Online Access Free H12-731-ENU Exam Questions

Which of the following statements is true about the life cycle of an IPsec tunnel:

• A.The IPsec tunnel will renegotiate a new tunnel when it reaches its lifetime.
• B.The lifecycle configuration of both ends must be the same.
• C.The soft timeout is the expiration time of the SA life cycle, and the hard timeout is the time to start negotiating a new SA before the expiration of the life cycle.
• D.IPsec SA lifetime can be calculated in traffic.

As shown in the figure, the routing example between the virtual firewall vpn1 and the root firewall needs to be configured.
Which of the following is correct:

• A.[USG-vpn1] ip route-static 202.168.10.0 255.255.255.0 public [USG] ip route-static 10.1.1.0 255.255.255.0 vpn-instance vpn1 10.1.2.2.2 [USG] ip route-static 202.168 .10.0 255.255.255.0 250.168.20.3
• B.[USG-vpn1] ip route-static 202.168.10.0 255.255.255.0 202.168.20.3 vpn-instance vpn1 [USG] ip route-static 10.1.1.0 255.255.255.0 vpn-instance vpn1 10.1.2.2.2
• C.[USG-vpn1] ip route-static 202.168.10.0 255.255.255.0 202.168.20.3 public [USG] ip route-static 10.1.1.0 255.255.255.0 10.1.2.2.2
• D.[USG-vpn1] ip route-static 202.168.10.0 255.255.255.0 202.168.20.3 [USG] ip route-static 10.1.1.0 255.255.255.0 vpn-instance vpn1 10.1.2.2.2

When the link state detection function of the USG firewall is enabled, when the interval between sending the first fragmented packet and the second fragmented packet of a TCP session is greater than the aging time of the session table, the session table will be deleted, and the subsequent packets will be deleted. The text will recreate the session table.

• A.FALSE
• B.TRUE

A network expects to use URPF technology to improve network security. Which mode of URPF is used in the following networking scenarios:

• A.strict mode
• B.According to the stem information, the corresponding mode cannot be judged
• C.strict mode or loose mode
• D.loose mode

SYN Flood attacks can be prevented through TCP reverse source detection and TCP proxy technology. Comparing the two defense technologies, the correct statement is:

• A.The use of TCP proxy mode can be used in scenarios where the round-trip paths are inconsistent.
• B.Only when the rate of SYN packets reaches the alarm value alert-rate-number, the device can check the SYN packets by the TCP proxy.
• C.The defense technology of reverse source detection mechanism and TCP proxy mode must enable state detection mechanism.
• D.When the SYN packet rate reaches the alarm value alert-rate-number, the device can perform source authentication check on SYN packets.