Huawei HCIP-Security (H12-721/722/723) flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Security zone

A logical grouping of interfaces with a common trust level. Traffic between zones is denied by default and permitted only by explicit security policy, giving the firewall its zone-based control model.

Defense in depth

Layering independent controls such as firewall, IPS, antivirus, and endpoint protection so that a single failed control does not expose the asset. Each layer assumes the previous one was bypassed.

SYN flood

A DoS attack sending many TCP SYN packets without completing the handshake, exhausting the half-open connection table. Defenses include SYN cookies, rate limiting, and anti-DDoS appliances.

Stateful inspection

The firewall records the first permitted packet in a session table and lets subsequent packets in either direction match that entry, avoiding repeated policy evaluation for established flows.

Default deny rule

The implicit final rule in a security policy set that drops traffic matching no earlier rule. It makes policy authoring fail-closed, so every permitted flow needs an explicit rule.

ASPF

Application Specific Packet Filter that inspects multi-channel protocols such as FTP and SIP, creating predicted server-map entries so related data connections are permitted dynamically.

Security policy match order

Rules are evaluated top-down and the first match wins; the implicit default is deny. Place specific rules above broad rules to avoid shadowing unintended traffic.

NAT Server

A destination NAT rule mapping a public IP and port to an internal server address and port. It creates a server-map entry so external clients can initiate connections to the private server.

Source NAT PAT

Port address translation rewrites many private source addresses to one public address using different source ports. It requires no one-to-one address mapping but limits concurrent connections.

Hairpin NAT

Allows internal clients to reach an internal server through its public address. It needs destination NAT plus source NAT so return traffic is routed back through the firewall.

Route preference

A tiebreaker among routes to the same destination from different protocols. Lower preference wins; on Huawei devices directly connected is 0, OSPF 10, static 60, and BGP 255.

IKE phase 1

Negotiates and establishes the ISAKMP security association that protects later IKE messages. It authenticates peers by pre-shared key or certificate and agrees on encryption and hash algorithms.

IPsec SA pair

Each IPsec tunnel uses two unidirectional security associations, one inbound and one outbound. Each SA is identified by SPI, destination address, and security protocol.

NAT traversal

Encapsulates ESP packets in UDP port 4500 so they pass through NAT devices. IKE itself uses UDP 500, while plain ESP uses IP protocol 50.

DSVPN

Huawei Dynamic Smart VPN uses mGRE with NHRP so spokes with dynamic addresses register with the hub and can build direct spoke-to-spoke shortcut tunnels for data traffic.

SSL VPN network extension

A full-tunnel mode where the client installs a virtual network adapter and routes traffic through the gateway, giving access to multiple internal resources beyond web applications.

IPS signature action

The response when a signature matches: alert and log only, or block and drop the packet. Profiles select enabled signature groups and their actions to balance detection and false positives.

Signature evasion

Techniques that make malicious traffic avoid pattern matching, such as fragmentation overlap, URL encoding, and session splicing. Normalization and reassembly before inspection counter them.

Streaming antivirus scan

Inspects file content while forwarding it to reduce latency, rather than buffering the whole file. Very large files may be partially scanned or skipped depending on configuration.

URL filtering category

Classifies requested URLs into categories such as malware, phishing, or social media. The security policy permits or blocks based on category rather than individual URL lists.

Content-security profile

A bundle of antivirus, IPS, URL filtering, and file-blocking settings attached to a permit rule. It applies only to traffic that the policy permits, never to denied traffic.

App-ID signature

Identifies an application by protocol behavior and payload patterns rather than by TCP or UDP port, so applications using nonstandard ports are still recognized and controlled.

Committed bandwidth

The guaranteed minimum forwarding rate for a traffic class. Traffic within the committed rate is protected from congestion, while excess traffic competes or is dropped.

Peak bandwidth

The maximum rate a traffic class may use. Traffic exceeding the peak rate is dropped or remarked, capping how much a single application can consume.

HRP

Huawei Redundancy Protocol synchronizes sessions, configuration, and status between an active and standby firewall pair, enabling the standby to take over with minimal disruption.

VRRP virtual IP

A shared gateway address owned by the VRRP master and taken over by the backup if the master fails. Hosts use it as their default gateway for transparent failover.

Split-brain

A failure where both HA devices become active because the heartbeat link is lost. It causes duplicate sessions and asymmetric forwarding, so heartbeat paths must be redundant.

BFD

Bidirectional Forwarding Detection sends rapid probes to detect link or peer failure in milliseconds, faster than routing protocol hellos, and can trigger route or HA failover.

Syslog severity

Numeric levels from 0 (emergency) to 7 (debug) that tag log messages. Lower numbers are more severe, and the configured threshold determines which messages are sent.

NTP for log correlation

Synchronizing device clocks so log timestamps align across firewalls and servers. Without it, incident timelines reconstructed from multiple devices are unreliable.

802.1X authentication

Port-based access control with three roles: supplicant client, authenticator switch, and RADIUS server. The port stays blocked until the user authenticates successfully.

Posture compliance check

Verifies an endpoint's antivirus status, patch level, and forbidden software before admission. Noncompliant devices are quarantined or granted only limited remediation access.