[Aug 24, 2021] H12-722 Ultimate Study Guide - ActualPDF
Ultimate Guide to Prepare H12-722 Certification Exam for HCNP-Security in 2021
NEW QUESTION 74
When the two-way SSL function is used to decrypt the HTTPS data packet, the value of the reverse proxy series represents the number of times which the data packet can be decrypted.
- A. False
- B. True
Answer: A
NEW QUESTION 75
Divert traffic using BGP protocol. The configuration command is as follows.
[sysname] route-policy 1 permit node 1
[sysname-route-policy] apply community no-advertise
[sysname-route-policy] quit
[sysname] bgp 100
[sysname-bgp] peer 7.7.1.2 as-number 100
[sysname-bgp] import-route unr
[sysname-bgp] ipv4-family unicast
[sysname-bgp-af-ipv4] peer 7.7.1.2 route-policy 1 export
[sysname-bgp-af-ipv4] peer 7.7.1.2 advertise-community
[sysname-bgp-af-ipv4] quit
[sysname-bgp] quit
Which of the following options are correct for the BGP drainage configuration description? (Multiple choice)
- A. The management center does not need to configure protection objects. When an attack is discovered, the traffic diversion task is automatically delivered.
- B. Use BGP to advertise UNR routes for dynamic traffic diversion.
- C. You also need to configure the firewall ddos bgp-next-hop fib-filter command to implement the remarks.
- D. After receiving the UNR route, the peer neighbor will not send it to any BGP neighbors.
Answer: B,D
NEW QUESTION 76
What are the typical technologies of anti-virus engines? (Multiple choices)
- A. Heuristic detection technology
- B. Document reputation detection technology
- C. Decryption technology
- D. First packet inspection technology
Answer: A,B,D
NEW QUESTION 77
For the basic mode of HTTP Flood Source authentication, which of the following are the correct descriptions? (Multiple choices)
- A. When there is an HTTP proxy server in the network, the firewall will add the proxy server IP address to the whitelist, but the basic source authentication of the zombie host is still valid.
- B. The basic mode effectively blocks access from non-browser clients.
- C. The basic mode will not affect the user experience, so the defense effect is higher than the enhanced mode.
- D. The zombie tool does not implement a complete HTTP protocol stack and does not support automatic redirection. Therefore, the basic mode can effectively defend against HTTP flood attacks.
Answer: B,D
NEW QUESTION 78
Buffer overflows, Trojans, backdoor attacks, etc. are all application-level attacks.
- A. True
- B. False
Answer: A
NEW QUESTION 79
Which of the following are the common causes of IPS detection failures? (Multiple choices)
- A. IPS function is not enabled
- B. Policy IDs with incorrect associations between IPS policy domains
- C. IPS policy is not submitted for compilation
- D. Bypass function in IPS is turned off
Answer: A,B,C
NEW QUESTION 80
Configure the following command on the Huawei firewall:
[USG] interface G0/0/1
[USG] ip urpf loose allow-default-route acl 3000
Which of the following options are correct? (Multiple choice)
- A. If the default route is configured but the parameter allow-default-route is not configured. As long as the source address of the packet does not exist in the FIB table of the firewall, the packet will be rejected.
- B. For the loose type check, if the source address of the packet exists in the FIB table of the firewall, the packet passes the check.
- C. If the source address of the packet does not exist in the FIB table of the firewall and the default route is configured and the allow-default-route parameter is also matched, the packet cannot pass the URPF check even if it is a loose type check.
- D. If the default route is configured and the allow-default-route parameter is also matched, if the source address of the packet does not exist in the FIB table of the firewall, but for the loose type check, the packet will pass through URPF check, and perform normal forwarding.
Answer: A,B,D
NEW QUESTION 81
If the regular expression is "abc.de", which of the following will not match the regular expression?
- A. abc.de
- B. abc+de
- C. abcdde
- D. abcde
Answer: D
NEW QUESTION 82
Which of the following descriptions about scanning and snooping attacks is wrong?
- A. Scanning attacks include address scanning and port scanning.
- B. When a worm breaks out, it is generally accompanied by an address scan attack, so scanning attacks are aggressive.
- C. It is usually the network detection behavior before the attacker launches a real attack.
- D. The source address of the scanning attack is real, so you can use the method of directly adding a blacklist for defense.
Answer: B
NEW QUESTION 83
The most common form of traffic-based attacks is flooding a large number of seemingly legitimate messages to the target host, eventually resulting in the exhaustion of network bandwidth or device resources.
Traffic attack packets do not include which of the following options?
- A. UDP packets
- B. TCP packets
- C. FTP packets
- D. ICMP packets
Answer: C
NEW QUESTION 84
Which of the following are the network layer attacks of the TCP/IP stack? (Multiple Choices)
- A. Buffer overflow
- B. Address scan
- C. Port scanning
- D. IP spoofing
Answer: B,D
NEW QUESTION 85
Which of the following options is correct about the sequence-by-flow detection of AntiDDoS?
1. The Netflow analysis device samples the current network traffic.
2 Send a drainage command to the cleaning center;
3 Discover DDoS attack traffic;
4. Netflor: analysis equipment sends alarms to ATIC Management Center;
5 abnormal flow is drained to the cleaning center for further inspection and cleaning;
6 The cleaning center sends the host of the attacked object IF address server to the router to implement the drainage.
7 Cleaning logs sent to the management center to generate reports;
8 The cleaned traffic is sent to the original destination server.
- A. 1-3-4-2-5-6-7-8
- B. 1-3-4-2-6-5-8-7
- C. 1-3-2-4-6-5-7-8
- D. 1-3-2-4-6-5-8-7
Answer: B
NEW QUESTION 86
The process of a browser carrying a cookie to request a resource from a server is as shown in the following figure. Which of the following steps have the session ID information in the message?
- A. 1, 3, 4
- B. 3, 4,
- C. 2, 4
- D. 5, 6
Answer: B
NEW QUESTION 87
The DDoS attack defense configuration process is as follows:
1, start the flow statistics function;
2. Set different protection thresholds for different types of attacks;
3. When the traffic exceeds the preset threshold, the system starts attack defense.
- A. TRUE
- B. FALSE
Answer: A
NEW QUESTION 88
The whitelist rule of the firewall antivirus module is configured as *example*. Which of the following matches is used in this configuration?
- A. Suffix matching
- B. Keyword matching
- C. Prefix matching
- D. exact match
Answer: B
NEW QUESTION 89
Which of the following options does not belong to the characteristics of Trojans?
- A. Not self-replicating but parasitic
- B. The ultimate intent is to steal information and implement remote monitoring
- C. Trojans replicate themselves
- D. Actively Infectious
Answer: D
NEW QUESTION 90
Which of the following statement about IPS is wrong?
- A. The covering signature has a higher priority than the signature in a centralized signature.
- B. Changes to the IPS policy do not take effect immediately. You need to submit a compilation to update the configuration of the IPS policy.
- C. The signature set can contain both pre-defined and custom signatures.
- D. When the source security zone is the same as the destination security zone, the IPS policy is applied in the domain.
Answer: C
NEW QUESTION 91
The anti-tampering technology of Huawei WAF products is based on the cache module. Assuming that user A accesses website B, website B has signs of page tampering. The workflow of the WAF tamper-resistant module has the following steps:
1, WAF uses the cached page to return to the client
2, WAF compares the server page content with the cached page content
3, After the learning is completed, the page content is stored in the cache
4, When the user accesses the web page, the WAF obtains the page content of the server
5, WAF initiates learning mode to learn the page content of the user visiting the website
Which of the following options is correct for the ordering of these steps?
- A. 5, 1, 2, 4, 3
- B. 2, 4, 1, 5, 3
- C. 3, 4, 2, 5, 1
- D. 5, 3, 4, 2, 1
Answer: D
NEW QUESTION 92
Anomaly detection establishes the normal behavior characteristics of the system's main body through analysis of system audit data: In the detection, if the audit data in the system is different from the normal behavior characteristics of the established subject, it is considered an intrusion behavior. Which of the following can be used as the system body? (Multiple choices)
- A. A group of users
- B. Single user
- C. Host
- D. A key program and file in the system
Answer: A,B,C,D
NEW QUESTION 93
......
HCNP-Security Fundamentals-H12-722 Exam-Practice-Dumps: https://www.actualpdf.com/H12-722_exam-dumps.html
