Huawei HCIA-Security (H12-711 V4.0) cheat sheet

CIA triad: Confidentiality = unauthorized disclosure prevented (encryption, access control); Integrity = unauthorized modification prevented (hashing, MAC, digital signature); Availability = timely, reliable access (redundancy, anti-DDoS).

Threat vs. vulnerability vs. risk: a threat is a potential cause of harm, a vulnerability is a weakness, risk = likelihood × impact of a threat exploiting a vulnerability.

Malware classes: virus needs a host and user action; worm self-propagates over networks; Trojan disguises as legitimate software; ransomware encrypts data and demands payment; botnet is a network of compromised hosts controlled by C2.

Common attack categories: reconnaissance (scanning, footprinting), spoofing (IP/MAC/ARP/DNS), DoS/DDoS (SYN flood, UDP flood, ICMP flood), injection, and social engineering (phishing, spear phishing, pretexting).

ARP spoofing poisons the victim's ARP cache to redirect traffic; DNS spoofing/cache poisoning returns forged records - both are man-in-the-middle enablers.

Defense-in-depth layers: physical, network, host, application, data. A single control failure should not expose the whole asset.

Security policy hierarchy: overarching security policy → domain-specific policies → procedures/standards; least privilege and separation of duties are core principles.

Attack lifecycle (kill chain style): reconnaissance → weaponization → delivery → exploitation → installation → C2 → actions on objective; detection at any stage disrupts the chain.

Security zones group interfaces with the same trust level; typical zones are Trust (internal), Untrust (Internet), DMZ (public-facing servers), and Management.

Default inter-zone policy is deny; traffic between zones must be explicitly permitted, and higher-to-lower trust direction still requires a rule.

DMZ hosts servers reachable from Untrust; the DMZ is isolated from Trust so a compromised public server cannot directly reach internal assets.

Zone pair (source zone → destination zone) is the key on which inter-zone policy is matched; intra-zone traffic is handled by the same-zone policy.

The firewall itself is a zone member (Local zone); traffic destined to the device (management, routing protocols) is governed by Local zone policy.

Stateful inspection builds a session table entry for the first permitted packet; return traffic of an established session is allowed without a reverse rule.

Placement rule: firewall at the trust boundary, IPS behind the firewall for permitted traffic, and management plane on a separate out-of-band network.

Redundancy designs: dual firewalls in active/standby (HA) or active/active; VRRP/HSRP provides gateway failover; link aggregation provides path redundancy.

Policy match order is top-down; the first matching rule wins, so specific rules must precede general ones, and an implicit deny-all sits at the end.

A security policy typically matches on source/destination zone, source/destination IP, service/port, application, user, and time range.

Stateful firewall session table fields: source/destination IP and port, protocol, zone, and timeout; long-lived sessions (e.g., FTP, SIP) need application-layer gateway handling.

NAT and policy interaction: on many firewalls the security policy is evaluated before or after NAT depending on vendor order - verify whether the policy sees pre-NAT or post-NAT addresses.

Application Layer Gateway (ALG) / NAT traversal handles protocols that embed IP addresses in payload (FTP, SIP, H.323).

Anti-spoofing: enable uRPF or ingress filtering on Untrust-facing interfaces to drop packets with internal source addresses arriving from outside.

Session aging and DoS protection: set per-IP connection limits and SYN-flood thresholds to protect the session table.

Configuration workflow: define zones and interfaces → addresses/services objects → NAT → security policy → verify with session and hit-count displays.

Source NAT (SNAT) translates the source address of outbound traffic so internal hosts can reach the Internet; many-to-one is NAT overload (PAT), using ports to multiplex.

Destination NAT (DNAT) / server mapping translates the destination address of inbound traffic to publish an internal server; it is paired with a security policy permitting the public address.

NAT Server (static one-to-one DNAT) maps a public IP:port to a private IP:port; NAT No-PAT maps one private IP to one public IP without port translation.

Bidirectional NAT combines SNAT and DNAT for traffic that must appear as a public address in both directions.

Hairpin NAT (NAT loopback) lets internal clients reach an internal server via its public address; without it, the return path breaks.

ACLs are ordered permit/deny lists matched top-down with an implicit deny; a wildcard mask is the inverse of the subnet mask (0.0.0.255 for /24).

Standard ACL matches source only; extended ACL matches source, destination, protocol, and port.

NAT does not replace a security policy - the translated address must still be permitted by a rule; log denied traffic to catch missing rules.

IPsec protocols: AH provides integrity and authentication only (no encryption, protocol 51); ESP provides confidentiality plus integrity/authentication (protocol 50).

IKE phase 1 builds the ISAKMP SA (main or aggressive mode, pre-shared key or certificates); IKE phase 2 builds IPsec SAs (quick mode) for ESP/AH.

IPsec SA parameters must match on both peers: encryption (AES), hash (SHA), DH group, authentication method, and lifetime.

Transport mode protects payload only (host-to-host); tunnel mode encapsulates the whole original IP packet (gateway-to-gateway, remote access).

Perfect Forward Secrecy (PFS) forces a new DH exchange per phase-2 rekey so compromise of one key does not expose prior traffic.

NAT-T encapsulates ESP in UDP port 4500 when NAT is detected, because ESP has no ports for NAT to translate.

GRE (protocol 47) is a stateless tunneling protocol with no encryption - it carries multicast/routing protocols and is often wrapped by IPsec for security.

L2TP (UDP 1701) carries PPP sessions but provides no encryption by itself; it is secured by pairing with IPsec (L2TP over IPsec).

SSL VPN uses TLS (TCP 443) and offers clientless (web portal) and full-tunnel modes; it traverses NAT and proxies more easily than IPsec.

IDS is passive (mirror/SPAN port) and alerts; IPS is inline and can drop malicious traffic - placement is behind the firewall on permitted traffic.

IPS detection methods: signature-based (known patterns, low false positives, cannot catch zero-days), anomaly-based (baselines, catches unknown but noisier), and reputation-based.

IPS actions: alert, block/drop, reset connection; a signature has a severity, protocol, direction, and trigger pattern.

Anti-virus scans files by protocol (HTTP, FTP, SMTP, POP3, IMAP) and by direction; engines use signature scanning plus heuristic/behavioral detection.

File-blocking and sandboxing complement AV: unknown files are detonated in a sandbox and verdicts are fed back to the gateway.

URL filtering uses categories and reputation; it can block, allow, or warn, and is enforced per user group and time range.

Application identification (App-ID style) recognizes applications regardless of port (e.g., P2P on port 80), enabling policy by application rather than port.

Content security profiles are applied to security policies; a profile not attached to a policy is not enforced.

SSL/TLS decryption is required for IPS/AV/URL filtering to inspect encrypted traffic; certificate-inspection exemptions must be planned.

Symmetric ciphers (AES, DES/3DES, SM4) use one shared key, are fast, and provide confidentiality; the key-distribution problem is solved by asymmetric crypto.

Asymmetric ciphers (RSA, ECC, SM2) use a public/private key pair; RSA security rests on integer factorization, ECC on the elliptic-curve discrete log.

Hash functions (SHA-256, SM3) are one-way and collision-resistant; they provide integrity, not confidentiality.

Digital signature = hash of the message encrypted with the sender's private key; the receiver verifies with the sender's public key - provides integrity, authentication, and non-repudiation.

PKI hierarchy: root CA → subordinate CA → end-entity certificates; the root self-signs and is the trust anchor.

Certificate contents: subject, public key, issuer, validity period, serial number, and extensions; the CA signs it, and revocation is via CRL or OCSP.

Authentication factors: something you know (password), something you have (token, certificate), something you are (biometrics); MFA combines at least two.

802.1X/EAP: supplicant → authenticator (switch/AP) → authentication server (RADIUS); EAP methods include PEAP, EAP-TLS, EAP-TTLS.

AAA = Authentication, Authorization, Accounting; RADIUS and TACACS+ are the common enterprise protocols (TACACS+ encrypts the full payload, RADIUS only the password).

Log severity levels (syslog): 0 emergency, 1 alert, 2 critical, 3 error, 4 warning, 5 notice, 6 informational, 7 debug - lower number is more severe.

Log destinations: console, buffer, syslog server, and SNMP traps; send to a remote syslog server so logs survive device compromise.

Time synchronization via NTP is required for correlated logs and certificate validity; mismatched clocks break IPsec and PKI.

IPsec troubleshooting order: check IKE phase 1 (proposal mismatch, PSK mismatch, peer unreachable) → phase 2 (proxy ID/subnet mismatch) → ESP (ACL/NAT, MTU/fragmentation).

Common IPsec failure causes: mismatched pre-shared key, mismatched encryption/hash/DH, mismatched interesting traffic ACLs, and NAT dropping ESP.

Useful diagnostics: ping/tracert for reachability, display session table for stateful firewall state, packet capture on the firewall for on-path analysis, and debug commands only under controlled conditions.

Change management: backup configuration before changes, apply in a maintenance window, verify with a rollback plan, and document the change.

Incident response phases: preparation → identification → containment → eradication → recovery → lessons learned.

Log severity levels (syslog): 0 emergency, 1 alert, 2 critical, 3 error, 4 warning, 5 notice, 6 informational, 7 debug - lower number is more severe.

Log destinations: console, buffer, syslog server, and SNMP traps; send to a remote syslog server so logs survive device compromise.

Time synchronization via NTP is required for correlated logs and certificate validity; mismatched clocks break IPsec and PKI.

IPsec troubleshooting order: check IKE phase 1 (proposal mismatch, PSK mismatch, peer unreachable) → phase 2 (proxy ID/subnet mismatch) → ESP (ACL/NAT, MTU/fragmentation).

Common IPsec failure causes: mismatched pre-shared key, mismatched encryption/hash/DH, mismatched interesting traffic ACLs, and NAT dropping ESP.

Useful diagnostics: ping/tracert for reachability, display session table for stateful firewall state, packet capture on the firewall for on-path analysis, and debug commands only under controlled conditions.

Change management: backup configuration before changes, apply in a maintenance window, verify with a rollback plan, and document the change.

Incident response phases: preparation → identification → containment → eradication → recovery → lessons learned.