Huawei H12-721 Online Practice Questions and Exam Preparation

Huawei H12-721 Online Questions & Answers

• Question 91:

  Shown below is an IPSec standby scenario, with main link A and backup link B. Assuming that on link B the next-hop IP address is 10.10.1.2 and 10.10.1.3, and we want to ensure that the primary and redundant backup link via IP-Link is configured.

  

  Which of the following is the correct cstatic routeonfiguration from the headquarters to the branch office?

  A. [USG] ip route-static 0.0.0.0 0.0.0.0 10.10.1.2 [USG] ip route-static 0.0.0.0 0.0.0.0 10.10.1.3
  B. [USG] ip route-static 0.0.0.0 0.0.0.0 10.10.1.2 ip-link 1 [USG] ip route-static 0.0.0.0 0.0.0.0 10.10.1.3 ip-link 2
  C. [USG] ip route-static 0.0.0.0 0.0.0.0 10.10.1.2 track ip-link 1 [USG] ip route-static 0.0.0.0 0.0.0.0 10.10.1.3 preference 70 track ip-link 2
  D. [USG] ip route-static 0.0.0.0 0.0.0.0 10.10.1.2 preference 70 track ip-link 1 [USG] ip route-static 0.0.0.0 0.0.0.0 10.10.1.3 track ip-link 2
  C. [USG] ip route-static 0.0.0.0 0.0.0.0 10.10.1.2 track ip-link 1 [USG] ip route-static 0.0.0.0 0.0.0.0 10.10.1.3 preference 70 track ip-link 2

• Question 92:

  BFD static route topology is shown in Figure A. On the firewall, administrator needs to do the following configuration: [USG9000_A] bfd [USG9000_A-bfd] quit [USG9000_A] bfd aa bind peer-ip 1.1.1.2 [USG9000_A-bfd-session-aa] discriminator local 10 [USG9000_A-bfd-session-aa] discriminator remote 20 [USG9000_A-bfd-session-aa] commit [USG9000_A-bfd-session-aa] quit Which of the following section of the configuration is correct there? (Choose two answers)

  

  A. The command "bfd as bind peer-ip 1.1.1.2" is used to create BFD sessions to detect link status binding policy
  B. The command [U5G9000_A] bfd configuration errors, should be replaced by [U5G9000_A] bfd enable BFD function to enable
  C. [USG9000_A-bfd-session-aa] commit configuration is optional, if not configure the system will default to submit to configure and generate BFD session log information, but does not establish the session table
  D. firewall on BFD session will also need to bind with a static route command: [USG9000_A] ip route-static 0.0.0.0 0 1.1.1.2 track bfd-session aa
  A. The command "bfd as bind peer-ip 1.1.1.2" is used to create BFD sessions to detect link status binding policy
  D. firewall on BFD session will also need to bind with a static route command: [USG9000_A] ip route-static 0.0.0.0 0 1.1.1.2 track bfd-session aa

• Question 93:

  See the following firewall information:

  

  Based on the output, which of the following answers are correct? (Choose three answers)

  A. The first packet interface to enter this data stream from the Trust zone, issuing from the Untrust zone interfaces
  B. This data stream has been NATed
  C. NAPT conversion technology is being used
  D. The virtual firewall feature is enabled firewall
  A. The first packet interface to enter this data stream from the Trust zone, issuing from the Untrust zone interfaces
  B. This data stream has been NATed
  C. NAPT conversion technology is being used

• Question 94:

  In a Dual hot standby SSL VPN scenario as shown, the network administrator has enabled SSL extensions. Which of the following information about the configuration of SSL VPN functionality is correct?

  

  A. When you create a virtual gateway the Master will not be synchronized to the Slave.
  B. When configuring the network extension, the address pool with binds to theVRRP backup group number 2.
  C. USG_ A virtual SSL VPN gateway must use IP address 202.38.10.2
  D. USG_B virtual SSL VPN gateway must use IP address 10.100.10.2
  B. When configuring the network extension, the address pool with binds to theVRRP backup group number 2.

• Question 95:

  In an enterprise network, USG A and USG B have established an IPsec VPN. The administrator needs to simulate traffic from server A to server B to test the connection. What ping command should the administrator use to simulate this traffic?

  

  A. Ping -a
  B. Ping -c
  C. Ping -t
  D. Ping –s
  A. Ping -a

• Question 96:

  Which of the following are flow-type attacks? (Choose two answers)

  A. IP Flood attack
  B. HTTP Flood Attack
  C. IP address scanning attack
  D. ICMP redirect packet attack
  A. IP Flood attack
  B. HTTP Flood Attack

• Question 97:

  In IPsec VPN with NAT traversal, you must use IKE aggressive mode.

  A. TRUE
  B. FALSE
  B. FALSE

• Question 98:

  When using digital certificates for authentication in IPsec VPN, it should adopt IKE main mode negotiation and validation of certificate is completed in the 5th 6th packet of the packet exchange.

  A. TRUE
  B. FALSE
  A. TRUE

• Question 99:

  USG remote capture device configuration functions in a way that the device can grab packets downloaded to the device. Users can download to a local service via FTP and use Firewall Packetyzer to analyze packet.

  A. TRUE
  B. FALSE
  A. TRUE

• Question 100:

  In the standby link IPsec backup application scenarios, which of the following ways is used by the standby link switch?

  A. Hot Standby
  B. Link-Group
  C. Eth-thrunk
  D. IP-Link
  D. IP-Link