Security Architecture and Threat Landscape
This domain tests how precisely you separate threats, vulnerabilities, and risks, and how you place Huawei security controls into a layered architecture. Scenario questions usually describe an attack or a weak design and ask which control or zone placement addresses it.
Core rules
- A threat is an actor or event with intent and capability; a vulnerability is a weakness; risk combines likelihood and impact.
- Common categories: malware and ransomware, phishing, DoS/DDoS, exploitation of unpatched services, credential theft, insider misuse, and advanced persistent threats.
- Defense in depth combines zones, security policy, IPS, antivirus, application control, and endpoint access control; one control is never sufficient.
- Zones carry trust: Trust for internal users, Untrust for the Internet, DMZ for public services. Good zone design limits lateral movement.
Worked example
An Internet-facing DMZ server runs an unpatched SMB service and is compromised to install ransomware. The vulnerability is the missing patch; the threat is the exploit campaign and ransomware; the risk is high because the service is externally reachable. A reasoned answer applies the patch, adds an IPS signature for the exploit, restricts SMB between zones, and monitors DMZ-to-Trust traffic. Patching alone is incomplete because the exam expects layered controls.
Traps that cost marks
- Calling an unpatched service a threat instead of a vulnerability.
- Treating DMZ hosts as trusted because they are “internal.”
- Selecting antivirus as the only control against service exploitation.
- Forgetting that a firewall policy permit does not by itself stop application-layer attacks.