Huawei HCSA-Presales-Network Security (Distribution) (H21-212) Certification Sample Questions

01. A small logistics company once enabled intrusion prevention and antivirus on its old all-in-one security appliance. Internet access slowed so badly that staff asked for both functions to be switched off.
Which point about the eKitEngine USG6000E-S answers this objection?
a) Its IPS signatures are produced on the intelligent cloud, so fewer signatures are matched on the device
b) Its web UI shows traffic and threat events, so staff can see which function slows the link
c) Its URL categories are queried in the cloud, so no content inspection runs on the device itself
d) Its adaptive security engine shares resources among services, and dedicated engines speed IPS

02. A 300-user logistics office has a 1 Gbit/s Internet link and wants all traffic inspected by IPS and antivirus without the firewall becoming the bottleneck. The engineer is choosing between the two USG6000E-S models.
Which recommendation is supported by sound sizing reasoning?
a) USG6000E-S03, as its 400 reference users already cover the 300 staff
b) USG6000E-S13, as its 1.2 Gbit/s threat protection rate exceeds the link
c) USG6000E-S03, as its 5 Gbit/s firewall throughput is five times the link
d) USG6000E-S13, as its 3 Gbps IPsec throughput is three times the link

03. Three payroll clerks at a logistics firm each receive an email addressed to them by name. It refers to the firm's real payroll software and asks them to confirm their login on a linked page. No other staff received it, and none of the targets is an executive.
Which term most precisely describes this attack?
a) Spear phishing
b) Pharming
c) Whaling
d) Vishing

04. A family-owned bakery chain wants to start a security program based on the IPDRR framework. Nobody can say which devices, cloud services and customer data the business has, or who is responsible for each.
Which step should come first?
a) Protect: install a firewall at every shop before reviewing anything else
b) Detect: deploy an IDS on a mirrored port to see what traffic is present
c) Identify: inventory the assets, data and owners, then assess the risks to each
d) Recover: write restoration plans for the devices, services and data, then test them

05. A veterinary practice keeps a regularly tested offline backup of its records system.
Which two IPDRR functions does this backup chiefly serve?
(Choose two.)
a) Detect, because the backup raises an alert when ransomware starts encrypting files
b) Identify, because the backup records every asset the practice owns
c) Respond, because the backup stops ransomware from spreading during an attack
d) Protect, because taking the backup is a safeguard put in place before any incident
e) Recover, because restoring from it brings services back after an incident

06. A consultant proposes applying the Gartner CARE model at a growing retail chain.
What is CARE used for, as Huawei describes it?
a) Classifying DDoS attacks by network, transport and application layer
b) Evaluating how well a firm's cybersecurity program is working
c) Defining the lifecycle functions from Identify through Recover
d) Granting access through continuous authentication and dynamic authorization

07. A security review at a small firm finds that an attacker tried to recover staff passwords, both from a stolen file of password hashes and by repeated login guesses.
Which three methods belong to the brute force family the attacker could have used?
(Choose three.)
a) Rainbow table attack
b) ARP poisoning attack
c) Dictionary attack
d) Watering hole attack
e) Exhaustive attack

08. An insurance broker emails policy documents to clients. It needs the documents to stay unreadable to anyone in transit, and it needs clients to be able to detect whether a document was altered. Its IT contractor proposes hashing every file and nothing else.
What is the main weakness of this proposal?
a) Hashing supports confidentiality but not integrity, so changes to the documents cannot be detected
b) Hashing supports availability only, so it neither hides the documents nor reveals changes to them
c) Hashing and encryption are interchangeable, so the only weakness is the higher processing cost
d) Hashing supports integrity but not confidentiality, so the documents can still be read in transit

09. A dental practice group runs three small sites. Its office manager handles IT part time and says that reviewing policies and logs on each security device takes most of a working day.
Which eKit firewall selling point should the presales engineer lead with?
a) Intelligent defense, with AI detection of unknown threats at the network edge
b) Simplified O&M, with central management of devices and policies
c) Superior performance, from a new software and hardware architecture
d) Anti-DDoS protection against flood attacks aimed at the practice websites

10. Staff at a small travel agency type the correct address of their airline booking portal, yet land on a convincing fake login page. No suspicious email was received, the office uses wired PCs only, and checks show the PCs' hosts files were modified.
Which attack explains these symptoms?
a) Pharming
b) An evil twin
c) Email phishing
d) Cross-site scripting