H12-724-ENU HCIP-Security (Fast track) V1.0 Exam Material

test2022-10-13T06:41:14+00:00

If you want to pass the H12-724-ENU exam on the first try, you should try H12-724-ENU HCIP-Security (Fast track) V1.0 Exam Material for a single success! Taking practice tests will give you an excellent idea of how you will perform on the real examination. FreeTestShare has made it simple to pass the H12-724-ENU exam with H12-724-ENU HCIP-Security (Fast track) V1.0 Exam Material with high scores.

You can check free H12-724-ENU practice exam below.

Page 1 of 10

1. Use the command on the switch to view the status of free mobility deployment, the command is as follows:

For the above command, which of the following descriptions is correct?

The control server address is 10.1.10.34

The authentication device address is 10.1.31.78

Status is "Working" Indicates that the switch and Controller Linkage is successful

current Controller The server is backup n

2. Web Standards that come with the client and operating system 8021 The instrument client only has the function of identity authentication:

It does not support the execution of inspection strategies and monitoring strategies. Any Office The client supports all inspection strategies and monitoring strategies.

True

False

3. Portal page push rules have priority, and the rules with higher priority are matched with the user's authentication information first. If none of the configured rules match, The default rules are used.

True

False

4. The security management system is only optional, and anti-virus software or anti-hacking technology can be a good defense against network threats.

True

False

5. When a guest needs to access the network through an account, which of the following methods can be used to access? (Multiple choice)

Create new account

Use existing social media accounts

No authentication, no account required

Scan public QR code

6. When the account assigned by the administrator for the guest is connected to the network, the audit action that the administrator can perform on the guest does not include which of the following options?

Visitor online and offline records

Force users to go offline

Account deactivation 1 reset Password

Send a warning message to the user

7. Content filtering is a security mechanism for filtering the content of files or applications through Huawei USCG00 products. Focus on the flow through deep recognition

Contains content, the device can block or alert traffic containing specific keywords.

True

False

8. Security authentication is mainly achieved through security policies. The terminal host support management for the security check of monthly users is mainly realized by loose check policies. End user behavior management is mainly realized by monitoring policies. If users need to formulate policies according to their own wishes, they can use them. Custom strategy.

True

False

9. According to the user’s access5W1H Conditions determine access rights andQoS Strategy for5W1Ho[Which of the following descriptions are correct? (Multiple choice)

WhoTo determine the ownership of the access device(Company standard,BYOD Wait)

WhoseTo determine the identity of the access person(member I, Visitors, etc.)

How Determine the access method(Wired, wireless, etc.)

What To determine the access device(PC,iOS Wait)

10. SQI Server2005 may not be properly installed, which of the following may be the possible reasons?

1433 port are occupied by the other processes

equipment 21 port is occupied

without prior installation of Microsoft SQL Server 2005 Toolkit

The operating system is Microsoft Windows Server 2003

Page 2 of 10

11. The cleaned traffic is sent to the original destination server.

1-3-4-2-5-6-7-8

1-3-2-4-6-5-7-8

1-3-4-2-6-5-8-7

1-3-24-6-5-8-7

12. When the -aa command is used on the access control device to test the connectivity with the Radius server, the running result shows success, but the user cannot Normal access, the possible reason does not include which of the following options?

The access layer switch does not start EAP Transparent transmission function.

wireless 02K In the scenario, the access control device is not equipped with a security board

AD The service controller is not added in the authentication scenario AD area.

The user account or password is incorrectly configured.

13. Regarding the anti-spam local black and white list, which of the following statements is wrong?

The black and white list is matched by extracting the destination IP address of the SMTP connection

The black and white list is matched by the sender's dns suffix

The black and white list is matched by extracting the source IP address of the SMTP connection

If the source IP address of the SMTP connection matches the blacklist, the connection will be blocked

14. Use on the terminal Portal The authentication is connected to the network, but you cannot jump to the authentication page. The possible reason does not include which of the following options?

Agile Controller-Campus Configured on Portal The authentication parameters are inconsistent with the access control device.

Access device Portal The authentication port number of the template configuration is 50100 ,Agile Controlle-Campus The above is the default.

CS Did not start

When the page is customized, the preset template is used.

15. What are the three main steps of business free deployment? (Multiple choice)

Define security group

Define and deploy group policies

The system runs automatically

Security group reported by the system

Define user groups

16. In Huawei USG6000 products, IAE provides an integrated solution, all content security detection functions are integrated in a well-designed

In the high-performance engine .

Which of the following is not the content security detection function supported by this product?

Application recognition and perception

URL classification and filtering

Video content filtering

Intrusion prevention

17. Regarding CAPWAP encryption, which of the following statements is wrong?

CAPWAP The data tunnel can be used DTLS Encrypted.

DTLS Support two authentication methods: Certificate authentication(out AC,AP Already brought)with PSK Password authentication.

DTLS Encryption can guarantee AC The issued control messages will not be eavesdropped on.

Use the certificate method to carry out DTLS Negotiation, the certificate is only used to generate the key, not right AP Perform authentication.

18. According to different reliability requirements, centralized networking can provide different reliability networking solutions. Regarding these solutions, which of the following descriptions are correct? (Multiple choice)

Basic networking includes deploying one SM Server, one SC Server, one DB and a AE server.

AE In addition to the deployment of basic networking components, the reliability of the network also requires the deployment of an additional backup SC server.

SC In addition to the deployment of basic networking components, the reliability of the network also requires the deployment of an additional backup SM server.

DB In addition to the deployment of basic networking components, the reliability of the network also requires the deployment of an additional backup D

19. User access authentication technology does not include which of the following options?

Authentication

Isolation repair'

Security check

Access control

20. Agile Controller-Campus As RADIUS When the server performs authentication, how many ends need to be configured for authentication on the admission control device?

1812

1813

8443

8080

Page 3 of 10

21. On WIDS functional WLAN Regarding the judgment of illegal devices in the network, which of the following statements are correct? (Multiple choice)

all Ad-hoc The device will be directly judged as an illegal device

Not this AC Access AP Is illegal AP

Not this AC Access STA Is illegal STA

Not this AC Access STA, Also need to check access AP Does it contain law

22. Regarding the basic principles of user access security, it is wrong not to list any description?

When a terminal device accesses the network, it first authenticates the user's identity through the access device, and the access device cooperates with the authentication server to complete the user Authentication.

The terminal device directly interacts with the security policy server, and the terminal reports its own status information, including virus database version, operating system version, and terminal Information such as the patch version installed on the device.

The security policy server checks the status information of the terminal, and for terminal devices that do not meet the corporate security standards, the security policy server reissues. The authorization information is given to the access device.

The terminal device selects the answer to the resource to be accessed according to the result of the status check.

23. Regarding the processing process of file overwhelming, which of the following statements is correct?

The file filtering module will compare the application type, file type, and transmission direction of the file identified by the previous module with the file filtering rules configured by the administrator. Then the lookup table performs matching from top to bottom.

If all the parameters of Wenzhu can match all file filtering rules, then the module will execute the action of this file filtering rule.

There are two types of actions: warning and blocking.

If the file type is a compressed file, then after the file filtering check, the female file will be sent to the file decompression module for decompression and decompression. Press out the original file. If the decompression fails, the file will not be re-filed.

24. If a company wants to detect image files, Shellcode code files and PDF files, which of the following types of sandboxes can be used? (More select)

PDF heuristic sandbox

PE heuristic sandbox

Web heuristic sandbox

Heavyweight sandbox (virtual execution)

25. Malicious code usually uses RootKit technology in order to hide itself. RootKit modifies the kernel of the system by loading a special driver.

To hide itself and the role of designated files.

True

False

26. Regarding scanning and snooping attacks, which of the following descriptions is wrong?

Scanning attacks include address scanning and port scanning.

It is usually the network detection behavior before the attacker launches the real attack.

The source address of the scanning attack is real, so it can be defended by adding direct assistance to the blacklist.

When a worm virus breaks out, it is usually accompanied by an address scanning attack, so scanning attacks are offensive.

27. CA receive PKI The entity's certificate registration request message.

1-3-5-4-2-6-7-8

1-3-5-6-7-4-8-2

1-3-2-7-6-4-5-8

1-3-2-4-8-6-5-7

28. Misuse detection is through the detection of similar intrusions in user behavior, or those that use system flaws to indirectly violate system security rules . To detect intrusions in the system .

Which of the following is not a feature of misuse detection 2

Easy to implement

Accurate detection

Effective detection of impersonation detection of legitimate users

Easy to upgrade

29. Which of the following is the default port number of Portal authentication service?

1812

1813

50200

50300

30. In enterprises where terminal host access control management is relatively strict, administrators hope to bind terminal hosts and accounts to prevent terminal users from accessing the controlled network from unauthorized terminal hosts at will. Regarding the description of binding the terminal host and account, which of the following is correct?

exist Any Office When logging in with an account for the first time, the terminal host is automatically bound to the current account, but the automatic binding process requires administrator approval

When other accounts need to be authenticated on the bound terminal host, there is no need to find the asset owner who is bound for the first time to authorize themselves.

Binding terminal hosts and accounts is only applicable to terminal users through Any Office Scenarios for authentication, Not applicable Web Agent Plugins and Web The scenario where the client authenticates.

There are only consoles in the account binding terminal host, which cannot be configured by the administrator.

Page 4 of 10

31. SACG query right-manager information as follows, which options are correct? (Select 2 answers)

SACG and IP address 2.1.1.1 server linkage is not successful

SACG linkage success with controller.

master controller IP address is 1.1.1.2.

master controller IP address is 2.1.1.1.

32. Jailbroken mobile terminalMobile terminals with non-compliant applications installed or terminals with non-compliant lock screen passwords connecting to the corporate network for office operations are not safe for companies. Any 0fice How to solve the problem of mobile office system?

Directly discard data sent by devices that do not comply with regulations

Certification of non-compliant equipment.

Check for non-compliant terminals, Prohibit unsafe devices from accessing the network.

Send alarm information to notify the administrator to deal with it.

33. Which of the following options cannot be triggered MAC Certification?

ARP Message

DHCP Message P

DHCPv6 Message

ICMP Message

34. About in WLAN User isolation technology is used in the networking environment .

Which of the following statements is wrong?

User isolation between groups means that users in different groups cannot communicate, but internal users in the same group can communicate

Isolation within a user group means that users within the same group cannot communicate with each other.

The user isolation function is related to the same AP Layer 2 packets between all wireless users on the Internet cannot be forwarded to each other

Intra-group isolation and inter-group isolation cannot be used at the same time

35. In the terminal security management, the black and white list mode is used to check the terminal host software installation status .

Which of the following situations is a compliant behavior?

The terminal host does not install the software in the whitelist, nor the software in the blacklist.

The terminal host installs all the software in the whitelist, but does not install the software in the blacklist.

The terminal host installs part of the software in the whitelist, but does not install the software in the blacklist.

The terminal host installs all the software in the whitelist, and also installs some of the software in the blacklist.

36. Which of the following is not an abnormal situation of the file type recognition result?

The file extension does not match.

Unrecognized file type

File corruption

The file is compressed

37. Terminal fault diagnosis tool can diagnose fault, also can collect terminal information.

TRUE

FALSE

38. Regarding the description of the logic architecture of the business accompanying, which of the following options is correct?

The business management plane focuses on administrators, authentication servers, and policy servers.

The network equipment plane focuses on user terminals and static resources.

The user plane focuses on authentication points and policy enforcement points.

The business free mobility logic architecture includes a management subsystem, an authentication and authorization subsystem, and a business strategy subsystem.

39. File filtering technology can filter files based on the application of the file, the file transfer direction, the file type and the file extension.

True

False

40. Which of the following options is about Portal The description of the certification process is correct?

Portal The certification process is only used in Web Certification

Server for a terminal Portal Certification will only give one Portal Device sends authentication message

Switch received Portal Online message, will give Radius Server send Radius Certification request

Portal The authentication message will not carry the result of the security check

Page 5 of 10

41. Which of the following statement is correct about Policy Center system client function?

NAC Agent support MAC account login.

Web page login for authentication and can perform checks Strategy.

Web Agent login for identity certification and security certification.

NAC Agent cannot be installed on Windows Vista operating system.

42. For the description of the principles of HTTP Flood and HTTPS Flood blow defense, which of the following options are correct? (multiple choice)

HTTPS Flood defense modes include basic mode, enhanced mode and 302 redirection.

HTTPS Flood defense can perform source authentication by limiting the request rate of packets.

The principle of HTTPS Flood attack is to request URIs involving database operations or other URIs that consume system resources, causing server resource consumption. Failed to respond to normal requests.

The principle of HTTPS Flood attack is to initiate a large number of HTTPS connections to the target server, causing the server resources to be exhausted and unable to respond to regular requests. begging.

43. The administrator has configured file filtering to prohibit internal employees from uploading development files, but internal employees can still upload development files .

Which of the following is not allowed Can the reason?

The file filtering configuration file is not referenced in the security policy

File filtering configuration file is incorrect

License is not activated.

The action configuration of the file extension does not match is incorrect

44. Regarding the description of the security zone in the Agile Controller-Campus, which of the following options are correct? (multiple choice)

The user domain is generally composed of various terminal users. The terminals in this area have the characteristics of large numbers, wide distribution, and strong mobility.

The business domain is a platform for the heavy load of business flows. According to the needs of the enterprise, security technology is used to logically divide the business to realize the security of the network.

The network domain is the most concerned security protection area of various enterprises, and it carries the important and core information assets of the enterprise.

The service domain is the area that provides security services for the corporate intranet. This area is generally composed of systems that provide security services such as antivirus servers, patch management servers, and terminal security servers.

45. Which of the following options belong to the network layer attack of the TCP/IP protocol stack? (multiple choice)

Address scanning

Buffer overflow p

Port scan

IP spoofing

46. If you use a normal account for authentication, which of the following descriptions is wrong?

Users can use Any Office Perform authentication.

User can't use web Way to authenticate.

Users can use Web Agent Perform authentication.

Users can use their own 802. 1X The client authenticates.

47. MAC Certification refers to 802.1x In the protocol authentication environment, the terminal does not respond to the connection control device after accessing the network 802.1x When protocol authentication is requested, the access control does not automatically obtain the terminal’s MAC The address is sent as a credential to access the network RADIUS The server performs verification.

True

False

48. Which of the following options is not a feature of big data technology?

The data boy is huge

A wide variety of data

Low value density

Slow processing speed

49. Which is correct about the following Policy Center troubleshooting process?

Hardware fault-> connection fault-> NAC client fault-> Policy Center server fault

connection fault-> Hardware fault-> NAC client fault-> Policy Center server fault

Hardware fault-> connection fault-> Policy Center server fault-> NAC client fault

hardware fault-> NAC client fault-> connection fault-> Policy Center server fault

50. Regarding the global configuration of file filtering configuration files for Huawei USG6000 products, which of the following descriptions is correct?

File filtering, content filtering and anti-virus detection cannot be performed when the file is damaged. At this time, the documents can be released or blocked according to business requirements.

When the file extension does not match, if the action is "Allow" or "Alarm", file filtering, content filtering and anti-virus are performed according to the file type Detection.

When the number of compression layers of a file is greater than the configured "Maximum Decompression Layers", the firewall cannot filter the file.

When the file type cannot be recognized, file filtering, content filtering and anti-virus detection are not performed.

Page 6 of 10

51. Intrusion detection is a network security technology used to detect any damage or attempt to damage the confidentiality, integrity or availability of the system .

Which of the following

What is the content of the intrusion detection knowledge base?

Complete virus sample

Complete Trojan Horse

Specific behavior patterns

Security Policy

52. Regarding uninstalling the Agile Controller-Campus in Windows and Linux systems, which of the following descriptions is correct?

Use a common account to execute sh uninstall.sh in the Agile Controller/Uninstall directory to start the uninstallation program.

Use the root account to execute sh uninstall.sh in the Agile Controller directory to start the uninstallation program. :

On the Windows platform, select "Start>All Programs>Huawei>Agile Controller>Server Startup config".

On the Windows platform, select "Start>All Programs> Huawei> Agile Controller>Uninstall

53. For the description of URPF technology, which of the following options are correct? (multiple choice)

The main function is to prevent network attacks based on source address spoofing.

In strict mode, it does not check whether the interface matches. As long as there is a route to the source address, the message can pass.

The loose mode not only requires corresponding entries in the forwarding table, but also requires that the interface must match to pass the URPF check.

Use URPF's loose mode in an environment where routing symmetry cannot be guaranteed.

54. Regarding the network intrusion detection system (NIDS), which of the following statements is wrong?

It is mainly used for real-time monitoring of the information of the critical path of the network, listening to all packets on the network, collecting data, and analyzing suspicious objects

Use the newly received network packet as the data source;

Real-time monitoring through the network adapter, and analysis of all communication services through the network;

Used to monitor network traffic, and can be deployed independently.

55. Guest management is Agile Controller-Campus Important function of, regarding visitor management, which of the following statements are correct? (Multiple choice)

Visitors can use their mobile phone number to quickly register an account

The administrator can assign different permissions to each visitor

Reception staff cannot create guest accounts

There is a violation of the guest account, and the administrator cannot retrospectively

56. Which of the following technologies can achieve content security? (multiple choice)

Web security protection

Global environment awareness

Sandbox and big data analysis

Intrusion prevention

57. Which of the following options is not a scenario supported by Free Mobility?

Intranet users access the data center/Internet.

When traveling users access intranet resources, traveling users pass VPN Access to the intranet.

Work as a team.

Realize mutual communication between devices.

58. Which of the following options is wrong for the description of the cleaning center?

The cleaning center completes the functions of drainage, cleaning, and re-injection of the flow after cleaning in the abnormal flow.

There are two types of drainage methods: static drainage and dynamic drainage.

Re-injection methods include: policy route re-injection, static route re-injection, VVPN back-injection and layer 2 same.

The cleaning equipment supports rich and flexible attack prevention technologies, but it is ineffective against cc attacks and ICMP Flood attacks.

59. In the terminal security all-round defense system, use PPT-PDCA The model can effectively implement terminal security defense .

Which of the following options does not belong to PPT Model?

technology

Process

organization

plan

60. Deploying on Windows platform, using SQL Server database About the HA function of Agile Cotoller-Campus, which of the following descriptions Is it correct? (multiple choice)

Deployment Management Center MC Time, support HA, Provide based on Keepalived Technical HA Active/standby switchover.

Deploy Business Manager SM Time, support HA, Provide based on Keepalived Technical HA Active/standby switchover.

Deploy business controller 3SC Time, support HA, Provide a backup solution in resource pool mode, which needs to be deployed N+1 indivual SC

Deploy the database DB Time, support HA use SQL Server Database mirroring technology requires the deployment of master DB+Mirroring DB+witness D

Page 7 of 10

61. The access control server is the implementer of the corporate security policy, responsible for implementing the corresponding access control in accordance with the security policy formulated by the customer's network(Allow, deny, leave or restrict).

True

False

62. There are two types of accounts on the Agile Controller-Campus: one is a local account and the other is an external account.

Which of the following is not a local account?

Ordinary account

Guest account

Anonymous account

Mobile certificate account

63. Regarding the sequence of file filtering technology processing flow, which of the following is correct?

(1) The security policy is applied as permit

(2) Protocol decoding

(3) File type recognition

(4) Application recognition

(5) File filtering

(1)(2)(3)(4)(5)

(1)(4)(2)(3)(5)

(1)(2)(4)(3)(5)

(1)(3)(2)(4)(5)

64. Regarding HTTP behavior, which of the following statements is wrong?

HTTP POST is generally used to send information to the server through a web page, such as forum posting x form submission, username I password login.

When the file upload operation is allowed, the alarm threshold and blocking threshold can be configured to control the size of the uploaded file.

When the size of the uploaded or downloaded file and the size of the content of the POST operation reach the alarm threshold, the system will generate log information to prompt the device management And block behavior.

When the uploaded or downloaded file size, POST operation content size reaches the blocking threshold, the system will only block the uploaded or downloaded file, POST operate.

65. If you are deploying BYOD When the system is installed, use a stand-alone installation SM, Dual-machine installation SC, Stand-alone hardware deployment AE, Which of the following descriptions are correct? (Multiple choice)

AE Server priority use)SC server.

Install AE When the server, you need to configure the main and standby SC Server IP address.

If the Lord SC After the server fails,AE The server will use the backup SC server.

host SC After the server is restored,AE Server will not switch back to master SC The server handles the business.

66. Which of the following options are right 802. 1X The description of the access process is correct? (Multiple choice).

Through the entire authentication process, the terminal passes EAP The message exchanges information with the server.

Terminal and 802.1X Switch EAP Message interaction,802.1X Switch and server use Radius Message exchange information

802.1X Authentication does not require security policy checks.

use MD5 The algorithm checks the information.

67. The service free mobility function of the Agile Controller can guide the flow to the security center for processing according to the service, improving the utilization of physical equipment.

True

False

68. Which of the following options describes the IntelliSense engine IAE incorrectly?

lAE's content security detection functions include application identification and perception, intrusion prevention, and Web application security.

Full English name: intelligent Awareness Engine.

The core of

IAE is to organically centralize all content security-related detection functions.

The security detection of the IAE engine is parallel, using a message-based file processing mechanism, which can receive file fragments and perform security checks.

69. Which of the following descriptions are correct for proxy-based anti-virus gateways? (multiple choice)

The detection rate is higher than the flow scanning method

System overhead will be relatively small

Cache all files through the gateway's own protocol stack

More advanced operations such as decompression, shelling, etc. can be performed

70. If you deploy Free Mobility, in the logic architecture of Free Mobility, which of the following options should be concerned by the administrator?

Is the strategy automatically deployed?

Choose the appropriate policy control point and user authentication point

Does the strategy deployment target a single user?

Does the strategy deployment target a single department?

Page 8 of 10

71. For the URL is htpt://www.abcd. com:8080/news/education. aspx?name=tom&age=20, which option is path?

htttp://www.abcd. com:8080/news/education. aspx

htttp://www.abcd. com:8080,te

/news/education. aspx

/news/education. aspx?name=tom&age=20

72. An enterprise administrator configures the Web reputation system as shown in the figure. Regarding the configuration, which of the following statements is correct?

The content in No. 2 must be configured.

In addition to this page configuration, you also need to enable the firewall and sandbox linkage, otherwise the page configuration is invalid

The content in No. 4 must be configured.

After the configuration is completed, you need to submit the configuration to take effect.

73. Viruses can damage computer systems. v Change and damage business data: spyware collects, uses, and disperses sensitive information of corporate employees.

These malicious pastoral software seriously disturb the normal business of the enterprise. Desktop anti-disease software can solve the problem of central virus and indirect software from the overall situation.

True

False

74. Which of the following iterations is correct for the description of the management center?

The management server of the management center is responsible for the cleaning of abnormal flow, as well as the collection and analysis of business data, and storage, and is responsible for the summary The stream is reported to the management server for report presentation.

The data coking device is responsible for the cleaning of abnormal flow, the centralized management and configuration of equipment, and the presentation of business reports.

The data collector and management server support distributed deployment and centralized deployment. Centralized deployment has good scalability.

The management center is divided into two parts: management server and teaching data collector.

75. Regarding the description of the ACL used in the linkage between SACG equipment and the TSM system, which of the following statements is correct!?

default ACL The rule group number can be arbitrarily specified.

default ACL The rule group number can only be 3999.

due to SACG Need to use ACL3099-3999 To pick TSM The rules issued by the system, so in the configuration TSM Before linkage, you need to ensure these ACL Not referenced by other functions.

The original group number is 3099-3999 of ACL Even if it is occupied, it can be successfully activated TSM Linkage.

76. Which of the following options is for Portal The description of the role of each role in the authentication system is correct?

The client is Any 0fice software.

Portal The role of the server is to receive client authentication requests, provide free portal services and authentication interfaces, and exchange client authentication information with access devices.

RADIUS The role of the server is to authenticate all the users in the network segment HTTP Requests are redirected to Portal server.

The role of admission control equipment is to complete the authentication, authorization and accounting of users.

77. For Huawei USG600 products, which of the following statements about mail filtering configuration is correct?

Cannot control the number of received email attachments

When the spam processing action is an alert, the email will be blocked and an alert will be generated

You can control the size of the attachment of the received mail

Cannot perform keyword filtering on incoming mail

78. Portal The second-level authentication method of authentication refers to the direct connection between the client and the access device(Or only layer devices exist in between),The device can learn the user’s MAC Address and can be used IP with MAC Address to identify the user.

True

False

79. Threats detected by the big data intelligent security analysis platform will be synchronized to each network device at the same time C and then collected from the network device

Collect it in the log for continuous learning and optimization.

True

False

80. Huawei's USG000 product can identify the true type of common files and over-check the content. Even if the file is hidden in a compressed file, or change the extension

The name of the exhibition can't escape the fiery eyes of the firewall.

True

False

Page 9 of 10

81. Which of the following attacks are attacks against web servers? (multiple choices)

Website phishing deception

Website Trojan

SQL injection

Cross-site scripting attacks 2335

82. Part of the reason why the APT attack becomes difficult to defend is that it uses the vulnerabilities to attack. This kind of zero-day hole usually requires flowers

A lot of time to research and analyze and produce corresponding defense methods.

True

False

83. An enterprise has 3 server, which is the most reasonable plan when deploy Policy Center system planning?

manager + controller + FTP + witness database, controller + master database + FTP, controller + mirror database+ FTP

manager + controller + FTP + master database, controller + FTP + witness database, controller + FTP + mirror database

manager + controller + FTP + mirror database, controller + FTP + witness database, controller + FTP + master database

manager + controller + FTP, controller + FTP + witness databases, controller + FTP + master database

84. Since the sandbox can provide a virtual execution environment to detect files in the network, the sandbox can be substituted when deploying security equipment Anti-Virus, IPS, spam detection and other equipment.

True

False

85. The following is the 802.1X access control switch configuration:

[S5720] dot1x authentication-method eap

[S5720-GigabitEthernet0/0/1] port link-type access

[S5720-GigabitEthemet0/0/1] port default vlan 11

[S5720-GigabitEthernet0/0/1] authentication dot1x

Assuming that GE0/0/1 is connected to user 1 and user 2 through the HUB, which of the following options is correct?

After user 1 is authenticated, user 2 can access network resources without authentication

User 1 and User 2 must be individually authenticated before they can access network resources

GE0/0/1 does not need to enable dot1X

Neither user 1 nor user 2 can pass the authentication and access network resources.

86. The following figure is a schematic diagram of the detection file of the firewall and the sandbox system linkage.

The Web reputation function is enabled on the firewall, and website A is set as a trusted website and website B is set as a suspicious website.

Which of the following statements is correct

The files obtained by users from website A and website B will be sent to the inspection node for inspection.

When a user visits website B, although the firewall will extract the file and send it to the detection node, the user can still access normally during the detection process Site

After the detection node detects the suspicious file, it not only informs the firewall in the figure of the result, but also informs other network devices connected to it.

Assuming that website A is an unknown website, the administrator cannot detect the traffic file of this website sC

87. Agile Controller-Campus All components are supported Windows System and Linux system.

True

False

88. When you suspect that the company's network has been attacked by hackers, you have carried out a technical investigation .

Which of the following options does not belong to the behavior that occurred in the early stage of the attack?

Planting malware

Vulnerability attack

Web application attacks

Brute force

89. A policy template is a collection of several policies. In order to audit the security status of different terminal hosts and the behavior of end users, the administrator needs to customize.

The same policy template is used to protect and manage terminal hosts. Regarding the policy template, which of the following option descriptions are correct? (Multiple choice)

When configuring the policy template, you can inherit the parent template and modify the parent template policy

Only the strategy in the strategy template can be used, and the administrator cannot customize the strategy.

You can assign a policy template to a certain network segment.

If different policy templates are applied to departments and accounts, the policy template assigned to the highest priority will take effect. The priority relationship of the number is: account>department

90. Regarding the file filtering technology in the USG6000 product, which of the following options is wrong?

It can identify the application that carries the file, the file transfer direction, the file type and the file extension.

Even if the file type is modified, it can also identify the true type of the file

It can identify the type of files transmitted by itself, and can block, alert and announce specific types of files.

It supports filtering the contents of compressed files after decompression. "

Page 10 of 10

91. An account can only belong to one user group, that is, a user can only belong to one department.

True

False