HCNP Security CISN (Huawei Certified Network Professional - Constructing Infrastructure of Security Network) Set 2

In Hot standby, the backup channel must be the primary interface to the interface board. Which type is not supported?

ACK Flood attacks exploit payload inspection defense. The principle is to clean equipment for ACK packet payload to check if the contents of the full load are consistent (as are all a load of content, etc.), the packet is discarded.

If using a policy template and configuring IPsec policy child policy, the firewall will first apply a policy template, and then it will apply the child policy.

Limiting policy function supports only the number of connections to the specified IP initiated or received to limit the number of connections.

After the configuration on NRT Server (no-reverse parameter is not added), the firewall will automatically generate static Server-map entries, the first packet matching Server-map entries, but it does not match the session table.

BFD static route topology is shown in Figure

Which statement is correct regarding local users with VPN instance bindings?

In hot standby networking environment, two USG's NAT configuration is consistent. When the virtual IP address is in the address of the VRRP backup group, then NAT address pool in the same network segment. The next two figures show the NAT Server applications with a combination of VRRP ARP response situations. Which Combination of the following NAT Server configuration and VRRP shown as options are correct?

No need to use deny rules because of the policy limiting strategy for deny rules without restrictions.

Tracert packet attack occurs when an attacker using TTL returned ________. ICMP timeout packets reach the destination address and return an ICMP time exceeded message back to the source IP address. An attacker may run the tracert program to detect source ip address in ICMP returned message and it can snoop structure of the network.