The basic implementation process of NGFW Intrusion Prevention (IPS) is:

• A. First, reassemble IP fragmented packets and TCP streams, then match characteristics, then perform protocol identification and protocol analysis to complete detection, and finally respond to processing.
• B. Protocol identification and protocol analysis are performed first, then IP fragment message reassembly and TCP stream reassembly are performed, then feature matching is performed to wake up intrusion detection, and finally response processing is performed.
• C. Threat identification based on message port number
• D. First, reassemble IP fragmented packets and TCP streams, then perform protocol identification and protocol analysis, then perform feature matching to wake up intrusion detection, and finally perform response processing.

Huawei Anti-Ddos ICMP Flood defense usually uses source detection to defend against

• A. True
• B. False

The mode of SYN Flood source detection in the ANTI-DDOS solution includes

• A. Basic mode
• B. Advanced mode
• C. Active mode
• D. Passive mode

The anti-Ddos solution needs to be deployed to take effect after modifying the defense policy of the protection object.

• A. True
• B. False

Regarding the detection function of Huawei sandbox, what is wrong is ()?

• A. After the reputation filtering is enabled, if the malicious file in the reputation is met, it is directly determined to be a malicious file, and no subsequent inspection is performed Measurement.
• B. After anti-virus filtering is enabled, if the virus file is detected by the anti-virus engine, it is directly determined to be a malicious file.
• C. In all cases, all sample files will enter the virtual execution environment for detection.
• D. FireHunter supports cloud reputation detection. By querying the file reputation with Huawei Security Center (sec.huawei.com), you can obtain More timely file threat information