H12-722_V3.0 HCIP-Security-CSSN V3.0 Questions and Answers

Only packets in one direction pass through the firewall

The same message passes through the firewall multiple times

IPS underreporting

Excessive traffic causes the Bypass function to be enabled

True

False

True

False

IPS policy is not submitted for compilation

False Policy IDs are associated with IPS policy domains

The IPS function is not turned on

Bypass function is closed in IPS

Website phishing deception

Website Trojan

SQL injection

Cross-site scripting attacks 2335

Intrusion prevention is a new security defense technology that can detect and prevent intrusions.

Intrusion prevention is a security mechanism that detects intrusions (including buffer overflow attacks, Trojan horses, worms, etc.) by analyzing network traffic

Intrusion prevention can block attacks in real time.

Intrusion prevention technology, after discovering an intrusion, the firewall must be linked to prevent the intrusion

Not self-replicating but parasitic

Trojans self-replicate and spread

Actively infectious

The ultimate intention is to steal information and implement remote monitoring

True

False

The management server of the management center is responsible for the cleaning of abnormal flow, as well as the collection and analysis of business data, and storage, and is responsible for the summary

The stream is reported to the management server for report presentation.

The data coking device is responsible for the cleaning of abnormal flow, the centralized management and configuration of equipment, and the presentation of business reports.

The data collector and management server support distributed deployment and centralized deployment. Centralized deployment has good scalability.

The management center is divided into two parts: management server and teaching data collector.

Scanning attacks include address scanning and port scanning.

It is usually the network detection behavior before the attacker launches the real attack.

155955cc-666171a2-20fac832-0c042c0424

The source address of the scanning attack is real, so it can be defended by adding direct assistance to the blacklist.

When a worm virus breaks out, it is usually accompanied by an address scanning attack, so scanning attacks are offensive.

True

False

Configuration plane

Business plane

Log plane

Data forwarding plane

SACG and IP address 2.1.1.1 server linkage is not successful

SACG linkage success with controller.

master controller IP address is 1.1.1.2.

master controller IP address is 2.1.1.1.

File content filtering

Voice content filtering

Apply content filtering..

The source of the video content

The file filtering module will compare the application type, file type, and transmission direction of the file identified by the previous module with the file filtering rules configured by the administrator.

Then the lookup table performs matching from top to bottom.

If all the parameters of Wenzhu can match all file filtering rules, then the module will execute the action of this file filtering rule.

There are two types of actions: warning and blocking.

If the file type is a compressed file, then after the file filtering check, the female file will be sent to the file decompression module for decompression and decompression.

Press out the original file. If the decompression fails, the file will not be re-filed.

True

False

TCP packets

UDP packet

ICMP message

FTP message

True

False

Confidentiality

Integrity

Availability

Recoverability

Generate logs and discard

Generate logs and forward them

Delete the content of the email attachment

Add announcement and generate log

After the file decompression fails, the file will still be filtered. .

The application identification module can identify the type of application that carries the file.

Protocol decoding is responsible for analyzing the file data and file transmission direction in the data stream.

The file type recognition module is responsible for identifying the true type of the file and the file extension based on the file data

Hacking

Weak personal safety awareness

Open company confidential files

Failure to update the virus database in time

It is impossible to detect violations of security policies.

It can detect all kinds of authorized and unauthorized intrusions.

Unable to find traces of the system being attacked.

is an active and static security defense technology.

155955cc-666171a2-20fac832-0c042c0425

manager + controller + FTP + witness database, controller + master database + FTP, controller + mirror database+ FTP

manager + controller + FTP + master database, controller + FTP + witness database, controller + FTP

+ mirror database

manager + controller + FTP + mirror database, controller + FTP + witness database, controller + FTP +

master database

manager + controller + FTP, controller + FTP + witness databases, controller + FTP + master database

Vulnerability intelligence

Defense in Depth

Offensive and defensive situation

Fight back against hackers

155955cc-666171a2-20fac832-0c042c045