An enterprise branch firewall is configured for NAT. As shown in the figure, USG_B is the NAT gateway. In order to extablish an IPSec VPN to USG_B, you need to configure what on USG_B? (Choose two answers)

• A.Configure a NAT Policy, citing the rule to allow the network segment's source and destination IP addresses for the ACL.
• B.Configure a IPSec policy template, citing the IKE peer.
• C.Configuration the IKE peer, use name authentication, and remote-address of the interface address on USG_A.
• D.Configure a NAT Policy, where there is first a deny IPsec rule within the enterprise network to protect the data flow from within the headquarters of the network, and then permit the enterprise network to the Internet network data stream.

Comment: *

Name: *

Email: *

Verification: *

Using the virtual firewall technology, users on the two VPNs can log in to their private VPNs through the Root VFW on the public network to directly access private network resources. What are the following statements about the characteristics of the VPN multi-instance service provided by the firewall?

• A.is easy to maintain, users can manage the entire firewall (including each virtual firewall) without a system administrator account with super user privileges.
• B.The access control authority is strict. The firewall can control the access rights of the VPN according to the user name and password. This allows different users such as travel employees and super users (need to access different VPN resources) to have different access rights.
• C.security is high, VPN users access through the firewall authentication and authorization, access after access is to use a separate virtual firewall system to manage users, the resources of different VPN users are completely isolated
• D.VPN access mode is flexible and reliable. It can support from public network to VPN, and can also support from VPN to VPN.

Comment: *

Name: *

Email: *

Verification: *

In the IPSec VPN, the digital certificate is used for identity authentication. If the IKE main mode is used for negotiation, the certificate verification is completed in message 5 and message 6.

• A.FALSE
• B.TRUE

Comment: *

Name: *

Email: *

Verification: *

ACK Flood attacks exploit payload inspection defense. The principle is to clean equipment for ACK packet payload to check if the contents of the full load are consistent (as are all a load of content, etc.), the packet is discarded.

• A.TRUE
• B.FALSE

Comment: *

Name: *

Email: *

Verification: *

According to the capture of the victim host, what kind of attack is this attack?

• A.ARP spoofing attack
• B.SYN Flood attack
• C.HTTP Flood attack
• D.ARP Flood attack

Comment: *

Name: *

Email: *

Verification: *