The following is a description of FW's audit conduct. Which one is correct? (single selection).

By default HTTP status code audit mode is the default mode Only common HTTP status codes areaudited.

After you create or modify an audit profile , the configuration content takes effect immediately.

By default , the audit function of outgoing file content is enabled by default.

By default HTTP status code audit mode is the default mode Only common HTTP status codes areaudited.

Which of the following situational aware detection attacks can DDOS attacks, firewall bypasses, and malware outreach attacks know? (multiple selection).

Meteor base rod anomaly detection

With the following description of network scanning defense technology, which is correct? (single selection).

If the rate at which its source IP accesses other protected addresses or ports exceeds the set access frequency threshold, this behavior is regarded as scanning behavior And add the purpose to the blacklist to block scan

For port scanning, you can defend by setting the value of the access frequency bureau.

If the access frequency is set too high More false positives will be generated, blocking normal access traffic.

If the rate at which its source IP accesses other protected addresses or ports exceeds the set access frequency threshold, this behavior is regarded as scanning behavior And add the purpose to the blacklist to block scan

If the frequency of the set direction is too low The scanning behavior is not recognized.

The following describes the network scanning defense technology Which one is wrong? (single selection).

The trapping probe has a business simulation function.

Firewalls and switch devices can act as trapping probes.

In networking mode where the trap and the trap probe are on the same firewall| CIS and SecoManager are not required for trapping Closed-loop threat linkage can be completed directly through FW.

The trapping system produces a unique fingerprint for each attacker Able to record hacker IP, operating system Information such as browser type, type of attack weapon, etC.

The following describes FW's application behavior control features Which one is correct? (single selection).

When creating a security strategy Application behavior control and yellow files can be combined with users, time periods, and other objects to achieve the purpose of application control for different users and different time periods.D . For HTTP behavior The application behavior control function can be controlled by DEToperation in POST.

For FTP behavior, application behavior control can limit the size of upload/download files, but cannot control the upload/download line separately

For IM behavior You can set a black whitelist The priority relationship between the black and white list and the provincial action is: blacklist, white list, default action.

When creating a security strategy Application behavior control and yellow files can be combined with users, time periods, and other objects to achieve the purpose of application control for different users and different time periods.D . For HTTP behavior The application behavior control function can be controlled by DEToperation in POST.

Which of the following is wrong about Huawei's approach to business security resilience? (single selection).

Abandon the traditional passive cyber threat defense mode and achieve security resilience with business as the center .

Achieve active security through correlation analysis and collaborative joint defense.

Abandon the traditional passive cyber threat defense mode and achieve security resilience with business as the center .

Use Al technology to compensate for the lag of threat defense.

Active security and passive defense through the department Protect against attacks at all stages of the cyber attack chain.

As shown in the following figure, you use the bypass method to deploy the Anti-DDoS system 8GP drainage UN route is used. The port numbers of the P1-P5 devices in the figure, what happens if a routing policy is not configured on R1 to direct cleansed traffic to P5? (single selection).

After the inspection equipment is cleaned, it will be sent to the cleaning equipment again

The flow to be detected is discarded by the cleaning equipment

The detection flow cannot be cleaned by Wang Chang

The traffic to be detected cannot reach the detection equipment

The following is a description of FW's DNS filtering feature What are the correct options? (multiple selection).

DNS filtering can release or block requests for different time periods or different users/groups by referencing time periods or users/groups.

The DNS filtering function is usually used in enterprise gateways to effectively manage users' access to network resources

The DNS overcast function has a great impact on the performance of the device compared to the URL overcast, but all services corresponding to the domain name can be controlled.

DNS filtering can be controlled at the stage of initiating HTTP/HHPS URL requests.

DNS filtering can release or block requests for different time periods or different users/groups by referencing time periods or users/groups.

The DNS filtering function is usually used in enterprise gateways to effectively manage users' access to network resources

The following is a description of the trapping technique The correct ones are which women's multiple choices).

If the attacker cannot notice the fake service provided by the honeypot, the capture efficiency of the honeypot is relatively low

Honeypot technology is to absorb the network by deploying some king machines as bait Trick attackers into attacking them This allows attacks to be captured and analyzed

The honeypile can only passively wait for the attacker to attack

If the attacker cannot notice the fake service provided by the honeypot, the capture efficiency of the honeypot is relatively low

Honeypot technology is to absorb the network by deploying some king machines as bait Trick attackers into attacking them This allows attacks to be captured and analyzed

Discuss the access layer switch equipment as honeypot equipment

The honeypile can only passively wait for the attacker to attack

The following describes how the intrusion prevention signature database is upgraded Which is wrong which n single selection)

Local upgrade methods include scheduled upgrade and immediate upgrade.

Online upgrade methods include scheduled upgrade and immediate upgrade.

can be upgraded locally to the feature database.

You can upgrade the special library by upgrading in Lee.

How does the following not belong to the firewall to detect viruses? (single selection).

Malicious domain name detection technology

First package detection technology

Malicious domain name detection technology

Document reputation detection technology

As shown in the following figure The headquarters network is deployed with dual machines, and the L2TPoverlPSec is configured separately to access the headquarters network. Below is a description of the configuration of interest in IPSecWhich one is correct? (single selection).

acl number 3000rule 10 permit udp destingation-port eq 1701

acl number 3000rule 10 permit udp souce-port eq 1701

acl number 3000rule 10 permit tcp souce-port eq 1701

ad number 3000rule 10 permit tcp destingation-poa eq 1701

acl number 3000rule 10 permit udp destingation-port eq 1701

In Huawei's user management solution, when using AD single sign-on, the firewall does not support which of the following ways to obtain the message that the user has passed the user authentication radio selection).

The AD single sign-on service program automatically reports messages to the firewall

The firewall monitors AD authentication packets

Install the single sign-on service program to receive messages from the PC

The AD single sign-on service program automatically reports messages to the firewall

Install the single sign-on service program to query the AD server security logs

In Huawei's user management solution, which of the following descriptions of authentication triggers are correct? (multiple selection).

The ways to trigger authentication for access users are: L2TPVPN, IPSecVPN, SSL VPN, etc

Exemption from authentication can be done without entering a username and password Complete the certification and visit the network resources.

Portal authentication refers to the portal authentication page provided by the firewall or thirdparty server to authenticate users.

The ways to trigger authentication for access users are: L2TPVPN, IPSecVPN, SSL VPN, etc

Exemption from authentication can be done without entering a username and password Complete the certification and visit the network resources.

Portal authentication refers to the portal authentication page provided by the firewall or thirdparty server to authenticate users.

Single sign-on refers to the firewall as an authentication point After the user completes authentication, they can go online on the firewall

The following describes the black hole route Which one is wrong? (single selection).

The black hole routing configuration consumes the CPU processing resources of the device.

When the NAT address pool address and the public network interface address are not on the same network segment Blackhole routing must be configured.

The black hole routing configuration consumes the CPU processing resources of the device.

Configuration command line of black hole routing: ip route-static (ip-address) null o

Configure the destination NAT In order to prevent the routing environment, the concubine needs to configure a blackholed route to the destination IP address before translation.

The following description of information security training Which items are correct? (multiple selection).

In terms of training content For senior executives, training on information security strategies and information security laws and regulations is required.

In terms of training method For most employees, just one induction training is not enough attention, and frequent email campaigns are needed to raise awareness of information security

Even for safety training, the focus will be different for different departments.

In terms of training content For senior executives, training on information security strategies and information security laws and regulations is required.

For grassroots employees, some safety technology training should be emphasized.

In terms of training method For most employees, just one induction training is not enough attention, and frequent email campaigns are needed to raise awareness of information security

The following is a description of traceability audits Which one is correct? (single selection).

Only audit administrators can configure audit functions and view audit logs

In a networking environment where the packet return path is inconsistent, the content of the audit log record is not complete.

Only audit administrators can configure audit functions and view audit logs

In the security policy, traffic configured as deny will be processed by the audit policy.

The audit strategy includes two parts: conditions and actions By matching any of the conditions, a response action can be performed.

What is correct in the following description of the capabilities of cybertrapping techniques? (multiple selection).

Network trapping technology can automatically sense APR-MISS and realize trapping.

Network trapping technology can automatically sense the non-existence of IP and realize trapping.

Network trapping technology can automatically sense APR-MISS and realize trapping.

Network trapping technology can automatically sense the non-existence of IP and realize trapping.

Network trapping technology can automatically sense the absence of MAC addresses and realize trapping.

Network trapping technology can automatically sense open ports and realize trapping.

Which of the following are China's information security standards organizations, multiple selections)

Technical Committee on Information Technology Security Standardization

Network and Information Security Technical Working Committee of China Communications Standards Association (CCSA).

National Internet Emergency Response Center

Technical Committee on Information Technology Security Standardization

China Association for Work Safety (CAWS).

Network and Information Security Technical Working Committee of China Communications Standards Association (CCSA).

Which of the following access control types is defined according to the organization's security policy or (single-select).

Logical/technical access control

Huawei H12-731_V2.0 Practice Test 5 - Free Online Exam Prep & Questions

Question 1 / 40

Which of the following describes the business process of the network trapping scheme wrong?

(single selection).

The attacker initiates a network scanning attack The purpose is to probe the network structure.

The business that the attacker eventually attacks is a deliberately constructed counterfeit food business. Therefore, all the actions of the attacker are monitored and reported to the CIS platform

When the access traffic reaches the trapping probe A collision between the probe needle and the trap will be used to send the access flow to the trap

Trapping probes can analyze the frequency of scanning different destination IPs or ports for the same source address Then a virtual MAC responds to the attacker.

Comment (0)

Huawei H12-731_V2.0 Practice Test 5

Question

Huawei H12-731_V2.0 Practice Tests

Practice Tests