Huawei HCSP-Presales-Network Security Planning and Design (H19-408) Certification Sample Questions

01. A government agency's security architect is reviewing what an active/standby NGFW pair keeps consistent through HRP backup. The architect wants to know which settings can be configured once on the active firewall and relied on to appear on the standby.
Which items does HRP back up from the active firewall to the standby?
(Choose two.)
a) Security policies
b) Interface IP addresses
c) NAT policies
d) Routes learned through OSPF

02. A regional ISP offers managed firewall services to several small enterprises from one shared firewall cluster in its data center. The customers use overlapping private address ranges, each wants its own security policies and NAT rules, and each must manage its own policies without seeing or affecting another customer's configuration.
Which firewall capability should the ISP's design rely on?
a) A security zone per customer, all within one shared policy set
b) Virtual systems, one per customer
c) Separate VLAN interfaces per customer with common NAT rules
d) Hot standby between two firewalls, with policies split per member

03. An e-commerce retailer's public storefront sits behind a stateful firewall that permits only HTTPS to the web servers. Penetration testers nevertheless extracted customer records by submitting crafted input in a search form, which the application passed to its database as part of a query.
Which security device is designed to address this attack in front of the web servers?
a) A second stateful firewall layer with stricter port rules
b) An Anti-DDoS cleaning device ahead of the firewall
c) An SSL VPN gateway for customer access to the storefront
d) A web application firewall

04. A container-shipping company's firewall logs show one external address sending probes to hundreds of ports across the servers in its DMZ within a few minutes. No connection has succeeded yet, but the security team wants such sources stopped automatically before an exploit follows.
Which basic firewall function addresses this need?
a) Scanning attack defense, which detects probing and blacklists the source
b) NAT Server, which hides the real server addresses behind a public address
c) ASPF, which tracks multi-channel protocols and opens dynamic data ports
d) Bandwidth management, which limits the traffic rate allowed from each source

05. A municipal government's firewall has an untrust zone facing the internet and a DMZ zone holding its public website. The DMZ has a higher security priority than the untrust zone. Internet users connect to the website through the firewall.
How is the direction of this traffic described in firewall terminology?
a) Outbound, from a higher- to a lower-priority zone
b) Outbound, from a lower- to a higher-priority zone
c) Inbound, from a higher- to a lower-priority zone
d) Inbound, from a lower- to a higher-priority zone

06. After a ransomware incident, a regional bank restores its branch systems from offline backups, verifies that the restored data is clean, and revises its recovery plan so that the next restoration is faster.
Which function of the IPDRR (Identify, Protect, Detect, Respond, Recover) framework do these activities belong to?
a) Respond, which contains and analyzes an incident while it is unfolding
b) Recover, which restores capabilities and services affected by an incident
c) Protect, which puts safeguards in place to limit potential events
d) Identify, which builds an understanding of assets, risks and business context

07. An energy utility's campus has NGFWs, switches and wireless controllers, each producing its own logs. During a recent incident, analysts could not connect events across these devices into one picture of how the attacker moved. The utility wants a component that collects logs and traffic data from the whole network and correlates them to expose advanced threats.
In Huawei's campus security solution, which component performs this role?
a) FireHunter, the sandbox that runs suspicious files in a virtual environment
b) The egress NGFW, correlating the logs held in its own local storage
c) HiSec Insight, the situational-awareness platform
d) Anti-DDoS, detecting and cleaning traffic floods at the campus border

08. A city hospital cannot patch an internal web server for several weeks because the clinical software vendor has not yet certified the fix. The firewall must keep allowing clinicians' web traffic to the server, but the security team wants attack traffic that tries to exploit the known vulnerability detected and blocked in the meantime.
Which content-security function is designed for this?
a) Intrusion prevention with exploit signatures
b) File blocking by file type and transfer direction
c) URL filtering by site category
d) Antivirus scanning of downloads

09. A logistics company sends daily shipment manifests from its regional depots to headquarters over a leased line. An internal review finds that several manifests arrived with altered delivery addresses. The files were not disclosed to anyone outside the company, and the transfer service stayed available throughout the period.
Which security property did this incident primarily violate?
a) Confidentiality, as the manifests were read by unauthorized outside parties
b) Availability, as the transfer service was interrupted
c) Non-repudiation, as a depot later denied having sent its manifest file
d) Integrity, as the manifest contents were changed without authorization

10. Staff in one office subnet at a regional hospital report intermittently slow access and certificate warnings when opening internal web portals. Users on other subnets are unaffected. The network team finds that, on affected PCs, the MAC address recorded for the default gateway matches an ordinary workstation on the same subnet rather than the gateway itself.
Which attack best explains these symptoms?
a) MAC flooding that fills the access switch table so frames are broadcast
b) ARP spoofing that puts the rogue workstation between users and the gateway
c) A SYN flood against the portal servers exhausting their connection resources
d) DNS cache poisoning on the internal DNS server redirecting portal names