H12-222 Sample Questions Answers

TRUE

FALSE

Liberal

Independent

Conservative

Ordered

ASPF checks application layer protocol information and monitors the application layer protocol status of connections.

ASPF determines whether data packets can pass the firewall through the dynamically generated ACL.

During configuration of the NAT server, static Servermap entries are generated.

The Servermap table uses the 5-tuple to represent one session.

ONF

IETF

ETSI

ITU

Access control by user name

According to whether the wireless terminal MAC address registration control access

Access control by SSID (different SSIDs for internal employees and guests)

Access control by wireless terminal type

This command is generally configured on a PE.

This command binds GO/0/1 and GO/0/2 on the PE to the VPN instances assigned for the customer network.

After an interface is bound to a VPN instance, the interface becomes a private network interface, which can be assigned with a private network address and run a private network routing protocol.

If an interface is unbound from a VPN instance, the device does not automatically clear IPv4 or IPv6 configurations on the interface.

The buffer overflow attack indicates that an attacker uses defects of memory operations of the software system and runs attack codes with high operation rights.

The buffer overflow attack is irrelevant to the OS vulnerabilities and architecture.

The buffer overflow attack is the most common attack of the software system.

The buffer overflow attack is an application-layer attack.

WFQ

PQ

FIFO

RR

1-2-3-4

1-4-3-2

3-2-1-4

3-4-1-2

As the ACL complexity and length increase, the firewall filtering performance deteriorates exponentially.

Static ACL rules cannot adapt to dynamic security filtering requirements.

It is easy for hackers muddle through without check the session state and analyze the data.

It can fully control network information exchange, and Session control is of high security.

IP address that is statically bound with the MAC address of a client in the database of the DHCP sever.

IP address that has been allocated to the client, that is, the IP address in the Requested IP Addr Option of the DHCP Discover packet sent by the client.

First available IP address found by the server in the DHCP address pool.

On the DHCP server query Expired and conflicting IP addresses, if you find an available IP address, you can assign.

IP address that once conflicts with the IP address of another client.

After an IP packet enters an MPLS domain, the device receiving the packet queries in the FIB table first.

The system automatically assigns an ID to the upper-layer application that uses a tunnel. This ID is also called the tunnel ID.

If the tunnel ID is 0x0, the MPLS forwarding process starts.

If the tunnel ID is not 0x0, the normal IP forwarding process starts.

The devices are managed by eSight.

Trap parameters have been correctly configured on the devices.

The SNMP protocol and parameters are correctly configured for managed devices on eSight.

There are reachable routes between eSight and devices.

DSCP priority

IP precedence

MPLS EXP priority

802.1p priority

MAC address

IP address

Lease time

Physical port and UDP port

TRUE

FALSE

The VRRP master periodically sends VRRP packets.

The VRRP master uses the virtual MAC address to respond to ARP Request packets destined for the virtual IP address.

The VRRP master forwards IP packets destined for the virtual MAC address.

Even if the router becomes the master, the backup router with a higher priority preempts to be the master.

Different zones of Firewall can use the same priority.

A firewall interface can belong to different zones.

Different firewall interfaces can belong to the same zone.

The default firewall zone can be deleted.

TRUE

FALSE

5

50

85

100

Orchestration application layer

Control layer

Logical layer

Forwarding layer

Application server

Controller

Orchestrator

Device

After a static LSP is established, each node on the LSP can detect the entire LSP.

When MPLS is enabled on the outbound interface of the ingress node and the physical status and the protocol status of the outbound interface are Up, the static LSP is Up regardless of whether there is an egress node or a transit node.

The transit node of a static LSP is configured and MPLS is enabled on both the inbound and outbound interfaces. If the physical status and the protocol status of the inbound and outbound interfaces are Up, the static LSP is Up.

The egress node of the static LSP is configured and MPLS is enabled on the inbound interface. If the physical status and the protocol status of the inbound interface are Up, the static LSP is Up regardless of whether there is an ingress node or a transit node.

TRUE

FALSE

2-way

down

init

up

TRUE

FALSE

TRUE

FALSE

Services are orchestrated based on the Layer 3 GRE tunnels and service devices can be deployed flexibly.

Service orchestration operations are visualized in the topology, simplifying the configuration and management.

Adding or deleting service devices does not change the physical topology of the live network and existing routes.

Services are orchestrated automatically, without the need for manual maintenance.

By default, the DHCP service must be enabled when you configure the DHCP server and DHCP relay agent.

VLANIF 100 receives DHCP packets and forwards the packets to the external DHCP server through a relay agent.

Specify VLANIF 100 to the DHCP server group dhcpgroup1.

Create a DHCP server group first and add a DHCP server to the group.

By default, DHCP servers on the network are added to dhcpgroup1 automatically.

Authentication domains are classified into the pre-authentication domain, isolation domain, and post-authentication domain.

A pre-authentication domain defines public network resources that users can access before passing identity authentication in the area, for example, the DNS server, external authentication source, Service Manager, and Service Controller.

An isolation domain defines resources that end users passing identity authentication but failing the security check can access. These resources such as the patch server and antivirus server can help end users eliminate violations.

A post-authentication domain defines controlled network resources that end users can access after passing identity authentication and security check, for example, the ERP system, financial system, and database.

TRUE

FALSE

Multiple users can be created for network management.

Users may be asked to log in to eSight from specified IP addresses in specific time ranges.

The administrator can force unauthorized login users to log out.

The login time of the administrator role also can be limited.

Packet length

VLAN ID

Source and destination IP addresses

ToS field

VRRP determines the device role in the virtual router based on device priorities.

If the backup router works in non-preemption mode, the backup router with a higher priority does not become the master router as long as the master router does not fail.

Even if there is the master router, the backup router will preempt to be the master router.

When two routers with the same priority preempt to be the master router, the IP addresses of interfaces are compared. The router with a larger IP address of the interface is selected as the master router.

Local zone

Trusted zone

Untrusted zone

Security zone

TRUE

FALSE

Multiple virtual routers can be configured on an interface of a router so that the router functions as the master of the virtual router and the backup of another virtual router.

In load balancing mode, multiple routers transmit service at the same time, so at least two or more virtual routers are required.

In load balancing mode, two or more VRRP groups are created, and multiple routers transmit services.

During priority configuration, the VRRP master of the three virtual routers can be on different routers.

They must be different.

They must be the same.

They may be the same.

TRUE

FALSE

802.1X

Portal

MAC address bypass

SACG

AAA