I85PREP
⌘ K
HCIE-Security study materials
HCIE-Security study resources

HCIE-Security practice questions

One question at a time. Build your HCIE-Security understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Architecture and Design

In a Huawei firewall deployment, which plane carries session table entries, security policy lookups, and NAT translation for transit traffic?

  1. The management plane
  2. The control plane
  3. The forwarding plane Correct answer.
  4. The presentation plane

Explanation

The forwarding plane (data plane) handles per-packet processing for transit traffic, including session establishment, security policy matching, and NAT translation. The control plane runs routing and protocol state, while the management plane handles administrative access. Separating these planes is a core architecture principle for scaling and hardening firewalls.

Question 2Security Architecture and Design

A security architect must place a firewall so that it can inspect traffic between internal users and an external partner while keeping the internal routing domain hidden. Which design best satisfies this requirement?

  1. Route the partner link through a dedicated DMZ interface with NAT applied to internal addresses Correct answer.
  2. Bridge all interfaces into one Layer 2 zone so addresses remain visible
  3. Place the partner link in the same trust zone as internal users
  4. Attach the partner link directly to the core switch with an ACL

Explanation

A dedicated DMZ interface with NAT hides internal addressing and enforces a policy boundary between the internal domain and the partner. Bridging or sharing a trust zone removes the inspection boundary and exposes internal topology. Direct core attachment bypasses the firewall's stateful inspection entirely.

Question 3Security Architecture and Design

Which statement correctly describes the role of a virtual firewall instance (virtual system) in a multi-tenant security architecture?

  1. It requires a separate physical management port per tenant
  2. It disables stateful inspection to reduce CPU load
  3. It duplicates the entire hardware chassis for each tenant
  4. It provides an isolated policy and routing context that shares the physical appliance's resources Correct answer.

Explanation

A virtual system creates an independent configuration context-its own policies, zones, and routing-while sharing the physical appliance's CPU, memory, and interfaces. This enables multi-tenant separation without dedicated hardware. It does not disable inspection or require per-tenant physical management ports.

Question 4Security Architecture and Design

In a Huawei firewall's security policy, traffic arrives on a zone and departs on another. What is the correct matching order that determines whether the packet is permitted?

  1. Routing table lookup first, then NAT, then the default action
  2. Inter-zone policy first, then intra-zone policy, then the default action Correct answer.
  3. Default action first, then inter-zone policy, then intra-zone policy
  4. Intra-zone policy first, then inter-zone policy, then the default action

Explanation

Huawei firewalls evaluate inter-zone policies before intra-zone policies, and if no rule matches, the default action applies. NAT and routing occur after the policy decision, not before it. Understanding this order is essential when troubleshooting unexpected denies.

Question 5Security Architecture and Design

A design requires that return traffic for outbound sessions be permitted without an explicit inbound rule. Which firewall mechanism provides this?

  1. A static route pointing return traffic to the outside interface
  2. A source NAT pool that rewrites all inbound packets
  3. An any-any inter-zone policy applied to all zones
  4. A stateful session table that permits reply packets of established sessions Correct answer.

Explanation

Stateful inspection records each permitted session, and reply packets belonging to that session are allowed automatically. This is the defining behavior of a stateful firewall. Static routes, any-any policies, and NAT pools do not by themselves authorize return traffic.

Question 6Security Architecture and Design

When designing high availability for a pair of firewalls using active/standby, which mechanism ensures that session state survives a failover?

  1. Dynamic routing reconvergence alone
  2. Spanning Tree Protocol convergence on the uplink switches
  3. Session synchronization between the peers over a dedicated heartbeat link Correct answer.
  4. Per-flow load balancing across both appliances

Explanation

Active/standby HA synchronizes session and configuration state so that established flows continue after failover. Routing reconvergence or STP alone would drop existing sessions. Load balancing across both appliances describes active/active, not state preservation in standby.

Question 7Security Architecture and Design

Which design principle is most consistent with defense in depth for an enterprise security architecture?

  1. Removing logging to reduce operational overhead
  2. Relying solely on perimeter firewalls for internal protection
  3. Consolidating all security functions into a single appliance
  4. Layering independent controls so that failure of one does not eliminate all protection Correct answer.

Explanation

Defense in depth layers independent controls-network, host, identity, and monitoring-so that a single failure does not collapse the security posture. Consolidation and perimeter-only designs create single points of failure. Removing logging eliminates detection and forensic capability.

Question 8Security Architecture and Design

A customer wants to inspect encrypted traffic from internal clients to external SaaS applications without installing software on endpoints. Which deployment is best suited?

  1. A reverse proxy placed in front of the SaaS provider
  2. A network tap that copies traffic to an IDS
  3. A host-based agent on each endpoint
  4. A forward proxy that performs TLS interception on the client egress path Correct answer.

Explanation

A forward proxy on the egress path can terminate and re-originate TLS to inspect client-initiated sessions without endpoint software. A reverse proxy protects servers, not outbound clients. A tap only observes copies, and a host agent contradicts the no-software requirement.

Question 9Security Architecture and Design

Which component in a zero trust architecture is responsible for evaluating access requests against policy and issuing an access decision?

  1. The certificate authority
  2. The policy enforcement point
  3. The policy decision point Correct answer.
  4. The data plane switch

Explanation

In zero trust, the policy decision point evaluates context and policy and returns an allow or deny decision. The policy enforcement point applies that decision to the traffic. The certificate authority issues credentials but does not make access decisions.

Question 10Security Architecture and Design

An architect is choosing between a stateful firewall and a stateless packet filter for a boundary between two trusted internal segments. Which statement is the strongest argument for the stateful firewall?

  1. It eliminates the need for any routing configuration
  2. It removes the need for logging on the segment
  3. It encrypts all traffic between the segments
  4. It tracks connection state so that only replies to permitted sessions are allowed back in Correct answer.

Explanation

A stateful firewall maintains a session table and permits only reply traffic that belongs to an established, permitted session. This is more precise than a stateless filter that must allow broad port ranges in both directions. It does not eliminate routing, encrypt traffic, or replace logging.

Question 11Security Architecture and Design

In a Huawei firewall, which zone type is predefined and used for traffic destined to the firewall itself, such as management and routing protocol packets?

  1. The untrust zone
  2. The local zone Correct answer.
  3. The trust zone
  4. The DMZ zone

Explanation

The local zone represents the firewall's own IP stack and handles traffic addressed to the device, including management and control-plane protocols. Trust, untrust, and DMZ are user-defined or default security zones for transit traffic. Policies toward the local zone control who can administer the device.

Question 12Security Architecture and Design

A security architect proposes placing an IPS in inline mode rather than tap mode. What is the primary architectural consequence of this choice?

  1. The IPS loses visibility of packet payloads
  2. The IPS can only alert and cannot drop traffic
  3. The IPS must be deployed behind a load balancer
  4. The IPS can block malicious traffic but becomes a potential point of failure in the path Correct answer.

Explanation

Inline deployment places the IPS directly in the forwarding path, enabling active blocking but introducing availability risk if the device fails or misclassifies traffic. Tap mode is passive and cannot block. Payload visibility is retained in both modes.

Question 13Security Architecture and Design

Which design best mitigates the risk of lateral movement after an internal host is compromised?

  1. Allowing all internal traffic and relying on perimeter controls
  2. Disabling host-based firewalls to avoid conflicts
  3. Micro-segmentation that restricts east-west traffic between workloads Correct answer.
  4. A single flat VLAN for all internal hosts

Explanation

Micro-segmentation limits east-west traffic so that a compromised host cannot freely reach other workloads. Flat networks and permissive internal policies enable lateral movement. Disabling host firewalls removes a control that could contain the breach.

Question 14Security Architecture and Design

When designing a VPN concentrator tier, which architecture reduces the impact of a single device failure while maintaining consistent policy?

  1. A concentrator connected to only one ISP link
  2. A single concentrator sized for peak load
  3. A cluster of concentrators behind a load balancer with shared policy configuration Correct answer.
  4. Two concentrators with manually maintained, divergent policies

Explanation

Clustering behind a load balancer provides redundancy while shared policy configuration keeps enforcement consistent. A single device is a single point of failure. Divergent policies create inconsistent enforcement, and a single ISP link removes path redundancy.

Question 15Security Architecture and Design

Which statement accurately describes the purpose of a demilitarized zone in enterprise security architecture?

  1. It replaces the need for a firewall between internal and external networks
  2. It stores backups of internal databases
  3. It provides a flat network for all employees
  4. It hosts externally accessible services while limiting their reach into the internal network Correct answer.

Explanation

A DMZ isolates internet-facing services so that compromise of those services does not grant direct access to the internal network. It is not a backup store, not a flat employee network, and does not replace the firewall-it is a firewall-defined zone.

Question 16Security Architecture and Design

An architect must ensure that a firewall policy change cannot be made by a single administrator without oversight. Which control best achieves this?

  1. A two-person approval workflow integrated with change management Correct answer.
  2. Direct console access for all administrators
  3. Shared administrator credentials for the team
  4. Disabling policy logging to reduce noise

Explanation

A two-person approval workflow enforces separation of duties so that no single administrator can unilaterally change policy. Shared credentials destroy accountability, and direct console access bypasses oversight. Logging should be retained for audit.

Question 17Security Architecture and Design

In a Huawei firewall, what is the effect of configuring a security policy with the action 'permit' but with no content security profile attached?

  1. Traffic is always redirected to the management plane
  2. Traffic matching the policy is allowed without additional content inspection Correct answer.
  3. Traffic is silently dropped by default
  4. Traffic is encrypted automatically

Explanation

A permit action authorizes matching traffic; content security profiles such as antivirus or IPS must be explicitly attached to add inspection. Without a profile, the traffic is forwarded without that content inspection. The firewall does not drop, redirect, or encrypt it by default.

Question 18Security Architecture and Design

Which architecture best supports inspecting traffic between virtual machines within the same physical host?

  1. A virtual switch with a security policy enforcement point attached to the hypervisor Correct answer.
  2. A physical firewall connected to the top-of-rack switch
  3. A router between the host and the core
  4. A span port on the physical switch

Explanation

Traffic between VMs on the same host never leaves the hypervisor, so enforcement must occur at the virtual switch or hypervisor layer. Physical firewalls and span ports only see traffic that traverses the physical network. A router between host and core cannot inspect intra-host flows.

Question 19Security Architecture and Design

Which statement correctly describes the relationship between a security zone and an interface on a Huawei firewall?

  1. An interface is bound to a zone, and the zone determines the policy context for traffic entering that interface Correct answer.
  2. Each interface can belong to multiple zones simultaneously
  3. Zones and interfaces are independent and never interact
  4. A zone is bound to an interface, and the interface determines the zone's policy

Explanation

Interfaces are assigned to zones, and the zone assignment determines which inter-zone policy applies to traffic entering that interface. An interface belongs to a single zone at a time. Zones do not depend on interfaces for their policy definition.

Question 20Security Architecture and Design

A security architect is designing a data center egress architecture and wants to avoid asymmetric routing that breaks stateful inspection. Which design choice best addresses this?

  1. Route inbound and outbound traffic through different firewalls
  2. Disable stateful inspection on all egress firewalls
  3. Ensure both directions of a flow traverse the same firewall instance Correct answer.
  4. Use ECMP across multiple firewalls without session synchronization

Explanation

Stateful firewalls require both directions of a flow to traverse the same instance so the session table can match reply packets. ECMP without synchronization or split inbound/outbound paths cause asymmetric routing and dropped sessions. Disabling inspection removes the security benefit.

Question 21Security Architecture and Design

Which security architecture pattern places a reverse proxy in front of internal application servers to terminate client TLS and re-encrypt to the backend?

  1. TLS offloading at the application delivery tier Correct answer.
  2. Endpoint-based agent inspection
  3. Stateless packet filtering at the core
  4. Full inline network tap deployment

Explanation

A reverse proxy that terminates client TLS and re-encrypts to the backend performs TLS offloading at the application delivery tier. This centralizes certificate management and allows inspection between the proxy and backend. Taps, stateless filters, and endpoint agents do not provide this function.

Question 22Security Architecture and Design

Which principle should guide the design of a security architecture's logging and monitoring tier?

  1. Centralize logs with integrity protection and time synchronization across sources Correct answer.
  2. Disable time synchronization to reduce traffic
  3. Store logs only on each device's local disk without synchronization
  4. Retain logs for no longer than one hour

Explanation

Centralized, integrity-protected logs with synchronized time enable reliable correlation and forensics. Local-only storage is easily lost when a device is compromised, and unsynchronized clocks break correlation. Short retention undermines investigation.

Question 23Security Architecture and Design

An architect must design segmentation for an industrial control network that must remain available even if the enterprise network is compromised. Which approach is most appropriate?

  1. A unidirectional gateway that permits data flow from the control network to the enterprise only Correct answer.
  2. A single router with no filtering between the networks
  3. A bidirectional firewall rule allowing all traffic between the networks
  4. A shared flat VLAN between control and enterprise systems

Explanation

A unidirectional gateway enforces one-way data flow, allowing telemetry out while preventing inbound access that could disrupt control systems. Bidirectional any-any rules, flat VLANs, and unfiltered routers all expose the control network to enterprise-side compromise.

Question 24Security Architecture and Design

In a Huawei firewall HA pair, which configuration must match on both peers for the pair to form correctly?

  1. Only the hostname of each device
  2. Only the administrator password
  3. HA parameters such as heartbeat interface and virtual address settings Correct answer.
  4. Only the SNMP community string

Explanation

HA formation requires consistent HA parameters, including heartbeat interface and virtual address configuration, so the peers can negotiate roles and synchronize state. Hostnames, passwords, and SNMP strings are administrative settings that do not determine HA negotiation.

Question 25Security Architecture and Design

Which statement best describes the security benefit of separating the management plane from the data plane on a firewall?

  1. Session tables are eliminated by the separation
  2. Administrative access can be restricted to a dedicated network so compromise of data traffic does not expose management Correct answer.
  3. Data traffic is encrypted automatically by the separation
  4. Routing protocols are disabled by the separation

Explanation

Separating the management plane allows administrative access to be confined to a dedicated management network, reducing exposure to data-plane attacks. The separation does not encrypt data traffic, disable routing, or eliminate session tables. It is a control-plane hardening measure.

Question 26Security Architecture and Design

Which security architecture model assumes that no user or device inside the corporate network is inherently trusted and requires continuous verification of every access request?

  1. Perimeter-based defense model
  2. Flat network with VLAN isolation
  3. Zero Trust architecture Correct answer.
  4. Demilitarized zone model

Explanation

Zero Trust removes implicit trust based on network location and instead verifies identity and device posture for each request. The perimeter model trusts everything inside the boundary, which is exactly what Zero Trust rejects. VLAN isolation and DMZ design are segmentation techniques, not trust models.

Question 27Security Architecture and Design

In a Huawei firewall, what is the purpose of the Trust zone in the default zone configuration?

  1. It carries traffic destined to the firewall's own management interfaces.
  2. It is the zone used exclusively for VPN tunnel termination.
  3. It is used for interfaces connected to internal networks whose traffic is generally more trusted. Correct answer.
  4. It is reserved for untrusted internet-facing interfaces.

Explanation

Huawei firewalls ship with predefined zones including Trust, Untrust, DMZ, and Local. Trust is intended for internal network segments considered relatively trustworthy, while Untrust typically faces the internet. The Local zone is the one that handles traffic addressed to the firewall itself.

Question 28Security Architecture and Design

Which design pattern improves availability of a security service by placing multiple inspection devices behind a load balancer that distributes flows across them?

  1. Active/standby failover pair
  2. Tap-mode monitoring deployment
  3. Single device with redundant power supplies
  4. Horizontal scaling cluster Correct answer.

Explanation

Horizontal scaling spreads traffic across several inspection nodes so that the loss of one node reduces capacity but does not stop service. Active/standby keeps one device idle and only improves failover, not throughput. Redundant power supplies and tap mode do not add processing capacity.

Question 29Security Architecture and Design

Which statement best describes the concept of least privilege as applied to security architecture?

  1. All users in a department should share a single privileged account.
  2. Every administrator should hold a superuser account for emergency use.
  3. Subjects should receive only the permissions required for their current tasks. Correct answer.
  4. Permissions should be granted permanently to avoid operational delays.

Explanation

Least privilege limits each subject to the minimum access needed to perform its function, reducing the blast radius of misuse or compromise. Standing superuser accounts and shared accounts violate this because they grant far more access than any single task requires. Permanent broad grants increase exposure over time.

Question 30Security Architecture and Design

An architect is designing segmentation for a data center and wants east-west traffic between application tiers to be inspected. Which approach best achieves this?

  1. Deploying a firewall or service chain between the tier segments Correct answer.
  2. Relying on the perimeter firewall to inspect all internal flows
  3. Applying ACLs only on the core router uplink to the internet
  4. Placing all tiers in one large VLAN and relying on host antivirus

Explanation

East-west inspection requires a policy enforcement point on the path between tiers, such as a firewall or a service chain inserted between segments. A single flat VLAN removes the enforcement boundary entirely. Perimeter devices and uplink ACLs only see north-south traffic, so internal flows bypass them.

Question 31Security Architecture and Design

A security architect wants to protect internal application servers so that clients never connect directly to them. Which pattern should be used?

  1. Transparent bridge firewall between the servers
  2. Host-based intrusion prevention on each server
  3. Reverse proxy in front of the servers Correct answer.
  4. Network address translation on the core switch

Explanation

A reverse proxy terminates client connections and forwards requests to backend servers, hiding server addresses and enabling centralized inspection and TLS termination. A transparent bridge filters traffic but clients still address the servers directly. Host IPS and NAT do not provide a mediating front end.

Question 32Security Architecture and Design

When designing a logging and monitoring tier for a security architecture, which principle most improves the trustworthiness of audit records?

  1. Retaining logs for a fixed short period to save storage
  2. Sending logs to a centralized, access-restricted collector in near real time Correct answer.
  3. Enabling verbose debugging on all production devices
  4. Storing logs only on the device that generated them

Explanation

Centralizing logs in a restricted collector in near real time prevents an attacker who compromises a device from erasing or altering the evidence. Local-only storage is vulnerable to tampering and loss. Verbose debugging increases noise and risk, and short retention undermines investigation.

Question 33Security Architecture and Design

Which mechanism in a Huawei firewall allows an administrator to verify that a proposed policy change works before it affects production traffic?

  1. Session aging
  2. Policy trial run Correct answer.
  3. Zone pair statistics
  4. Policy hit counting

Explanation

The policy trial run feature lets the firewall evaluate traffic against a candidate policy and report what would happen without enforcing it, so changes can be validated safely. Hit counting reports matches on live policies, session aging manages table entries, and zone pair statistics summarize traffic.

Question 34Security Architecture and Design

An architect must ensure that a critical internal service remains reachable if the primary inspection path fails. Which design element is most appropriate?

  1. Increasing the session table size on the primary device
  2. Disabling inspection for the service during business hours
  3. A bypass path with health monitoring that activates on inspection failure Correct answer.
  4. A second administrator account for the inspection device

Explanation

A monitored bypass path preserves reachability when the inspection node fails, trading inspection coverage for availability according to a defined policy. Extra accounts, larger session tables, and scheduled inspection gaps do not address path failure. The bypass decision should be explicit and logged.

Question 35Security Architecture and Design

In a Huawei firewall active/standby deployment, which statement correctly describes the role of the heartbeat link?

  1. It load-balances sessions across both peers.
  2. It provides the management address used by administrators to log in.
  3. It carries user data traffic between the two peers during normal operation.
  4. It exchanges status and synchronization information so each peer knows the other's health. Correct answer.

Explanation

The heartbeat link carries hello and status messages that let each peer detect failure and trigger a switchover. User traffic normally traverses the data interfaces, not the heartbeat. Management access uses management interfaces, and active/standby does not load-balance sessions.

Question 36Security Architecture and Design

An architect is separating the management plane from the data plane on a firewall. Which outcome most directly justifies this separation?

  1. The firewall no longer needs security policies for user traffic.
  2. Management traffic is isolated so a compromise of data traffic cannot easily reach administrative functions. Correct answer.
  3. Session synchronization between HA peers becomes unnecessary.
  4. Data throughput increases because the management plane handles forwarding.

Explanation

Separating planes gives administrative access its own path and controls, so attacks or congestion on the data plane are less likely to reach management functions. The data plane still performs forwarding, policies remain required, and HA synchronization is unaffected.

Question 37Security Architecture and Design

Which design choice best supports defense in depth across a multi-tier web application architecture?

  1. Combining network, host, application, and data controls at multiple tiers Correct answer.
  2. Centralizing all controls on the database server
  3. Relying on a single perimeter firewall as the only control
  4. Removing host controls to reduce operational overhead

Explanation

Defense in depth layers independent controls so that failure or bypass of one layer does not expose the asset. A single perimeter control creates a single point of failure. Removing host controls and concentrating everything on one server both reduce redundancy and increase blast radius.

Question 38Security Architecture and Design

An architect must inspect traffic between virtual machines on the same physical host without relying on the physical network. Which capability is required?

  1. Spanning tree tuning on the access switch
  2. Virtual firewall or security group enforcement inside the hypervisor Correct answer.
  3. A physical tap on the host uplink
  4. Static ARP entries on the virtual machines

Explanation

Intra-host traffic may never leave the hypervisor, so enforcement must occur in the virtual switching layer or through host-based security groups. A physical tap on the uplink cannot see traffic that stays local. Spanning tree and ARP settings affect L2 behavior but provide no inspection.

Question 39Security Architecture and Design

An industrial control network must keep running even if the enterprise IT network is compromised. Which segmentation approach best meets this requirement while allowing controlled data exchange?

  1. Connecting OT devices directly to the internet for patching
  2. Merging the OT and IT networks into one flat domain
  3. A dedicated OT zone with a tightly controlled conduit to IT Correct answer.
  4. Using the same domain controller for OT and IT authentication

Explanation

A dedicated OT zone with a narrow, monitored conduit limits exposure while permitting necessary data flows. Flattening the networks or sharing authentication infrastructure lets an IT compromise spread into OT. Direct internet access for OT devices adds exposure without containment.

Question 40Security Architecture and Design

A security architect is evaluating whether an inline IPS should fail open or fail closed when it loses power. Which consideration should drive the decision?

  1. The number of signatures licensed on the device
  2. The relative business impact of an outage versus undetected malicious traffic Correct answer.
  3. The vendor's recommended default setting
  4. The device's maximum throughput rating

Explanation

The fail-open versus fail-closed decision is a risk trade-off between availability loss and security exposure for the protected asset. Throughput ratings, signature counts, and vendor defaults are inputs but do not determine which impact is acceptable. The choice should be documented per segment.

Question 41Network Security Technologies

On a Huawei USG firewall, which security zone is predefined and has a priority of 100 by default?

  1. Untrust
  2. Local Correct answer.
  3. Trust
  4. DMZ

Explanation

The Local zone is a built-in zone that represents the firewall device itself and is assigned the highest default priority of 100. Traffic destined to or originating from the device (management, routing protocols) is matched against the Local zone. Trust, Untrust, and DMZ are administrator-defined zones whose priorities the administrator sets, typically 85, 5, and 50 respectively.

Question 42Network Security Technologies

A security policy on a USG firewall has been created but is not taking effect for matching traffic. Which condition most commonly explains this?

  1. The policy is disabled or its action is set to no-match rather than permit/deny Correct answer.
  2. The policy uses a security profile instead of an ACL
  3. The policy references a zone pair that does not exist
  4. The policy priority is lower than the default interzone policy

Explanation

A newly created security policy must be enabled and given an explicit action of permit or deny; a disabled rule or one left in a non-enforcing state is skipped during matching. Firewalls evaluate enabled policies in priority order and stop at the first match, so an inactive rule never controls traffic. Checking the enable state and action is the first troubleshooting step.

Question 43Network Security Technologies

In a USG interzone security policy, traffic from a higher-priority zone to a lower-priority zone is treated how by default when no explicit policy matches?

  1. Redirected to the Local zone for inspection
  2. Permitted only if a session already exists
  3. Denied by the default interzone action Correct answer.
  4. Permitted by the default interzone action

Explanation

By default the interzone action is deny, so any traffic not matched by an explicit permit policy is dropped regardless of the direction between zone priorities. Zone priority affects features such as NAT and interzone default behavior only when the administrator changes the default action. Explicit security policies must therefore be created for permitted flows.

Question 44Network Security Technologies

Which statement correctly describes the relationship between a NAT policy and a security policy on a Huawei USG firewall?

  1. Security policy matching uses the pre-NAT source and post-NAT destination addresses Correct answer.
  2. A NAT policy implicitly permits the translated traffic
  3. NAT is applied only after the security policy has permitted the packet
  4. Security policy matching uses post-NAT addresses for both source and destination

Explanation

On the USG, the security policy is evaluated using the original source address and the translated (post-NAT) destination address, while NAT translation of the source occurs after policy lookup. This ordering means server NAT policies change the destination the security policy must match, but source NAT does not change the source the policy sees. A NAT policy never grants permission by itself.

Question 45Network Security Technologies

An administrator wants internal users to reach an internal web server through its public IP address while both reside in the same internal network. Which NAT technique is required?

  1. NAT Server Correct answer.
  2. Destination NAT with a no-pat pool
  3. Source NAT with an address pool
  4. Bidirectional NAT applied to the Local zone

Explanation

NAT Server maps a public destination address and port to an internal server address and port, enabling external and internal clients to reach the server by its public address. Source NAT changes the client's address and does not solve reaching a server by a different destination address. NAT Server is the standard term for this destination-translation configuration on Huawei firewalls.

Question 46Network Security Technologies

Which address translation behavior is characteristic of a source NAT policy using a no-pat address pool?

  1. Multiple internal hosts share one public address using port-based multiplexing
  2. Only the destination address is translated
  3. Each internal host is assigned a unique public address with port translation disabled Correct answer.
  4. The source address is translated only for the first packet of each session

Explanation

A no-pat pool performs one-to-one address translation: each internal host consumes one public address and ports are preserved. This is used when applications do not tolerate port translation or when inbound mapping by address is required. PAT pools, by contrast, multiplex many hosts onto one address using ports.

Question 47Network Security Technologies

A firewall administrator wants to inspect and block malicious files downloaded over HTTP without terminating the TCP connection. Which security profile is appropriate?

  1. File blocking profile Correct answer.
  2. URL filtering profile
  3. IPS signature profile
  4. Anti-DDoS profile

Explanation

A file blocking profile identifies file types and can block or alert on transfers carried over inspected protocols such as HTTP and FTP without breaking the connection at the TCP layer. It works on file type and direction rules rather than on exploit signatures. IPS detects known attack patterns, URL filtering classifies sites, and anti-DDoS handles volumetric or flood behavior.

Question 48Network Security Technologies

In the content security detection flow of a USG firewall, which profile type is evaluated against the reputation of the destination server rather than the payload of the request?

  1. URL filtering Correct answer.
  2. Anti-virus
  3. File blocking
  4. IPS

Explanation

URL filtering classifies the requested destination against a category or reputation database and permits or blocks based on that classification. It does not inspect the payload for malicious content. IPS and anti-virus examine traffic content, and file blocking examines file type and transfer direction.

Question 49Network Security Technologies

Which statement correctly distinguishes an IPS signature from an anti-virus signature on a Huawei firewall?

  1. IPS signatures match exploit traffic patterns, while anti-virus signatures match known malicious file content Correct answer.
  2. IPS signatures require SSL decryption, while anti-virus does not
  3. IPS signatures are applied only to inbound traffic, while anti-virus applies only to outbound traffic
  4. IPS signatures match file hashes, while anti-virus signatures match protocol anomalies

Explanation

IPS signatures describe traffic patterns associated with exploits and attacks, whereas anti-virus signatures describe known malicious code inside transferred files. The two engines therefore complement each other in a content security profile. Direction and decryption requirements are configurable and do not define the fundamental difference.

Question 50Network Security Technologies

Which feature allows a USG firewall to detect and block traffic that matches known attack patterns embedded in permitted application flows?

  1. Intrusion prevention Correct answer.
  2. Authentication policy
  3. Application identification
  4. Bandwidth management

Explanation

Intrusion prevention uses signatures and protocol anomaly detection to find exploit attempts inside permitted traffic and can reset or drop the offending connection. Application identification classifies the protocol but does not by itself detect exploit content. Bandwidth management and authentication serve different control objectives.