2023 The Most Effective H12-731-ENU with 205 Questions Answers
Try Free and Start Using Realistic Verified H12-731-ENU Dumps Instantly.
The Huawei H12-731-ENU certification exam is an advanced-level certification that is designed for network security professionals who have experience in designing, implementing, and managing secure networks using Huawei products. The exam tests a candidate's knowledge and skills in various areas of network security, and includes both written and practical tests. To prepare for the exam, candidates should have a strong understanding of network security concepts, practical experience in implementing secure networks, and experience using Huawei network security products.
The Huawei H12-731-ENU exam is a computer-based exam that consists of multiple-choice questions and simulation questions. The exam is timed and lasts for four hours. To pass the exam, IT professionals must achieve a score of at least 600 out of 1000.
NEW QUESTION # 21
The correct description of the no-reverse parameter in the firewall NAT Server configuration command is:
- A. Configure the nat server with the parameter no-reverse. When the public network user accesses the server, the firewall can convert the server's public network address into a private network address; when the server actively accesses the public network, the firewall can also convert the server's public network address. Convert the private network address to the public network address.
- B. Configure nat server without the no-reverse parameter. When a public network user accesses the server, the firewall can convert the server's public network address into a private network address; when the server actively accesses the public network, the firewall can also convert the server's public network address. The private network address is converted into a public network address.
- C. Configure the nat server with the parameter no-reverse, the device only converts the public network address to the private network address, and cannot convert the private network address to the public network address.
- D. Configure the nat server without the no-reverse parameter, the device only converts the public network address to the private network address, and cannot convert the private network address to the public network address.
Answer: B,C
NEW QUESTION # 22
Which statement is false about client-side troubleshooting when using Agile Controller to protect endpoints?
- A. The failure to connect to the SC server may be a security check failure
- B. The failure to connect to the SC server may be a network failure
- C. If you can't connect to the SC server, the server address may be wrong.
- D. Failure to connect to the SC server may be a server failure
Answer: A
NEW QUESTION # 23
By viewing the configuration information of a USG firewall running normally on the live network, the following information is obtained:
#
ip service-set http 8080 type object
service 0 protocol tcp destination-port 8080
#
security-policy
rule name untrust_to_dmz1
source-zone untrust
destination-zone dmz
service ftp
destination-address 192.168.5.3
32
action permit
rule name un trust_to_dmz2
source-zone untrust
destination-zone dmz
service service-set http_8080
destination-address 192.168.5.2
32
action permit
#
Which of the following statements is incorrect:
- A. External network users can use port 80 to access the www service of the server whose address is 192.168.5.2.
- B. External network users can access the destination port 8080 of the server whose address is 192.168.5.2.
- C. External network users can use non-21 port to establish ftp connection with the server whose address is 192.168.5.3.
- D. External network users can use port 21 to establish an ftp connection with the server whose address is 192.168.5.3.
Answer: A,C
NEW QUESTION # 24
Regarding the firewall IP-Link feature, the following description is incorrect:
- A. The firewall continuously sends ARP request packets to the target network segment, and when it receives ARP response packets, it considers the link to be normal.
- B. The ICMP detection method can be used to detect the reliability of the chromium road across the network segment.
- C. ARP detection mode only supports detection of direct links.
- D. The firewall continuously sends ICMP packets to the specified destination address, and if no ICMP echo reply is received for 3 seconds (default), the link is considered to be faulty.
Answer: A
NEW QUESTION # 25
For some large IP data packets, in order to meet the requirements of the MTU (Maximum Transmission Unit) of the link layer, it needs to be fragmented and divided into several IP packets during the transmission process. In each IP header there is an offset field and a split flag (MF), where the offset field indicates the location of the fragment in the entire IP packet. If the attacker sets the offset field to an incorrect value after intercepting the IP data packet, the receiver cannot correctly combine the values of the offset field in the data packet after receiving the split data packets. In this way, the receiver will keep trying, and the operating system will crash due to resource exhaustion.
What is this attack method?
- A. Teardrop Attack
- B. WinNuke Attack
- C. TCP packet flag attack
- D. Ip Fragmented Packet Attack
Answer: A
NEW QUESTION # 26
The IPsec status information of a network is as follows, [USG A] display ike sa
current ike sa number: 2
-------------------------------------------------- -------------------------------------
conn-id peer flag phase vpn
-------------------------------------------------- --------------------------------------
40006 <unnamed> NONE v1:2 public
40004 1.1.1.2 RD|ST v1:2 public
2012-08-08 15:05:15 USG %%01IKE/4/WARNING (I): phase2: proposal or pfs dh-group up mismatch, please check ipsec proposal and pfs dh-group configuration.
*0.1921499990 USG IKE/7/DEBUG: got NOTIFY of type NO_PROPOSAL_CHOSEN
Which of the following options is a possible cause of failure?
- A. Inconsistent PFS configuration
- B. Incorrect ACL configuration
- C. IKE pre-shared key mismatch
- D. IPsec proposal mismatch
Answer: A,D
NEW QUESTION # 27
In the L2TP Over IPsec scenario, the central node uses the IPsec template, how to configure the IPsec Security ACL on the LNS at this time?
- A. rule permit udp destination-port eq 1701
- B. rule permit udp source-port eq 1701
- C. rule permit tcp source-port eq 1701
- D. rule permit tcp destination-port eq 1701
Answer: B
NEW QUESTION # 28
Which statement is true about certificate OCSP and CRL technology?
- A. CRL is more time-sensitive than OCSP.
- B. OCSP must frequently download the certificate list on the client side to keep the list updated.
- C. The OCSP protocol obtains the revocation status of a certificate in an online manner to check whether the other party's certificate is revoked.
- D. The CDP (CPL Distribution Points) information automatically obtained from the client certificate will not be stored in the configuration file, so when the USG restarts, the automatically obtained CDP information will not be saved.
- E. OCSP can obtain the revocation status of the certificate in real time.
Answer: C,D,E
NEW QUESTION # 29
In the scenario of dual-system hot backup of firewalls, IPsec VPN does not support real-time backup of tunnels.
- A. FALSE
- B. TRUE
Answer: A
NEW QUESTION # 30
What are the online certificate application methods supported by firewall PKI?
- A. LDAP
- B. TFTP
- C. SCEP
- D. FTP
- E. HTTP
Answer: C
NEW QUESTION # 31
In order to ensure the normal operation of the device and prevent security threats, it is necessary to strengthen the security of the device. The correct consideration is:
- A. Use Telnet protocol for device management.
- B. The security policy from Untrust, Trust, DMZ zone to Local zone only opens ports that allow ICMP, SSH login, SNMP, etc.
- C. Set the console password, and set the login timeout and authentication times limit of the administrator interface.
- D. SNMPv2 version and network management communication.
Answer: B,C
NEW QUESTION # 32
Regarding the trigger mechanism of 802.1X authentication, which of the following descriptions are correct?
- A. The authentication device can trigger authentication in multicast or unicast.
- B. 802.1X authentication can only be initiated by an authentication device (such as an 802.1X switch).
- C. The 802.1X client can trigger authentication by multicast or broadcast.
- D. The 802.1X authentication trigger can only be initiated by the client.
Answer: A,C
NEW QUESTION # 33
According to the following networking, a customer uses the following configuration on the cleaning equipment. The following statement is correct:
ip route-static 0.0.0.0 0 10.1.2.1
- A. The default route is used for static route diversion
- B. The default route is used for BGP diversion
- C. This default route is used for traffic back injection
- D. This default route is used to send probe traffic for attack prevention
Answer: D
NEW QUESTION # 34
If you use a mobile terminal (Android or Apple system) to access intranet resources through a web proxy, which of the following methods should be recommended?
- A. Only use web link
- B. Such mobile phones cannot access intranet resources through web proxy at all
- C. can be rewritten using web link or web
- D. can only be rewritten using the web
Answer: D
NEW QUESTION # 35
The USG serves as the gateway of the headquarters. Users on business trips need to use the Internet to establish a VPN tunnel to access the resources of the headquarters, and users on business trips do not need to install any dial-up software. Which of the following VPN technologies is most suitable:
- A. IPsec VPN
- B. SSL VPN
- C. L2TP
- D. GRE
Answer: B
NEW QUESTION # 36
The terminal uses Agent for 802.1x authentication, the IP address of SC and Radius server is 172.18.10.68, and it always prompts network communication failure during authentication;
Viewing the Radius authentication log shows that the Radius authentication is successful and the authorization is ACL3001. The switch configuration is as follows:
dot1x enable
dot1x authentication-method eap
radius-server template lzy
radius-server shared-key simple 123456
radius-server authentication 172.18.10.68 1812
radius-server accounting1 72.1 3.10.63 1813
radius-server authorization 172.18.10.68 shared-key simple 123456
aaa
authentication-scheme default
authentication-scheme auth
authentication-mode radius
accounting-scheme acco
accounting-mode radius
accounting realtime 3
domain default
authentication-scheme auth
accounting-scheme acco
radius-server lzy
interface GigabitEthernet0/0/14
description connect 222
port hybrid pvid vlan 105
port hybrid untagged vlan 105
dot1x enable
acl number 3001
rule 1 permit ip destination 172.18.100.235 0
rule 2 permit ip destination 172.18.100.237 0
rule 10 deny ip
What could be the reason for the failure of network communication?
- A. Authorization rule ACL configuration error
- B. Billing configuration may be wrong
- C. AAA configuration error
- D. GigabitEthernet0/0/14 port configuration error
Answer: A
NEW QUESTION # 37
In NGFW, to use the RBL blacklist, which of the following key options need to be configured by the network administrator?
- A. Reply Code
- B. RBL server IP address
- C. DNS server
- D. SMTP server IP address
Answer: A,C
NEW QUESTION # 38
In the networking shown in the figure, the traffic from the PC to access the Web Server must go through the firewall, and the traffic from the Web Server to the PC must go through the firewall.
With intra-domain bidirectional NAT properly configured on the firewall, the following descriptions of packet IP addresses may be correct:
- A. The source IP address of the data packet received by the factory PC from the web server is the IP address of the interface (2).
- B. The source IP address of the data packet received by the PC from the web server is 10.1.1.2.
- C. The source IP address of the data packet received by the web server for accessing its web service from the PC is the IP address of the interface (1).
- D. The source IP address of the data packet received by the web server for PC access to its web service is 10.1.1.5.
Answer: A,C
NEW QUESTION # 39
Which of the following descriptions are correct about the way SAC devices are connected to the network?
- A. SACG devices are required to communicate with the Agile Controller at Layer 2.
- B. SACG is usually side-mounted on the core switch device and uses policy routing to divert traffic.
- C. SACG supports side-hook on non-Huawei devices.
- D. SACG equipment is required to communicate with the terminal at Layer 2.
Answer: B,C
NEW QUESTION # 40
Which of the following descriptions about dual-system hot standby is incorrect?
- A. VGMP is currently in the active state. After the VRRP interface belonging to the VGMP goes down, the VGMP state will definitely switch to the standby state.
- B. After enabling fast backup, the configuration of the host can also be backed up to the standby.
- C. The firewall configuration backup direction must be from the VGMP master state device to the backup state device.
- D. After automatic backup is enabled, all sessions on the host will be automatically backed up to the standby.
Answer: B
NEW QUESTION # 41
USGA G0/0/2 (30.1.1.2) ----------------------------- (30.1.1.1) G0/0/2 USGB
A network adopts the above topology and establishes BFD with USGA and USGB, but it is found that the BFD session cannot be Up. The most probable cause is:
<USGA> display bfd session all
-------------------------------------------------- -------------------------------------------------- -------------
Local Remote Peer IP Address Interface Name State Type
-------------------------------------------------- -------------------------------------------------- ------------
60 20 30.1.1.1 GigabitEthernet0/0/2 Down Static
-------------------------------------------------- -------------------------------------------------- ------------
<USGB> display bfd session all
-------------------------------------------------- -------------------------------------------------- -------------
Local Remote Peer IP Address Interface Name State Type
-------------------------------------------------- -------------------------------------------------- ------------
60 20 30.1.1.2 GigabitEthernet0/0/2 Down Static
-------------------------------------------------- -------------------------------------------------- ------------
- A. BFC session configuration not committed
- B. The shutdown command is configured on one side of the BFC session
- C. Identifiers at both ends of the BFC session do not correspond
- D. BFD session with unbound outbound interface
Answer: C
NEW QUESTION # 42
......
Download Free Latest Exam H12-731-ENU Certified Sample Questions: https://actualtests.dumpsquestion.com/H12-731-ENU-exam-dumps-collection.html