Huawei HCIE-Security (Huawei Certified Internetwork Expert-Security) Sample Questions:

1. The description of the basic forwarding processing flow of the USG stateful inspection firewall is correct:

A) When the destination address NAT is required, NAT is performed first, and then the inter-zone policy matching detection is performed.
B) When the source address network address translation is required, NAT is performed first, and then the inter-zone policy matching detection is performed.
C) When the data packets enter the firewall, the blacklist matching is performed first, and then the session table matching is performed.
D) For the first packet, first perform single-packet-based attack defense detection, and then perform packet filtering.

2. Which of the following descriptions about IP-Link is incorrect?

A) Implement link detection based on ICMP echo request or ARP request.
B) The linkage between static routes and IP-Link can be automatically checked. When a link failure is found, the static route of the opposite end will be adjusted accordingly.
C) Provides millisecond-level rate-determining reachability detection.
D) It can provide reachability detection for multiple service modules such as static routing and VRRP.

3. A PC receives a fragmented package as shown in the figure below. According to the following package information, which of the following options is correct?

A) The flag bit in the Layer 3 IP header is 1
B) The protocol number in the IP header is 2
C) offset bit is 0
D) There are subsequent IP fragments

4. If the hardware security access control gateway adopts the next generation firewall, in "Policy > Admission Control > SAC Configuration > Hardware SACG", select the "Controlled Domain" tab, and add the controlled domain ERP (172.10.11.1/32 ) and DB_Oracle ( 172.10.12.32/32 ), then query the firewall configuration through the CLI to obtain the following information:
display acl all
............
Advanced ACL 3100, 1 rule, not binding with vpn-instance
Acl's step is 1
rule 1 deny ip (0 times matched)
Advanced ACL 3101, 1 rule, not binding with vpn-instance
Acl's step is 1
rule 1 permit ip (0 times matched)
Advanced ACL 3102, 1 rule, not binding with vpn-instance
Acl's step is 1
rule 1 deny ip destination 172.13.11.10 (0 times matched)
Advanced ACL 3103, 1 rule, not binding with vpn-instance
Ad's step is 1
rule 1 permit ip destination 172.13.11.10 (0 times matched)
Advanced ACL 3354,
Which of the following statements is correct about the above ACL configuration?

A) The Agile Controller manager will regularly check and deliver the control domain configuration, and the problem will be automatically fixed.
B) You can only log in to the hardware security access control gateway, execute the controlled domain refresh command sync role-info in diagnostic mode, and actively request to refresh the controlled domain from the Agile Controller manager.
C) The current controlled domain is not completely delivered to the hardware security access control gateway.
D) The controlled domain can be delivered to the hardware security access control gateway by manually synchronizing the controlled domain on the Agile Controller manager.

5. Which of the following functional blocks can be used in conjunction with the IP-Link function?

A) OSPF
B) DHCP
C) VRRP
D) Routing Policy

Solutions: