Huawei HCIE-Security (Huawei Certified Internetwork Expert-Security) Sample Questions:

1. Which of the following statements is true about the life cycle of an IPsec tunnel:

A) The IPsec tunnel will renegotiate a new tunnel when it reaches its lifetime.
B) The soft timeout is the expiration time of the SA life cycle, and the hard timeout is the time to start negotiating a new SA before the expiration of the life cycle.
C) IPsec SA lifetime can be calculated in traffic.
D) The lifecycle configuration of both ends must be the same.

2. Which of the following is a correct description of the stateful inspection firewall forwarding principle:

A) Establish a connection for this UDP data stream when processing UDP protocol packets.
B) The firewall does not support the stateful inspection mechanism when deployed as a Layer 2 device.
C) Session state detection based on TCP connection three-way handshake.
D) ICMP packets will not be checked for status.
E) The non-first packet forwarding is based on the session table, which can only be forwarded if it matches the session table.

3. The ARP protocol is used to map the IP address to the correct MAC address, so that the device can encapsulate the correct frame header on the data frame to complete the data forwarding.
If the ARP table is abnormal, it will directly cause the device to fail to forward packets. In the dual-system hot backup scenario, which of the following descriptions are correct when the active and standby firewalls respond to ARP?

A) Request the real IP address of the interface and reply with the real MAC of the interface.
B) Request the IP address of the NAT address pool, the current master device responds with a virtual MAC, and the standby device does not respond.
C) Request VRRP virtual IP address, the current master device responds with virtual MAC, and the standby device does not respond.
D) Configure the ARP proxy to request ARP source IP and destination IP in the same network segment at the same time.

4. According to the "GB/T 22240-2008 Information Security Technology Information System Security Level Protection Grading Guide", information systems are divided into five levels according to different levels, of which the protection capabilities of the five levels include:

A) undefined
B) Able to protect the system from malicious attacks from external small organizations, threat sources with few resources, general natural disasters, and other threats of considerable damage to important resources, and to discover important security Vulnerabilities and security incidents, after the system is compromised, can restore some functions for a period of time.
C) It can protect the system from malicious attacks from external organized groups, threat sources with relatively rich resources, serious natural disasters, and other major threats caused by relatively harmful threats under a unified security strategy. Resource damage can find security loopholes and security incidents, and after the system is damaged, most functions can be restored.
D) Resources that can protect the system from malicious attacks, severe natural disasters, and other threats of considerable severity from national-level, hostile organizations, and resource-rich threat sources under a unified security strategy Damage, can find security breaches and security incidents, after the system is damaged, can quickly restore all functions.

5. Which of the following options can be used as conditions for Portal push ?

A) Endpoint IP address range
B) SSID of the access AP
C) MAC address of the connected AC
D) Terminal device type
E) Terminal browser type
F) MAC address of the access AP

Solutions: