[2026] Huawei HCIE-Security (Huawei Certified Internetwork Expert-Security)

문제1

For some large IP data packets, in order to meet the requirements of the MTU (Maximum Transmission Unit) of the link layer, it needs to be fragmented and divided into several IP packets during the transmission process. In each IP header there is an offset field and a split flag (MF), where the offset field indicates the location of the fragment in the entire IP packet. If the attacker sets the offset field to an incorrect value after intercepting the IP data packet, the receiver cannot correctly combine the values of the offset field in the data packet after receiving the split data packets. In this way, the receiver will keep trying, and the operating system will crash due to resource exhaustion.
What is this attack method?

A. Ip Fragmented Packet Attack

B. TCP packet flag attack

C. WinNuke Attack

D. Teardrop Attack

정답: D

문제2

In the networking of MPLS Spoke-Hub, what routing protocol is used between Hub-PE and Spoke-PE to exchange routing?

A. OSPF

B. RIP

C. EBGP

D. IBGP

정답: C

문제3

After the USG enables the HRP backup function, key configuration commands and session table status information will be synchronously backed up to the standby device in real time. What configuration commands and status information can be backed up?

A. session table

B. interface configuration command

C. Forwarding Policy Commands

D. Virtual Firewall Command

E. Attack Defense Command

정답: A,C,E

문제4

What is the matching priority order of the URL filtering of the USG firewall?

A. Whitelist, Blacklist, Custom Classification, Predefined Classification

B. Whitelist, Blacklist, Predefined Classification, Custom Classification

C. blacklist, whitelist, predefined classification, custom classification

D. Blacklist, Whitelist, Custom Classification, Predefined Classification

정답: A

문제5

VGMP unified management of VRRP backup group status, the priority of VGMP management group Active is 65001, and the priority of Standby is 65000. When the VGMP management group monitors the interface Down through the VRRP backup group or directly, the priority of the VGMP management group will be recalculated. When each interface is Down, the priority of the VGMP management group decreases by 2.

A. FALSE

B. TRUE

정답: B

문제6

The terminal uses Agent for 802.1x authentication, the IP address of SC and Radius server is 172.18.10.68, and it always prompts network communication failure during authentication;
Viewing the Radius authentication log shows that the Radius authentication is successful and the authorization is ACL3001. The switch configuration is as follows:
dot1x enable
dot1x authentication-method eap
radius-server template lzy
radius-server shared-key simple 123456
radius-server authentication 172.18.10.68 1812
radius-server accounting1 72.1 3.10.63 1813
radius-server authorization 172.18.10.68 shared-key simple 123456
aaa
authentication-scheme default
authentication-scheme auth
authentication-mode radius
accounting-scheme acco
accounting-mode radius
accounting realtime 3
domain default
authentication-scheme auth
accounting-scheme acco
radius-server lzy
interface GigabitEthernet0/0/14
description connect 222
port hybrid pvid vlan 105
port hybrid untagged vlan 105
dot1x enable
acl number 3001
rule 1 permit ip destination 172.18.100.235 0
rule 2 permit ip destination 172.18.100.237 0
rule 10 deny ip
What could be the reason for the failure of network communication?

A. Authorization rule ACL configuration error

B. Billing configuration may be wrong

C. AAA configuration error

D. GigabitEthernet0/0/14 port configuration error

정답: A

문제7

The following configuration, when the physical state of interface G0/0/1 goes down, what will happen to the switch switch?
PC ----------------- (G0/0/1) FW (G0/0/2) ---------------- Switch
#
interface GigabitEthernet0/0/1
link-group 1
interface GigabitEthernet0/0/2
link-group 1
#

A. The ARP entry of the Switch interface address is immediately deleted.

B. No change.

C. The ARP entry of the Switch interface address will be aged out.

D. The firewall sends gratuitous ARP to the upstream device Switch to update the MAC address.

정답: A

문제8

If you use a mobile terminal (Android or Apple system) to access intranet resources through a web proxy, which of the following methods should be recommended?

A. Only use web link

B. can only be rewritten using the web

C. can be rewritten using web link or web

D. Such mobile phones cannot access intranet resources through web proxy at all

정답: B

문제9

Which of the following descriptions about IP-Link is incorrect?

A. The linkage between static routes and IP-Link can be automatically checked. When a link failure is found, the static route of the opposite end will be adjusted accordingly.

B. Provides millisecond-level rate-determining reachability detection.

C. It can provide reachability detection for multiple service modules such as static routing and VRRP.

D. Implement link detection based on ICMP echo request or ARP request.

정답: A,B

문제10

The difference between IKEv1 and IKEv2, which of the following descriptions are correct?

A. The integrity algorithm of the IKE SA is only supported by IKEv1.

B. IKEv2 can use AAA server to assign private IP address, IKEv1 cannot provide this function.

C. IKEv1 supports DPD by default. As long as DPD is configured on one end, the other end can respond to DPD packets. IKEv2 cannot.

D. IKE SA and IPsec SA are established, using 4 messages for IKEv2 and 9 messages for IKEV1 main mode.

정답: B,D

문제11

Which of the following options can be used as conditions for Portal push ?

A. MAC address of the connected AC

B. Terminal device type

C. Endpoint IP address range

D. Terminal browser type

E. SSID of the access AP

F. MAC address of the access AP

정답: B,C,E,F

문제12

On the USG stateful inspection firewall, if the administrator sets the security policy for data packets from Trust to Untrust to permit, and the security policy for data packets in the opposite direction to deny, the final result is:

A. Terminals in the Untrust zone cannot actively initiate connections to terminals in the Trust zone, but the returned packets in the Trust zone can pass normally.

B. Terminals in the Untrust zone cannot actively initiate connections to terminals in the Trust zone, and can only passively connect to connections initiated by users in the Trust zone.

C. Terminals in the Trust zone can actively initiate connections to terminals in the Untrust zone, and even the packets returned by Untrust can pass normally.

D. Terminals in the Trust zone can actively initiate connections to terminals in the Untrust zone, but the packets returned by Untrust cannot pass normally.

정답: B,C

문제13

As shown in the figure below, a company uses the USG6600 firewall as the egress. The company has two egresses. Carrier A and carrier B share the egress load. When an engineer deploys the firewall, two egresses are added to the untrust zone at the same time. The user has joined the trust zone and made source NAT mapping. After the deployment, it is found that some users have normal access to the Internet, while some users have very slow access to the Internet, and even sometimes cannot access the Internet.
[USG] display firewall session table verbose
http VPN: public --> public
Zone: trust --> untrust TTL: 00:00:10 Left: 00:00:08
Interface: GigabitEthernet0/0/0 Nexthop: 41.134.5.49 MAC: F0-DE-F1-69-26-91
<--packets: 9 bytes: 364 -->packets: 9 bytes: 364
10.16.1.20:5246 [41.134.5.52:5246] --> 16.8.3.8:80
http VPN: public --> public
Zone: trust --> untrust TTL: 00:10:00 Left: 00:09:59
Interface: GigabitEthernet0/0/1 Nexthop: 41.160.30.65 MAC: 00-21-97-cf-22-38
<--packets: 4 bytes: 238 -->packets: 14 bytes: 1640
10.16.1.122:3745 [41.134.5.52:3745] --> 2.2.2.2:80
[USG] display ip routing-table
20:56:07 2012/09/30
Route Flags: R - relay, D - download to fib
Routing Tables: Public
Destinations: 5 Routes: 5
Destination/Mask Proto Pre Cost Flags NextHop
0.0.0.0/0
Static 60
0
RD 41.134.5.49
0.0.0.0/0
Static
60
0
RD 41.160.30.65
10.16.1.1/24
Direct
0
0
D 127.0.0.1
127.0.0.0/8
Direct
0
0D 127.0.0.1
127.0.0.1/32
Direct
0
0
D 127.0.0.1
Based on the above information, please determine which of the following descriptions is correct?

A. It can be inferred that the source NAT configuration is correct.

B. The problem is caused by the user's PC.

C. The issue is related to carrier network stability.

D. The problem is caused by an equal-cost route.

정답: A,D

Huawei HCIE-Security (Huawei Certified Internetwork Expert-Security) - H12-731-ENU무료 덤프문제 풀어보기

우리와 연락하기

유용한 링크

최신 업데이트