H12-711_V4.0 Exam Dumps - Huawei HCIA-Security Questions and Answers

Explanation From HCIA-Security documents:

All four statements describe standard PKI roles and structure. A PKI entity is any certificate holder or relying participant that uses PKI services, which includes people, organizations, network devices, servers, and even application processes, so A is correct. PKI trust is commonly built using a CA hierarchy, where the root CA anchors trust and subordinate CAs issue certificates under the root’s authority, so B is correct. The CA is the core trusted component that signs (issues) certificates and manages their lifecycle activities such as renewal, suspension or revocation publication, and certificate status services, so C is correct. In many enterprise implementations, the PKI system is presented as three major roles: entities that request/use certificates, the RA that performs identity verification and approval of requests, and the CA that issues certificates based on validated requests, so D is also correct.

A. Scanning attacks → Attackers use ICMP packets to probe the target IP address to identify active hosts that connect to the target network.

B. Malformed packet attacks → Attackers send considerable malformed packets in an attempt to crash targeted hosts or servers.

C. Special packet control attacks → Such attacks are reconnaissance activities for attacks but not real attacks. That is, attackers send special packets to probe network structures.

In HCIA-Security, single-packet attacks are commonly categorized by the purpose and structure of the packets being sent. Scanning attacks are mainly used to discover targets and collect information before a real attack begins. A common example is using ICMP probe packets to identify whether hosts are alive and reachable on a network. This makes the ICMP host-discovery description the correct match for scanning attacks.

Malformed packet attacks involve sending packets with abnormal, invalid, or deliberately corrupted structures. Their purpose is to exploit weaknesses in protocol handling or operating system processing so that the target host, device, or server becomes unstable, crashes, or stops responding. Therefore, the description about sending many malformed packets to crash targets clearly matches this category.

Special packet control attacks are also more related to probing than direct destruction. In this case, attackers send specially crafted control or probe packets to learn network structure, device behavior, or service characteristics. These activities are considered reconnaissance rather than full attacks. That is why the description about probing network structures with special packets belongs to special packet control attacks.

This statement is TRUE . On Huawei firewalls, security policies are mainly used to control traffic between different security zones . The firewall determines policy matching based on the source zone and destination zone , and these interzone policies decide whether traffic is permitted or denied.

For traffic between users in the same zone , permit security policies generally do not need to be configured. This is because hosts and interfaces belonging to the same security zone are considered to have the same trust level, and their communication is not normally controlled by interzone security policy rules in the same way as traffic moving from one zone to another. In other words, the main purpose of zoning is to define boundaries between different trust levels, not to force permit rules for communications inside a single zone.

This behavior simplifies firewall policy deployment. Administrators mainly need to focus on policy design for traffic such as Trust to Untrust , Untrust to DMZ , or DMZ to Trust , where different trust levels exist. Therefore, for traffic between users in the same zone , a permit action security policy is generally not required .