Spring Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Home
Huawei
HCIA-Security
H12-711_V4.0
HCIA-Security V4.0 Exam Questions and Answers

Pass the Huawei HCIA-Security H12-711_V4.0 Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam H12-711_V4.0 Premium Access

View all detail and faqs for the H12-711_V4.0 exam

Go to Exam

755 Students Passed

96% Average Score

97% Same Questions

Viewing page 3 out of 5 pages

Viewing questions 21-30 out of questions

Questions # 21:

Certificates saved in DER format may or may not contain a private key.

Options:

TRUE

FALSE

Answer

Questions # 22:

Which of the following attack methods is to construct special SQL statements and submit sensitive information to exploit program vulnerabilities

Options:

Buffer overflow attack

SQL injection attacks

Worm attack

Phishing attacks

Answer

Questions # 23:

Digital envelope technology means that the sender uses the receiver's public key to encrypt the data, and then sends the ciphertext to the receiver ( )[Multiple choice]*

Options:

TRUE

FALSE

Answer

Questions # 24:

In the automatic backup mode of hot standby on the second machine, which of the following sessions is backed up?

Options:

ICMP session

TCP half-connection session

Self-session to the firewall

UDP first packet session

Answer

Questions # 25:

Which of the following descriptions about the heartbeat interface is wrong ( )?[Multiple choice]*

Options:

It is recommended to configure at least two heartbeat interfaces. - One heartbeat interface is used as the master, and the other heartbeat interface is used as the backup.

The interface MTU value is greater than 1500 and cannot be used as a heartbeat interface

The connection method of the heartbeat interface can be directly connected, or it can be connected through a switch or router

MGMT interface (Gigabi tEtherneto/0/0) cannot be used as heartbeat interface

Answer

Questions # 26:

As shown in the figure, what is the authentication range of the AH protocol in tunnel mode?

Question # 26

Options:

The3

The4

The2

The1

Answer

Questions # 27:

What type of ACL does ACL number 3001 correspond to?

Options:

Layer 2 ACL

interface ACL

Basic ACL

Advanced ACLs

Answer

Questions # 28:

Both digital envelopes and digital signatures guarantee data security and verify the origin of data.

Options:

TRUE

FALSE

Answer

Questions # 29:

As shown in the figure, which of the following shows the authentication range of ESP in transport mode?

Options:

Answer

Explanation

Explanation From HCIA-Security documents:

In ESP transport mode, the authentication function provides data integrity and origin authentication for specific parts of the IP packet. The authentication calculation covers the ESP header, TCP/UDP header, user data, and ESP tail (including padding, Pad Length, and Next Header fields) . However, it does not include the outer IP header, because some IP header fields (such as TTL) may change during packet forwarding. It also does not include the ESP Authentication Data field itself, since that field stores the integrity check value result of the calculation.

In the diagram, range 3 correctly represents the portion starting from the ESP header up to the ESP tail, excluding the IP header and excluding the ESP Authentication Data field.

Range 1 only covers part of the payload, range 2 does not include the ESP header, and range 4 incorrectly includes the IP header. Therefore, option 3 accurately describes the authentication scope of ESP in transport mode.

Questions # 30:

In the PKI certificate revocation process, a user needs to send a signed and encrypted email to the RA to apply for certificate revocation.

Options:

TRUE

FALSE

Answer

Explanation

Explanation From HCIA-Security documents:

In a PKI, certificate revocation is mainly about requester authentication and approval, not about using one mandatory communication method. The RA is responsible for verifying the applicant’s identity and the legitimacy of the revocation request, then submitting the validated request to the CA. After approval, the CA updates the certificate status, typically by publishing an updated CRL or providing status through OCSP, so relying parties can detect that the certificate is no longer trustworthy.

A “signed and encrypted email” is only one possible way to send a revocation request, but it is not required. In practice, organizations may accept revocation requests through a portal, ticketing system, dedicated PKI management interface, phone with pre-agreed authentication, or other controlled channels. If email is used, digital signature can help prove the requester’s identity and protect integrity, while encryption is optional and depends on policy because the key need is authorization, not confidentiality.

Viewing page 3 out of 5 pages

Viewing questions 21-30 out of questions