H12-721-ENU exam is regarded as one of the most favorites Huawei Certifications. Many IT professionals prefer to add exam H12-721-ENU among their credentials. The certification strengthens the employment prospects and opens up myriads of opportunities for them. Passcert not only caters you all the information regarding the exam H12-721-ENU but also provides you the excellent H12-721-ENU exam questions which make the certification exam easy for you.
Passcert will update the H12-721 HCNP-Security-CISN dumps for any changes in time, and also we are always accepting the feedbacks about this exam from our users, in specialty, we will mend the exam pool with the suggestions from those users who got full scores in this exam, so to perfect Passcert H12-721-ENU to make it always have the best quality!
Share some HCNP-Security H12-721-ENU exam questions and answers below.
Which of the following protocol is not included in USG series firewall dual-hot-standby?
DHCP snooping function needs to maintain the binding table, what contents of the binding table are included? (Select 3 Answers)
D. DHCP Server µÄ IP
USG dual-hot-standby must meet certain conditions to use, which of the following statements are correct? (Choose 2 answers)
A. The product model of the active and standby devices must be the same
B. The software version of the active and standby devices must be consistent
C. The interface IP of the active and standby two devices must be the same.
D. The active device must be configured and the standby device does not need any configuration.
In the following virtual firewall networking, the USG Unified Security Gateway provides rental services, VPN instance wfw1 is rented to enterprise A, and the networking diagram is as follows.
Enterprise A extranet user's PC C needs to access the Enterprise A extranet DMZ zone server B through NAT, if want to achieve the requirement, which of the following key configuration must do? (Select 3 Answers)
A. [USG] ip vpn-instance vfw1 vpn-id 1
B. [USG] ip vpn-instance vfw1
[USG-vpn-vfw1] route-distinguisher 100 £º 1
C. [USG] nat server zone vpn-instance vfw1 untrust global 184.108.40.206 inside 192.168.1.2 vpn-instance vfw1
D. [USG] nat address-group 1 220.127.116.11 18.104.22.168 vpn-instance vfw1
One network is shown as below:
PC establish l2tp vpn through the vpn client and USG (LNS), what are possible reasons of dial-up failure? (Select 3 Answers)
A. The tunnel name of the LNS is not consistent with the client's.
B. L2TP tunnel authentication failed.
C. PPP authentication fails, the PPP authentication mode set on the client PC and LNS is not consistent.
D. The client PC can not obtain the IP address assigned to it from the LNS.
Access to the headquarters server from the branch computer through the IPsec VPN, at this moment, the IPSEC tunnel can be established normally but business is blocked up, what are the possible reasons? (Select 3 Answers)
A. The packet is fragmented and the fragmented packet is discarded on the link.
B. There is load sharing or dual-link, may be inconsistent path back and forth.
C. Routing shocks.
D. The DPD detection parameters are inconsistent at both ends.
The main method of Defense cache server DNS Request Flood is to use the DNS source authentication.
The interactive process of the firewall linkage NIP intruding detection device is as the following:
1. Record the intrusion process, alarm log records
2. NIP is doing attack detection
3. Reconfigure the firewall
4. Terminate the invasion
Which one of the following interaction sequences is correct?
What is the correct statement about IPsec and IKE? (Choose 3 Answers)
A. IPsec has two ways to establish an alliance, one is manual, one is IKE auto-negotiation (isakmp).
B. IKE aggressive mode can choose to negotiate the IP address or ID of the initiator to check the find the corresponding authentication and complete the negotiation finally.
C. The NAT across function deletes the verification process of UDP port number during the IKE negotiation. At the same time, the discovery function of the NAT gateway device in the VPN tunnel is implemented. That is, if the NAT gateway device is discovered, then the after IPsec data transmission use UDP encapsulation.
D. IKE security mechanisms include DH Diffie-Hellman switching and key distribution, perfect forward security (PFS) and SHA1, etc. encryption algorithm.
A data flow has established session in the firewall, if modifing the packet filtering strategy corresponding to data, how does firewall implement?
A. When a new packet arrives at the firewall, immediately follow the latest policy to filter and refresh the session table
B. Immediately follow the latest strategy to perform filtering, do not refresh the session table.
C. Before session aging, do not perform new strategy, match according to the previously established session
D. The modification will fail, after clearing the session, and then can modify.
When you have no idea about the H12-721-ENU exam while studying, we will be your study guide. Passcert products can help you master the Huawei Certification knowledge by clearly showing you the key points required in the exam. With the help of our H12-721 HCNP-Security-CISN dumps you will learn better without attending other expensive courses.