Try Free Huawei H12-721 HCIP-Security-CISN Updated Questions & Answers

Question 1

Which part of the attack packet is matched by the blacklist to achieve attack prevention?

Asource address

Bdestination address

Csource port

Ddestination port

Correct answer: A

Question 2

About load balancing, the following configuration is available: [USG] slb enable [USG]slb [USG-slb] rserver 1 rip 10.1.1.3 weight 32 [USG-slb] rserver 2 rip 10.1.1.4 weight 16 [USG-slb] rserver 3 rip 10.1.1.5 weight 32 [USG-slb] group test [USG-slb-group-test]metric srchash [USG-slb-group-test] add rserver 1 [USG-slb-group-test] add rserver 2 [ USG-slb-group-test] add rserver 3 Which of the following statements is correct?

Aload balancing algorithm is a polling algorithm

BThis configuration is a complete load balancing configuration

Cdetermines which server the data stream should flow to based on the weight value. The smaller the weight value, the weaker the processing power of the corresponding real server.

Dweight represents the weight of the real server

Correct answer: C, D

Question 3

What are the possible reasons why the firewall 2 IPSec VPN cannot be established successfully?

Adevice does not have a route to the intranet

B. The ACL referenced by the security policy configured on the gateways at both ends is incorrect.

CThe IPSec proposal configured on the gateways at both ends is inconsistent.

Dis not configured with DPD at both ends

Correct answer: A, B, C

Note: DPD (dear peer detection) can detect various abnormal states that may exist in the peer device in time.

Question 4

The firewall device defends against the SYN Flood attack by using the technology of source legality verification. The device receives the SYN packet and sends the SYN-ACK probe packet to the source IP address host in the SYN packet. If the host exists, it will Which message is sent?

ARST message

BFIN message

CACK message

DSYN message

Correct answer: A

Question 5

Avoid DHCP server spoofing attacks. DHCP snooping is usually enabled. What is the correct statement?

Aconnected user's firewall interface is configured in trusted mode

BThe firewall interface connected to the DHCP server is configured as untrusted mode.

CDHCP relay packets received on the interface in the untrusted mode are discarded.

DThe DHCP relay packet received in the D trusted mode and passed the DHCP snooping check.

Correct answer: C

Note: DHCP snooping is a DHCP security feature that filters DHCP messages that do not contain information through MAC address restriction, DHCP snooping security binding, IP+MAC binding, and Option 82 features. DHCP DoS attack, DHCP server spoofing attack, ARP man-in-the-middle attack, and IP/MAC Snooping attack. DHCP snooping is enabled on all interfaces of the DHCP client. If the user-side interface is not configured with the Trusted mode, the interface is enabled with the Snooping feature. The default interface mode is Untrusted. This prevents the DHCP server from being attacked by the bogus. To prevent the attack from being attacked by the DHCP server, you can configure the DHCP snooping function on the device to configure the interface on the user side as Untrusted and the interface on the DHCP server as Trusted. All received from the Untrusted interface. DHCP relay packets are discarded. DHCP snooping is configured on the firewall. The DHCP snooping binding function is used to forward packets only if the received packets are the same as those in the binding table. Otherwise, the packets are discarded.

H12-721 Exam Dumps and Practice Questions

Most Recent Huawei H12-721 Exam Dumps

Actual Huawei H12-721 Exam Questions

Unlock all Huawei H12-721 questions