Huawei HCIA-Security (H12-711 V4.0) study plan

Describe the packet-forwarding path through a Huawei firewall (session setup, session table lookup, and fast-path forwarding) well enough to explain in your own words why the first packet of a flow is handled differently from later packets

List the components of a security policy rule (source and destination zones, addresses, service, action, and time range) and state the matching order the device applies when several rules could match

Configure a basic inter-zone security policy that permits one specific application flow and blocks all other traffic between the same two zones, then verify the result with session table output

Distinguish the default actions available to a security policy (permit, deny, and the logging or alerting options attached to them) and explain when each is appropriate

Identify the CLI commands used to view the session table, hit counts on policy rules, and dropped-packet statistics

Configure source NAT (address pool and PAT variants) and server NAT (destination NAT with port mapping) on the firewall and confirm each with session table entries showing translated addresses

Explain how NAT interacts with security policy matching: which addresses the policy sees before and after translation, and how that ordering affects rule design

Design an address-and-service object structure (address sets, service groups) for a multi-segment network so that policy rules stay readable and reusable

Troubleshoot a NAT failure by reading session table and debug output to decide whether the fault lies in the policy, the NAT rule, or routing

Compare NAT on the firewall with NAT performed on an upstream router and state two operational reasons to prefer each placement

Draw a zone map for a typical enterprise edge (untrust, trust, DMZ, and a management zone) and justify the trust level and default inter-zone policy posture for each pair of zones

Configure interfaces into security zones, including a sub-interface for a VLAN-tagged segment, and verify zone membership from the CLI

Explain how the firewall handles traffic that arrives and leaves on the same zone (intra-zone traffic) and configure the policy needed to permit or block it deliberately

Describe the role of routing in zone design: how return-path correctness and asymmetric routing break stateful inspection, and how to detect it

Plan a migration from a router-with-ACLs edge to a zone-based firewall, listing the ACL rules that map to policy rules and the ones that need redesign

Explain the IPsec phase 1 and phase 2 negotiation sequence, naming the parameters that must match on both peers at each phase and what happens when one mismatches

Configure a site-to-site IPsec tunnel between two firewalls using pre-shared key authentication and a specific proposal set, then bring the tunnel up and verify it with IKE and IPsec SA displays

Diagnose a tunnel that fails to establish by checking proposal mismatch, pre-shared key mismatch, proxy ID or traffic selector mismatch, and routing to the peer

Describe the difference between main mode and aggressive mode and state one security consequence of choosing aggressive mode

Explain how NAT traversal works for IPsec and why a tunnel between two NATed peers needs it

Compare IPsec, SSL VPN, L2TP over IPsec, and GRE by use case (site-to-site, remote worker, legacy client, tunneling non-IP traffic) and pick the right one for four given scenarios

Configure remote-access SSL VPN with a user account, an address pool, and a resource list, then connect a client and confirm the assigned address and reachable resource

Explain how certificates replace pre-shared keys in IPsec and SSL VPN: what the peer validates, and what breaks when a certificate expires or a CA is not trusted

Describe the PKI building blocks (CA, RA, certificate, CRL, and enrollment request) and trace the steps a device follows to enroll and obtain a certificate from a CA

Explain how digital signatures and symmetric key exchange combine in a TLS handshake, and where identity authentication of the server happens in that flow

Explain how signature-based intrusion prevention differs from anomaly detection, and state one realistic limitation of each in a production network

Configure an IPS profile, apply it to a traffic path, and confirm that a test signature triggers an alert and a block action, reading the threat log to identify the signature that fired

Configure anti-virus scanning on a file-transfer path, explain what file types and protocols are covered, and describe the latency trade-off of full scanning versus a size limit

Configure URL filtering with a category-based profile and a custom whitelist and blacklist, then verify that a blocked category returns the block page while a whitelisted site loads

Explain how content security profiles attach to security policy rules and why applying a profile without a matching permit rule has no effect

Classify the main threat categories (reconnaissance, spoofing, man-in-the-middle, denial of service, application-layer injection, malware) and map each to at least one control the firewall can enforce

Explain symmetric versus asymmetric encryption, hashing, and message authentication codes, and state which property (confidentiality, integrity, authenticity) each provides

Describe common authentication factors and methods (password, token, certificate, and multi-factor combinations) and choose an appropriate method for three given access scenarios

Walk through a public-key exchange in which an attacker sits in the middle, and explain precisely which validation step defeats the attack

Explain how a spoofed source address is detected at the firewall and what anti-spoofing configuration looks like on an interface

Configure log export to a syslog server, confirm logs arrive, and identify which log types (traffic, threat, policy, system) answer which operational question

Build a troubleshooting sequence for 'users cannot reach a server through the firewall' that checks interface status, zone membership, routing, policy match, NAT, and session table in a fixed order

Interpret session table fields (state, timeout, translated addresses, and application protocol) to decide whether a flow is being dropped, denied, or simply idle-timed out

Explain how to back up and restore a firewall configuration and why a pre-change backup belongs in every change procedure

Take a timed 50-question mixed practice set across all eight domains and record your score per domain