Huawei HCIE-Security (Huawei Certified Internetwork Expert-Security) Sample Questions:

1. The correct description of the no-reverse parameter in the firewall NAT Server configuration command is:

A) Configure nat server without the no-reverse parameter. When a public network user accesses the server, the firewall can convert the server's public network address into a private network address; when the server actively accesses the public network, the firewall can also convert the server's public network address. The private network address is converted into a public network address.
B) Configure the nat server with the parameter no-reverse. When the public network user accesses the server, the firewall can convert the server's public network address into a private network address; when the server actively accesses the public network, the firewall can also convert the server's public network address. Convert the private network address to the public network address.
C) Configure the nat server without the no-reverse parameter, the device only converts the public network address to the private network address, and cannot convert the private network address to the public network address.
D) Configure the nat server with the parameter no-reverse, the device only converts the public network address to the private network address, and cannot convert the private network address to the public network address.

2. IKE V1 - Phase negotiation is unsuccessful, what information needs to be checked, and what may be the reasons?

A) Check whether the physical link is normal.
B) View IKE debug information and UDP port 500 packet session statistics.
C) Check the IPsec proposal parameter configuration.
D) Check if the ACL configuration matches.

3. The correct statement about UDP Flood and TCP Flood attack prevention is:

A) The UDP protocol is connectionless and therefore cannot be implemented by source detection.
B) UDP and TCP protocols can be implemented through proxy technology.
C) Prevent UDP Flood By analyzing the rules and characteristics of UDP packets sent by a certain host, the rules and characteristics are called fingerprint learning.
D) The fingerprint learning function of UDP packets learns all fields of the packet data segment.

4. The IPsec status information of a network is as follows, [USG A] display ike sa
current ike sa number: 2
-------------------------------------------------- -------------------------------------
conn-id peer flag phase vpn
-------------------------------------------------- --------------------------------------
40006 <unnamed> NONE v1:2 public
40004 1.1.1.2 RD|ST v1:2 public
2012-08-08 15:05:15 USG %%01IKE/4/WARNING (I): phase2: proposal or pfs dh-group up mismatch, please check ipsec proposal and pfs dh-group configuration.
*0.1921499990 USG IKE/7/DEBUG: got NOTIFY of type NO_PROPOSAL_CHOSEN
Which of the following options is a possible cause of failure?

A) Inconsistent PFS configuration
B) IPsec proposal mismatch
C) Incorrect ACL configuration
D) IKE pre-shared key mismatch

5. In the USG, the planning UTM statement is correct:

A) UTM can support inconsistent return path networking.
B) UTM cannot be used in dual-system hot backup load balancing scenarios.
C) SA function requires license support.
D) The firewall link-state inspection mechanism must be enabled first.

Solutions: