H12-721 Exam Dumps - Huawei Certified ICT Professional - Constructing Infrastructure of Security Network

Note: The automatic backup command is enabled by default on the USG. Used in dual-system hot standby network

Note: RD: indicates that this SA has been successfully established; ST: indicates that this end is the channel negotiation initiator; RL: indicates that this channel has been replaced by a new channel, and will be deleted after a period of time; FD: indicates that this channel has been established. A soft timeout has occurred and is still in use. It will be deleted during a hard timeout. TO: indicates that the SA has not received a keepalive message after the last keepalive timeout. If the next keepalive timeout occurs, it will not be received. To the keepalive message, this SA will be deleted.

Note: Malformed message attack: By sending a defective message to the target system, the target system will make an error when processing such an IP packet, or cause a system crash, which affects the normal operation of the target system. The main attack methods are: SMURF attack; Second, LAND attack; Third, Fraggle attack; Fourth, IP Fragment attack; Fifth, IP Spoofing attack; Six, Ping of Death attack; Seven, TCP Flag attack; Eight, Tear Drop attack; Nine is the WinNuke attack.

Answer: BC Note: ACK Flood defense principle: First, when the ACK packet rate exceeds the threshold, the session check is started: (If the cleaning device checks that the ACK packet does not hit the session, there are two processing modes, (strict mode - - The strict mode is recommended in the network where the route is deployed. If the cleaning device does not check the established session, the device discards the packet. The basic mode: When the bypass is deployed, the device is cleaned before the session is established. The session is not detected. In this case, the basic mode is recommended. That is, when the ACK packet rate exceeds the threshold for a period of time, the session check is started. The device first passes several ACK packets to establish a session. Check the session to determine whether to discard the packet. Second, if the cleaning device checks the ACK packet to hit the session, check the session creation reason). The second is that the load check is performed by the cleaning device to check the payload of the ACK packet. If the payloads are all consistent (if the payload content is all 1), the packet is discarded. The third is to check the reason for the session creation if the cleaning device checks that the ACK packet hits the session. The fourth is if the session is by SYN or SYN-

If the ACK packet is built, the packet is allowed to pass. If the session is created by another packet (for example, an ACK packet), the packet inspection result is checked. The packet with the correct sequence number is allowed to pass, and the incorrect packet is discarded. The payload check can be enabled only if "session check" is enabled, and the payload check is performed on the packets passed by the session check.