Huawei HCIA-Security (H12-711 V4.0) study guide
Huawei HCIA-Security (H12-711 V4.0) · Work through your exam, one topic at a time.
HCIA-Security (exam code H12-711, currently V4.0) is Huawei's associate-level security certification, aimed at engineers who are moving into firewall and network-security operations, and at candidates building a foundation before higher-level Huawei security tracks. It is an entry credential: it assumes basic TCP/IP and routing knowledge rather than deep cryptography or large-scale security architecture experience. The Huawei HCIA-Security (H12-711 V4.0) study guide has 8 sections and about 2,496 words.
01Security Fundamentals and Threat Landscape
Security Fundamentals and Threat Landscape asks you to define core security terms, classify attacks, and explain how layered controls on a Huawei USG address them. Expect definition-matching items and short scenarios such as 'which term describes a weakness in a service?' CIA triad : confidentiality (encryption, access control), integrity (hashing, signatures), availability (anti-DDoS, redundancy).
325 words, about 2 min02Network Security Architecture and Zone Design
Local (100) : the firewall itself; management traffic such as SSH, HTTPS and SNMP to the device is Local-zone traffic. Trust (85) : internal user networks.
327 words, about 2 min03Firewall Technologies and Policy Configuration
USG is a stateful firewall: the first packet of a flow is checked against the security policy and a session entry is created. Return traffic matches the session, not the policy.
312 words, about 2 min04Network Address Translation and Access Control
Source NAT (NAT policy) : translates private source addresses. Easy IP uses the egress interface address; PAT uses an address pool with port translation; No-PAT is one-to-one without port translation.
313 words, about 2 min05Virtual Private Networks (IPsec, SSL, L2TP, GRE)
IPsec protects traffic between gateways or hosts. IKE negotiates SAs in two phases: phase 1 builds the ISAKMP SA (proposal with encryption, hash, DH group, authentication method, lifetime); phase 2 builds the IPsec SA (protocol ESP or AH, encryption, hash, PFS, lifetime).
322 words, about 2 min06Intrusion Prevention and Content Security (IPS, Anti-Virus, URL Filtering)
IPS inspects packets and flows against signatures for known exploit patterns and anomaly rules. A signature has an ID, severity, action (alert or block) and direction.
289 words, about 1 min07Encryption, PKI and Identity Authentication
Symmetric algorithms (AES, SM4) are fast and used for bulk data; asymmetric algorithms (RSA, SM2) are slow and used for key exchange and signatures. Hashes (SHA-256, SM3) give integrity; HMAC adds a shared key.
315 words, about 2 min08Security Operations, Logging and Troubleshooting
USG produces traffic, threat, operation and system logs. Syslog severity runs from 0 (emergency) to 7 (debug): a lower number means higher severity.
293 words, about 1 min