QUESTION 101
In IPsec, AH provides data origin authentication, data integrity check, and anti-replay, but does not provide encryption.
A. TRUE
B. FALSE
Correct Answer: A
QUESTION 102
SM3 is a commercial algorithm compiled by the National Cryptography Administration. It is used for digital signature and authentication, message authentication code generation and authentication, and random number generation in cryptography applications. It can meet the security requirements of various cryptography applications.
A. TRUE
B. FALSE
Correct Answer: A
QUESTION 103
In asymmetric encryption algorithms, only public keys can be used to encrypt data, and private keys are used to decrypt data. This process is irreversible.
A. TRUE
B. FALSE
Correct Answer: A
QUESTION 104
Symmetric key encryption features high efficiency, simple algorithm, and low cost. It is suitable for encrypting a large amount of data.
A. TRUE
B. FALSE
Correct Answer: A
QUESTION 105
Which of the following statements is incorrect about GRE?
A. To enhance GRE security, the devices at both ends of a GRE tunnel authenticate each other.
B. GRE consists of the passenger protocol, encapsulation protocol, and transport protocol.
C. GRE can encapsulate only network-layer protocol packets but not multicast packets.
D. Encapsulation protocols encapsulate packets of passenger protocols so that the original packets can be transmitted over the GRE tunnel.
Correct Answer: C
QUESTION 106
If the user identity or public key is changed, or a user service is interrupted, the user must revoke the digital certificate. Specifically, the user must unbind the public key from the user identity information. In PKI, the CA mainly uses OCSP and to revoke certificates. (Enter the acronym in uppercase letters.)
Correct Answer: CRL
QUESTION 107
In the encryption and decryption process, digital envelope solves the problems of symmetric key release and slow public key encryption, and improves security, scalability, and efficiency.
A. TRUE
B. FALSE
Correct Answer: A
QUESTION 108
A PKI entity can apply for a local certificate from a CA in online or mode. (Enter lowercase letters.)
Correct Answer: offline
QUESTION 109
Which of the following statements are correct about IKEv2 negotiation?
A. The messages in an IKEV2 Create_Child_SA Exchange are protected by the keys negotiated in an Initial Exchange.
B. During IKEv2 negotiation, some control information is transmitted through an Informational Exchange.
C. In normal cases, IKEv2 requires two exchanges (a total of four messages) to establish a pair of IPsec SAs.
D. The four messages in an IKEv2 Initial Exchange are encrypted for transmission.
Correct Answer: ABC
QUESTION 110
In a PKI system, a CA certificate cannot be a self-signed certificate.
A. TRUE
B. FALSE
Correct Answer: B
QUESTION 111
Which of the following statements is incorrect about IPsec encapsulation modes?
A. Two encapsulation modes are available: transport mode and tunnel mode.
B. Compared with AH, ESP does not check the integrity of the IP header in transport mode. Therefore, ESP cannot ensure the security of the IP header.
C. The tunnel mode occupies more bandwidth resources than the transport mode because of an additional IP header.
D. The transport mode is more secure than the tunnel mode.
Correct Answer: D
QUESTION 112
Which of the following is used by IPsec to compare the ICV to verify the integrity and authenticity of data packets?
A. MD5
B. HMAC
C. DES
D. AES
Correct Answer: B
QUESTION 113
HTTPS introduces the TLS layer based on HTTP to provide identity authentication, encryption, and integrity check for data transmission.
A. TRUE
B. FALSE
Correct Answer: A
QUESTION 114
On a firewall, security policies with the permit action do not need to be configured for traffic between users in the same zone.
A. TRUE
B. FALSE
Correct Answer: B
QUESTION 115
In the OSI model, frames refer to data transmitted at the data link layer between two devices.
A. TRUE
B. FALSE
Correct Answer: A
QUESTION 116
Which of the following servers are involved in the DNS system?
A. Authoritative DNS server
B. Cache server
C. Root server
D. Top-level DNS server
Correct Answer: ACD
QUESTION 117
The protocol data unit (PDU) has different names at different layers. Which of the following is its name at the transport layer?
A. Segment
B. Frame
C. Packet
D. Data
Correct Answer: A
QUESTION 118
Which of the following is not a common route of transmission for worms?
A. USB flash drive
B. Email
C. Network sharing
D. Backdoor program
Correct Answer: D
QUESTION 119
Multiple security zones can be configured on Huawei firewalls. By default, users in a high-priority security zone can access users in a low-priority security zone.
A. TRUE
B. FALSE
Correct Answer: B
QUESTION 120
Which of the following attacks can be detected through intrusion prevention?
A. Directory traversal
B. Injection attack
C. Buffer overflow attack
D. Troian horse
Correct Answer: ABCD