HCIE-Security cheat sheet

Security levels in Huawei's multi-level security model: public < internal < secret < top secret; a subject may read objects at or below its level and write only at or above it (no read up, no write down).

BLP (Bell-LaPadula) enforces confidentiality: Simple Security Property = no read up; *-Property = no write down; Discretionary Security Property uses an access matrix.

Biba enforces integrity: no read down, no write up. Clark-Wilson uses well-formed transactions and separation of duty instead of lattice levels.

Common Criteria evaluation levels EAL1-EAL7; EAL4 is the highest level achievable with a realistic development cost for general commercial products, EAL7 requires formal verification.

TCSEC divisions: D (minimal), C1/C2 (discretionary), B1/B2/B3 (mandatory), A1 (verified design); C2 requires individual accountability via audit.

Reference monitor properties: complete mediation, tamper-proof, and verifiable. The TCB is the totality of protection mechanisms enforcing the security policy.

Defense in depth layers for a campus design: border firewall, IPS, core/aggregation ACL and uRPF, access-layer port security and 802.1X, endpoint agent, and SIEM correlation.

Redundancy rule: dual-node firewall clustering uses VRRP/HRP with a heartbeat link; the standby device synchronizes sessions so failover preserves stateful flows.

Risk = Threat x Vulnerability x Asset value; residual risk = total risk minus the effect of implemented controls. ALE = SLE x ARO, SLE = asset value x exposure factor.

IPsec phase 1 (IKE SA) negotiates encryption, hash, DH group, and authentication; phase 2 (IPsec SA) negotiates ESP/AH transforms and PFS. Main mode = 6 messages, aggressive mode = 3 messages but exposes the identity.

ESP provides confidentiality plus optional integrity; AH provides integrity and authentication only and does not traverse NAT. NAT-T encapsulates ESP in UDP port 4500.

IKEv2 uses 4 messages (IKE_SA_INIT, IKE_AUTH) and supports MOBIKE for endpoint address changes; it is the preferred choice when NAT traversal and rekeying efficiency matter.

SSL/TLS VPN virtual gateway binds a VPN instance, a public address/port, and a certificate; a virtual gateway is the unit of policy, not the physical interface.

DSVPN uses NHRP to resolve spoke public addresses through the hub; mGRE tunnels carry dynamic spoke-to-spoke traffic, and IPsec over the tunnel secures it.

Anti-DDoS: SYN flood defense uses source authentication (SYN cookie/proxy) and rate limiting; the cleaning center diverts traffic by BGP or policy-based routing and reinjects clean traffic with GRE.

WAF detection modes: signature matching for known CVEs, semantic/state-machine analysis for injection, and bot/CC defense via rate thresholds and JS challenges.

NAT and security policy order on Huawei USG: policy routing, then NAT server/outbound NAT, then interzone policy; the security policy must permit the post-NAT zone pair.

802.1X roles: supplicant, authenticator (switch), authentication server (RADIUS). EAP methods: EAP-TLS (certificates both sides), PEAP (server certificate, inner MS-CHAPv2), EAP-TTLS.

EDR detection chain: process creation, file write, registry change, network connection, and script block logging; behavioral rules combine these into a single alert with a process tree.

Huawei HiSec Endpoint (formerly EDR) uses a lightweight agent plus a management center; isolation (network quarantine) is reversible and keeps the management channel open.

IoC vs IOA: IoC is a static artifact (hash, IP, domain); IOA is behavior (e.g., Office spawning PowerShell), which survives hash mutation.

Cloud shared responsibility: the provider secures physical, host, and virtualization layers; the tenant secures guest OS, workloads, identities, data classification, and security group rules.

Security groups are stateful and allow-only; network ACLs are stateless and evaluated in order. Default-deny inbound is the baseline, and 0.0.0.0/0 on management ports is a finding.

CSPM checks for public storage buckets, overly permissive IAM policies, unencrypted volumes, disabled logging/trails, and exposed management interfaces.

Micro-segmentation enforces east-west policy per workload identity rather than per subnet; it limits lateral movement after a single host compromise.

Zero trust pillars: identity, device, network, application/workload, data, visibility and analytics, automation. Policy decision point evaluates continuously, not once at login.

Container security: scan images in the registry, run as non-root, use read-only root filesystem, drop Linux capabilities, and sign images so admission control can verify provenance.

SOC tiering: Tier 1 triage and false-positive filtering, Tier 2 investigation and containment, Tier 3 threat hunting and detection engineering; escalation requires documented criteria.

Incident response phases: preparation, identification, containment, eradication, recovery, lessons learned. Containment options are isolate host, block IP/domain, disable account, revoke session.

Log retention and correlation: firewall session logs, IPS alerts, DNS queries, proxy logs, and authentication events must share a normalized time source (NTP) to correlate.

Detection content quality metrics: true positive rate, false positive rate, mean time to detect (MTTD), mean time to respond (MTTR); tuning targets FP rate before adding new rules.

Vulnerability management: CVSS base score plus environmental and temporal context determines priority; a critical CVSS on an unreachable host ranks below a medium on an internet-facing one.

Change management requires request, risk assessment, approval, implementation window, rollback plan, and verification; emergency changes are retro-approved within a defined window.

Compliance mapping: ISO 27001 clauses map to controls, not to products; evidence must be dated, attributable, and retained for the audit period.

Threat intelligence: strategic, tactical, operational, and technical levels; STIX/TAXII carry indicators, and feed indicators require aging/TTL because attacker infrastructure rotates.

Backup rule 3-2-1: three copies, two media types, one offsite; immutable or offline copies are required to survive ransomware that targets connected backups.

IPsec troubleshooting order: check IKE SA (display ike sa) then IPsec SA (display ipsec sa); phase 1 failure = proposal mismatch, PSK mismatch, or unreachable peer; phase 2 failure = traffic selector or PFS mismatch.

If IKE SA is up but no traffic passes, verify the ACL/traffic selector matches the actual subnets bidirectionally, check NAT exemption (NAT policy must not translate tunnel traffic), and check the interzone policy.

Policy matching is top-down, first match wins; a broad permit above a specific deny shadows the deny. Use policy hit counters to confirm which rule matched.

Session table diagnosis: display firewall session table verbose shows NAT translations and the matching policy; asymmetric routing causes drops because the return packet misses the session.

High CPU causes on a firewall: session flood, small-packet attack, logging storm, or complex application-layer inspection; check with display cpu-usage and identify the top task.

HA failure: VRRP split-brain from heartbeat link loss causes dual active; verify HRP status, heartbeat interface, and that both devices have identical software and policy.

Packet capture on the device (capture-packet) at inbound and outbound interfaces localizes the drop: same packet in and out = forwarding issue downstream; missing outbound = device dropped it.

Optimization levers: enable fast forwarding for established flows, reduce unnecessary deep inspection, tune session aging for long-lived applications, and offload logging to a collector.

Certificate errors in SSL inspection: verify the client trusts the inspection CA, the server certificate chain is complete, and SNI/hostname matches the certificate CN/SAN.

Security levels in Huawei's multi-level security model: public < internal < secret < top secret; a subject may read objects at or below its level and write only at or above it (no read up, no write down).

BLP (Bell-LaPadula) enforces confidentiality: Simple Security Property = no read up; *-Property = no write down; Discretionary Security Property uses an access matrix.

Biba enforces integrity: no read down, no write up. Clark-Wilson uses well-formed transactions and separation of duty instead of lattice levels.

Common Criteria evaluation levels EAL1-EAL7; EAL4 is the highest level achievable with a realistic development cost for general commercial products, EAL7 requires formal verification.

TCSEC divisions: D (minimal), C1/C2 (discretionary), B1/B2/B3 (mandatory), A1 (verified design); C2 requires individual accountability via audit.

Reference monitor properties: complete mediation, tamper-proof, and verifiable. The TCB is the totality of protection mechanisms enforcing the security policy.

Defense in depth layers for a campus design: border firewall, IPS, core/aggregation ACL and uRPF, access-layer port security and 802.1X, endpoint agent, and SIEM correlation.

Redundancy rule: dual-node firewall clustering uses VRRP/HRP with a heartbeat link; the standby device synchronizes sessions so failover preserves stateful flows.

Risk = Threat x Vulnerability x Asset value; residual risk = total risk minus the effect of implemented controls. ALE = SLE x ARO, SLE = asset value x exposure factor.

IPsec phase 1 (IKE SA) negotiates encryption, hash, DH group, and authentication; phase 2 (IPsec SA) negotiates ESP/AH transforms and PFS. Main mode = 6 messages, aggressive mode = 3 messages but exposes the identity.

ESP provides confidentiality plus optional integrity; AH provides integrity and authentication only and does not traverse NAT. NAT-T encapsulates ESP in UDP port 4500.

IKEv2 uses 4 messages (IKE_SA_INIT, IKE_AUTH) and supports MOBIKE for endpoint address changes; it is the preferred choice when NAT traversal and rekeying efficiency matter.

SSL/TLS VPN virtual gateway binds a VPN instance, a public address/port, and a certificate; a virtual gateway is the unit of policy, not the physical interface.

DSVPN uses NHRP to resolve spoke public addresses through the hub; mGRE tunnels carry dynamic spoke-to-spoke traffic, and IPsec over the tunnel secures it.

Anti-DDoS: SYN flood defense uses source authentication (SYN cookie/proxy) and rate limiting; the cleaning center diverts traffic by BGP or policy-based routing and reinjects clean traffic with GRE.

WAF detection modes: signature matching for known CVEs, semantic/state-machine analysis for injection, and bot/CC defense via rate thresholds and JS challenges.

NAT and security policy order on Huawei USG: policy routing, then NAT server/outbound NAT, then interzone policy; the security policy must permit the post-NAT zone pair.

802.1X roles: supplicant, authenticator (switch), authentication server (RADIUS). EAP methods: EAP-TLS (certificates both sides), PEAP (server certificate, inner MS-CHAPv2), EAP-TTLS.

EDR detection chain: process creation, file write, registry change, network connection, and script block logging; behavioral rules combine these into a single alert with a process tree.

Huawei HiSec Endpoint (formerly EDR) uses a lightweight agent plus a management center; isolation (network quarantine) is reversible and keeps the management channel open.

IoC vs IOA: IoC is a static artifact (hash, IP, domain); IOA is behavior (e.g., Office spawning PowerShell), which survives hash mutation.

Cloud shared responsibility: the provider secures physical, host, and virtualization layers; the tenant secures guest OS, workloads, identities, data classification, and security group rules.

Security groups are stateful and allow-only; network ACLs are stateless and evaluated in order. Default-deny inbound is the baseline, and 0.0.0.0/0 on management ports is a finding.

CSPM checks for public storage buckets, overly permissive IAM policies, unencrypted volumes, disabled logging/trails, and exposed management interfaces.

Micro-segmentation enforces east-west policy per workload identity rather than per subnet; it limits lateral movement after a single host compromise.

Zero trust pillars: identity, device, network, application/workload, data, visibility and analytics, automation. Policy decision point evaluates continuously, not once at login.

Container security: scan images in the registry, run as non-root, use read-only root filesystem, drop Linux capabilities, and sign images so admission control can verify provenance.

SOC tiering: Tier 1 triage and false-positive filtering, Tier 2 investigation and containment, Tier 3 threat hunting and detection engineering; escalation requires documented criteria.

Incident response phases: preparation, identification, containment, eradication, recovery, lessons learned. Containment options are isolate host, block IP/domain, disable account, revoke session.

Log retention and correlation: firewall session logs, IPS alerts, DNS queries, proxy logs, and authentication events must share a normalized time source (NTP) to correlate.

Detection content quality metrics: true positive rate, false positive rate, mean time to detect (MTTD), mean time to respond (MTTR); tuning targets FP rate before adding new rules.

Vulnerability management: CVSS base score plus environmental and temporal context determines priority; a critical CVSS on an unreachable host ranks below a medium on an internet-facing one.

Change management requires request, risk assessment, approval, implementation window, rollback plan, and verification; emergency changes are retro-approved within a defined window.

Compliance mapping: ISO 27001 clauses map to controls, not to products; evidence must be dated, attributable, and retained for the audit period.

Threat intelligence: strategic, tactical, operational, and technical levels; STIX/TAXII carry indicators, and feed indicators require aging/TTL because attacker infrastructure rotates.

Backup rule 3-2-1: three copies, two media types, one offsite; immutable or offline copies are required to survive ransomware that targets connected backups.

IPsec troubleshooting order: check IKE SA (display ike sa) then IPsec SA (display ipsec sa); phase 1 failure = proposal mismatch, PSK mismatch, or unreachable peer; phase 2 failure = traffic selector or PFS mismatch.

If IKE SA is up but no traffic passes, verify the ACL/traffic selector matches the actual subnets bidirectionally, check NAT exemption (NAT policy must not translate tunnel traffic), and check the interzone policy.

Policy matching is top-down, first match wins; a broad permit above a specific deny shadows the deny. Use policy hit counters to confirm which rule matched.

Session table diagnosis: display firewall session table verbose shows NAT translations and the matching policy; asymmetric routing causes drops because the return packet misses the session.

High CPU causes on a firewall: session flood, small-packet attack, logging storm, or complex application-layer inspection; check with display cpu-usage and identify the top task.

HA failure: VRRP split-brain from heartbeat link loss causes dual active; verify HRP status, heartbeat interface, and that both devices have identical software and policy.

Packet capture on the device (capture-packet) at inbound and outbound interfaces localizes the drop: same packet in and out = forwarding issue downstream; missing outbound = device dropped it.

Optimization levers: enable fast forwarding for established flows, reduce unnecessary deep inspection, tune session aging for long-lived applications, and offload logging to a collector.

Certificate errors in SSL inspection: verify the client trusts the inspection CA, the server certificate chain is complete, and SNI/hostname matches the certificate CN/SAN.

Security levels in Huawei's multi-level security model: public < internal < secret < top secret; a subject may read objects at or below its level and write only at or above it (no read up, no write down).

BLP (Bell-LaPadula) enforces confidentiality: Simple Security Property = no read up; *-Property = no write down; Discretionary Security Property uses an access matrix.

Biba enforces integrity: no read down, no write up. Clark-Wilson uses well-formed transactions and separation of duty instead of lattice levels.

Common Criteria evaluation levels EAL1-EAL7; EAL4 is the highest level achievable with a realistic development cost for general commercial products, EAL7 requires formal verification.

TCSEC divisions: D (minimal), C1/C2 (discretionary), B1/B2/B3 (mandatory), A1 (verified design); C2 requires individual accountability via audit.

Reference monitor properties: complete mediation, tamper-proof, and verifiable. The TCB is the totality of protection mechanisms enforcing the security policy.

Defense in depth layers for a campus design: border firewall, IPS, core/aggregation ACL and uRPF, access-layer port security and 802.1X, endpoint agent, and SIEM correlation.

Redundancy rule: dual-node firewall clustering uses VRRP/HRP with a heartbeat link; the standby device synchronizes sessions so failover preserves stateful flows.

Risk = Threat x Vulnerability x Asset value; residual risk = total risk minus the effect of implemented controls. ALE = SLE x ARO, SLE = asset value x exposure factor.

IPsec phase 1 (IKE SA) negotiates encryption, hash, DH group, and authentication; phase 2 (IPsec SA) negotiates ESP/AH transforms and PFS. Main mode = 6 messages, aggressive mode = 3 messages but exposes the identity.

ESP provides confidentiality plus optional integrity; AH provides integrity and authentication only and does not traverse NAT. NAT-T encapsulates ESP in UDP port 4500.

IKEv2 uses 4 messages (IKE_SA_INIT, IKE_AUTH) and supports MOBIKE for endpoint address changes; it is the preferred choice when NAT traversal and rekeying efficiency matter.

SSL/TLS VPN virtual gateway binds a VPN instance, a public address/port, and a certificate; a virtual gateway is the unit of policy, not the physical interface.

DSVPN uses NHRP to resolve spoke public addresses through the hub; mGRE tunnels carry dynamic spoke-to-spoke traffic, and IPsec over the tunnel secures it.

Anti-DDoS: SYN flood defense uses source authentication (SYN cookie/proxy) and rate limiting; the cleaning center diverts traffic by BGP or policy-based routing and reinjects clean traffic with GRE.

WAF detection modes: signature matching for known CVEs, semantic/state-machine analysis for injection, and bot/CC defense via rate thresholds and JS challenges.

NAT and security policy order on Huawei USG: policy routing, then NAT server/outbound NAT, then interzone policy; the security policy must permit the post-NAT zone pair.

802.1X roles: supplicant, authenticator (switch), authentication server (RADIUS). EAP methods: EAP-TLS (certificates both sides), PEAP (server certificate, inner MS-CHAPv2), EAP-TTLS.

EDR detection chain: process creation, file write, registry change, network connection, and script block logging; behavioral rules combine these into a single alert with a process tree.

Huawei HiSec Endpoint (formerly EDR) uses a lightweight agent plus a management center; isolation (network quarantine) is reversible and keeps the management channel open.

IoC vs IOA: IoC is a static artifact (hash, IP, domain); IOA is behavior (e.g., Office spawning PowerShell), which survives hash mutation.

Cloud shared responsibility: the provider secures physical, host, and virtualization layers; the tenant secures guest OS, workloads, identities, data classification, and security group rules.

Security groups are stateful and allow-only; network ACLs are stateless and evaluated in order. Default-deny inbound is the baseline, and 0.0.0.0/0 on management ports is a finding.

CSPM checks for public storage buckets, overly permissive IAM policies, unencrypted volumes, disabled logging/trails, and exposed management interfaces.

Micro-segmentation enforces east-west policy per workload identity rather than per subnet; it limits lateral movement after a single host compromise.

Zero trust pillars: identity, device, network, application/workload, data, visibility and analytics, automation. Policy decision point evaluates continuously, not once at login.

Container security: scan images in the registry, run as non-root, use read-only root filesystem, drop Linux capabilities, and sign images so admission control can verify provenance.

SOC tiering: Tier 1 triage and false-positive filtering, Tier 2 investigation and containment, Tier 3 threat hunting and detection engineering; escalation requires documented criteria.

Incident response phases: preparation, identification, containment, eradication, recovery, lessons learned. Containment options are isolate host, block IP/domain, disable account, revoke session.

Log retention and correlation: firewall session logs, IPS alerts, DNS queries, proxy logs, and authentication events must share a normalized time source (NTP) to correlate.

Detection content quality metrics: true positive rate, false positive rate, mean time to detect (MTTD), mean time to respond (MTTR); tuning targets FP rate before adding new rules.

Vulnerability management: CVSS base score plus environmental and temporal context determines priority; a critical CVSS on an unreachable host ranks below a medium on an internet-facing one.

Change management requires request, risk assessment, approval, implementation window, rollback plan, and verification; emergency changes are retro-approved within a defined window.

Compliance mapping: ISO 27001 clauses map to controls, not to products; evidence must be dated, attributable, and retained for the audit period.

Threat intelligence: strategic, tactical, operational, and technical levels; STIX/TAXII carry indicators, and feed indicators require aging/TTL because attacker infrastructure rotates.

Backup rule 3-2-1: three copies, two media types, one offsite; immutable or offline copies are required to survive ransomware that targets connected backups.

IPsec troubleshooting order: check IKE SA (display ike sa) then IPsec SA (display ipsec sa); phase 1 failure = proposal mismatch, PSK mismatch, or unreachable peer; phase 2 failure = traffic selector or PFS mismatch.

If IKE SA is up but no traffic passes, verify the ACL/traffic selector matches the actual subnets bidirectionally, check NAT exemption (NAT policy must not translate tunnel traffic), and check the interzone policy.

Policy matching is top-down, first match wins; a broad permit above a specific deny shadows the deny. Use policy hit counters to confirm which rule matched.

Session table diagnosis: display firewall session table verbose shows NAT translations and the matching policy; asymmetric routing causes drops because the return packet misses the session.

High CPU causes on a firewall: session flood, small-packet attack, logging storm, or complex application-layer inspection; check with display cpu-usage and identify the top task.

HA failure: VRRP split-brain from heartbeat link loss causes dual active; verify HRP status, heartbeat interface, and that both devices have identical software and policy.

Packet capture on the device (capture-packet) at inbound and outbound interfaces localizes the drop: same packet in and out = forwarding issue downstream; missing outbound = device dropped it.

Optimization levers: enable fast forwarding for established flows, reduce unnecessary deep inspection, tune session aging for long-lived applications, and offload logging to a collector.

Certificate errors in SSL inspection: verify the client trusts the inspection CA, the server certificate chain is complete, and SNI/hostname matches the certificate CN/SAN.

Security levels in Huawei's multi-level security model: public < internal < secret < top secret; a subject may read objects at or below its level and write only at or above it (no read up, no write down).

BLP (Bell-LaPadula) enforces confidentiality: Simple Security Property = no read up; *-Property = no write down; Discretionary Security Property uses an access matrix.

Biba enforces integrity: no read down, no write up. Clark-Wilson uses well-formed transactions and separation of duty instead of lattice levels.

Common Criteria evaluation levels EAL1-EAL7; EAL4 is the highest level achievable with a realistic development cost for general commercial products, EAL7 requires formal verification.

TCSEC divisions: D (minimal), C1/C2 (discretionary), B1/B2/B3 (mandatory), A1 (verified design); C2 requires individual accountability via audit.

Reference monitor properties: complete mediation, tamper-proof, and verifiable. The TCB is the totality of protection mechanisms enforcing the security policy.

Defense in depth layers for a campus design: border firewall, IPS, core/aggregation ACL and uRPF, access-layer port security and 802.1X, endpoint agent, and SIEM correlation.

Redundancy rule: dual-node firewall clustering uses VRRP/HRP with a heartbeat link; the standby device synchronizes sessions so failover preserves stateful flows.

Risk = Threat x Vulnerability x Asset value; residual risk = total risk minus the effect of implemented controls. ALE = SLE x ARO, SLE = asset value x exposure factor.

IPsec phase 1 (IKE SA) negotiates encryption, hash, DH group, and authentication; phase 2 (IPsec SA) negotiates ESP/AH transforms and PFS. Main mode = 6 messages, aggressive mode = 3 messages but exposes the identity.

ESP provides confidentiality plus optional integrity; AH provides integrity and authentication only and does not traverse NAT. NAT-T encapsulates ESP in UDP port 4500.

IKEv2 uses 4 messages (IKE_SA_INIT, IKE_AUTH) and supports MOBIKE for endpoint address changes; it is the preferred choice when NAT traversal and rekeying efficiency matter.

SSL/TLS VPN virtual gateway binds a VPN instance, a public address/port, and a certificate; a virtual gateway is the unit of policy, not the physical interface.

DSVPN uses NHRP to resolve spoke public addresses through the hub; mGRE tunnels carry dynamic spoke-to-spoke traffic, and IPsec over the tunnel secures it.

Anti-DDoS: SYN flood defense uses source authentication (SYN cookie/proxy) and rate limiting; the cleaning center diverts traffic by BGP or policy-based routing and reinjects clean traffic with GRE.

WAF detection modes: signature matching for known CVEs, semantic/state-machine analysis for injection, and bot/CC defense via rate thresholds and JS challenges.

NAT and security policy order on Huawei USG: policy routing, then NAT server/outbound NAT, then interzone policy; the security policy must permit the post-NAT zone pair.

802.1X roles: supplicant, authenticator (switch), authentication server (RADIUS). EAP methods: EAP-TLS (certificates both sides), PEAP (server certificate, inner MS-CHAPv2), EAP-TTLS.

EDR detection chain: process creation, file write, registry change, network connection, and script block logging; behavioral rules combine these into a single alert with a process tree.

Huawei HiSec Endpoint (formerly EDR) uses a lightweight agent plus a management center; isolation (network quarantine) is reversible and keeps the management channel open.

IoC vs IOA: IoC is a static artifact (hash, IP, domain); IOA is behavior (e.g., Office spawning PowerShell), which survives hash mutation.

Cloud shared responsibility: the provider secures physical, host, and virtualization layers; the tenant secures guest OS, workloads, identities, data classification, and security group rules.

Security groups are stateful and allow-only; network ACLs are stateless and evaluated in order. Default-deny inbound is the baseline, and 0.0.0.0/0 on management ports is a finding.

CSPM checks for public storage buckets, overly permissive IAM policies, unencrypted volumes, disabled logging/trails, and exposed management interfaces.

Micro-segmentation enforces east-west policy per workload identity rather than per subnet; it limits lateral movement after a single host compromise.

Zero trust pillars: identity, device, network, application/workload, data, visibility and analytics, automation. Policy decision point evaluates continuously, not once at login.

Container security: scan images in the registry, run as non-root, use read-only root filesystem, drop Linux capabilities, and sign images so admission control can verify provenance.

SOC tiering: Tier 1 triage and false-positive filtering, Tier 2 investigation and containment, Tier 3 threat hunting and detection engineering; escalation requires documented criteria.

Incident response phases: preparation, identification, containment, eradication, recovery, lessons learned. Containment options are isolate host, block IP/domain, disable account, revoke session.

Log retention and correlation: firewall session logs, IPS alerts, DNS queries, proxy logs, and authentication events must share a normalized time source (NTP) to correlate.

Detection content quality metrics: true positive rate, false positive rate, mean time to detect (MTTD), mean time to respond (MTTR); tuning targets FP rate before adding new rules.

Vulnerability management: CVSS base score plus environmental and temporal context determines priority; a critical CVSS on an unreachable host ranks below a medium on an internet-facing one.

Change management requires request, risk assessment, approval, implementation window, rollback plan, and verification; emergency changes are retro-approved within a defined window.

Compliance mapping: ISO 27001 clauses map to controls, not to products; evidence must be dated, attributable, and retained for the audit period.

Threat intelligence: strategic, tactical, operational, and technical levels; STIX/TAXII carry indicators, and feed indicators require aging/TTL because attacker infrastructure rotates.

Backup rule 3-2-1: three copies, two media types, one offsite; immutable or offline copies are required to survive ransomware that targets connected backups.

IPsec troubleshooting order: check IKE SA (display ike sa) then IPsec SA (display ipsec sa); phase 1 failure = proposal mismatch, PSK mismatch, or unreachable peer; phase 2 failure = traffic selector or PFS mismatch.

If IKE SA is up but no traffic passes, verify the ACL/traffic selector matches the actual subnets bidirectionally, check NAT exemption (NAT policy must not translate tunnel traffic), and check the interzone policy.

Policy matching is top-down, first match wins; a broad permit above a specific deny shadows the deny. Use policy hit counters to confirm which rule matched.

Session table diagnosis: display firewall session table verbose shows NAT translations and the matching policy; asymmetric routing causes drops because the return packet misses the session.

High CPU causes on a firewall: session flood, small-packet attack, logging storm, or complex application-layer inspection; check with display cpu-usage and identify the top task.

HA failure: VRRP split-brain from heartbeat link loss causes dual active; verify HRP status, heartbeat interface, and that both devices have identical software and policy.

Packet capture on the device (capture-packet) at inbound and outbound interfaces localizes the drop: same packet in and out = forwarding issue downstream; missing outbound = device dropped it.

Optimization levers: enable fast forwarding for established flows, reduce unnecessary deep inspection, tune session aging for long-lived applications, and offload logging to a collector.

Certificate errors in SSL inspection: verify the client trusts the inspection CA, the server certificate chain is complete, and SNI/hostname matches the certificate CN/SAN.

Security levels in Huawei's multi-level security model: public < internal < secret < top secret; a subject may read objects at or below its level and write only at or above it (no read up, no write down).

BLP (Bell-LaPadula) enforces confidentiality: Simple Security Property = no read up; *-Property = no write down; Discretionary Security Property uses an access matrix.

Biba enforces integrity: no read down, no write up. Clark-Wilson uses well-formed transactions and separation of duty instead of lattice levels.

Common Criteria evaluation levels EAL1-EAL7; EAL4 is the highest level achievable with a realistic development cost for general commercial products, EAL7 requires formal verification.

TCSEC divisions: D (minimal), C1/C2 (discretionary), B1/B2/B3 (mandatory), A1 (verified design); C2 requires individual accountability via audit.

Reference monitor properties: complete mediation, tamper-proof, and verifiable. The TCB is the totality of protection mechanisms enforcing the security policy.

Defense in depth layers for a campus design: border firewall, IPS, core/aggregation ACL and uRPF, access-layer port security and 802.1X, endpoint agent, and SIEM correlation.

Redundancy rule: dual-node firewall clustering uses VRRP/HRP with a heartbeat link; the standby device synchronizes sessions so failover preserves stateful flows.

Risk = Threat x Vulnerability x Asset value; residual risk = total risk minus the effect of implemented controls. ALE = SLE x ARO, SLE = asset value x exposure factor.

IPsec phase 1 (IKE SA) negotiates encryption, hash, DH group, and authentication; phase 2 (IPsec SA) negotiates ESP/AH transforms and PFS. Main mode = 6 messages, aggressive mode = 3 messages but exposes the identity.

ESP provides confidentiality plus optional integrity; AH provides integrity and authentication only and does not traverse NAT. NAT-T encapsulates ESP in UDP port 4500.

IKEv2 uses 4 messages (IKE_SA_INIT, IKE_AUTH) and supports MOBIKE for endpoint address changes; it is the preferred choice when NAT traversal and rekeying efficiency matter.

SSL/TLS VPN virtual gateway binds a VPN instance, a public address/port, and a certificate; a virtual gateway is the unit of policy, not the physical interface.

DSVPN uses NHRP to resolve spoke public addresses through the hub; mGRE tunnels carry dynamic spoke-to-spoke traffic, and IPsec over the tunnel secures it.

Anti-DDoS: SYN flood defense uses source authentication (SYN cookie/proxy) and rate limiting; the cleaning center diverts traffic by BGP or policy-based routing and reinjects clean traffic with GRE.

WAF detection modes: signature matching for known CVEs, semantic/state-machine analysis for injection, and bot/CC defense via rate thresholds and JS challenges.

NAT and security policy order on Huawei USG: policy routing, then NAT server/outbound NAT, then interzone policy; the security policy must permit the post-NAT zone pair.

802.1X roles: supplicant, authenticator (switch), authentication server (RADIUS). EAP methods: EAP-TLS (certificates both sides), PEAP (server certificate, inner MS-CHAPv2), EAP-TTLS.

EDR detection chain: process creation, file write, registry change, network connection, and script block logging; behavioral rules combine these into a single alert with a process tree.

Huawei HiSec Endpoint (formerly EDR) uses a lightweight agent plus a management center; isolation (network quarantine) is reversible and keeps the management channel open.

IoC vs IOA: IoC is a static artifact (hash, IP, domain); IOA is behavior (e.g., Office spawning PowerShell), which survives hash mutation.

Cloud shared responsibility: the provider secures physical, host, and virtualization layers; the tenant secures guest OS, workloads, identities, data classification, and security group rules.

Security groups are stateful and allow-only; network ACLs are stateless and evaluated in order. Default-deny inbound is the baseline, and 0.0.0.0/0 on management ports is a finding.

CSPM checks for public storage buckets, overly permissive IAM policies, unencrypted volumes, disabled logging/trails, and exposed management interfaces.

Micro-segmentation enforces east-west policy per workload identity rather than per subnet; it limits lateral movement after a single host compromise.

Zero trust pillars: identity, device, network, application/workload, data, visibility and analytics, automation. Policy decision point evaluates continuously, not once at login.

Container security: scan images in the registry, run as non-root, use read-only root filesystem, drop Linux capabilities, and sign images so admission control can verify provenance.

SOC tiering: Tier 1 triage and false-positive filtering, Tier 2 investigation and containment, Tier 3 threat hunting and detection engineering; escalation requires documented criteria.

Incident response phases: preparation, identification, containment, eradication, recovery, lessons learned. Containment options are isolate host, block IP/domain, disable account, revoke session.

Log retention and correlation: firewall session logs, IPS alerts, DNS queries, proxy logs, and authentication events must share a normalized time source (NTP) to correlate.

Detection content quality metrics: true positive rate, false positive rate, mean time to detect (MTTD), mean time to respond (MTTR); tuning targets FP rate before adding new rules.

Vulnerability management: CVSS base score plus environmental and temporal context determines priority; a critical CVSS on an unreachable host ranks below a medium on an internet-facing one.

Change management requires request, risk assessment, approval, implementation window, rollback plan, and verification; emergency changes are retro-approved within a defined window.

Compliance mapping: ISO 27001 clauses map to controls, not to products; evidence must be dated, attributable, and retained for the audit period.

Threat intelligence: strategic, tactical, operational, and technical levels; STIX/TAXII carry indicators, and feed indicators require aging/TTL because attacker infrastructure rotates.

Backup rule 3-2-1: three copies, two media types, one offsite; immutable or offline copies are required to survive ransomware that targets connected backups.

IPsec troubleshooting order: check IKE SA (display ike sa) then IPsec SA (display ipsec sa); phase 1 failure = proposal mismatch, PSK mismatch, or unreachable peer; phase 2 failure = traffic selector or PFS mismatch.

If IKE SA is up but no traffic passes, verify the ACL/traffic selector matches the actual subnets bidirectionally, check NAT exemption (NAT policy must not translate tunnel traffic), and check the interzone policy.

Policy matching is top-down, first match wins; a broad permit above a specific deny shadows the deny. Use policy hit counters to confirm which rule matched.

Session table diagnosis: display firewall session table verbose shows NAT translations and the matching policy; asymmetric routing causes drops because the return packet misses the session.

High CPU causes on a firewall: session flood, small-packet attack, logging storm, or complex application-layer inspection; check with display cpu-usage and identify the top task.

HA failure: VRRP split-brain from heartbeat link loss causes dual active; verify HRP status, heartbeat interface, and that both devices have identical software and policy.

Packet capture on the device (capture-packet) at inbound and outbound interfaces localizes the drop: same packet in and out = forwarding issue downstream; missing outbound = device dropped it.

Optimization levers: enable fast forwarding for established flows, reduce unnecessary deep inspection, tune session aging for long-lived applications, and offload logging to a collector.

Certificate errors in SSL inspection: verify the client trusts the inspection CA, the server certificate chain is complete, and SNI/hostname matches the certificate CN/SAN.