Encryption Technology Applications

What this chapter covers

Encryption Technology Applications is 15% of the Huawei HCIA-Security H12-711 exam, the largest single chapter. It covers how cryptography protects real traffic through SSL and TLS, what a VPN is and how VPNs are classified, the GRE, L2TP, IPsec and SSL VPN technologies, and how IPsec and SSL VPN are configured on a USG firewall.

Questions are single-answer, multiple-answer without a stated count, true/false, drag and drop and typed fill-in-the-blank, often "Which of the following statements is true?". Many show a firewall topology figure between two sites, an IPsec configuration, or display ike sa and display ipsec sa output, and ask why a tunnel does or does not come up.

It has 3 outline topics, and three pages cover them.

How the topics fit together

The first page shows how the algorithms and certificates from the last two chapters combine inside SSL and TLS. The VPN overview then applies the same ideas to whole networks, and the configuration page turns them into USG commands.

IPsec and SSL VPN both use symmetric encryption for data, DH or asymmetric keys for key exchange, HMAC for integrity and pre-shared keys or certificates for authentication.

How to use these pages

Each topic page has the same shape, so you can skim for what you need.

• What it is: the idea in plain words.
• How it works: the mechanism, with tables and examples.
• What to remember for the exam: the facts to memorize.
• Common mistakes: the classic traps.
• Check yourself: three questions to test your understanding.

Read each configuration snippet and say what it does before reading the explanation. The exam often shows a short configuration and asks which traffic is permitted, translated or allowed to log in.