Huawei Security

With a large number of network users, large enterprises usually use a hierarchical structure to support network expansion and growing number of users.

• True

• False

Answer explanation

• Large enterprises typically use a hierarchical network structure (core, distribution, and access layers) to manage and expand their networks efficiently as the number of users grows. This design helps in improving scalability, manageability, and performance.

During the ARP process, ARP reply packets are sent in broadcast mode. All hosts on the same Layer 2 network can receive these packets and learn the mapping between IP and MAC addresses.

• True

• False

Answer explanation

False: ARP reply packets are sent in unicast mode directly to the requesting host, not broadcast mode. Only the requesting host receives the ARP reply and learns the mapping between IP and MAC addresses.

The persistent connection function of the firewall allows you to set a long aging time for specific TCP and UDP data flows, ensuring that the session information does not age out for a long time.

• True

• False

Answer explanation

True: Firewalls with a persistent connection feature can be configured to maintain session information for specific TCP and UDP data flows for an extended period, preventing the session from timing out.

NAT in Easy IP mode translates only private IP addresses. It cannot translate port numbers.

• True

• False

Answer explanation

False: NAT in Easy IP mode (also known as PAT - Port Address Translation) translates both IP addresses and port numbers to allow multiple devices on a local network to be mapped to a single public IP address, thus enabling multiple simultaneous connections.

When the stateful inspection function is disabled, the firewall creates a session for subsequent packets.

• True

• False

Answer explanation

True,Meskipun stateful inspection dinonaktifkan, firewall tetap perlu membuat sesi untuk melacak dan mengelola paket yang melewati koneksi. Ini memungkinkan firewall untuk memastikan bahwa paket-paket yang terkait dengan koneksi yang sama diatur dan diteruskan dengan benar. Oleh karena itu, pernyataan bahwa firewall akan membuat sesi untuk paket-paket berikutnya ketika stateful inspection dinonaktifkan adalah benar.

Which of the following values is the default security level of the Trust zone on a Huawei USG firewall?

• 5

• 50

• 85

• 100

Answer explanation

• C. 85: On Huawei USG firewalls, the Trust zone typically has the high default security level, which is 85.

Which of the following values is the default port number of the SSH protocol?

• 20

• 21

• 22

• 23

Answer explanation

C. 22: The default port number for the SSH (Secure Shell) protocol is 22.

Which of the following is a private IP address?

• 192.200.1.1

• 172.32.1.1

• 192.1.1.1

• 172.20.2.1

Answer explanation

D. 172.20.2.1: This IP address falls within the private IP address range of 172.16.0.0 to 172.31.255.255.

 Which of the following TCP ports are used by the FTP service by default?

• 20

• 23

• 22

• 21

Answer explanation

• A. 20

• D. 21

• FTP uses port 21 for control commands and port 20 for data transfer by default.

A session-based stateful inspection firewall processes the first packet and subsequent packets differently. Which of the following statements are correct?

• When receiving a packet, the firewall searches for a matching entry in the session table. If a matching entry is found, the firewall processes the packet as a subsequent packet.

• When receiving a packet, the firewall searches for a matching entry in the session table. If no match is found, the firewall processes the packet as the first packet.

• When stateful inspection is enabled, subsequent packets also need to be checked based on security policies.

• When stateful inspection is enabled and the firewall processes TCP packets, a session can be established only for SYN packets.

Answer explanation

• A. When receiving a packet, the firewall searches for a matching entry in the session table. If a matching entry is found, the firewall processes the packet as a subsequent packet.

• B. When receiving a packet, the firewall searches for a matching entry in the session table. If no match is found, the firewall processes the packet as the first packet.

• D. When stateful inspection is enabled and the firewall processes TCP packets, a session can be established only for SYN packets.

• These statements correctly describe how a stateful inspection firewall processes packets.