QUESTION 61
When Eth-Trunk is deployed for the heartbeat links between firewalls, the Eth-Trunk interface can be configured as a Layer 2 interface as long as the total bandwidth of active links on the Eth-Trunk is greater than 30% of the bandwidth required by service traffic.

A. TRUE
B. FALSE

Correct Answer: B
QUESTION 62
As shown in the figure, firewalls are deployed as gateways in hot standby mode, and their upstream and downstream devices are all switches. To implement load balancing of incoming and outgoing traffic in this scenario, how many VRRP groups need to be configured?

A. 4
B. 2
C. 6
D. 3

Correct Answer: B
QUESTION 63
The BFD echo function offers a detection mechanism in which both communication parties periodically send BFD echo packets. If one party does not receive any echo packet from the other party within the detection period, the link is considered faulty.

A. TRUE
B. FALSE

Correct Answer: B
QUESTION 64
As shown in the figure, two firewalls are deployed in hot standby mode, their upstream and downstream devices are switches, and the web server on the intranet provides services for Internet users through NAT Server. Which of the following statements are true about this scenario?

A. If the two firewalls work in load sharing mode, and if the public IP address for NAT Server and that of the VRRP group are not on the same network segment, you need to bind NAT Server and the VRRP group.
B. If the two firewalls work in active/ standby mode, you do not need to manually bind the VRRP group and NAT Server.
C. If the two firewalls work in load sharing mode, and if the public IP address for NAT Server and that of the VRRP group are not on the same network segment, you do not need to bind NAT Server and the VRRP group.
D. If the two firewalls work in load sharing mode, and if the public IP address for NAT Server and that of the VRRP group are on the same network segment, you do not need to bind NAT Server and the VRRP group.

Correct Answer: BCD
QUESTION 65
The public system manages other virtual systems and provides services for communication between virtual systems.

A. TRUE
B. FALSE

Correct Answer: A
QUESTION 66
When allocating resources to firewall virtual systems, the administrator needs to properly calculate the resources. If a virtual system consumes too many resources, other virtual systems receive insufficient

resources and services cannot run properly.

A. TRUE
B. FALSE

Correct Answer: A
QUESTION 67
Which of the following statements are true about virtual system administrators?

A. Both the public system administrator and virtual system administrator can delete configurations of other virtual systems.
B. Based on the virtual system type, administrators are classified into public system administrators and virtual system administrators.
C. The public system administrator can create one or more administrators for a virtual system .
D. After the virtual system function is enabled, the device administrator will become the virtual system administrator.

Correct Answer: BC
QUESTION 68
Which of the following are virtual system types on the firewall?

A. Public system
B. Virtual system
C. Management system
D. Configuration system

Correct Answer: AB
QUESTION 69
Bandwidth multiplexing is not supported in parent and child firewall policies.

A. TRUE
B. FALSE

Correct Answer: B
QUESTION 70
Both the parent and child policies must use the same traffic limiting mode; that is, either “setting the upstream and downstream bandwidths'” or “setting the overall bandwidth”. otherwise, bandwidth control is not accurate.

A. TRUE
B. FALSE

Correct Answer: A
QUESTION 71
Which of the following statements are true about connection limiting in bandwidth management?

A. The traffic of P2P services cannot be reduced even if the number of connections is limited.
B. The rate of new connections can be limited.
C. Session resources can be saved .
D. Connection limiting assists the firewall in defending against DDoS attacks on the intranet server.

Correct Answer:
QUESTION 72

Which of the following are outbound technologies used in intelligent uplink selection?

A. Global route selection
B. ISP-based route selection
C. Smart DNs
D. PBR

Correct Answer: ABD
QUESTION 73
The health check technology can ensure the network service quality. Which of the following detection protocols are supported by the health check technology?

A. UDP
B. HTTP
C. TCP
D. DNS

Correct Answer: BCD
QUESTION 74
Which of the following technologies does not belong to outbound intelligent uplink selection?

A. Global route selection policy
B. PBR
C. Smart DNS
D. ISP-based route selection

Correct Answer: C
QUESTION 75
IPsec uses IKEv1 main mode to establish tunnels and uses certificates to verify identities. Which of the following messages are used to verify certificates?

A. Message 5
B. Message 3
C. Message 4
D. Message 6

Correct Answer: AD
QUESTION 76
In the figure, if firewall A initiates IKE negotiation, you only need to configure a security policy on firewall A, not on firewall B.

A. TRUE
B. FALSE

Correct Answer: B
QUESTION 77

Which of the following parameters need to be configured for an IPsec proposal?

A. Key
B. Authentication algorithm
C. Encapsulation mode
D. Security protocol

Correct Answer: AB
QUESTION 78
In site-to-multisite scenarios where the IP address at the headquarters is fixed but the IP addresses at branches are not, you are advised to use a template IPsec policy to establish a VPN.

A. TRUE
B. FALSE

Correct Answer: A
QUESTION 79
An enterprise has multiple branches. The egress IP address of the headquarters is fixed, but the egress IP addresses of branches are random. Therefore, an IPsec VPN needs to be established between the headquarters and branches. To reduce management and maintenance costs, which of the following is the recommended IPsec VPN configuration mode?

A. Both the headquarters and branches use the template IPsec policy mode.
B. The headquarters and branches use the site-to-site mode.
C. IKEv2 is used between the headquarters and branches.
D. The headquarters uses the template IPsec policy mode, and branches use the site-to-site mode.

Correct Answer: D
QUESTION 80
Which of the following protocols can be encapsulated through GRE over IPsec?

A. VRRP
B. OSPF
C. IPX
D. IPv6

Correct Answer: BCD