Huawei HCIA-Security (H12-711 V4.0) key terms

The overall picture of adversary motivations, capabilities, and attack methods that an organization faces, used to prioritize defensive controls and security spending.

A well-resourced attacker, often state-sponsored, that maintains long-term covert access to a target network through stealthy lateral movement and repeated exfiltration rather than a single quick strike.

A software flaw unknown to the vendor at the time of exploitation, so no patch exists and signature-based defenses may miss the attack until detection content is updated.

An attack in which many compromised hosts flood a target or its links with traffic, exhausting bandwidth or connection state so legitimate users cannot be served.

A TCP attack that sends many half-open connection requests with spoofed sources, filling the target's connection table until real clients are refused service.

Manipulating people through deception, such as phishing or pretexting, to reveal credentials or perform actions that weaken technical controls.

A fraudulent message that impersonates a trusted party to trick the recipient into clicking a malicious link, opening an attachment, or surrendering credentials on a fake page.

A logical grouping of interfaces that share the same trust level and policy treatment, such as Trust, Untrust, and DMZ, so rules can be written between zones instead of hosts.

A segmented network holding externally reachable servers, placed between the untrusted internet and the internal network so a compromised public server cannot directly reach internal hosts.

Layering independent controls across network, host, application, and identity so that failure or bypass of any single control does not expose the whole environment.

Granting each user, service, or system only the access strictly needed for its task, and no more, to limit the blast radius of misuse or compromise.

An ordered set of rules that matches traffic by zone, address, service, user, and application and then permits, denies, or inspects it according to organizational intent.

A firewall rule evaluated for traffic moving from one security zone to another, typically defaulting to deny and requiring explicit permits for allowed flows.

A firewall's record of established flows, storing addresses, ports, protocol state, and applied actions so return traffic is recognized and forwarded without re-evaluating every rule.

A firewall technique that tracks connection state and permits return packets belonging to an already-approved session, rather than judging each packet in isolation.

Rewriting source or destination IP addresses, and often ports, as packets cross a device, to conserve public addresses or hide internal topology.

Translation applied to the source address of outbound traffic, letting many internal hosts share one public address and concealing internal addressing from external observers.

A destination-translation rule that maps a public address and port to an internal server, publishing a service such as a web site to external clients.

Rewriting the destination address of inbound packets so traffic aimed at a public address is redirected to an internal host, commonly used to expose services.

A named, ordered list of permit and deny statements matching addresses, ports, or protocols, used by firewalls and routers to filter traffic or to select which traffic a feature handles.

A suite of protocols that authenticates and encrypts IP packets at the network layer, providing confidentiality and integrity for site-to-site and remote-access tunnels.

The negotiation protocol that establishes shared keys and security associations for IPsec, running in two phases: a protected management channel, then quick creation of data tunnels.

A one-way agreement between IPsec peers specifying the protocols, algorithms, keys, and lifetime used to protect a particular traffic flow.

The IPsec protocol that encrypts and authenticates packet payloads, offering confidentiality plus integrity, unlike AH which protects integrity only.

A secret value configured identically on both IPsec peers and used during authentication, simple to deploy but weak if reused widely or chosen poorly.

Remote access delivered through TLS over a browser or client, giving users encrypted entry to internal applications without installing site-to-site tunnel hardware.

A tunneling protocol that wraps one network protocol inside another to carry traffic such as multicast or routing updates across a network that would otherwise not forward it, without encryption by itself.

An inline sensor that inspects traffic against signatures and behavioral rules and can drop malicious packets in real time, unlike an IDS which only alerts.

A pattern or rule describing known malicious traffic, such as a byte sequence or protocol anomaly, which an IPS or antivirus engine matches to detect attacks.

Content scanning that detects and blocks known malicious files and code by matching signatures or heuristics as files pass through the gateway or reside on hosts.

Classifying requested web addresses against categories or reputation lists and blocking or allowing access according to policy, to reduce malware and policy violations.

Encryption in which the same secret key both encrypts and decrypts data, fast enough for bulk traffic but requiring secure key distribution between parties.

Encryption using a public key to encrypt or verify and a mathematically related private key to decrypt or sign, solving key distribution but slower than symmetric ciphers.

The policies, certificate authorities, registration processes, and repositories that issue, distribute, and revoke digital certificates so parties can trust public keys.

A signed data structure binding a public key to an identity, issued by a certificate authority and validated by relying parties to confirm whom they are communicating with.

A published list of certificates that a certificate authority has invalidated before expiry, checked by verifiers so compromised or misissued credentials are no longer trusted.

Requiring two or more independent evidence types, such as a password plus a one-time code or token, so a stolen password alone cannot grant access.

Assigning permissions to roles rather than individuals, then granting users roles, which simplifies administration and enforces consistent privilege boundaries.

A standard protocol and message format for forwarding event records from network devices to a central collector, enabling correlation, retention, and audit.

A platform that aggregates logs from many sources, correlates events, and raises alerts, giving analysts a unified view for detection and investigation.

Reviewing device and system records for anomalies, policy denials, or attack indicators to reconstruct incidents and confirm whether controls behaved as intended.

The channel through which compromised hosts receive instructions and return stolen data, often disguised as normal web or DNS traffic to evade filtering.

A protocol that encrypts and authenticates application sessions such as HTTPS, using certificates to prove server identity and keys to protect data in transit.