Huawei H12-731-ENU 問題集

質問 1：
IPsec tunnel communication is used between the headquarters and branch offices, in order to ensure the security of data transmission on the Internet. The administrator uses the dual-system hot backup function to improve the reliability of the communication between the headquarters and the branch offices, so as to avoid the failure of one USG in the headquarters and the failure of the branch offices to access the headquarters.
According to the following network diagram, which of the following statements is correct?

A. Only ESP and Tunnel mode encapsulation can be used.
B. Only IPsec dual-system hot backup in active/standby backup mode can be used.
C. USG A , USG_B must enable NAT traversal.
D. USG A , USG_B and USG_C only need to configure the route of the Internet, and there is no need to configure the route between the branch intranet and the headquarters intranet in USG_A , USG_B and USG_C.
正解：A,B

質問 2：
Regarding SACG's built-in ACL, which of the following statements are correct?
A. The default ACL rule group number can be arbitrarily specified.
B. The default ACL rule group number can only be 3099.
C. The administrator needs to customize the ACL (number 3100~3999) rules to control the permissions of different access users.
D. Since SACG needs to use ACL3099~3999 to receive the rules issued by the TSM system, it is necessary to ensure that these ACLs are not referenced by other functions before configuring TSM linkage.
正解：B,D

質問 3：
The following figure shows the IKEv1 negotiation process. What information is negotiated in the ① and ② messages?

A. AUTH payload
B. IKE Security Proposal
C. ID payload
D. Swap temporary random numbers
正解：B,D

質問 4：
Which of the following descriptions are correct about the way SAC devices are connected to the network?
A. SACG equipment is required to communicate with the terminal at Layer 2.
B. SACG devices are required to communicate with the Agile Controller at Layer 2.
C. SACG is usually side-mounted on the core switch device and uses policy routing to divert traffic.
D. SACG supports side-hook on non-Huawei devices.
正解：C,D

質問 5：
When the IPsec negotiation fails, turn on the debug switch of IKE, and the following information is displayed: got NOTIFY of type INVALID_ID_INFORMATION or drop message from ABCD due to notification type INVALID_ID_INFORMATION, what does it mean?
A. LOCAL-ID-TYPE at both ends are inconsistent
B. IPsec proposals at both ends do not match
C. IKE proposals at both ends do not match
D. ACL configurations on both ends do not match
正解：D

質問 6：
The correct description of the no-reverse parameter in the firewall NAT Server configuration command is:
A. Configure the nat server without the no-reverse parameter, the device only converts the public network address to the private network address, and cannot convert the private network address to the public network address.
B. Configure the nat server with the parameter no-reverse, the device only converts the public network address to the private network address, and cannot convert the private network address to the public network address.
C. Configure the nat server with the parameter no-reverse. When the public network user accesses the server, the firewall can convert the server's public network address into a private network address; when the server actively accesses the public network, the firewall can also convert the server's public network address. Convert the private network address to the public network address.
D. Configure nat server without the no-reverse parameter. When a public network user accesses the server, the firewall can convert the server's public network address into a private network address; when the server actively accesses the public network, the firewall can also convert the server's public network address. The private network address is converted into a public network address.
正解：B,D