Huawei HCIA-Security H12-711 Practice Exam
Huawei Certified ICT Associate-Security (HCIA-Security) H12-711
The Huawei HCIA-Security H12-711 V4.0 exam validates the skills to build and operate the security of small and medium-sized enterprise networks. It covers eleven areas: network security concepts and standards, network basics, common threats and prevention, firewall security policies, firewall NAT, firewall hot standby, firewall user management, firewall intrusion prevention and antivirus, encryption fundamentals, the PKI certificate system, and encryption applications such as IPsec and SSL VPN, the largest area at 15%. This practice exam uses the question formats Huawei lists, including multiple-answer, true/false, drag and drop and typed fill-in-the-blank questions, with USG firewall configuration, display output and topology exhibits.
Question bank updated : questions, answers, explanations and chapters.
Certification Overview
- Exam name: HCIA-Security H12-711
- Vendor: Huawei
- Exam code: H12-711
- Duration: 90 minutes
- Total questions: about 60
- Official passing score: 600 out of 1000 (source)
- Our practice exam pass mark: 60%
Who Should Take This Exam?
Network Security Engineer, Junior Security Engineer, Information Security Operations and Maintenance Engineer, Firewall Administrator, Network Engineer, Network Administrator, and students starting a security career on Huawei equipment
Prerequisites
No formal prerequisite; Huawei recommends basic knowledge of TCP/IP and of routing and switching.
Topics Covered
- Network Security Concepts and Specifications
- Network Basics
- Common Network Security Threats and Threat Prevention
- Firewall Security Policies
- Firewall NAT Technologies
- Firewall Hot Standby Technologies
- Firewall User Management Technologies
- Firewall Intrusion Prevention Technologies
- Fundamentals of Encryption Technologies
- PKI Certificate System
- Encryption Technology Applications
Question Types
- Multiple Choice (Single Answer)
- Multiple Choice (Multiple Answers)
- Drag and Drop
- True / False
- Fill in the Blank
- Scenario-Based
HCIA-Security H12-711 Practice Questions
Our question bank contains 600+ practice questions for this certification. Sample questions from each exam chapter. Expand a question to see the answer choices. With full access, you get unlimited practice exams with randomised questions from our full question bank.
Network Security Concepts and Specifications
In the P2DR model, which element sits at the core and guides the other three?
- A. Protection
- B. Detection
- C. Policy Correct answer
- D. Response
Option C, Policy, is correct because in the P2DR model the security policy sits at the core and guides protection, detection and response. The other three elements are the activities carried out to enforce that policy.
Which activities belong to the detection element of the P2DR model?
- A. Log auditing, performed after events Correct answer
- B. Vulnerability scanning, run on a schedule Correct answer
- C. Intrusion detection, based on live traffic Correct answer
- D. Firewall filtering, applied to inbound traffic
- E. Data encryption, applied to stored files
Options A, B and C are correct because log auditing, vulnerability scanning and intrusion detection all discover problems and attacks, which is the detection element of P2DR. Firewall filtering and data encryption are protection measures.
Network Basics
In the TCP/IP model, what is the PDU of the network layer called?
- A. Segment
- B. Frame
- C. Bit
- D. Packet Correct answer
Option D is correct because the PDU of the network layer is the packet. The segment belongs to the transport layer, the frame to the data link layer, and the bit to the physical layer.
Which statements describe the physical layer of the OSI model?
- A. It transmits a bit stream over the transmission medium Correct answer
- B. It adds source and destination MAC addresses to frames
- C. It sets up sessions between application processes
- D. It defines electrical and mechanical interface characteristics Correct answer
- E. It forwards packets between networks by IP address
Options A and D are correct because the physical layer transmits the bit stream and defines the electrical and mechanical interface characteristics. MAC addressing belongs to the data link layer, sessions to the session layer, and IP forwarding to the network layer.
Common Network Security Threats and Threat Prevention
Which type of malicious code spreads across a network on its own by exploiting system vulnerabilities?
- A. Spyware
- B. Virus
- C. Worm Correct answer
- D. Trojan horse
Option C, Worm, is correct because a worm replicates itself and spreads across the network by exploiting system vulnerabilities, with no user action needed. A virus needs a host file and user action to spread, a Trojan horse does not self-replicate, and spyware only collects information.
As shown in the figure, FW1 receives packets on GE1/0/3 with source address 192.168.10.5 and destination address 172.16.1.10. Which statement describes these packets?
- A. They are normal Untrust-to-DMZ traffic, because the destination address is inside the DMZ network
- B. They indicate a port scan, because the packets come from the Internet toward a DMZ host
- C. They indicate IP spoofing, because the source address belongs to a network behind a different interface Correct answer
- D. They indicate a Land attack, because the source address is an internal address of the firewall
Option C is correct because 192.168.10.5 is PC1 in the Trust zone behind GE1/0/1, yet the packet arrives on GE1/0/3 from the Untrust side, so the source address was forged. Option A ignores the invalid source. Option B is wrong because one packet is not a scan. Option D is wrong because a Land attack needs source and destination to be the same address.
Firewall Security Policies
Where is a firewall typically deployed to separate an enterprise intranet from the Internet?
- A. At the access layer of each floor
- B. At the enterprise network egress Correct answer
- C. On the uplink of the wireless controller
- D. Between the core and distribution switches
Option B is correct because the firewall sits at the enterprise network egress, between the intranet and the Internet, where it can control all traffic crossing that boundary. Access-layer floors, the wireless controller uplink and the core-to-distribution links are internal segments, not the Internet edge.
As shown in the figure, SRV2 starts a connection to UPD1 to download patches. Which source zone and destination zone does the security policy rule for this connection use?
- A. Source zone Untrust, destination zone DMZ
- B. Source zone DMZ, destination zone Local
- C. Source zone DMZ, destination zone Untrust Correct answer
- D. Source zone Trust, destination zone Untrust
Option C is correct because SRV2 (172.16.1.20) sits in the DMZ behind GE1/0/2 and UPD1 (198.51.100.10) is beyond R1 in the Untrust zone, so the connection goes from DMZ to Untrust. Option A reverses the direction. Option B uses Local, which applies only to traffic to or from the firewall itself. Option D starts in Trust, where SRV2 is not.
Firewall NAT Technologies
Which problem was NAT introduced to relieve?
- A. Broadcast storms in large VLANs
- B. Routing table growth on core routers
- C. Shortage of public IPv4 addresses Correct answer
- D. Slow convergence of dynamic routing
Option C is correct because NAT was introduced to relieve the shortage of public IPv4 addresses, letting many private hosts share a few public addresses. Broadcast storms are a Layer 2 problem, and routing table growth and routing convergence are routing-protocol and summarization concerns that NAT does not address.
Based on the configuration shown, which source address does the firewall use for traffic from host 192.168.20.5 in the Trust zone to the Internet?
- A. 203.0.113.1 Correct answer
- B. 192.168.20.5
- C. 203.0.113.10
- D. 203.0.113.12
Option A is correct because the nat-policy rules are matched in order and 192.168.20.5 falls in 192.168.20.0/24, which matches rule nat_b with action source-nat easy-ip. Easy-IP uses the egress interface address, GigabitEthernet1/0/2, which is 203.0.113.1. Options C and D are addresses in natpool1, which only rule nat_a (192.168.10.0/24) uses, and option B would mean no translation happens.
Firewall Hot Standby Technologies
Why are two USG firewalls deployed as a hot standby pair at the network edge?
- A. To translate private addresses to public ones
- B. To encrypt traffic between the two units
- C. To avoid a single point of failure Correct answer
- D. To double the forwarding rate of one uplink
Option C is correct because a hot standby pair keeps services running when one firewall fails, which removes the single point of failure. Address translation (A) and encryption (B) are separate features, and in active/standby mode the second unit does not add forwarding capacity (D).
As shown in the figure, FW1 and FW2 are to form an HRP hot standby pair. Which interfaces should be configured as the heartbeat interfaces?
- A. GE1/0/7 on FW1 and GE1/0/7 on FW2 Correct answer
- B. GE1/0/1 on FW1 and GE1/0/2 on FW2
- C. GE1/0/2 on FW1 and GE1/0/2 on FW2
- D. GE1/0/1 on FW1 and GE1/0/1 on FW2
Option A is correct because the figure shows a direct link between FW1 and FW2 on GE1/0/7 at both ends in the 10.10.0.0/24 segment, which is the dedicated link for heartbeat traffic. GE1/0/1 connects each firewall to the Trust switch SW1 and GE1/0/2 connects each to the Untrust switch SW2, so those are service interfaces carrying user traffic. Options B, C and D pick service interfaces.
Firewall User Management Technologies
Which transport protocol and port does HWTACACS use?
- A. TCP port 49 Correct answer
- B. UDP port 1812
- C. TCP port 389
- D. UDP port 1813
Option A is correct because HWTACACS runs over TCP port 49, which gives it reliable delivery. UDP ports 1812 and 1813 are the RADIUS authentication and accounting ports, and TCP port 389 is LDAP.
Both RADIUS and HWTACACS can be used for accounting on the firewall.
- A. True Correct answer
- B. False
True. Both RADIUS and HWTACACS support accounting on the firewall, and either can be bound to an accounting scheme. LDAP is the protocol among the common ones that has no accounting.
Firewall Intrusion Prevention Technologies
Which statements describe an intrusion detection system?
- A. It receives a copy of the traffic from a mirror port Correct answer
- B. It drops the offending packets in the forwarding path
- C. It terminates the attacker's session by proxying it
- D. It raises alarms when it recognizes an attack Correct answer
Options A and D are correct because an IDS works on a mirrored copy of the traffic and raises alarms when it recognizes an attack. Dropping packets in the forwarding path or proxying the attacker's session (options B and C) are prevention functions of an inline device.
The block action of an IPS signature discards the matching packets.
- A. True Correct answer
- B. False
True. The block action discards the matching packets and generates a log, whereas alert only forwards them and logs the event.
Fundamentals of Encryption Technologies
Which algorithms can be used to create a digital signature?
- A. AES
- B. 3DES
- C. RC4
- D. RSA Correct answer
- E. ECC Correct answer
Options D and E are correct because RSA and ECC are asymmetric algorithms that can sign a digest with a private key. AES, 3DES, and RC4 are symmetric ciphers and are not used for digital signatures.
The effective key length of DES is 56 bits.
- A. True Correct answer
- B. False
True. DES uses a 64-bit key of which 8 bits are parity bits, so the effective key length is 56 bits. This short key is why DES is considered weak today.
PKI Certificate System
Which items does a PKI entity include in the certificate request it submits to the CA?
- A. The serial number of the certificate
- B. Its public key Correct answer
- C. The digital signature of the CA
- D. Its identity information Correct answer
- E. Its own private key
Options B and D are correct because a certificate request carries the entity's public key and its identity information, which the CA binds together in the certificate. The entity's private key never leaves the entity, and the serial number and the CA signature are added by the CA when it issues the certificate, not supplied in the request.
Encryption Technology Applications
Which are SSL VPN service modes on a Huawei USG?
- A. Network extension Correct answer
- B. Web proxy Correct answer
- C. Transport mode
- D. Quick mode
- E. Aggressive mode
Options A and B are correct because Huawei USG SSL VPN provides web proxy, file sharing, port forwarding and network extension services. Transport mode, quick mode and aggressive mode are IPsec/IKE terms, not SSL VPN service modes.
Free Study Guide
Read the free Huawei HCIA-Security H12-711 study guide: every exam topic explained in plain English, with diagrams, exam tips and the mistakes to avoid.
More Huawei Practice Exams
Practise with realistic mock exams to prepare for your Huawei certification.