Huawei HCIA-Security (H12-711 V4.0) flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA triad

Confidentiality prevents unauthorized disclosure, integrity prevents unauthorized modification, and availability ensures timely reliable access. These three properties are the baseline criteria for evaluating any security control.

Risk formula

Risk equals the likelihood of a threat exploiting a vulnerability multiplied by the resulting impact. Reducing either the likelihood (controls) or the impact (recovery, segmentation) lowers overall risk.

Worm versus virus

A virus requires a host file and usually user action to spread, while a worm self-propagates across networks without a host or user interaction, often exploiting unpatched services.

ARP spoofing

An attacker sends forged ARP replies so the victim maps a legitimate IP address to the attacker's MAC address. Traffic is then redirected through the attacker, enabling man-in-the-middle interception.

DMZ zone purpose

The demilitarized zone hosts servers reachable from untrusted networks. It is isolated from the trusted internal zone so a compromised public server cannot directly reach internal assets.

Default inter-zone policy

Most firewalls deny traffic between different security zones by default. Any permitted flow, even from a higher-trust zone to a lower-trust zone, needs an explicit policy rule.

Local zone

The Local zone represents the firewall device itself. Traffic destined to the device, such as management access and routing protocols, is controlled by Local zone policy.

Stateful inspection

The firewall records the first permitted packet in a session table and automatically allows return traffic belonging to that established session, without requiring a reverse rule.

Policy match order

Security policies are evaluated from top to bottom and the first matching rule is applied. Specific rules must therefore be placed above general rules, with an implicit deny at the end.

Anti-spoofing with uRPF

Unicast Reverse Path Forwarding checks that a packet's source address is reachable through the interface it arrived on. Packets with internal source addresses arriving from the Internet are dropped.

SNAT overload (PAT)

Source NAT with port address translation lets many internal hosts share one public address by translating source ports. The firewall tracks each translation in its NAT session table.

Destination NAT server mapping

Destination NAT rewrites the destination address of inbound traffic to an internal server's private address. A matching security policy permitting the public address must also exist.

Hairpin NAT

Hairpin NAT, also called NAT loopback, lets internal clients reach an internal server through its public address. Without it, the server replies directly and the return path breaks.

Wildcard mask

An ACL wildcard mask is the bitwise inverse of the subnet mask. A 0 bit must match exactly and a 1 bit is ignored; for a /24 network the wildcard is 0.0.0.255.

AH versus ESP

AH provides integrity and authentication but no encryption, using IP protocol 51. ESP provides confidentiality plus integrity and authentication, using IP protocol 50.

IKE phase 1

IKE phase 1 negotiates the ISAKMP security association using main or aggressive mode. Peers authenticate with a pre-shared key or certificates and agree on encryption, hash, and DH group.

IPsec tunnel mode

Tunnel mode encapsulates the entire original IP packet inside a new IP header. It is used for gateway-to-gateway and remote-access VPNs, hiding internal addresses from the transit network.

Perfect Forward Secrecy

PFS performs a fresh Diffie-Hellman exchange for each phase-2 rekey. Compromise of one session key therefore does not expose keys or traffic from earlier sessions.

NAT traversal (NAT-T)

ESP has no ports for NAT devices to translate, so NAT-T encapsulates ESP inside UDP port 4500. Peers detect NAT during IKE and switch to this encapsulation automatically.

GRE characteristics

GRE is a stateless tunneling protocol using IP protocol 47. It carries multicast and routing protocols but provides no encryption, so it is often protected by wrapping it in IPsec.

L2TP over IPsec

L2TP carries PPP sessions over UDP port 1701 but provides no encryption by itself. Pairing it with IPsec supplies confidentiality and integrity for remote-access VPN users.

SSL VPN modes

SSL VPN uses TLS on TCP port 443 and offers clientless web-portal access and full-tunnel mode. It traverses NAT and restrictive networks more easily than IPsec.

IDS versus IPS

An IDS is passive, receiving mirrored traffic, and only alerts on attacks. An IPS sits inline with the traffic flow and can actively drop or reset malicious connections.

Signature-based detection

Signature detection matches traffic against known attack patterns, giving low false positives but no protection against unknown or zero-day attacks. It is commonly combined with anomaly detection.

URL filtering categories

URL filtering classifies websites into categories and reputation scores, then blocks, allows, or warns per user group and time range. It reduces exposure to phishing and inappropriate content.

Content security profiles

Anti-virus, IPS, URL filtering, and application control settings are grouped into a profile. The profile only takes effect when it is attached to a security policy rule.

Digital signature

A digital signature is a message hash encrypted with the sender's private key. The receiver verifies it with the sender's public key, proving integrity, origin, and non-repudiation.

PKI trust anchor

The root CA self-signs its certificate and acts as the trust anchor. Subordinate CAs are certified by the root, forming a chain that clients validate when checking end-entity certificates.

Certificate revocation

Revoked certificates are published through a Certificate Revocation List or queried in real time via OCSP. Clients check revocation before trusting a certificate presented during a handshake.

802.1X roles

802.1X defines a supplicant requesting access, an authenticator such as a switch or access point, and an authentication server, typically RADIUS, which validates credentials and returns the decision.

Syslog severity levels

Syslog severity runs from 0 emergency through 1 alert, 2 critical, 3 error, 4 warning, 5 notice, 6 informational, to 7 debug. Lower numbers indicate more severe events.

IPsec troubleshooting order

Verify IKE phase 1 first, checking proposals and pre-shared keys, then phase 2 proxy identities, and finally ESP forwarding. NAT devices dropping ESP and MTU fragmentation are common later-stage causes.