H12-723 Huawei Certified ICT Professional - Constructing Terminal Security System Questions and Answers

Visitors can use their mobile phone number to quickly register an account

The administrator can assign different permissions to each visitor

Reception staff cannot create guest accounts

There is a violation of the guest account, and the administrator cannot retrospectively

Office Windows System host

For testing Linux System host

Mobile client, such as smart phone, etc

Network printer 232335

View in task manager TMCSever Whether the service is started.

View in task manager TMCServerDaemon Whether the service is started.

View in task manager TMCServer with TMCSeverDaemon Whether the service is started.

Select on the server " Start > all programs > Huawei > Agile Cortroler > Sever rtrller " ,an examination MC Whether the status is " run " .

AE Server priority use)SC server.

Install AE When the server, you need to configure the main and standby SC Server IP address.

If the Lord SC After the server fails,AE The server will use the backup SC server.

host SC After the server is restored,AE Server will not switch back to master SC The server handles the business.

S5720HI Series Switch:

AR Series router

USG6000 Series firewall

SVN5600 series

As Agile Controller-Campus The management center is responsible for formulating the overall strategy.

As Agile Controller-Campus The management interface is used to configure and monitor the system.

Integrated with standards RADIUS server,Porta Server, etc., responsible for linking with network access equipment to realize user-based network access control Strategy.

As Agile Controller-Campus ’S security assistance server, responsible for iRadar Analysis and calculation of reported security incidents.

Patch management and Windows The patch check strategy can check whether the terminal host has installed the specified Windows Make system patches.

Windows Patch check strategy focuses on checking whether the terminal host is installed Windows Operating system patches.

When the terminal host does not install the specified Windows When making a system patch, according to Windows The patch check policy prohibits terminal hosts from accessing the controlled network.

Patch management focuses on checking whether the terminal host has installed the specified patch,Perform access control on the terminal host.

A What is configured on the device is MAC Bypass authentication

B What is configured on the device is MAC Bypass authentication o

A On the device 2GE1/01 Can access PC Can also access dumb terminal equipment

B On the device GE1/0/1 Can access PC It can also access dumb terminal equipment. Upper

Double click on the desktop " Start Server " The shortcut starts.

choose " Start > all programs > Huawei > MCServer > StartServer.

choose " Start > all programs > Huawei > Agile Controller > Server Startup Config " To manually start the required components.

choose " Start 3 all programs > Huawei > MCServer > Sever Startup Conig " ,Manually start the required components

Announcements can be issued by the security department

The terminal must have a proxy client installed to receive announcements.

If the system issues an announcement and the proxy client is not online, the announcement information will not be received after going online.

Announcements can be issued by account.

Centralized deployment

Distributed deployment

Hierarchical deployment

Two-machine deployment

Deployment Management Center MC Time, support HA, Provide based on Keepalived Technical HA Active/standby switchover.

Deploy Business Manager SM Time, support HA, Provide based on Keepalived Technical HA Active/standby switchover.

Deploy business controller 3SC Time, support HA, Provide a backup solution in resource pool mode, which needs to be deployed N+1 indivual SC

Deploy the database DB Time, support HA use SQL Server Database mirroring technology requires the deployment of master DB+Mirroring DB+witness DB.

Common_ user Users can access Internet www H.

VIP Users can access Internet w H.

VIP Can visit Mail Server H.

Common user Users can access Mail_ Sever resource.

Obtain

deploy

run

Uninstall

A serious violation will prohibit access to the post-authentication domain.

The access control list of the post-authentication domain has not been delivered SACG.

ALC The number of rules issued is too many, and a lot of time is required to match, causing interruption of access services.

Agile Controller-Campus Wrong post-authentication domain resources are configured on the server.

Provide unified and secure access to enterprise mobile applications on mobile terminals.

The tunnel is dedicated and cannot be penetrated by viruses.

Applications are quickly integrated and can be extended.

It can be quickly integrated and docked with the enterprise application cloud platform.

Through the entire authentication process, the terminal passes EAP The message exchanges information with the server.

Terminal and 802.1X Switch EAP Message interaction,802.1X Switch and server use Radius Message exchange information

802.1X Authentication does not require security policy checks.

use MD5 The algorithm checks the information.

802.1X Authentication can only be initiated by the client.

802.1X Certification can only be done by certified equipment(like 802.1X switch)Initiate

8021X The client can trigger authentication through multicast or broadcast.

The authentication equipment department triggers authentication through multicast or unicast.

access mode

Normal mode

Mixed mode

Monitoring mode

worms using application software loophole to spread wantonly, consume network bandwidth and destroy important data.

hackers, malicious employee use loophole to attack or invade enterprise servers, business secrets were tampered, damaged and theft .

As long as the system software update in time for system loophole problems can be effectively solved.

The Internet has made application software loophole to spread rapidly, making loophole easier to become targets of attack.

TRUE

FALSE

WIDS Is a wireless intrusion prevention system

WIPS Wireless intrusion detection system

WIDS Is a wireless intrusion countermeasure system

WIPS Is a wireless intrusion prevention system

URL audit function is used to record the user ' s HTTP Internet behavior as the basis for the audit.

The user can configure the web type to be audited, WEB types to distinguish with file extensions, including html, jsp, aspx, etc.

can audit user HTTP access in the specific content of the Post, as a user Internet censorship

internal users access to the specified type of WEB resource, the firewall will be logged and sent to log server.

Open https://SM server IP:8943 in the browser, enter the account admin and the default password Changeme123, if the login is successful, it will be explained. The SIM components are normal.

After logging in to SC, select Resources > Users > User Management to create a common account. Open https://SM server IP:8447 in the browser newauth, if you can successfully log in using the account created in the previous step, the SM component is normal.

Open https://SC Server IP:8443 in the browser and enter the account admin and the default password Changeme123. If the login is successful, it will be explained. The SC component is normal.

After logging in to SM, select Ziyuan > User > User Management, and Xinlu has a common part number. Open https://SC server IP:8447 newauth in the browser. If you can successfully log in with the account created in the previous step, it means that the SC component is Wang Chang.

When configuring the policy template, you can inherit the parent template and modify the parent template policy

Only the strategy in the strategy template can be used, and the administrator cannot customize the strategy.

You can assign a policy template to a certain network segment.

If different policy templates are applied to departments and accounts, the policy template assigned to the highest priority will take effect. The priority relationship of the number is: account > department

MAC Certification

82.1 Certification

Portal Certification

MAC(prioritized

right

wrong

right

wrong

message through the firewall only one direction

the same message repeatedly through the firewall

IP omission

heavy traffic cause Bypass features enabled

Download and backdoor characteristics

Information Collection feature

own hidden feature

system attacks characteristics

The biggest difference between the two is MAC Bypass authentication belongs to 802 1X Certification, while MAC Certification does not belong to 802 1X Certification.

If a network can connect to dumb terminals(printer,IP telephone), The text may be connected to a portable computer, please use MAC Bypass authentication:First try 802 1X Authentication, try again if authentication fails MAC Certification

If a network will only connect to dumb terminals(printer,IP telephone),please use MAC Certification in order to shorten the certification time.

MAC Authentication MAC One more bypass authentication 802 In the instrument certification process, the open time is longer than MAC The bypass authentication time is long.

default ACL The rule group number can be arbitrarily specified.

default ACL The rule group number can only be 3999.

due to SACG Need to use ACL3099-3999 To pick TSM The rules issued by the system, so in the configuration TSM Before linkage, you need to ensure these ACL Not referenced by other functions.

The original group number is 3099-3999 of ACL Even if it is occupied, it can be successfully activated TSM Linkage.

Asset management can register assets automatically or manually.

Enable the automatic asset registration mode, the asset registration process does not require end users to participate.

Automatic registration of assets is suitable for situations where the asset number is automatically maintained by the business manager.

Manually registering assets means that the administrator I Way to create an asset record on the business manager, and put the asset number in Any Office Enter it to complete the asset registration

process.

The control server address is 10.1.10.34

The authentication device address is 10.1.31.78

Status is " Working " Indicates that the switch and Controller Linkage is successful

current Controller The server is backup n

When USG device unable to connect to the Internet, you can choose local upgrade

When the USG devices can connect to the Internet, can upgrade manually and automatically

The upgrade process of abnormal will not be able to return to the original Knowledge base

You can configure the automatic save function, after saving the upgrade application control is configured as system configuration

http://www.test.com/news

www.test.com/news/

WWW.TEST.COM/news

www.test.com/news.aspx

Access control

safety certificate

Authentication

System Management

Directly discard data sent by devices that do not comply with regulations

Certification of non-compliant equipment.

Check for non-compliant terminals, Prohibit unsafe devices from accessing the network.

Send alarm information to notify the administrator to deal with it.

right

wrong

NIP compare the data packet and application knowledge base, identify specific data flow

NIP support for specific IP network segment, in a specific time period, for strategy processing

NIP using leading hardware architecture, FPGA realization of the application layer acceleration, ESP achieve forward acceleration

NIP Manager supports mail alarm response mode

right

wrong

WLAN Is to adopt 80211 Technical WiFi

WLAN There are two basic architectures: FAT AP with AC+FIT AP

AC+FATAP The architecture is suitable for medium and large use scenarios

AC+FITAP Autonomous network architecture

Is the strategy automatically deployed?

Choose the appropriate policy control point and user authentication point

Does the strategy deployment target a single user?

Does the strategy deployment target a single department?

bandwidth

Forwarding priority

Authority

Strategy

TRUE

FALSE

The client is Any 0fice software.

Portal The role of the server is to receive client authentication requests, provide free portal services and authentication interfaces, and exchange client authentication information with access devices.

RADIUS The role of the server is to authenticate all the users in the network segment HTTP Requests are redirected to Portal server.

The role of admission control equipment is to complete the authentication, authorization and accounting of users.

right

wrong

TRUE

FALSE

right

wrong

You can check whether the screen saver is enabled on the terminal

You can check whether the screen saver password is enabled

Only supports Windows operating system

Screen saver settings cannot be automatically repaired

Brute force

Crowd attack

DoS Denial of service attack

Weak IV attack

TRUE

FALSE

Basic networking includes deploying one SM Server, one SC Server, one DB and a AE server.

AE In addition to the deployment of basic networking components, the reliability of the network also requires the deployment of an additional backup SC server.

SC In addition to the deployment of basic networking components, the reliability of the network also requires the deployment of an additional backup SM server.

DB In addition to the deployment of basic networking components, the reliability of the network also requires the deployment of an additional backup DB..

CAPWAP The data tunnel can be used DTLS Encrypted.

DTLS Support two authentication methods:Certificate authentication(out AC,AP Already brought)with PSK Password authentication.

DTLS Encryption can guarantee AC The issued control messages will not be eavesdropped on.

Use the certificate method to carry out DTLS Negotiation, the certificate is only used to generate the key, not right AP Perform authentication.

User domain

Network domain

Business domain:

Attack domain

After the configuration is complete, the switch will automatically release the data flow to access the security controller,No need for manual configuration by the administrator.

This configuration allows users to access network resources before authentication.

After the configuration is complete, the administrator still needs to manually configure the release network segment

Only after the authentication is passed, the terminal can access 10.1.31.78 Host.

TRUE

FALSE