Huawei HCIP-Security (H12-721/722/723) study plan

Map each USG security zone (Trust, Untrust, DMZ, Local) to its interface and explain in writing why inter-zone traffic is denied by default

Configure a baseline inter-zone policy on a USG6000V lab instance and verify permitted and denied flows with display security-policy rule all and session tables

Differentiate stateful inspection behavior from stateless ACL filtering by tracing one TCP handshake through the session table

Classify the threat categories in Domain 1 (reconnaissance, spoofing, DoS/DDoS, malware delivery, web exploitation) and name the USG feature that mitigates each

Write policy rules using the correct match order (security policy before inter-zone default action) and justify rule ordering to avoid shadowed entries

Configure and test NAT Server, source NAT (NAT policy), and NAT64-free bidirectional NAT scenarios on the lab firewall

Apply the ASPF and server-map concepts to explain why return traffic and multi-channel protocols (FTP) need special handling

Troubleshoot one deliberately broken policy using display firewall session table verbose and display security-policy statistics

Draft a 10-rule policy set for a small branch (LAN, DMZ web server, guest Wi-Fi) that satisfies least-privilege principles

Build a site-to-site IPsec VPN in main mode with pre-shared key authentication and verify phase 1 and phase 2 SAs with display ike sa and display ipsec sa

Diagnose a failing IPsec tunnel by isolating IKE proposal mismatch, ACL/proxy-ID mismatch, and routing black holes in sequence

Compare IKEv1 and IKEv2 negotiation, and explain when aggressive mode or NAT-T is required

Configure GRE over IPsec and state one scenario where GRE is preferred over pure IPsec (multicast or routing protocol transport)

Explain how DSVPN (mGRE with NHRP) lets spokes build dynamic tunnels through a hub and list the key NHRP registration and resolution steps

Configure an SSL VPN gateway with a web proxy resource and a network-extension resource, then connect with a client and confirm the assigned virtual IP and routes

Set up L2TP over IPsec for remote access and contrast its authentication and address assignment with SSL VPN

Configure VRRP on two firewalls in active/standby and verify master election and failover by shutting the master interface

Explain HRP synchronization scope (sessions, config, some state) and identify what is not synchronized by default

Design a dual-system hot standby topology that combines VRRP virtual IPs with HRP channel and heartbeat links

Enable IPS with a signature profile and demonstrate that a test attack is blocked while legitimate traffic passes, reading the threat log entry

Configure antivirus file-type and protocol scanning and explain the trade-off between scan depth and throughput

Set up URL filtering and file reputation (content security) profiles and attach them to a policy rule

Trace a packet through source NAT, destination NAT, and policy lookup in the correct order and document the order of operations

Explain policy-based routing and its interaction with NAT and return-path routing in a dual-ISP design

Configure application identification (SA signature-based) and write a policy that permits one application while denying another on the same port

Build a bandwidth management policy with per-user and per-application limits and verify shaping with traffic statistics

Set up syslog export and configure log severity and log suppression, then confirm entries arrive at a collector

Practice three diagnostic workflows: high CPU, session table exhaustion, and a policy that does not match

Interpret display firewall statistics and session verbose output to locate the drop reason for a given flow

Describe the HiSec/campus solution components (access control, endpoint posture, NAC, controller) and how they integrate with the firewall

Configure 802.1X or portal authentication in a campus scenario and explain posture assessment flow

Explain zero-trust and SDP concepts at a level sufficient to answer architecture questions, without vendor marketing claims

Revisit Domain 1 threat modeling and map each threat to the now-known mitigation feature across all domains

Re-run the two heaviest labs (policy/NAT and IPsec/HA) from a blank configuration to prove retention within a time limit

Complete a timed 60-question mixed practice set and review every wrong answer to its root concept

Consolidate a one-page command cheat sheet for the most-used display and debugging commands

List your five weakest sub-topics and close each with a targeted 20-minute review