Provide Huawei H12-731-ENU Dumps Updated Jan 18, 2023 With 205 QA's
Latest H12-731-ENU Dumps for Success in Actual Huawei Certified
NEW QUESTION 61
In the abnormal traffic cleaning scheme, re-injection refers to sending the cleaned normal traffic back to the original link, and then forwarding it to the protection object.
In order to configure simple, and there are multiple back-injection interfaces, what specific back-injection technology implementations are required?
- A. GRE Remarks
- B. Policy route back annotation
- C. MPLS LSP back note
- D. Static route back annotation
Answer: B
NEW QUESTION 62
In the Agile Controller solution, the USG is used for hardware SACG access authentication.
According to the following information:
<USG6700> display right-manager role-id rule
Advanced ACL 3099, 5 rules, not binding with vpn-instance
Acl's step is 1
rule 1000 permit ip (1200 times matched)
rule 1001 permit ip destination 172.13.11.2210 (501 times matched)
rule 1002 permit ip destination 172.10.11.223 0 (77 times matched)
rule 1003 permit ip destination 172.19.0.0 0.0.255.255 (0 times matched)
rule 1004 deny ip (507759 times matched)
- A. The escape route has been opened
- B. User enters post-authentication domain
- C. User enters quarantine domain
- D. User enters pre-authentication domain
Answer: A
NEW QUESTION 63
In the networking of MPLS Spoke-Hub, what routing protocol is used between Hub-PE and Spoke-PE to exchange routing?
- A. RIP
- B. EBGP
- C. IBGP
- D. OSPF
Answer: B
NEW QUESTION 64
A company's egress gateway dual links are connected to different operators, and have the following requirements:
Users can access the Internet through two operators. When the links to the two operators work normally, all traffic is forwarded by the primary link (ISP1), and when the primary link fails, all traffic is transmitted by the backup link. Road (ISP2) forwarding.
Which of the following options is correct?
- A. [USG] ip-link check enable [USG] ip-link 1 destination 200.1.1.8 mode icmp [USG] ip-link 2 destination 234.1.1.8 mode icmp [USG] ip route-static 0.0.0.0 0.0. 0.0 GigabitEthernet 0/0/2 200.1.1.8 preference 30 track ip-link 1 [USG] ip route-static 0.0.0.0 0.0.0.0 GigabitEthernet 0/0/3 234.1.1.8 preference 20 track ip-link 2
- B. [USG] ip-link check enable [USG] ip-link 1 destination 200.1.1.8 mode icmp [USG] ip route-static 0.0.0.0 0.0.0.0 GigabitEthernet 0/0/2 200.1.1.8 track ip- link 1 [USG] ip route-static 0.0.0.0 0.0.0.0 GigabitEthernet 0/0/3 234.1.1.8
- C. [USG] ip-link check enable [USG] ip-link 2 destination 234.1.1.8 mode icmp [USG] ip route-static 0.0.0.0 0.0.0.0 GigabitEthernet 0/0/2 200.1.1.8 preference 20 [ USG] ip route-static 0.0.0.0 0.0.0.0 GigabitEthernet 0/0/3 234.1.1.8 preference 30 track ip-link 2
- D. [USG] ip-link check enable [USG] ip-link 1 destination 200.1.1.8 mode icmp [USG] ip route-static 0.0.0.0 0.0.0.0 GigabitEthernet 0/0/2 200.1.1.8 preference 20 track ip-link 1 [USG] ip route-static 0.0.0.0 0.0.0.0 GigabitEthernet 0/0/3 234.1.1.8 preference 30
Answer: D
NEW QUESTION 65
When upgrading the IPS signature database and AV virus database online, it is found that the upgrade fails. During the upgrade operation, the following information is displayed:
Connecting to the security server failure.
The following possible problems are:
- A. Check whether the domain name of the security service center is correct and valid.
- B. Check whether the DNS server configuration is correct and valid.
- C. IPS or AV engine is abnormal.
- D. Licensee not purchased.
Answer: A,B
NEW QUESTION 66
The networking of a network is as follows: PC----ADSL router-----USG-----LAN
The key configurations of the USG are as follows:
l2tp enable
interface Virtual-Template1
ppp authentication-mode pap
ip address 4.1.1.1 255.255.255.0
remote address pool 1
l2tp-group 1
mandatory-Icp
allow 12tp virtual-template 1
#
user-ma page user pc1
password admin@123
aaa
domain default
ip pool 1 4.1.1.1 4.1.1.99
Assuming that other configurations are complete and correct, what is the problem with this configuration in actual work?
- A. Disconnect immediately after successful dialing.
- B. The dial-up is successful, but the intranet server cannot be accessed.
- C. You can dial successfully, and you can also access the intranet server.
- D. Failed to dial successfully.
Answer: D
NEW QUESTION 67
When configuring the firewall security policy, which of the following configuration commands is correct to match the data packets sent from the 192.168.10.0 network segment?
- A. source-address 192.168.10.0 0.0.0.255
- B. destination-address 192.168.10.0 0.0.0.255
- C. destination-address 192.168.10.0 255.255.255.0
- D. source-address 192.168.10.0 255.255.255.0
Answer: A
NEW QUESTION 68
When configuring an IKE proposal, which of the following three parameters must be configured?
- A. PFS
- B. security acl
- C. DH-group
- D. encryption algorithm
- E. Hash algorithm
Answer: C,D,E
NEW QUESTION 69
Use NGFW for SSL VPN connection, use certificate authentication, certificate can be selected, but after clicking login, you cannot log in to the resource page. After using debug check on NGFW, it prompts that the certificate is wrong.
<NGFW>debugging ssl error
<NGFW>terminal debugging
<NGFW>terminal monitor
*0.10012266 USG2130 SSL/7/error:
SSL 3.0, Alert, write, fatal bad certificate
But check that the certificate is complete and the contents of the certificate are correct.
What are the possible reasons for this certificate validation error?
- A. The system clock is correct, but the certificate has expired.
- B. When the certificate expires, the system clock is not the current time, but is configured within the certificate's validity period.
- C. A browser that does not support SSL3.0 is used.
- D. The certificate is within the validity period, but the system clock is wrong, and the system clock is not within the validity period.
Answer: A,D
NEW QUESTION 70
Which of the following commands cannot be backed up in the command backup function of the firewall's dual-system hot backup?
- A. routing table
- B. IP address configuration
- C. Forwarding Policy Commands
- D. IPS command
Answer: A,B
NEW QUESTION 71
In the Anti-DDoS abnormal traffic cleaning solution, the correct recommendations for planning and deployment are:
- A. In scenarios with heavy traffic, it is recommended to deploy in a straight path.
- B. The priority deployment defense mode is automatic, after running for a period of time, the Anti-DDoS works normally and then the deployment defense mode is manual.
- C. Learn the traffic baseline values of each service type in the protection object through the baseline learning cycle, and generate learning results according to the settings of the learning task.
- D. The cleaning equipment is directly deployed at the entrance of the enterprise. At the same time, the cleaning equipment has a built-in Bypass card to enhance the reliability of the solution.
Answer: C,D
NEW QUESTION 72
The correct order of URL filtering processing flow is:
① The NGFW matches the URL information with the blacklist.
② The NGFW matches the URL information with the whitelist.
③ NGFW matches URL information with custom categories.
④ Start remote server classification query.
⑤ NGFW matches URL information with predefined categories in the local cache.
- A. ②①③⑤④
- B. ①②③⑤④
- C. ①②③④⑤
- D. ④③⑤①②
Answer: A
NEW QUESTION 73
For the description of NAT Server, which is correct?
- A. If the public network address of the NAT Server and the corresponding public network interface address are not in the same network segment, you do not need to configure black hole routing.
- B. If the public network address of the NAT Server is the interface address, if the black hole route of this address is configured, the service access to the firewall itself will be abnormal.
- C. If the public network address of the NAT Server and the corresponding public network interface address are in the same network segment, you do not need to configure black hole routing.
- D. NAT Server cannot be configured on the virtual firewall for users of the root firewall.
Answer: C
NEW QUESTION 74
A PC receives a fragmented package as shown in the figure below. According to the following package information, which of the following options is correct?
- A. offset bit is 0
- B. There are subsequent IP fragments
- C. The flag bit in the Layer 3 IP header is 1
- D. The protocol number in the IP header is 2
Answer: A,B
NEW QUESTION 75
In the L2TP Over IPsec scenario, the central node uses the IPsec template, how to configure the IPsec Security ACL on the LNS at this time?
- A. rule permit tcp destination-port eq 1701
- B. rule permit udp source-port eq 1701
- C. rule permit tcp source-port eq 1701
- D. rule permit udp destination-port eq 1701
Answer: B
NEW QUESTION 76
In the USG, the planning UTM statement is correct
- A. It is recommended to regularly upgrade the signature database
- B. Before using UTM functions, the operation mode must be configured as UTM mode.
- C. When the USG cannot connect to the security service center, it can only be upgraded locally, and the signature database cannot be upgraded in a unified manner.
- D. UTM will reassemble all fragments, and if the packet exceeds the cache range, the packet will be discarded.
Answer: A,D
NEW QUESTION 77
The attacker sends a TCMP request message to the broadcast address in the network with the attacker's IP address, so that all hosts in the network respond to the attacked ICMP response message, causing the victim's system to be busy and link congestion.
Why is this attack attacked?
- A. Land Attack
- B. Smurf Attack
- C. Fraggle Attack
- D. IP Spoofing Attack
Answer: B
NEW QUESTION 78
In the TCP spoofing attack, in order to establish a fake TCP connection with the victim host, the attacker must obtain the key information in the TCP session through calculation or guessing:
- A. Sequence Number responded by the victim host
- B. Chechsum responded by the victim host
- C. Acknowledgement Number responded by the victim host
- D. Urgent Pointer responded by the victim host
Answer: A
NEW QUESTION 79
There are multiple real servers in an enterprise network that provide FTP services to the outside world, and the load balancing function is configured to ensure the load balancing of traffic flowing through the USG.
The administrator hopes that by detecting the real server status, the load ratio of each server is the same as the weight ratio. The following suitable configurations are:
- A. # Configure the real server to join the negative balance group. [USG-slb] group test [USG-slb-group-test] metric weightrr [USG-slb-group-test] addrserver 1 [USG-slb-group-test] addrserver 2 [USG-slb-group-test] addrserver 3 [USG-slb-group-test] quit
- B. # Configure the real server to join the negative balance group. [USG-slb] group test [USG-slb-group-test] metric least-connection [USG-slb-group-test] addrserver 1 [USG-slb-group-test] addrserver 2 [USG-slb-group-test] ] addrserver 3 [USG-slb-group-test] quit
- C. # Configure the real server to join the negative balance group. [USG-slb] group test [USG-slb-group-test] metric roundrobin [USG-slb-group-test] addrserver 1 [USG-slb-group-test] addrserver 2 [USG-slb-group-test] addrserver 3 [USG-slb-group-test] quit
- D. # Configure the real server to join the negative balance group. [USG-slb] group test [USG-slb-group-test] metric srchash [USG-slb-group-test] addrserver 1 [USG-slb-group-test] addrserver 2 [USG-slb-group-test] addrserver 3 [USG-slb-group-test] quit
Answer: A
NEW QUESTION 80
The following configuration, when the physical state of interface G0/0/1 goes down, what will happen to the switch switch?
PC ----------------- (G0/0/1) FW (G0/0/2) ---------------- Switch
#
interface GigabitEthernet0/0/1
link-group 1
interface GigabitEthernet0/0/2
link-group 1
#
- A. The ARP entry of the Switch interface address is immediately deleted.
- B. No change.
- C. The ARP entry of the Switch interface address will be aged out.
- D. The firewall sends gratuitous ARP to the upstream device Switch to update the MAC address.
Answer: A
NEW QUESTION 81
What is the matching priority order of the URL filtering of the USG firewall?
- A. Whitelist, Blacklist, Custom Classification, Predefined Classification
- B. Whitelist, Blacklist, Predefined Classification, Custom Classification
- C. blacklist, whitelist, predefined classification, custom classification
- D. Blacklist, Whitelist, Custom Classification, Predefined Classification
Answer: A
NEW QUESTION 82
What aspects need to be checked for IPS (Intrusion Prevention) failures?
- A. Whether to configure the IPS policy and apply it to the interzone.
- B. Check whether the IPS blacklist is configured.
- C. Whether to enable IPS global switch.
- D. Whether the overlay signature is configured.
- E. Whether the configured policy is submitted for compilation.
Answer: A,C,E
NEW QUESTION 83
Which of the following networking is not included in the common networking modes of the NIP5000?
- A. Bypass deployment
- B. Dual Arm Deployment
- C. One-arm deployment
- D. In-Line Deployment
Answer: B
NEW QUESTION 84
Which of the following applications cannot be secured using packet filtering alone?
- A. WWW service
- B. Telnet service
- C. H.323
- D. FTP service
Answer: C,D
NEW QUESTION 85
......
Changing the Concept of H12-731-ENU Exam Preparation 2023: https://pdfvce.trainingdumps.com/H12-731-ENU-valid-vce-dumps.html
