I85PREP
⌘ K
Huawei HCIP-Security (H12-721/722/723) study materials
Huawei HCIP-Security (H12-721/722/723) study resources

Huawei HCIP-Security (H12-721/722/723) practice questions

One question at a time. Build your Huawei HCIP-Security (H12-721/722/723) understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Architecture and Threat Landscape

In a Huawei firewall deployment, which zone is used to hold the interfaces that face the untrusted public network by default?

  1. DMZ zone
  2. Trust zone
  3. Untrust zone Correct answer.
  4. Local zone

Explanation

The Untrust zone is the predefined security zone that contains interfaces facing external, untrusted networks such as the Internet. Its default interzone priority is lower than Trust, so traffic from Untrust to Trust is restricted unless a policy permits it.

Question 2Security Architecture and Threat Landscape

Which security zone on a Huawei firewall has the highest default priority value and therefore the highest trust level?

  1. Untrust
  2. Local Correct answer.
  3. Trust
  4. DMZ

Explanation

The Local zone has the highest default priority (100) because it represents the firewall's own control plane and must be protected most strongly. Trust (85), DMZ (50) and Untrust (5) follow in descending order.

Question 3Security Architecture and Threat Landscape

A security administrator wants traffic between two zones to be permitted without writing a security policy. Which interzone behavior on a Huawei firewall makes this possible?

  1. Configuring a zone pair with the default action permit Correct answer.
  2. Setting the interzone action to permit
  3. Disabling the firewall's session table
  4. Enabling stateful inspection

Explanation

On Huawei firewalls the relationship between two zones is controlled by a zone pair (interzone), and its default action can be set to permit or deny. When the default action is permit, traffic between those zones passes without an explicit security policy.

Question 4Security Architecture and Threat Landscape

Which type of firewall inspects each packet independently against a static rule set without maintaining connection state?

  1. Application-layer proxy firewall
  2. Stateful inspection firewall
  3. Packet-filtering firewall Correct answer.
  4. Next-generation firewall

Explanation

A packet-filtering firewall evaluates every packet in isolation against configured rules and keeps no record of established connections. This makes it fast but unable to reason about session context, which later stateful and application-aware designs added.

Question 5Security Architecture and Threat Landscape

What is the primary security purpose of placing web servers in a DMZ rather than in the internal Trust zone?

  1. To increase the throughput of the servers
  2. To avoid the need for any security policy
  3. To allow the servers to bypass the firewall
  4. To limit the damage if an Internet-facing server is compromised Correct answer.

Explanation

A DMZ segments Internet-facing servers away from internal assets, so a compromise of a public server does not give direct access to the internal network. Access from the DMZ to Trust can then be tightly controlled by policy.

Question 6Security Architecture and Threat Landscape

In the Huawei firewall security policy matching process, what happens when a packet matches no security policy rule?

  1. It is permitted by the default interzone action
  2. It is dropped by the default deny action Correct answer.
  3. It is logged and then permitted
  4. It is redirected to the DMZ

Explanation

Security policies are evaluated top-down and the first match wins; if no rule matches, the default action applies, which is deny by default. This default-deny posture is a core principle of firewall policy design.

Question 7Security Architecture and Threat Landscape

Which attack manipulates the source address of packets so that replies are directed to a victim, overwhelming it with unsolicited responses?

  1. DNS tunneling
  2. ARP spoofing
  3. SYN flood
  4. Smurf attack Correct answer.

Explanation

A Smurf attack spoofs the victim's source address in ICMP echo requests sent to a broadcast address, so many hosts send replies to the victim. The amplification of responses is what makes it a volumetric reflection attack.

Question 8Security Architecture and Threat Landscape

A server is receiving a large volume of TCP SYN packets with spoofed source addresses and its connection table is filling up. Which defense most directly mitigates this at the firewall?

  1. SYN flood protection with source verification Correct answer.
  2. IPsec encryption of the traffic
  3. URL filtering
  4. Antivirus scanning of HTTP downloads

Explanation

SYN flood protection detects excessive half-open connections and can use source verification or proxy-based handshakes to absorb the flood before it reaches the server. URL filtering, antivirus and IPsec do not address connection-table exhaustion.

Question 9Security Architecture and Threat Landscape

Which technique does a firewall use to reassemble and inspect traffic that has been deliberately fragmented to evade detection?

  1. Port scanning detection
  2. Fragment reassembly before inspection Correct answer.
  3. Stateless packet filtering
  4. NAT traversal

Explanation

Attackers fragment packets so that a signature or policy is split across fragments and escapes inspection. The firewall reassembles fragments into complete packets before applying deep inspection, so the full payload is evaluated.

Question 10Security Architecture and Threat Landscape

What is the main purpose of NAT in a perimeter firewall deployment?

  1. To hide internal addresses from external networks Correct answer.
  2. To encrypt traffic between sites
  3. To authenticate users accessing the Internet
  4. To detect intrusions in real time

Explanation

NAT translates internal private addresses to public ones, which conserves address space and hides the internal addressing scheme from external observers. It is a translation and concealment mechanism, not an encryption or authentication control.

Question 11Security Architecture and Threat Landscape

Which type of malware propagates autonomously across networks by exploiting vulnerabilities without requiring user interaction?

  1. Logic bomb
  2. Worm Correct answer.
  3. Trojan horse
  4. Rootkit

Explanation

A worm self-replicates and spreads across networks by exploiting vulnerabilities, requiring no user action to propagate. This autonomous spreading is what distinguishes it from Trojans, which rely on user execution.

Question 12Security Architecture and Threat Landscape

An analysis shows a compromised host resolving unusually long, high-entropy subdomains of a single domain at regular intervals. Which threat is most likely?

  1. DNS tunneling for command and control Correct answer.
  2. ARP cache poisoning
  3. Password brute forcing
  4. Cross-site scripting

Explanation

Long, random-looking subdomain labels sent periodically are a signature of DNS tunneling, where data is encoded into DNS queries to a controlled authoritative server. This allows command-and-control or exfiltration to blend into allowed DNS traffic.

Question 13Security Architecture and Threat Landscape

Which security control best reduces the risk of credential theft through lateral movement inside a data center segment?

  1. Using a single flat VLAN for all servers
  2. Increasing the size of the public IP pool
  3. Micro-segmentation with least-privilege policies Correct answer.
  4. Disabling logging to reduce overhead

Explanation

Micro-segmentation divides the data center into small trust zones and permits only the flows each workload needs, so stolen credentials cannot move freely between systems. Least-privilege interzone policy limits the blast radius of a compromised host.

Question 14Security Architecture and Threat Landscape

In a zero-trust architecture, what replaces the traditional assumption that anything inside the corporate network is trusted?

  1. Static VLAN assignment
  2. Trust based on network location
  3. A single perimeter firewall
  4. Continuous verification of identity and device posture Correct answer.

Explanation

Zero trust removes implicit trust based on network location and instead verifies identity, device health and context for every access request. Authorization is evaluated continuously rather than granted once at the perimeter.

Question 15Security Architecture and Threat Landscape

Which statement correctly describes the difference between an IDS and an IPS in a Huawei security deployment?

  1. An IDS detects and alerts, while an IPS can drop malicious traffic inline Correct answer.
  2. An IDS encrypts traffic while an IPS decrypts it
  3. An IPS performs only signature updates while an IDS performs inspection
  4. An IDS blocks traffic inline while an IPS only logs

Explanation

An IDS monitors a copy of traffic and raises alerts but does not sit in the forwarding path, whereas an IPS is deployed inline and can actively drop or reset malicious sessions. The key distinction is detection-only versus prevention capability.

Question 16Security Architecture and Threat Landscape

A firewall policy allows any source to reach an internal server on TCP 3389. Which change most reduces the attack surface without breaking administration?

  1. Enable broadcast forwarding on the server VLAN
  2. Remove the server from the DMZ
  3. Change the server port to a non-standard number
  4. Restrict the source to a management jump host and specific addresses Correct answer.

Explanation

Limiting RDP access to a known management jump host and specific source addresses applies least privilege and shrinks exposure while keeping administration functional. Security by obscurity through a non-standard port does not address the underlying exposure.

Question 17Security Architecture and Threat Landscape

Which characteristic most clearly identifies an advanced persistent threat rather than opportunistic malware?

  1. High-volume indiscriminate scanning of the Internet
  2. A single exploit followed by no further activity
  3. Immediate encryption of all files on a host
  4. Long-term stealthy presence with staged objectives Correct answer.

Explanation

An APT is defined by a prolonged, stealthy campaign in which an actor maintains access and progresses through staged objectives over time. Opportunistic malware typically spreads broadly and acts quickly rather than pursuing a sustained mission.

Question 18Security Architecture and Threat Landscape

In a Huawei firewall, which object is referenced by a security policy to match traffic by IP address range rather than by a single host?

  1. Address object Correct answer.
  2. Service object
  3. Time range object
  4. Application object

Explanation

Address objects (and address groups) encapsulate IP addresses, ranges or subnets so that security policies can reference them by name. Service objects describe protocols and ports, and application objects describe recognized applications.

Question 19Security Architecture and Threat Landscape

An administrator observes that a policy permitting HTTP is also allowing SSH to the same server. Which design flaw is the most likely cause?

  1. The session table is too small
  2. NAT is disabled on the firewall
  3. The server's antivirus is outdated
  4. The policy matches on the wrong service or uses a broad service group Correct answer.

Explanation

A security policy matches on the combination of source, destination and service; if the service field is set to any or to a group that includes SSH, SSH is permitted alongside HTTP. The fix is to narrow the service to the exact ports required.

Question 20Security Architecture and Threat Landscape

Which deployment places a firewall in a transparent layer-2 mode where it forwards frames without changing IP addressing?

  1. Virtual wire with NAT
  2. Routed mode
  3. Transparent mode Correct answer.
  4. Proxy mode

Explanation

In transparent mode the firewall acts as a layer-2 bridge, inspecting traffic without altering IP addresses or routing. This allows security enforcement to be inserted into an existing segment without re-addressing.

Question 21Firewall Fundamentals and Policy Design (USG series)

On a Huawei USG firewall, what is the default interzone behavior for traffic passing between two different security zones when no interzone policy is configured?

  1. Traffic is permitted by default
  2. Traffic is permitted only for TCP
  3. Traffic is denied by default Correct answer.
  4. Traffic is logged and then permitted

Explanation

The USG applies a default deny posture between security zones, so packets traversing from one zone to another are dropped unless an interzone policy explicitly permits them. This default-deny design forces the administrator to define each permitted flow deliberately, which is the foundation of least-privilege policy design on the device.

Question 22Firewall Fundamentals and Policy Design (USG series)

Which zone on a USG firewall is reserved and used for traffic destined to the device itself, such as management access to the firewall?

  1. local Correct answer.
  2. untrust
  3. trust
  4. dmz

Explanation

The local zone represents the firewall device itself, so traffic addressed to the USG's own interfaces is handled in the local zone. Policies that control SSH, HTTPS, or SNMP access to the device are written between a source zone and the local zone.

Question 23Firewall Fundamentals and Policy Design (USG series)

A security policy on a USG is configured with source zone trust, destination zone untrust, and no other match conditions. What does this policy match?

  1. All traffic from trust to untrust regardless of address or service Correct answer.
  2. Only HTTP traffic from trust to untrust
  3. Only traffic whose source address is in the trust subnet
  4. Only traffic initiated from untrust to trust

Explanation

In a security policy, any match field left unconfigured acts as a wildcard, so specifying only the zone pair matches every source and destination address and every service. The policy therefore permits or denies all flows from trust to untrust depending on its action.

Question 24Firewall Fundamentals and Policy Design (USG series)

When multiple security policies could match the same packet on a USG, how does the firewall decide which policy applies?

  1. It applies the policy with the lowest sequence number among matches Correct answer.
  2. It applies all matching policies in parallel
  3. It applies the most recently created policy
  4. It applies the policy with the most specific address objects

Explanation

USG security policies are evaluated in sequence order, and the first policy whose conditions all match the packet determines the action. Administrators therefore place narrow, specific rules above broad rules so the intended policy is reached first.

Question 25Firewall Fundamentals and Policy Design (USG series)

An administrator wants a USG security policy to permit only web browsing and to block all other services between the same zone pair. Which configuration approach achieves this?

  1. Create a permit policy for HTTP and HTTPS, then a deny policy for any service below it Correct answer.
  2. Create a deny policy for all services above a permit policy for HTTP and HTTPS
  3. Rely on the default interzone action and create no policies
  4. Create a single permit policy with no service specified

Explanation

Because policies are evaluated top-down, the specific permit rules for HTTP and HTTPS must appear before a broad deny rule so that web traffic matches first. The trailing deny-any rule then catches everything else, giving an explicit whitelist posture.

Question 26Firewall Fundamentals and Policy Design (USG series)

What is the primary purpose of a security zone on a Huawei USG firewall?

  1. To group interfaces that share a common security trust level Correct answer.
  2. To encrypt traffic between two sites
  3. To assign IP addresses to interfaces automatically
  4. To provide NAT translation for outbound traffic

Explanation

A security zone logically groups one or more interfaces that share the same trust level, and policies are written between zones rather than between individual interfaces. This abstraction keeps policy sets manageable as the number of interfaces grows.

Question 27Firewall Fundamentals and Policy Design (USG series)

Which statement correctly describes the relationship between an interface and a security zone on a USG?

  1. A zone can contain only one interface
  2. Interfaces do not need to be assigned to any zone
  3. An interface can belong to multiple zones simultaneously
  4. An interface belongs to exactly one zone at a time Correct answer.

Explanation

Each interface on a USG is bound to a single security zone at any given time, which determines how its traffic is classified for policy matching. A zone may contain multiple interfaces, but an individual interface cannot be split across zones.

Question 28Firewall Fundamentals and Policy Design (USG series)

A USG policy references an address object group named Web-Servers that contains three host addresses. A new server is added to the group. What is the effect on the policy?

  1. The policy automatically matches traffic to the new server without editing the rule Correct answer.
  2. The policy stops matching until the group is recreated
  3. The new server is matched only after the group is renamed
  4. The policy must be edited and recommitted to include the new server

Explanation

Address objects and groups are referenced by name, so adding a member to the group updates every policy that references it. This object-based design avoids editing many rules when the underlying address set changes.

Question 29Firewall Fundamentals and Policy Design (USG series)

What is the effect of enabling the session-based or stateful inspection behavior on a USG when permitting outbound traffic from trust to untrust?

  1. Return traffic for the permitted session is allowed back without a separate untrust-to-trust policy Correct answer.
  2. Return traffic requires a separate untrust-to-trust permit policy
  3. Return traffic is inspected as a new session each time
  4. Return traffic is always dropped regardless of state

Explanation

The USG maintains a session table, so once an outbound flow is permitted, the corresponding return packets are recognized as part of that established session and are allowed back. This stateful behavior is why a single direction policy is normally sufficient for client-server flows.

Question 30Firewall Fundamentals and Policy Design (USG series)

Which USG feature allows an administrator to test the effect of a new security policy without actually forwarding or blocking live traffic?

  1. Zone broadcast
  2. Interface auto-negotiation
  3. Session aging
  4. Policy trial run or simulation mode Correct answer.

Explanation

The USG provides a policy hit simulation or trial-run capability that reports which policy would match a given flow without enforcing the action. This lets administrators validate rule ordering and match conditions before committing changes to production.

Question 31Firewall Fundamentals and Policy Design (USG series)

An administrator needs to permit ICMP echo requests from the untrust zone to a single public server in the dmz zone while denying all other untrust-to-dmz traffic. Which design is most appropriate?

  1. Relying on the default interzone action for untrust-to-dmz
  2. A permit policy for the entire dmz zone with no service restriction
  3. A permit policy for the server address and ICMP above a deny-any untrust-to-dmz policy Correct answer.
  4. A deny-any untrust-to-dmz policy above a permit policy for the server and ICMP

Explanation

The specific permit for the server address and ICMP service must be placed above the broad deny so that the intended flow matches first. This top-down ordering produces a minimal exposure where only the required ping reaches the public server.

Question 32Firewall Fundamentals and Policy Design (USG series)

Which action can a USG security policy apply to matched traffic?

  1. Only deny, because the default is permit
  2. Only permit or deny, with no other options
  3. Permit, deny, or permit with additional content inspection profiles Correct answer.
  4. Only redirect to a proxy server

Explanation

A security policy can permit or deny traffic, and a permit action can additionally attach profiles such as antivirus, IPS, or URL filtering for deeper inspection. This lets a single rule both allow a flow and apply content security to it.

Question 33Firewall Fundamentals and Policy Design (USG series)

What happens to a packet on a USG when it matches a security policy whose action is deny?

  1. It is dropped and, if logging is enabled, a log is generated Correct answer.
  2. It is queued until an administrator approves it
  3. It is forwarded but logged
  4. It is automatically translated by NAT

Explanation

A deny action causes the firewall to drop the matching packet, and if session logging is configured for that rule, a log entry records the drop. The packet is not forwarded, so the connection cannot complete.

Question 34Firewall Fundamentals and Policy Design (USG series)

An administrator wants to allow a specific internal host to reach a database server while all other hosts in the same zone are blocked from that server. Which match conditions should the permit policy include to be as precise as possible?

  1. Source zone only
  2. Source address and destination zone only
  3. Source zone, destination zone, source address, destination address, and service Correct answer.
  4. Destination zone and service only

Explanation

The most precise permit specifies the zone pair, the exact source host, the exact destination server, and the database service. This minimizes the traffic the rule unintentionally matches and keeps the policy aligned with least privilege.

Question 35Firewall Fundamentals and Policy Design (USG series)

Which USG object type is best suited to represent a set of related services, such as the ports used by a multi-tier application, so that a single policy can reference them?

  1. Session table entry
  2. Service group Correct answer.
  3. Address group
  4. Zone pair

Explanation

A service group bundles multiple service objects so a policy can reference the whole set by name. Address groups represent hosts or subnets, not ports, so they are not the right object for grouping services.

Question 36Firewall Fundamentals and Policy Design (USG series)

A USG has a security policy permitting trust-to-untrust for any service. An administrator adds a higher-priority deny policy for a specific destination address. What is the result for traffic to that destination?

  1. The traffic is permitted because the permit policy already exists
  2. The traffic bypasses all policies
  3. The traffic is permitted and denied alternately
  4. The traffic is denied because the higher-priority deny matches first Correct answer.

Explanation

Because the deny policy sits above the broad permit in sequence, the destination-specific traffic matches the deny first and is dropped. The broad permit only applies to traffic that does not match any earlier policy.

Question 37Firewall Fundamentals and Policy Design (USG series)

What is the role of the ASPF feature on a Huawei USG in relation to security policy?

  1. It orders policies by sequence number
  2. It assigns security zones to interfaces
  3. It performs stateful protocol inspection to permit related return channels for multi-channel protocols Correct answer.
  4. It provides the default deny action between zones

Explanation

ASPF, the Application Specific Packet Filter, performs stateful inspection of application-layer protocols so that dynamically negotiated return channels, such as FTP data connections, are recognized and permitted. Without it, multi-channel protocols would break because their secondary connections do not match the original policy.

Question 38Firewall Fundamentals and Policy Design (USG series)

An administrator notices that an FTP session is permitted by policy but file transfers fail. Which USG feature is most likely misconfigured or disabled?

  1. Session aging time
  2. Zone broadcast
  3. NAT server mapping
  4. ASPF for FTP Correct answer.

Explanation

FTP uses a separate data channel, and ASPF must inspect the control connection to open the negotiated data connection dynamically. If ASPF for FTP is disabled, the control channel succeeds while the data transfer is blocked.

Question 39Firewall Fundamentals and Policy Design (USG series)

Which statement about the relationship between NAT and security policy on a USG is correct?

  1. NAT and security policy are evaluated in random order
  2. NAT replaces the need for security policy
  3. Security policy is evaluated before NAT, so policies match the original addresses Correct answer.
  4. NAT is applied before security policy matching, so policies see translated addresses

Explanation

On the USG, security policy is evaluated before NAT translation, so policy rules are written against the pre-translation addresses. Administrators must keep this order in mind when troubleshooting why a policy does not match as expected.

Question 40Firewall Fundamentals and Policy Design (USG series)

A USG policy is configured with source zone trust and destination zone trust. What type of traffic does this policy govern?

  1. Traffic destined to the firewall itself
  2. Traffic between two interfaces that are both in the trust zone Correct answer.
  3. Traffic from untrust to trust
  4. Traffic from trust to the local zone

Explanation

An intra-zone policy, where the source and destination zones are the same, controls traffic between interfaces that belong to that zone. It does not govern traffic to the local zone or traffic crossing into a different zone.

Question 41Firewall Fundamentals and Policy Design (USG series)

Which tool on a USG lets an administrator see which policy a live flow matched and whether it was permitted or denied?

  1. Zone broadcast counters
  2. Session table with policy match information Correct answer.
  3. Interface duplex settings
  4. License activation page

Explanation

The session table records active flows along with the policy that matched and the resulting action, making it the primary troubleshooting tool for policy behavior. Administrators can filter sessions by address or port to confirm the verdict for a specific flow.

Question 42Firewall Fundamentals and Policy Design (USG series)

An administrator wants to log all denied traffic from untrust to trust for auditing. What should be enabled on the relevant deny policy?

  1. Session logging for the deny action Correct answer.
  2. NAT server mapping
  3. Zone broadcast
  4. Interface auto-negotiation

Explanation

Enabling session logging on a deny policy causes the USG to generate a log entry each time the rule drops a packet. This provides the audit trail of blocked attempts without changing the forwarding verdict.

Question 43Firewall Fundamentals and Policy Design (USG series)

Which design principle best reflects least-privilege policy design on a USG?

  1. Use a single permit-any policy for all zone pairs
  2. Permit all traffic between internal zones to simplify administration
  3. Disable the default deny action to avoid blocking legitimate traffic
  4. Permit only the specific zones, addresses, and services required, and deny the rest Correct answer.

Explanation

Least privilege means each policy permits only the exact zones, addresses, and services that a business flow requires, with everything else denied. This limits the attack surface and makes the rule set easier to audit.

Question 44Firewall Fundamentals and Policy Design (USG series)

A USG administrator creates a policy with source zone untrust and destination zone trust that permits HTTP to an internal web server. After deployment, external users can reach the server, but the administrator is concerned about exposure. Which additional control most directly reduces risk while preserving the service?

  1. Disable stateful inspection for the policy
  2. Remove the service condition to match all protocols
  3. Change the source zone to trust
  4. Restrict the destination address to the specific web server and attach a content security profile Correct answer.

Explanation

Tightening the destination to the exact server address and attaching a content security profile narrows what the rule exposes and adds inspection of the permitted traffic. This preserves the web service while reducing the attack surface compared with a broad permit.

Question 45Firewall Fundamentals and Policy Design (USG series)

Which statement about how a USG handles traffic that matches no configured security policy between two different zones is correct?

  1. It is held for administrator review
  2. It is translated by NAT and forwarded
  3. It is dropped according to the default interzone action Correct answer.
  4. It is permitted and logged

Explanation

When no policy matches, the USG falls back to the default interzone action, which is deny, so the traffic is dropped. Administrators who need a flow must add an explicit policy rather than relying on implicit permission.

Question 46Firewall Fundamentals and Policy Design (USG series)

On a Huawei USG, which interzone behavior applies by default to traffic that matches no explicit security policy when the zones are different?

  1. The traffic is denied and a log entry is generated only if logging is enabled. Correct answer.
  2. The traffic is redirected to the management interface for approval.
  3. The traffic is permitted because interzone inspection is disabled by default.
  4. The traffic is permitted only for TCP and denied for UDP and ICMP.

Explanation

On a USG, the default interzone action is deny, so any packet that does not match an explicit security policy between two different zones is dropped. Logging is a separate setting, so a default deny may be silent unless logging is enabled on the policy or the default action. This default-deny behavior is the foundation of least-privilege policy design on the platform.

Question 47Firewall Fundamentals and Policy Design (USG series)

An administrator configures a USG security policy with source zone trust, destination zone trust, and action permit. Which traffic can this policy match?

  1. Traffic entering one trust interface and leaving another trust interface. Correct answer.
  2. Traffic entering a trust interface and leaving an untrust interface.
  3. Traffic entering a trust interface and leaving a dmz interface.
  4. Traffic entering an untrust interface and leaving a trust interface.

Explanation

A security policy matches on the source and destination zones of the flow, so trust-to-trust means the ingress interface belongs to the trust zone and the egress interface also belongs to trust. Traffic between two different zones, such as trust and untrust, requires a policy whose zone pair matches that direction. This lets administrators control traffic between internal segments even when both sides share the same zone.

Question 48Firewall Fundamentals and Policy Design (USG series)

Which USG object type is designed to group multiple predefined and custom services so that one policy can reference the entire set?

  1. Time range
  2. Application group
  3. Service group Correct answer.
  4. Address group

Explanation

A service group aggregates individual service objects, each defined by protocol and port, so a single policy can reference the group instead of listing each service. Address groups aggregate IP addresses or subnets, and time ranges control when a policy is active, so neither represents ports. Grouping services keeps policies concise and easier to maintain when a multi-tier application uses several ports.

Question 49Firewall Fundamentals and Policy Design (USG series)

A USG policy permits trust-to-untrust for web browsing, but the administrator wants DNS queries from the same hosts to be allowed only to two specific DNS servers. Which configuration achieves this with least privilege?

  1. Add a policy permitting DNS service from the host group to a DNS server address group, placed above any broad permit. Correct answer.
  2. Create a permit-any policy for the trust zone and rely on the DNS servers to filter queries.
  3. Disable stateful inspection so DNS responses are dropped and only queries are sent.
  4. Add DNS to the existing web browsing policy so all destinations are reachable on port 53.

Explanation

Least privilege means permitting only the required service to only the required destinations, so a dedicated policy with a DNS service object and a destination address group of the two servers is appropriate. Placing it above broader permits ensures the specific rule is evaluated first. Adding DNS to a policy that permits any destination would allow port 53 to every host on the internet, which is broader than required.

Question 50Firewall Fundamentals and Policy Design (USG series)

On a USG, a policy uses an address object that contains a single host address. The administrator edits the object to add a second host. What is the effect on the existing policy?

  1. The policy is placed in an error state because objects cannot hold multiple hosts.
  2. The policy immediately matches traffic to both hosts without editing the policy itself. Correct answer.
  3. The policy must be deleted and recreated before the second host is matched.
  4. The policy continues to match only the first host until the policy is re-applied.

Explanation

Policies reference objects by name, and the object content is resolved when traffic is evaluated, so editing the object changes what the policy matches without touching the policy. This object reuse is a core benefit of the USG policy model, since one address object can be shared by many policies. No re-creation or manual re-application of the policy is required.