I85PREP
⌘ K
Huawei HCIA-Security (H12-711 V4.0) study materials
Huawei HCIA-Security (H12-711 V4.0) study resources

Huawei HCIA-Security (H12-711 V4.0) practice questions

One question at a time. Build your Huawei HCIA-Security (H12-711 V4.0) understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Fundamentals and Threat Landscape

In the Huawei threat landscape model, which term best describes an attacker who uses stolen credentials to log in and then moves laterally between internal servers while appearing as a legitimate user?

  1. Insider threat who is a current employee
  2. Script kiddie using prebuilt tools
  3. Advanced persistent threat actor Correct answer.
  4. Hacktivist motivated by ideology

Explanation

An advanced persistent threat (APT) is a well-resourced actor that gains entry, maintains long-term covert access, and moves laterally toward high-value data. Credential theft followed by stealthy lateral movement is a classic APT technique rather than opportunistic tool use. The other terms describe motivation or origin, not the stealthy, persistent intrusion pattern described.

Question 2Security Fundamentals and Threat Landscape

A security team classifies threats by their primary objective. Which category is defined by the goal of disrupting service availability rather than stealing data?

  1. Data exfiltration
  2. Phishing campaign
  3. Privilege escalation
  4. Denial-of-service attack Correct answer.

Explanation

A denial-of-service attack consumes or overwhelms resources such as bandwidth, connections, or CPU so that legitimate users cannot reach the service. Its objective is availability impact, not confidentiality. Phishing, exfiltration, and privilege escalation aim at credential or data compromise.

Question 3Security Fundamentals and Threat Landscape

Which property of the CIA triad is directly violated when an attacker alters the amount field in a financial transaction in transit?

  1. Confidentiality
  2. Availability
  3. Non-repudiation
  4. Integrity Correct answer.

Explanation

Integrity means data is accurate and unaltered; modifying a transaction value breaks it. Confidentiality concerns unauthorized disclosure, and availability concerns timely access. Non-repudiation is a related security service about proving an action occurred, not a CIA triad pillar.

Question 4Security Fundamentals and Threat Landscape

What distinguishes a virus from a worm in classic malware taxonomy?

  1. A worm requires user interaction to execute, while a virus spreads automatically
  2. A virus encrypts files for ransom, while a worm only displays advertisements
  3. A worm self-propagates across networks without a host file, while a virus needs a host to attach to Correct answer.
  4. A virus spreads only through email attachments, while a worm spreads only through USB drives

Explanation

A worm is standalone code that replicates across networks by exploiting services or weak credentials, needing no host program. A virus inserts its code into an executable or document and runs when the host is executed. The distinction is self-propagation versus host dependence, not the transport medium.

Question 5Security Fundamentals and Threat Landscape

In a typical TCP three-way handshake, which flag combination does a client send first to initiate a connection?

  1. SYN Correct answer.
  2. RST
  3. ACK
  4. FIN

Explanation

The client begins with a SYN segment carrying its initial sequence number. The server replies with SYN-ACK, and the client completes with ACK. FIN is used to close a connection and RST to abort it.

Question 6Security Fundamentals and Threat Landscape

Which statement correctly describes how a stateful firewall differs from a stateless packet filter?

  1. It maintains a session table so return traffic is permitted without an explicit inbound rule Correct answer.
  2. It assigns IP addresses to internal hosts dynamically
  3. It decrypts TLS traffic before applying policy
  4. It inspects application payloads to block SQL injection strings

Explanation

A stateful firewall records connection state and automatically allows packets belonging to established sessions, so return traffic does not need a separate rule. Stateless filters evaluate each packet independently against static rules. Deep payload inspection, TLS decryption, and address assignment are functions of other devices or features.

Question 7Security Fundamentals and Threat Landscape

A user receives an email that appears to come from the finance director and urgently requests a wire transfer. Which social engineering technique is primarily being used?

  1. Tailgating
  2. DNS cache poisoning
  3. Business email compromise Correct answer.
  4. Watering hole attack

Explanation

Business email compromise impersonates or hijacks an executive or partner mailbox to trick staff into transferring funds or data. The urgency and authority cues are hallmarks of this fraud. Watering hole, tailgating, and DNS cache poisoning are different attack vectors.

Question 8Security Fundamentals and Threat Landscape

Which technique allows an attacker to send packets with a forged source IP address while still receiving the replies?

  1. ARP cache poisoning of the victim host
  2. On-path interception of the return traffic Correct answer.
  3. Blind spoofing without any reply path
  4. MAC flooding of the switch CAM table

Explanation

If an attacker forges the source address, replies go to the spoofed address; to see them the attacker must position on the path or otherwise intercept that return traffic. Blind spoofing by definition does not receive replies. MAC flooding and ARP poisoning are LAN-level attacks that do not by themselves deliver replies for a spoofed source.

Question 9Security Fundamentals and Threat Landscape

During reconnaissance, an attacker sends TCP packets with the SYN flag to many destination ports and records which ports respond with SYN-ACK. Which scanning technique is this?

  1. Xmas tree scan
  2. UDP scan
  3. Fragmentation scan
  4. TCP SYN scan Correct answer.

Explanation

A SYN scan sends SYN probes and treats SYN-ACK as open and RST as closed, often without completing the handshake. It is fast and relatively stealthy because full connections are not established. UDP, Xmas tree, and fragmentation scans use different probe types.

Question 10Security Fundamentals and Threat Landscape

Which characteristic most reliably distinguishes a DDoS attack from a DoS attack launched from a single host?

  1. It relies on a single spoofed source address
  2. It always exploits an application-layer vulnerability
  3. It encrypts victim data and demands payment
  4. Traffic originates from many distributed sources, often a botnet Correct answer.

Explanation

Distributed denial of service aggregates traffic from many compromised hosts, which makes simple source-based filtering ineffective and amplifies volume. A single-source DoS comes from one origin. Application-layer exploitation, ransomware, and single-source spoofing are not defining traits of DDoS.

Question 11Security Fundamentals and Threat Landscape

A web application reflects user input into an HTML page without encoding, and an attacker injects a script that steals session cookies. Which vulnerability class is this?

  1. Insecure deserialization
  2. Cross-site request forgery
  3. Cross-site scripting Correct answer.
  4. SQL injection

Explanation

Reflected cross-site scripting occurs when untrusted input is echoed into a response without output encoding, letting the attacker's script run in the victim's browser context. Session cookie theft is a typical XSS impact. SQL injection targets the database, CSRF abuses a victim's existing session, and deserialization attacks object parsing.

Question 12Security Fundamentals and Threat Landscape

An attacker submits the input ' OR '1'='1 into a login form and gains access without valid credentials. Which defense most directly prevents this?

  1. Using parameterized queries with bound parameters Correct answer.
  2. Setting the HttpOnly flag on session cookies
  3. Adding a CAPTCHA to the login page
  4. Enforcing HTTPS for the login page

Explanation

The payload alters the SQL WHERE clause so the condition is always true; parameterized queries separate code from data so the input cannot change query logic. CAPTCHA, HTTPS, and HttpOnly address automation, transport confidentiality, and cookie theft respectively, not injection.

Question 13Security Fundamentals and Threat Landscape

Which statement best describes the role of a DMZ in enterprise network security architecture?

  1. It is the segment where employee endpoints connect to the core switch
  2. It hosts externally accessible services in a segment isolated from the internal trusted network Correct answer.
  3. It stores backup copies of internal databases for disaster recovery
  4. It is a management VLAN used only by network administrators

Explanation

A DMZ sits between the untrusted internet and the trusted internal network, hosting public-facing servers so that a compromise there does not directly expose internal systems. Firewall policy strictly controls traffic between the DMZ and both sides. Backup storage, endpoint access, and management VLANs are separate design concerns.

Question 14Security Fundamentals and Threat Landscape

What is the primary security function of NAT in a typical enterprise edge deployment?

  1. It encrypts traffic between sites
  2. It hides internal addressing from external observers and reduces direct inbound reachability Correct answer.
  3. It inspects packet payloads for malicious signatures
  4. It authenticates users before granting internet access

Explanation

NAT translates private addresses to public ones, so external parties cannot directly address internal hosts and unsolicited inbound connections are harder. It is not an authentication, content inspection, or encryption mechanism and should not be relied on as a security control by itself.

Question 15Security Fundamentals and Threat Landscape

In an IPsec VPN, which protocol provides confidentiality of the payload while AH alone does not?

  1. AH
  2. GRE
  3. ESP Correct answer.
  4. IKE phase 1

Explanation

ESP can encrypt the payload, providing confidentiality, and optionally authenticate it. AH provides integrity and origin authentication but no encryption, so data remains readable. IKE negotiates security associations, and GRE is a tunneling protocol without built-in encryption.

Question 16Security Fundamentals and Threat Landscape

A security analyst sees a host repeatedly resolving many random-looking domain names that mostly do not exist. Which malicious activity is most consistent with this pattern?

  1. ARP spoofing on the local segment
  2. Domain generation algorithm communication by malware Correct answer.
  3. Brute-force login against a web portal
  4. SMTP relay abuse for spam delivery

Explanation

Domain generation algorithms produce large numbers of pseudo-random domains so malware can locate its command-and-control server despite takedowns, resulting in many failed lookups. SMTP abuse, ARP spoofing, and login brute force do not generate this DNS pattern.

Question 17Security Fundamentals and Threat Landscape

Which attack tricks a victim's browser into sending an authenticated state-changing request to a site where the victim is already logged in?

  1. Cross-site request forgery Correct answer.
  2. Clickjacking
  3. Session fixation
  4. Reflected cross-site scripting

Explanation

CSRF exploits the browser's automatic inclusion of session cookies, so a forged request from another site is executed with the victim's privileges. Defenses include anti-CSRF tokens and SameSite cookies. XSS executes attacker script, clickjacking overlays UI, and session fixation pre-sets a session identifier.

Question 18Security Fundamentals and Threat Landscape

Which property of a cryptographic hash function makes it unsuitable for an attacker to find two different inputs producing the same digest?

  1. Key length
  2. Salt uniqueness
  3. Collision resistance Correct answer.
  4. Perfect forward secrecy

Explanation

Collision resistance means finding any two distinct inputs with the same hash output is computationally infeasible. Key length applies to ciphers, perfect forward secrecy concerns session key compromise, and salting is a password storage practice.

Question 19Security Fundamentals and Threat Landscape

An organization wants to detect intrusions by comparing traffic against known attack signatures while allowing legitimate traffic. Which technology best fits this requirement?

  1. Host-based file integrity monitoring
  2. Security information and event management correlation only
  3. Network address translation at the edge
  4. Signature-based intrusion prevention system deployed inline Correct answer.

Explanation

A signature-based IPS matches traffic against known attack patterns and can block them when deployed inline. File integrity monitoring watches host file changes, SIEM correlation aggregates logs, and NAT performs address translation without detection.

Question 20Security Fundamentals and Threat Landscape

Which statement correctly describes a zero-day vulnerability?

  1. It is a flaw that has existed for exactly one day
  2. It is a publicly disclosed flaw with an available patch
  3. It is exploitable before the vendor has released a patch or signature Correct answer.
  4. It is a vulnerability that only affects unpatched Windows hosts

Explanation

A zero-day is a vulnerability unknown to or unpatched by the vendor at the time of exploitation, so signature and patch defenses lag behind. The term does not refer to elapsed time, a specific operating system, or a flaw with an available fix.

Question 21Security Fundamentals and Threat Landscape

An attacker on the same LAN poisons ARP caches so that traffic between a victim and the gateway passes through the attacker. Which impact does this primarily achieve?

  1. Privilege escalation on the domain controller
  2. Denial of service through disk exhaustion
  3. Permanent data destruction on the victim host
  4. On-path interception enabling traffic modification Correct answer.

Explanation

ARP poisoning maps the gateway IP to the attacker's MAC, placing the attacker on the path so traffic can be read and altered, an on-path (man-in-the-middle) condition. It does not directly destroy data, fill disks, or elevate domain privileges.

Question 22Security Fundamentals and Threat Landscape

A company must choose between symmetric and asymmetric cryptography for bulk data encryption between two branches. Which reasoning is correct?

  1. Asymmetric encryption removes the need for any key management
  2. Symmetric encryption cannot provide confidentiality and should be avoided for bulk data
  3. Symmetric encryption is preferred for bulk data because it is computationally faster, with the shared key protected by asymmetric methods Correct answer.
  4. Asymmetric encryption is preferred for bulk data because it is faster than symmetric encryption

Explanation

Symmetric ciphers such as AES process bulk data far more efficiently, while asymmetric algorithms are used to exchange or protect the symmetric keys. This hybrid approach is standard in VPNs and TLS. Asymmetric encryption is slower and still requires key management.

Question 23Security Fundamentals and Threat Landscape

During an incident, an analyst finds that an attacker used valid domain credentials obtained from a phishing email and then accessed several servers. Which phase of the attack lifecycle does the server access represent?

  1. Weaponization of the payload
  2. Establishing persistence on the first host
  3. Reconnaissance before initial access
  4. Lateral movement after initial access Correct answer.

Explanation

After gaining initial access through stolen credentials, the attacker uses them to move from host to host, which is lateral movement. Reconnaissance precedes access, weaponization prepares the payload, and persistence maintains access on an already compromised host.

Question 24Security Fundamentals and Threat Landscape

Why does an attacker commonly combine spoofed source addresses with reflection in a volumetric DDoS attack?

  1. It encrypts the attack traffic to bypass firewalls
  2. It hides the true origin and redirects amplified responses toward the victim Correct answer.
  3. It guarantees the victim will accept the packets as legitimate
  4. It ensures the attacker receives the victim's replies

Explanation

Reflection uses third-party servers to send responses to a spoofed victim address, and amplification multiplies volume, while spoofing conceals the attacker's identity. The goal is not to appear legitimate, encrypt traffic, or receive replies.

Question 25Network Security Architecture and Zone Design

On a Huawei firewall, which zone is predefined to hold interfaces that connect to internal networks requiring the highest level of trust by default?

  1. DMZ zone
  2. Untrust zone
  3. Local zone
  4. Trust zone Correct answer.

Explanation

The Trust zone is a predefined security zone on Huawei firewalls and is intended for internal network segments whose users are considered highly trusted. Its default priority is the highest among the predefined zones except Local, and inter-zone traffic policy is applied between zones.

Question 26Network Security Architecture and Zone Design

What is the default inter-zone behavior on a Huawei firewall when no security policy matches the traffic between two zones?

  1. The traffic is permitted only for TCP
  2. The traffic is redirected to the DMZ
  3. The traffic is denied by default Correct answer.
  4. The traffic is permitted by default

Explanation

Huawei firewalls use a default-deny model for inter-zone traffic: if no security policy matches a flow, the packet is dropped. Administrators must explicitly permit the required traffic with a security policy. This default-deny posture is a core principle of the zone-based architecture.

Question 27Network Security Architecture and Zone Design

Which zone on a Huawei firewall is used to represent the firewall's own IP addresses and the traffic destined to or originated from the device itself?

  1. Trust
  2. Untrust
  3. DMZ
  4. Local Correct answer.

Explanation

The Local zone is a special predefined zone that represents the firewall itself. Traffic to the device's own interfaces, such as management access, is handled in the Local zone. Security policies can therefore control which zones may reach the firewall's own services.

Question 28Network Security Architecture and Zone Design

A firewall has an interface in the DMZ zone hosting a web server. Which zone pair must be permitted so that Internet users can reach the web server?

  1. Untrust to DMZ Correct answer.
  2. Local to Trust
  3. Trust to DMZ
  4. DMZ to Trust

Explanation

Internet users reside in the Untrust zone, and the web server resides in the DMZ zone, so the required direction is Untrust to DMZ. The security policy must permit the specific service port to the server address. Return traffic is handled by the session table rather than by a reverse policy.

Question 29Network Security Architecture and Zone Design

Which statement describes the function of the security zone on a Huawei firewall?

  1. It provides NAT translation for outbound traffic
  2. It assigns an IP address to each interface
  3. It groups interfaces with the same trust level so that policy is applied between groups Correct answer.
  4. It encrypts traffic between two firewalls

Explanation

A security zone is a logical grouping of interfaces that share a similar trust level. Security policies are then applied between zones rather than between individual interfaces. This simplifies policy management and enforces consistent treatment of traffic with the same trust level.

Question 30Network Security Architecture and Zone Design

An administrator wants traffic between two interfaces in the same zone to be inspected by security policy. What is the correct design action?

  1. Assign both interfaces to the Local zone
  2. Disable the default-deny action
  3. Place the interfaces in different zones Correct answer.
  4. Enable the same-zone traffic inspection option

Explanation

By default, traffic between interfaces in the same zone is not filtered by inter-zone security policy. To have the traffic inspected by policy, the interfaces must be placed in different zones. This is a common design consideration when segmenting internal networks.

Question 31Network Security Architecture and Zone Design

In a typical three-zone enterprise design, which zone should host servers that must be accessible from the Internet but must not initiate connections to internal user networks?

  1. DMZ Correct answer.
  2. Trust
  3. Untrust
  4. Local

Explanation

The DMZ is designed to host externally reachable services while isolating them from the internal network. Policies typically permit Untrust to DMZ for specific services and deny DMZ to Trust. This limits the impact if a public server is compromised.

Question 32Network Security Architecture and Zone Design

A security policy is configured from Trust to Untrust permitting HTTP, and a second policy from Trust to Untrust permitting HTTPS. A user opens an HTTP session to a web server. How does the firewall match the policies?

  1. It matches the last policy in the list
  2. It matches only policies containing the any service
  3. It matches the first policy whose conditions are satisfied and stops Correct answer.
  4. It matches both policies and requires both to permit

Explanation

Security policies are evaluated in order from top to bottom, and the first matching policy determines the action. Once a match occurs, evaluation stops and later policies are not consulted. Policy ordering therefore directly affects which action is applied.

Question 33Network Security Architecture and Zone Design

Which zone pair is used when an internal administrator needs to manage the firewall through an interface in the Trust zone?

  1. Trust to Local Correct answer.
  2. DMZ to Local
  3. Trust to Untrust
  4. Local to Trust

Explanation

Management traffic from internal users is destined to the firewall itself, which resides in the Local zone. The direction is therefore from Trust to Local, and the policy must permit the management protocol used. Without such a policy the connection is dropped by default.

Question 34Network Security Architecture and Zone Design

What is the effect of the security zone priority value on a Huawei firewall?

  1. It defines the routing priority for the zone
  2. It sets the bandwidth limit for the zone
  3. It determines the order in which interfaces are initialized
  4. It is used to compare trust levels of zones and can influence default behavior between zones Correct answer.

Explanation

Each zone has a priority that expresses its trust level, with higher values indicating greater trust. The priority is used for zone comparison and can affect default handling such as inter-zone behavior before explicit policies. It does not configure bandwidth or routing.

Question 35Network Security Architecture and Zone Design

A company wants all traffic from the Trust zone to the Untrust zone permitted, but wants to log every denied session. Which design element provides the logging of denied traffic?

  1. The default inter-zone action with logging enabled Correct answer.
  2. The zone priority value
  3. The routing table
  4. The interface IP address

Explanation

Denied traffic is the traffic that matches no permit policy, so it is handled by the default inter-zone action. Enabling logging on that default action records denied sessions. This gives visibility of traffic blocked by the default-deny posture.

Question 36Network Security Architecture and Zone Design

Which statement about the relationship between an interface and a security zone on a Huawei firewall is correct?

  1. An interface must belong to the Local zone
  2. An interface belongs to exactly one zone at a time Correct answer.
  3. An interface does not need a zone to forward traffic
  4. An interface can belong to multiple zones simultaneously

Explanation

Each interface is assigned to one security zone at a time, and that assignment determines how policy treats its traffic. Moving an interface to another zone changes the policies that apply to it. An interface without a zone assignment cannot be used for normal inter-zone forwarding.

Question 37Network Security Architecture and Zone Design

An engineer places the internal user network and the public web server in the same zone to simplify policy. What is the main security consequence?

  1. NAT is disabled for the zone
  2. Traffic between them is not filtered by inter-zone policy Correct answer.
  3. The server automatically receives a public IP address
  4. The zone priority becomes zero

Explanation

Interfaces in the same zone are not subject to inter-zone security policy by default, so traffic between the users and the server would bypass policy inspection. This weakens the isolation that the DMZ design is meant to provide. Separating the segments into different zones restores policy control.

Question 38Network Security Architecture and Zone Design

Which of the following best describes a security policy on a Huawei firewall?

  1. A certificate used for IPsec authentication
  2. A set of match conditions and an action applied to traffic between zones Correct answer.
  3. A list of IP addresses blocked at the interface level
  4. A routing rule that selects the outbound interface

Explanation

A security policy consists of match conditions such as source zone, destination zone, source address, destination address, and service, together with an action of permit or deny. It is evaluated for traffic between zones. This is the central control mechanism of the zone-based architecture.

Question 39Network Security Architecture and Zone Design

Traffic from Untrust to DMZ on port 443 is required, but the same traffic on port 22 must be blocked. How should policies be ordered to achieve this with the fewest policies?

  1. Permit Untrust to DMZ any service, then deny port 22
  2. Permit port 443 only, relying on default deny for port 22 Correct answer.
  3. Deny all Untrust to DMZ traffic, then permit port 443
  4. Deny Untrust to DMZ port 22, then permit Untrust to DMZ port 443

Explanation

Because unmatched traffic is denied by default, a single policy permitting port 443 is sufficient to allow HTTPS while blocking SSH. Adding an explicit deny is unnecessary when the default action already denies. This is the most concise and least error-prone configuration.

Question 40Network Security Architecture and Zone Design

Which zone should be used for a segment of partner servers that must be reachable from both the Internet and internal users, but must be isolated from each other?

  1. The Trust zone
  2. The Untrust zone
  3. A custom security zone with its own priority Correct answer.
  4. The Local zone

Explanation

Huawei firewalls allow administrators to create custom security zones with a chosen priority, which is appropriate for segments that do not fit the predefined roles. A dedicated zone lets policy isolate partner servers from other segments. The predefined zones would either over-trust or under-trust the segment.

Question 41Network Security Architecture and Zone Design

What happens to a packet that arrives on an interface that has not been assigned to any security zone?

  1. It is processed as Trust zone traffic
  2. It is forwarded using the default route
  3. It cannot be processed by inter-zone policy and is dropped Correct answer.
  4. It is automatically assigned to the DMZ zone

Explanation

Zone membership is a prerequisite for inter-zone policy processing, so an interface without a zone cannot have its traffic evaluated and permitted normally. The packet is therefore dropped. Administrators must assign every forwarding interface to a zone.

Question 42Network Security Architecture and Zone Design

A firewall policy permits Trust to Untrust for a client's outbound web session. Which statement about the return traffic is correct?

  1. The return traffic is permitted because it matches the existing session Correct answer.
  2. The return traffic is always dropped by default
  3. The return traffic must be permitted by a NAT policy
  4. A separate Untrust to Trust policy must permit the return packets

Explanation

Huawei firewalls are stateful: once a session is established by a permitted forward packet, return packets belonging to that session are allowed without a reverse policy. This is why only the initiating direction needs a permit policy. The session table tracks the connection state.

Question 43Network Security Architecture and Zone Design

Which design principle best justifies placing publicly accessible servers in a DMZ rather than in the Trust zone?

  1. It reduces the number of security policies required
  2. It limits the exposure of internal networks if the server is compromised Correct answer.
  3. It eliminates the need for a default-deny action
  4. It allows the servers to bypass stateful inspection

Explanation

The DMZ isolates Internet-facing servers from internal user networks so that a compromised server cannot directly reach internal resources. Policies typically allow Untrust to DMZ for specific services and block DMZ to Trust. This containment is the primary reason for the DMZ design.

Question 44Network Security Architecture and Zone Design

An administrator needs to allow DNS queries from the Trust zone to a DNS server in the DMZ. Which policy conditions are required at minimum?

  1. Source zone Local, destination zone DMZ, service any
  2. Source zone Trust, destination zone Local, service any
  3. Source zone DMZ, destination zone Trust, service DNS
  4. Source zone Trust, destination zone DMZ, service DNS Correct answer.

Explanation

The client is in Trust and the server is in DMZ, so the source zone is Trust and the destination zone is DMZ. The service must be restricted to DNS so that only the intended application is permitted. Address conditions can further narrow the policy to the specific client and server.

Question 45Network Security Architecture and Zone Design

Which statement about the predefined zones on a Huawei firewall is correct?

  1. The DMZ zone must be deleted before custom zones are created
  2. Trust, Untrust, DMZ, and Local are predefined and cannot be deleted Correct answer.
  3. Predefined zones have no priority value
  4. Only Trust and Untrust are predefined

Explanation

Huawei firewalls ship with the predefined zones Trust, Untrust, DMZ, and Local, which serve as the basis of the zone-based architecture and cannot be deleted. Administrators can add custom zones alongside them. The predefined zones already carry default priority values.

Question 46Network Security Architecture and Zone Design

A policy from Untrust to DMZ permits HTTPS to a server, and a policy from DMZ to Untrust permits DNS. A DMZ server sends an HTTPS response to an Internet client. Which policy permits the response?

  1. The DMZ to Untrust DNS policy
  2. A new policy must be created for each response packet
  3. The Untrust to DMZ HTTPS policy, through session matching Correct answer.
  4. No policy is needed because responses are always permitted

Explanation

The response belongs to the session created by the client's initial HTTPS request, which was permitted by the Untrust to DMZ policy. Stateful inspection allows the return packet based on the session table. The DMZ to Untrust policy applies only to new sessions initiated by the server.

Question 47Network Security Architecture and Zone Design

Which two elements are typically used together to define the scope of a security policy between zones? (Choose the best single answer.)

  1. Routing protocol and metric
  2. Source and destination zones plus addresses and services Correct answer.
  3. Zone name and interface description
  4. Interface speed and duplex

Explanation

A security policy's scope is defined by match conditions: source and destination zones, source and destination addresses, and the service or application. These conditions determine exactly which traffic the action applies to. Routing metrics, interface speed, and descriptions do not scope policy.

Question 48Network Security Architecture and Zone Design

An engineer must ensure that traffic from a guest Wi-Fi network cannot reach internal servers, but can reach the Internet. Which zone design achieves this with minimal policy?

  1. Place the guest network in the DMZ zone and permit DMZ to Trust
  2. Place the guest network in a separate custom zone and permit only that zone to Untrust Correct answer.
  3. Place the guest network in the Local zone
  4. Place the guest network in the Trust zone and rely on default deny

Explanation

A dedicated zone for guests allows a single policy permitting guest-to-Untrust while the default-deny action blocks guest-to-Trust and guest-to-DMZ. This isolates guests from internal resources with minimal configuration. Sharing the Trust zone would expose internal servers to guest traffic.

Question 49Firewall Technologies and Policy Configuration

On a Huawei firewall, which security zone is predefined and has a default priority of 5, making it the zone into which packets from untrusted external networks are usually placed?

  1. The DMZ zone
  2. The Untrust zone Correct answer.
  3. The Local zone
  4. The Trust zone

Explanation

Huawei firewalls ship with predefined zones Trust, Untrust, DMZ and Local. Untrust has priority 5 and is intended for external, low-trust networks, so it is the usual placement for Internet-facing interfaces. Trust has priority 85, DMZ 50, and Local 100.

Question 50Firewall Technologies and Policy Configuration

A firewall policy is configured with the action Permit and no other matching conditions. Which statement describes how the traffic is handled?

  1. Traffic matching the policy is allowed only after the session table is cleared
  2. Traffic matching the policy is forwarded according to the policy, and the policy hit count increments Correct answer.
  3. Traffic matching the policy is allowed only if it also matches the default interzone action
  4. Traffic matching the policy is dropped because security policies require a content profile

Explanation

A security policy with action Permit allows matching traffic and records a hit on that policy, which is useful for verification. Content profiles and other advanced settings are optional refinements, not prerequisites for forwarding. The default interzone action only applies to traffic that matches no policy.