgpl ipv4-family unicast [sysname-bgp-af-ipv4] peer 7.7.1.2 route-policy 1 export [sysname-bgp-af-ipv4] peer 7.7. 1.2 advertise community [sysname-bgp-af-ipv4] quit [sysname-bgp]quit Which of the following options is correct for the description of BGP diversion configuration?(multiple choice)

Use BGP to publish UNR routes to achieve dynamic diversion.

After receiving the UNR route, the peer neighbor will not send it to any BGP neighbor.

Use BGP to publish UNR routes to achieve dynamic diversion.

After receiving the UNR route, the peer neighbor will not send it to any BGP neighbor.

You also need to configure the firewall ddos bgp-next-hop fib-filter command to implement backinjection.

The management center does not need to configure protection objects. When an attack is discovered, it automatically issues a traffic diversion task.

The administrator has configured file filtering to prohibit internal employees from uploading development files, but internal employees can still upload development files. Which of the following is not allowed Can the reason?

The action configuration of the file extension does not match is incorrect

The file filtering configuration file is not referenced in the security policy

File filtering configuration file is incorrect

The action configuration of the file extension does not match is incorrect

Regarding the Anti-DDoS cloud cleaning solution; which of the following statements is wrong?

Since the Cloud Cleaning Alliance will direct larger attack flows to the cloud for cleaning, it will cause network congestion.

Ordinary attacks will usually be cleaned locally first.

If there is a large traffic attack on the network, send it to the cloud cleaning center to share the cleaning pressure.

Since the Cloud Cleaning Alliance will direct larger attack flows to the cloud for cleaning, it will cause network congestion.

The closer to the attacked self-labeled cloud cleaning service, the priority will be called.155955cc-666171a2-20fac832-0c042c0430

The processing flow of IPS has the following steps;

Protocol identificationWhich of the following is the correct order of the processing flow?

An enterprise administrator configures the Web reputation system as shown in the figure. Regarding the configuration, which of the following statements is correct?

In addition to this page configuration, you also need to enable the firewall and sandbox linkage, otherwise the page configuration is invalid

The content in No. 2 must be configured.

In addition to this page configuration, you also need to enable the firewall and sandbox linkage, otherwise the page configuration is invalid

The content in No. 4 must be configured.

After the configuration is completed, you need to submit the configuration to take effect.

Which of the following is not an abnormal situation of the file type recognition result?

The file extension does not match.

For SYIN Flood attacks, TCP source authentication and TCP proxy can be used for defense. Which of the following descriptions is correct?

During the TCP proxy process, the firewall will proxy and respond to each SYN message received, and maintain a semi-connection, so when the SYN message is When the document flow is heavy, the performance requirements of the firewall are often high.

TCP proxy means that the firewall is deployed between the client and the server. When the SYI packet sent by the client to the server passes through the firewall, the The firewall replaces the server and establishes a three-way handshake with the client. Generally used in scenarios where the back and forth paths of packets are inconsistent.

During the TCP proxy process, the firewall will proxy and respond to each SYN message received, and maintain a semi-connection, so when the SYN message is When the document flow is heavy, the performance requirements of the firewall are often high.

TCP source authentication has the restriction that the return path must be consistent, so the application of TCP proxy is not common. State "QQ: 9233

TCP source authentication is added to the whitelist after the source authentication of the client is passed, and the SYN packet of this source still needs to be verified in the future.

Which of the following iterations is correct for the description of the management center?

The management center is divided into two parts: management server and teaching data collector.

The management server of the management center is responsible for the cleaning of abnormal flow, as well as the collection and analysis of business data, and storage, and is responsible for the summary The stream is reported to the management server for report presentation.

The data coking device is responsible for the cleaning of abnormal flow, the centralized management and configuration of equipment, and the presentation of business reports.

The data collector and management server support distributed deployment and centralized deployment. Centralized deployment has good scalability.

The management center is divided into two parts: management server and teaching data collector.

Which of the following options is wrong for the description of the cleaning center?

The cleaning equipment supports rich and flexible attack prevention technologies, but it is ineffective against cc attacks and ICMP Flood attacks.

The cleaning center completes the functions of drainage, cleaning, and re-injection of the flow after cleaning in the abnormal flow.

There are two types of drainage methods: static drainage and dynamic drainage.

Re-injection methods include: policy route re-injection, static route re-injection, VVPN backinjection and layer 2 same.

The cleaning equipment supports rich and flexible attack prevention technologies, but it is ineffective against cc attacks and ICMP Flood attacks.

Regarding Huawei's anti-virus technology, which of the following statements is wrong?

The anti-virus engine can detect the file type through the file extension

The virus detection system cannot directly detect compressed files

The anti-virus engine can detect the file type through the file extension

Gateway antivirus default file maximum decompression layer is 3 layers

The implementation of gateway antivirus is based on proxy scanning and stream scanning

Huawei H12-724 Practice Test 4 - Free Online Exam Questions 121-160

Single-packet attacks are divided into scanning and snooping attacks, malformed packet attacks, and special packet attacks. Ping of death is a special packet attack.

Become a Premium Member for full access

Unlock Premium Member

Huawei H12-724 Practice Test 4

Question

Huawei H12-724 Practice Tests

Practice Tests