H12-711 Sample Questions & Answers

NAT Server, also known as port forwarding or destination NAT, is used to publish internal services to an external network. It maps a combination of a public IP address and a port to an internal private IP address and port. This allows inbound traffic from the internet to reach the internal server. Static NAT creates a one-to-one mapping of entire IP addresses, which is not what is required here. Dynamic NAT and PAT are for outbound connections.

IPSec VPN is the industry standard for creating secure site-to-site connections over untrusted networks like the internet. It operates at the network layer (Layer 3) and can protect all IP traffic between the two locations, ensuring both confidentiality (through encryption with ESP) and integrity (through hashing with ESP or AH). SSL VPN is primarily used for remote user access, not for connecting entire sites.

The Diffie-Hellman algorithm is a key exchange protocol. Its purpose in IKE is to allow two parties, without any prior shared secret, to jointly establish a shared secret key over an insecure communication channel. This shared secret is then used to derive the symmetric keys for encrypting the subsequent IKE and IPSec communication. It does not perform payload encryption or peer authentication itself.

In an 802.1X architecture, there are three main components. The Supplicant is the client software on the end-user device. The Authentication Server (typically a RADIUS server) validates the user's credentials. The Authenticator is the network access device, such as a switch or wireless access point, that controls physical access to the network and acts as a proxy between the supplicant and the authentication server.

A Man-in-the-Middle (MitM) attack is an active eavesdropping attack where the attacker intercepts a communication channel between two systems. The attacker can then read, insert, and modify data in the intercepted communication without either of the two parties knowing that the channel has been compromised.

Because preemption is enabled, a router with a higher priority will always attempt to become the Master. Router A has a higher priority (120) than Router B (100). When Router A comes back online, it will detect that the current Master (Router B) has a lower priority. Due to preemption being enabled, Router A will take over the Master role.

The Registration Authority (RA) is the component of a PKI that is responsible for identity verification of individuals or entities requesting certificates. The RA vets the request and, upon successful verification, instructs the Certificate Authority (CA) to issue the certificate. The CA is responsible for digitally signing and issuing the certificate itself.

This scenario describes a classic TCP SYN Flood attack. The attacker sends a succession of SYN requests to a target's system in an attempt to consume enough server resources to make the system unresponsive to legitimate traffic. The attacker does not complete the three-way handshake, leaving the server with a large number of half-open connections.

The best practice is to follow the principle of least privilege. This involves creating a specific rule to permit only the required traffic (SSH and RDP) from the Trust zone to the DMZ zone. The firewall's default security policy for inter-zone traffic is 'deny', which will automatically block all other traffic that doesn't match this specific permit rule. Creating broad permit rules is insecure.