H12-723 Huawei Certified ICT Professional - Constructing Terminal Security System Questions and Answers

The user distribution range is large, and the access control requirements are high.

The deployment of the access control strategy is significant.

Access rights are difficult to control.

User experience technology

Through the entire authentication process, the terminal passes EAP The message exchanges information with the server.

Terminal and 802.1X Switch EAP Message interaction,802.1X Switch and server use Radius Message exchange information

802.1X Authentication does not require security policy checks.

use MD5 The algorithm checks the information.

Check for prohibited software licenses and sub-licensed software

Check for prohibited software

Check for prohibited software and software that must be installed

Check the software that must be installed

TRUE

FALSE

When the account number is reserved, only the sword type number cannot be authenticated on the bound terminal device, and it can be authenticated normally on other terminal devices.

The account is locked on all terminal devices and cannot be recognized.

If you want to lock out the account, the administrator can only delete the account from the list.

After the lock time, the account will be automatically unlocked

exist Any Office When logging in with an account for the first time, the terminal host is automatically bound to the current account, but the automatic binding process requires administrator approval

When other accounts need to be authenticated on the bound terminal host, there is no need to find the asset owner who is bound for the first time to authorize themselves.

Binding terminal hosts and accounts is only applicable to terminal users through Any Office Scenarios for authentication, Not applicable Web Agent Plugins and Web The scenario where the client authenticates.

There are only consoles in the account binding terminal host, which cannot be configured by the administrator.

TRUE

FALSE

IDS only supports Inline online deployment

IPS deployed as a bypass mode is similar to the function of ID

the core technology of IPS is deep packet inspection and bypass inspection

With the IPS does not need to deploy a firewall and IDS

1812

1813

8443

8080

Directly discard data sent by devices that do not comply with regulations

Certification of non-compliant equipment.

Check for non-compliant terminals, Prohibit unsafe devices from accessing the network.

Send alarm information to notify the administrator to deal with it.

Install the operating system

Install the database

Install antivirus software

Import License

MAC Certification

Password authentication

Not certified:

SN Certification

Straight forward to return authentication failure information.

Discard user information.

User 91 Information sent to AD The server performs verification.

Synchronize the database again.

router

switch

Firewall

IPS

must use the DNS server not been DNS hijacking

must use recursive query DNS server

DNS server should be reachable IP

DNS server must listen on port 25

Provide unified and secure access to enterprise mobile applications on mobile terminals.

The tunnel is dedicated and cannot be penetrated by viruses.

Applications are quickly integrated and can be extended.

It can be quickly integrated and docked with the enterprise application cloud platform.

When USG device unable to connect to the Internet, you can choose local upgrade

When the USG devices can connect to the Internet, can upgrade manually and automatically

The upgrade process of abnormal will not be able to return to the original Knowledge base

You can configure the automatic save function, after saving the upgrade application control is configured as system configuration

Agile Controller-Campus Integrated RADIUS All functions of server and client."

Agile Controller-Campus As RADIUS On the server side, the user terminal acts as RADIUS Client.

Certified equipment(like 802. 1X switch)As RADIUS On the server side, the user terminal acts as RADIUS Client.

Agile Controller-Campus As RADIUS Server side, authentication device(like 802.1X switch)As RADIUS Client.

worms using application software loophole to spread wantonly, consume network bandwidth and destroy important data.

hackers, malicious employee use loophole to attack or invade enterprise servers, business secrets were tampered, damaged and theft .

As long as the system software update in time for system loophole problems can be effectively solved.

The Internet has made application software loophole to spread rapidly, making loophole easier to become targets of attack.

Through the mail client, you can connect No or Exchange Mail system.

Support automatic mail transmission encryption, transmission encryption method supports a full range of IPSec/TLS protocol.

Online survey of attached documents is not supported.

Support MAP4/SMTP/EAS Send and receive emails with standard protocols such as, and support real-time email push.

URL audit function is used to record the user's HTTP Internet behavior as the basis for the audit.

The user can configure the web type to be audited, WEB types to distinguish with file extensions, including html, jsp, aspx, etc.

can audit user HTTP access in the specific content of the Post, as a user Internet censorship

internal users access to the specified type of WEB resource, the firewall will be logged and sent to log server.

When a terminal device accesses the network, it first authenticates the user's identity through the access device, and the access device cooperates with the authentication server to complete the user Authentication.

The terminal device directly interacts with the security policy server, and the terminal reports its own status information, including virus database version, operating system version, and terminal Information such as the patch version installed on the device.

The security policy server checks the status information of the terminal, and for terminal devices that do not meet the corporate security standards, the security policy server reissues. The authorization information is given to the access device.

The terminal device selects the answer to the resource to be accessed according to the result of the status check.

Download and backdoor characteristics

Information Collection feature

own hidden feature

system attacks characteristics

1-2-3-4

4-2-3-1

3-2-1-4

2-3-1-4

A What is configured on the device is MAC Bypass authentication

B What is configured on the device is MAC Bypass authentication o

A On the device 2GE1/01 Can access PC Can also access dumb terminal equipment

B On the device GE1/0/1 Can access PC It can also access dumb terminal equipment. Upper

SACG and IP Address is 2.1.1.1 The server linkage is unsuccessful.

SACG The linkage with the controller is successful.

main controller IP address is 1.1.1.2.

main controller IP address is 2.1.1.1.

Intranet users access the data center/Internet.

When traveling users access intranet resources, traveling users pass VPN Access to the intranet.

Work as a team.

Realize mutual communication between devices.