H12-731-ENU Exam Dumps Pass with Updated Jan-2023 Tests Dumps
H12-731-ENU exam questions for practice in 2023 Updated 205 Questions
NEW QUESTION 19
Comparing the two technologies of mail content filtering and RBL filtering, the correct statement is:
- A. Mail content filtering Filters the mail content.
- B. RBL filtering only filters messages sent by male POP3.
- C. Mail Content Filtering supports filtering of webmail or mail transmitted via SMTP/POP3.
- D. RBL filtering is based on the destination IP address of the SMTP connection.
Answer: A,C
NEW QUESTION 20
A server on the network has been responding very slowly recently. By looking at its running status, it is found that its CPU and memory usage ratio is high, but there is little or no data transmission in these TCP session connections.
For the following judgments about this problem phenomenon, please choose the best one:
- A. The server is under SYN flood attack.
- B. The server is under HTTP POST slow attack.
- C. The server is under UDP flood attack.
- D. The server is under a TCP spoofing attack.
Answer: B
NEW QUESTION 21
In the USG, the planning UTM statement is correct
- A. UTM will reassemble all fragments, and if the packet exceeds the cache range, the packet will be discarded.
- B. When the USG cannot connect to the security service center, it can only be upgraded locally, and the signature database cannot be upgraded in a unified manner.
- C. It is recommended to regularly upgrade the signature database
- D. Before using UTM functions, the operation mode must be configured as UTM mode.
Answer: A,C
NEW QUESTION 22
The USG serves as the gateway of the headquarters. Users on business trips need to use the Internet to establish a VPN tunnel to access the resources of the headquarters, and users on business trips do not need to install any dial-up software. Which of the following VPN technologies is most suitable:
- A. L2TP
- B. SSL VPN
- C. IPsec VPN
- D. GRE
Answer: B
NEW QUESTION 23
A network needs to replace the dual-system hot-standby USG_A and USG_B due to the network upgrade of the new hardware USG. Without affecting the business, how to upgrade:
USG_A is the Active device, and USG_B is the Standby device.
Which of the following are the correct cutover steps?
① Connect the 5th line to the new USG_B in turn.
② Connect lines 1 , 2 , and 3 from the old USG_A to the new USG A in turn,
③ Power on the new USG_B and the new USG_A, and import the configuration.
④ Input undo hrp enable in USG_B, and cut off lines 4, 5, and 3 in turn.
⑤ Adjust the routing cost so that all traffic passes through USB_B.
⑥ Enter hrp enable for new USG_A and new USG_B to adjust routing cost to meet expectations.
- A. ③ -> ④ -> ⑤ -> ① -> ② -> ⑥
- B. ③ -> ④ -> ① -> ⑤ -> ② -> ⑥
- C. ④ -> ① -> ⑤ -> ③ -> ② -> ⑥
- D. ③ -> ④ -> ① -> ② -> ⑥ -> ⑤
Answer: B
NEW QUESTION 24
In the networking shown in the figure, the default gateway for accessing the external network is not configured on the Web server. To ensure that users on the external network can normally access the Web server through the NAT Server, which one of the following configuration plans for the firewall is correct:
- A. It is necessary to configure destination-nat for external network users on the firewall to convert the public network address of the accessed web server into the internal network address
- B. It is necessary to configure nat server on the firewall to ensure that external network users can access the Web server by accessing 202.20.1.5.
- C. It is necessary to configure the source NAT from Untrust to the DMZ on the firewall to translate the source address of the data packets from the external network users accessing the Web server to 192.168.1.1.
- D. It is necessary to configure the source NAT in the direction from DMZ to Untrust on the firewall, so that the web server can access the external network, so that the response message of the web server can be returned to the external network user.
Answer: B,C
NEW QUESTION 25
Regarding the authentication mode of 802.1X, which of the following descriptions are correct?
- A. From the point of view of the authentication requirements for all access users, the MAC-based mode is more secure than the port-based mode.
- B. Under the same interface, port-based and MAC-based modes can be enabled at the same time.
- C. 802.1X authentication mode is divided into interface-based and MAC-based.
- D. From the point of view of the authentication requirements for all access users, the port-based mode is more secure than the MAC-based mode.
Answer: A,C
NEW QUESTION 26
According to the following networking, a customer uses the BGP traffic diversion policy route back injection method. Which of the following configurations must be configured on the cleaning device?
- A. firewall ddos bgp-next-hop fib-filter
- B. firewall ddos bgp-next-hop 10.1.3.1
- C. interface GigabitEthernet2/0/2 anti-ddos flow-statistic enable
- D. ip route-static 0.0.0.0 0 10.1.3.1
Answer: B
NEW QUESTION 27
There are hundreds of people in a medium-sized enterprise network accessing the Internet through the company's firewall, and the company has deployed a corporate portal website in the firewall DMZ. Which of the following criteria should be followed as an IT security professional for purchasing and deploying Internet access auditing products.
- A. Order No. 82 of the Ministry of Public Security
- B. NIST800-53
- C. State Office issued No. 28
- D. ISO27002
Answer: A
NEW QUESTION 28
The correct statement of the principle of virtual firewall technology is:
- A. Different virtual firewalls have the same way-in-table, so address overlap is not supported on different virtual firewalls.
- B. Independent allocation of virtual system resources, independent provision of security services, and support for multiple VPN instances.
- C. Virtual firewall and root firewall cannot be accessed.
- D. Each virtual firewall system can support TRUST, UNTRUST, DMZ, LOCAL and other security zones, with flexible interface division and allocation.
Answer: B,D
NEW QUESTION 29
Which of the following descriptions about dual-system hot standby is incorrect?
- A. After enabling fast backup, the configuration of the host can also be backed up to the standby.
- B. The firewall configuration backup direction must be from the VGMP master state device to the backup state device.
- C. After automatic backup is enabled, all sessions on the host will be automatically backed up to the standby.
- D. VGMP is currently in the active state. After the VRRP interface belonging to the VGMP goes down, the VGMP state will definitely switch to the standby state.
Answer: A
NEW QUESTION 30
In the networking of MPLS Spoke-Hub, what routing protocol is used between Hub-PE and Spoke-PE to exchange routing?
- A. IBGP
- B. RIP
- C. EBGP
- D. OSPF
Answer: C
NEW QUESTION 31
What aspects need to be checked for IPS (Intrusion Prevention) failures?
- A. Whether the overlay signature is configured.
- B. Whether the configured policy is submitted for compilation.
- C. Whether to configure the IPS policy and apply it to the interzone.
- D. Whether to enable IPS global switch.
- E. Check whether the IPS blacklist is configured.
Answer: B,C,D
NEW QUESTION 32
What is the main function of the SM component in Agile Controller?
- A. As the security defense server of Agile Controller, it is responsible for analyzing and calculating the security events reported by iRadar.
- B. As the management interface of Agile Controller, configure and monitor the system.
- C. As the management center of Agile Controller, it integrates standard RADIUS server, Portal server, Auth server and Network server.
- D. As the management center of the Agile Controller, it is responsible for formulating the overall strategy.
Answer: B,D
NEW QUESTION 33
Which of the following packets can be unicast packets
- A. VGMP Hello
- B. VRRP Hello
- C. HRP Hello
- D. BFD
- E. OSPF Hello
Answer: A,C,E
NEW QUESTION 34
Huawei USG firewall, in the dual-system hot-standby network (as shown in the figure), the PC cannot log in to the real IP address of the external network port of the standby firewall FW2 through SSH. Check the corresponding sessions on the active and standby firewalls as follows, and analyze the following statements about this fault. is it right ?
HRP_A <E1000-1> display firewall session table verbose source inside 192.168.22.151
tcp VPN: public ->
public
Zone: trust -> local TTL: 00:00:05 Left: timeout
Interface: G0/0/1 Nexthop: 192.168.22.122 MAC: 00-22-a1-06-b3-cb
<-- packets: 1
bytes: 48 -> packets: 0 bytes: 0
192.168.22.122:22 <-- 192.168.22.151:4354
HRP_S <-E1000-2>display firewall session table verbose source inside 192.168.22.151
tcp VPN: public -> public
Zone: trust -> local TTL: 00:00:05 Left: timeout
Interface: I0 Nexthop: 127.0.0.1 MAC: 00-00-00-00-00-00
<-- packets: 1
bytes: 48 -> packets: 1 bytes: 44
192.168.22.122:22 <-- 192.168.22.151:4354
- A. The problem may be caused by turning off hrp mirror session enable.
- B. When the PC logs in to the standby firewall FW2, the round-trip path is inconsistent.
- C. Because the SSH client supports packet retransmission during the login process.
- D. The problem is caused by disabling the indo firewall session link-state check function of the chromium road state check function.
Answer: B,D
NEW QUESTION 35
What are the methods for firewalls to diagnose forwarding faults?
- A. message missing
- B. Packet loss statistics based on 5-tuple
- C. View session table
- D. Debug IP Packet
- E. Statistics of detailed packet loss classification
Answer: A,B,D
NEW QUESTION 36
What functions does content filtering include in the Huawei USG firewall?
- A. file content filtering
- B. file extension filter
- C. Apply content filtering
- D. mail filtering
Answer: A,C
NEW QUESTION 37
The firewall single sign-on authentication process as shown in the figure includes the following main links:
a. Find user group information on AD server
b. The device has created an online user list, and the user directly accesses external resources
c. Send information such as username and group to the device
d. User requests authentication
e. Actively send a message to the AD monitoring service (username, user IP address)
f . Server authentication passed
Please select the correct correspondence between letters and numbers ?
- A. ① -> d ② -> f ③ -> e ④ -> d ⑤ -> C ⑥ -> b
- B. ① -> d ② -> e ③ -> f ④ -> a ⑤ -> C ⑥ -> b
- C. ① -> d ② -> f ③ -> d ④ -> e ⑤ -> C ⑥ -> b
- D. ① -> d ② -> e ③ -> d ④ -> f ⑤ -> C ⑥ -> b
Answer: A
NEW QUESTION 38
The whitelist + blacklist mode is adopted in terminal security management. Which of the following are normal behaviors?
- A. The terminal host installs all the software in the whitelist, but does not install the software in the blacklist.
- B. The terminal host does not install the software in the white list, nor the software in the black list.
- C. The terminal host installs all the software on the whitelist terminal, and also installs some software in the blacklist.
- D. Some software in the whitelist is installed on the terminal host, but the software in the blacklist is not installed.
Answer: A
NEW QUESTION 39
In 802.1X authentication, if the authentication point is on the switch at the aggregation layer, what special configurations are required in addition to the conventional configurations such as RADIUS, AAA, and 802.1X?
- A. No special configuration required.
- B. The access layer switch needs to be configured to transparently transmit 802.1X packets.
- C. Both aggregation layer and access layer switches need to enable 802.1X function.
- D. The aggregation layer switch needs to be configured to transparently transmit 802.1X packets.
Answer: B
NEW QUESTION 40
A network expects to use URPF technology to improve network security. Which mode of URPF is used in the following networking scenarios:
- A. strict mode
- B. loose mode
- C. According to the stem information, the corresponding mode cannot be judged
- D. strict mode or loose mode
Answer: B
NEW QUESTION 41
In the Agile Controller solution, the USG is used for hardware SACG access authentication.
According to the following information:
<USG6700> display right-manager role-id rule
Advanced ACL 3099, 5 rules, not binding with vpn-instance
Acl's step is 1
rule 1000 permit ip (1200 times matched)
rule 1001 permit ip destination 172.13.11.2210 (501 times matched)
rule 1002 permit ip destination 172.10.11.223 0 (77 times matched)
rule 1003 permit ip destination 172.19.0.0 0.0.255.255 (0 times matched)
rule 1004 deny ip (507759 times matched)
- A. User enters post-authentication domain
- B. User enters pre-authentication domain
- C. User enters quarantine domain
- D. The escape route has been opened
Answer: D
NEW QUESTION 42
Which of the following statements is true about the life cycle of an IPsec tunnel:
- A. The lifecycle configuration of both ends must be the same.
- B. The IPsec tunnel will renegotiate a new tunnel when it reaches its lifetime.
- C. IPsec SA lifetime can be calculated in traffic.
- D. The soft timeout is the expiration time of the SA life cycle, and the hard timeout is the time to start negotiating a new SA before the expiration of the life cycle.
Answer: B,C
NEW QUESTION 43
......
Authentic H12-731-ENU Dumps With 100% Passing Rate Practice Tests Dumps: https://www.itpassleader.com/Huawei/H12-731-ENU-dumps-pass-exam.html
Updated Premium H12-731-ENU Exam Engine pdf: https://drive.google.com/open?id=1UYQSZKvDX0OLxc8lBqLK8-Y639-QgfFn