Huawei H12-721 Online Practice Questions and Exam Preparation

Huawei H12-721 Online Questions & Answers

• Question 101:

  IPSec NAT traversal is not supported in IKE main mode and aggressive mode of IP addresses + pre-shared key authentication mode, because the pre-shared key authentication requires the extraction of IP packets in order to find the IP address of the source address of the corresponding pre-shared secret key, and the presence of NAT causes a change to make the device unable to find the address of a pre-shared key.

  A. TRUE
  B. FALSE
  A. TRUE

• Question 102:

  In the IKE V1 pre-shared key mode capture shown, what data is shown in the main role?

  

  A. The negotiation phase SA 2
  B. The negotiation phase SA 1
  C. A random number used to exchange D-H public value, needed for the exchange of identity information
  A. The negotiation phase SA 2

• Question 103:

  Policy strategy limiting constraints include quintuple, time, user identity and application protocols.

  A. TRUE
  B. FALSE
  A. TRUE

• Question 104:

  With the abnormal flow cleaning solutions, in order to ensure that the introduction of the attack traffic priority cleaning center can be cleaned as shown in the figure, the following configuration was made using the management center:

  Select "Configuration"> Anti-DDoS> "drainage management" to create drainage tasks, configure the IP address of the protected 10.1.3.10, subnet mask of 255.255.255.255.

  After completion of the above steps to configure the cleaning center, what route will be generated?

  

  A. The purpose of the address is 32 static host routes are the attacker's
  B. The destination address is a 32 bit iEGP host route is the attacker's
  C. The destination address is 32 bit eBGP host route is the attacker's
  D. The source address of the attacker's 32 static host routes
  A. The purpose of the address is 32 static host routes are the attacker's

• Question 105:

  In USG equipment, which statement is correct on current-configuration files and saved- configuration profile? (Choose two answers)

  A. ELI administrators to configure a feature USG device, the device will modify Saved- configuration immediately.
  B. See the next startup configuration file to load the device display saved-configuration.
  C. When executing the Save command, the device will be current-configuration is copied to the saved-configuration.
  D. When executing the Save command, current-configuration commands to take effect.
  B. See the next startup configuration file to load the device display saved-configuration.
  C. When executing the Save command, the device will be current-configuration is copied to the saved-configuration.

• Question 106:

  Which of the following packets are not sent during IP-link detection? (Choose two answers)

  A. ARP packets
  B. IGMP packets
  C. ICMP packets
  D. Hello packets
  B. IGMP packets
  D. Hello packets

• Question 107:

  In an Eth-Trunk interface, you can achieve load balancing by configuring different weights on each member link.

  A. TRUE
  B. FALSE
  A. TRUE

• Question 108:

  After the device is configured with Link-group, use the display link-group 1 command to get the following information:

  

  What information do you get from the above output? (Choose two answers)

  A. GigabitEthernet0/0/2 Interface failed
  B. GigabitEthernet0/0/1 Interface failed
  C. GigabitEthernet0/0/2 interface fault because the other group was forced to convert to fault state
  D. GigabitEthernet0/0/1 interface fault because the other group was forced to convert to fault state
  B. GigabitEthernet0/0/1 Interface failed
  C. GigabitEthernet0/0/2 interface fault because the other group was forced to convert to fault state

• Question 109:

  A network is as follows:

  LAN---------------G0/0/0 USG G0/0/1--------------Server.

  After administrators analyze a possible attack on the LAN networking G0/0/0 connection and want to enable ARP Flood attack prevention, restricting ARP traffic to 100 packs / min.

  What should be configured to enable this?

  A. firewall defend arp-flood enable firewall defend arp-flood interface GigabitEthernet 0/0/0 max-rate 100
  B. firewall defend arp-flood enable firewall defend arp-flood interface GigabitEthernet 0/0/0 max-rate 6000
  C. firewall defend arp-flood enable firewall defend arp-flood interface GigabitEthernet 0/0/1 max-rate 100
  D. firewall defend arp-flood enable firewall defend arp-flood interface GigabitEthernet 0/0/1 max-rate 6000
  B. firewall defend arp-flood enable firewall defend arp-flood interface GigabitEthernet 0/0/0 max-rate 6000

• Question 110:

  An IPsec VPN connection established by two USG firewalls in NAT traversal mode fail to see any information from the "display ike sa" command. Neither session information nor UDP port 500 information is displayed. What are possible reasons for this? (Choose two answers)

  A. public network unreachable.
  B. middle device blocking UDP 500 port.
  C. middle device blocking UDP 4500 port.
  D. middle device blocking ESP packets.
  A. public network unreachable.
  B. middle device blocking UDP 500 port.