Which two statements are true regarding firewall user authentication?() (Choose two.)A. When configured for pass-through firewall user authentication, the user must first open a connection to the Junos security remote network resource.B. When configured f

题目
Which two statements are true regarding firewall user authentication?() (Choose two.)

A. When configured for pass-through firewall user authentication, the user must first open a connection to the Junos security remote network resource.

B. When configured for Web firewall user authentication only, the user must first open a connection to the Junos security remote network resource.

C. If a Junos security device is configured for pass-through firewall user authentication, new sessions are automatically intercepted .

D. If a Junos security device is configured for Web firewall user authentication, new sessions are automatically intercepted.


相似考题
更多“Which two statements are true regarding firewall user authentication?() (Choose two.) ”相关问题
  • 第1题:

    下列复选框构造方法,错误的是()。

    A.setLayout(newGridLayout(3,1));

    B.add(newCheckbox("one",null,true));

    C.add(newCheckbox("tWO");

    D.add(newCheckbox("one",true);


    正确答案:D

  • 第2题:

    以下程序段的输出结果为( )。 int j=2 switch (j){ Case 2: system.out.print("two."): Case 2+1: System.out.println("three."); break: default: System.out.println (“value is”+j): Break }A.B.two

    A.two.three.

    B.two

    C.three

    D.value is 2


    正确答案:A

  • 第3题:

    WhichofthefollowingareassociatedwiththeapplicationlayeroftheOSImodel?(two.)()

    A.ping

    B.Telnet

    C.FTP

    D.TCP

    E.IP


    参考答案:B, C

  • 第4题:

    Giventheconfigurationshownintheexhibit,whichconfigurationobjectwouldbeusedtoassociatebothNancyandWalterwithfirewalluserauthenticationwithinasecuritypolicy?()profileftp-users{clientnancy{firewall-user{password"$9$lJ8vLNdVYZUHKMi.PfzFcyrvX7";SECRET-DATA}}clientwalter{firewall-user{password"$9$a1UqfTQnApB36pBREKv4aJUk.5QF";SECRET-DATA}}session-options{client-groupftp-group;}}firewall-authentication{pass-through{default-profileftp-users;ftp{banner{login"JUNOSRocks!";}}}}

    A.ftp-group

    B.ftp-users

    C.firewall-user

    D.nancyandwalter


    参考答案:A

  • 第5题:

    CiscoNX-OSSoftwaresupportsSNMPv1,SNMPv2c,andSNMPv3.BothSNMPv1andSNMPv2cuseacommunity-basedformofsecurity.SNMPv3providessecureaccesstodevicesbyacombinationofauthenticatingandencryptingframesoverthenetwork.WhichsecurityfeaturesareprovidedinCiscoNX-OSSNMPv3?()

    A.encryption—scramblesthepacketcontentstopreventthemfrombeingseenbyunauthorizedsources

    B.password—apassword(communitystring)sentincleartextbetweenamanagerandagentforaddedprotection

    C.authentication—determinesthatthemessageisfromavalidsource

    D.messageintegrity—ensuresthatapackethasnotbeentamperedwithwhileitwasintransit

    E.user—todetermineifuserauthenticationisusedinsteadofcommunitystrings


    参考答案:A, C, D

  • 第6题:

    某全国连锁企业的总部和分布在全国各地的30家分公司之间经常需要传输各种内部数据,因此公司决定在总部和各分公司之间建立VPN技术。具体拓扑如下:配置部分只显示了与总部与分公司1的配置。根据拓扑完成问题1-问题3。



    [问题1](3分):在总部与分公司之间相连的VPN方式是(1),在IPsec工作模式中有传输模式和隧道模式,其中将源IP数据包整体封装后再进行传输的模式是(2).1备选答案:A.站点到站点 B.端到端C.端到站点[问题2](13分):请将相关配置补充完整。总部防火墙firewall1的部分配置如下。 (3)[FIREWALL1] interface(4)[FIREWALL1-GigabitEthernet1/0/2] ip address (5)[FIREWALL1-GigabitEthernet1/0/2] quit[FIREWALL1] interface GigabitEthernet 1/0/1[FIREWALL1-GigabitEthernet1/0/1] ip address 202.1.3.1 24[FIREWALL1-GigabitEthernet1/0/1] quit# 配置接口加入相应的安全区域。[FIREWALL1] firewall zone trust [FIREWALL1-zone-trust] add interface (6)[FIREWALL1-zone-trust] quit[FIREWALL1](7)[FIREWALL1-zone-untrust] add interface GigabitEthernet 1/0/1[FIREWALL1-zone-untrust] quit2. 配置安全策略,允许私网指定网段进行报文交互。# 配置Trust域与Untrust域的安全策略,允许封装前和解封后的报文能通过[FIREWALL1](8)[FIREWALL1-policy-security] rule name 1[FIREWALL1-policy-security-rule-1] source-zone (9)[FIREWALL1-policy-security-rule-1] destination-zone untrust[FIREWALL1-policy-security-rule-1] source-address (10)[FIREWALL1-policy-security-rule-1] destination-address 192.168.200.0 24[FIREWALL1-policy-security-rule-1] action (11)[FIREWALL1-policy-security-rule-1] quit…..# 配置Local域与Untrust域的安全策略,允许IKE协商报文能正常通过FIREWALL1。[FIREWALL1-policy-security] rule name 3[FIREWALL1-policy-security-rule-3] source-zone local[FIREWALL1-policy-security-rule-3] destination-zone untrust[FIREWALL1-policy-security-rule-3] source-address 202.1.3.1 32[FIREWALL1-policy-security-rule-3] destination-address 202.1.5.1 32[FIREWALL1-policy-security-rule-3] action permit[FIREWALL1-policy-security-rule-3] quit…3. 配置IPSec隧道。# 配置访问控制列表,定义需要保护的数据流。[FIREWALL1] (12)[FIREWALL1-acl-adv-3000] rule permit (13)[FIREWALL1-acl-adv-3000] quit# 配置名称为tran1的IPSec安全提议。[FIREWALL1] ipsec proposal tran1[FIREWALL1-ipsec-proposal-tran1] encapsulation-mode (14)[FIREWALL1-ipsec-proposal-tran1] transform esp[FIREWALL1-ipsec-proposal-tran1] esp authentication-algorithm sha2-256[FIREWALL1-ipsec-proposal-tran1] esp encryption-algorithm aes[FIREWALL1-ipsec-proposal-tran1] quit# 配置序号为10的IKE安全提议。[FIREWALL1] (15)[FIREWALL1-ike-proposal-10] authentication-method pre-share[FIREWALL1-ike-proposal-10] authentication-algorithm sha2-256[FIREWALL1-ike-proposal-10] quit# 配置IKE用户信息表。[FIREWALL1] ike user-table 1[FIREWALL1-ike-user-table-1] user id-type ip 202.1.5.1 pre-shared-key Admin@gkys[FIREWALL1-ike-user-table-1] quit# 配置IKE Peer。[FIREWALL1] ike peer b[FIREWALL1-ike-peer-b] ike-proposal 10[FIREWALL1-ike-peer-b] user-table 1[FIREWALL1-ike-peer-b] quit# 配置名称为map_temp序号为1的IPSec安全策略模板。[FIREWALL1] ipsec policy-template map_temp 1[FIREWALL1-ipsec-policy-template-map_temp-1] security acl 3000[FIREWALL1-ipsec-policy-template-map_temp-1] proposal tran1[FIREWALL1-ipsec-policy-template-map_temp-1] ike-peer b[FIREWALL1-ipsec-policy-template-map_temp-1] reverse-route enable[FIREWALL1-ipsec-policy-template-map_temp-1] quit# 在IPSec安全策略map1中引用安全策略模板map_temp。[FIREWALL1] ipsec policy map1 10 isakmp template map_temp# 在接口GigabitEthernet 1/0/1上应用安全策略map1。[FIREWALL1] interface GigabitEthernet 1/0/1[FIREWALL1-GigabitEthernet1/0/1] ipsec policy map1[FIREWALL1-GigabitEthernet1/0/1] quit [问题3]IPsec中,通过一些协议的处理,可以有效的保护分组安全传输。其中能够确保数据完整性,但是不能确保数据机密性的是(17),而技能报数数据传输的机密性又能保证数据完整性的是(18)


    答案:
    解析:
    [问题1]A,隧道模式[问题2](3)system-view (4)GigabitEthernet 1/0/2(5) 192.168.1.1 24或者192.168.1.1 255.255.255.0 (6) GigabitEthernet 1/0/2(7) firewall zone untrust (8) security-policy(9) trust (10) 192.168.100.0 24(11) permit (12) acl 3000(13) ip source 192.168.100.0 0.0.0.255 destination 192.168.200.0 0.0.0.255 (14)tunnel (15)ike proposal 10 [问题3](17)AH (18)ESP
    【解析】
    [问题1]IPSec VPN应用场景分为站点到站点、端到端、端到站点三种模式。1)站点到站点(Site-to-Site)。站点到站点又称为网关到网关,多个异地机构利用运营商网络建立IPSec隧道,将各自的内部网络联系起来。2)端到端(End-to-End)。端到端又称为PC到PC,即两个PC之间的通信由IPSec完成。3)端到站点(End-to-Site)。端到站点,两个PC之间的通信由网关和异地PC之间的IPSec会话完成。

    {图}

    [问题2] system-view[FIREWALL1] interface GigabitEthernet 1/0/2[FIREWALL1-GigabitEthernet1/0/2] ip address 192.168.1.1 24 [FIREWALL1-GigabitEthernet1/0/2] quit[FIREWALL1] interface GigabitEthernet 1/0/1[FIREWALL1-GigabitEthernet1/0/1] ip address 202.1.3.1 24[FIREWALL1-GigabitEthernet1/0/1] quit# 配置接口加入相应的安全区域。[FIREWALL1] firewall zone trust [FIREWALL1-zone-trust] add interface GigabitEthernet 1/0/2[FIREWALL1-zone-trust] quit[FIREWALL1] firewall zone untrust [FIREWALL1-zone-untrust] add interface GigabitEthernet 1/0/1[FIREWALL1-zone-untrust] quit2. 配置安全策略,允许私网指定网段进行报文交互。# 配置Trust域与Untrust域的安全策略,允许封装前和解封后的报文能通过[FIREWALL1] security-policy [FIREWALL1-policy-security] rule name 1[FIREWALL1-policy-security-rule-1] source-zone trust [FIREWALL1-policy-security-rule-1] destination-zone untrust[FIREWALL1-policy-security-rule-1] source-address 192.168.100.0 24 [FIREWALL1-policy-security-rule-1] destination-address 192.168.200.0 24[FIREWALL1-policy-security-rule-1] action permit [FIREWALL1-policy-security-rule-1] quit…..# 配置Local域与Untrust域的安全策略,允许IKE协商报文能正常通过FIREWALL1。[FIREWALL1-policy-security] rule name 3[FIREWALL1-policy-security-rule-3] source-zone local[FIREWALL1-policy-security-rule-3] destination-zone untrust[FIREWALL1-policy-security-rule-3] source-address 202.1.3.1 32[FIREWALL1-policy-security-rule-3] destination-address 202.1.5.1 32[FIREWALL1-policy-security-rule-3] action permit[FIREWALL1-policy-security-rule-3] quit…3. 配置IPSec隧道。# 配置访问控制列表,定义需要保护的数据流。[FIREWALL1] acl 3000[FIREWALL1-acl-adv-3000] rule permit ip source 192.168.100.0 0.0.0.255 destination 192.168.200.0 0.0.0.255 [FIREWALL1-acl-adv-3000] quit# 配置名称为tran1的IPSec安全提议。[FIREWALL1] ipsec proposal tran1[FIREWALL1-ipsec-proposal-tran1] encapsulation-mode tunnel [FIREWALL1-ipsec-proposal-tran1] transform esp[FIREWALL1-ipsec-proposal-tran1] esp authentication-algorithm sha2-256[FIREWALL1-ipsec-proposal-tran1] esp encryption-algorithm aes[FIREWALL1-ipsec-proposal-tran1] quit# 配置序号为10的IKE安全提议。[FIREWALL1] ike proposal 10 [FIREWALL1-ike-proposal-10] authentication-method pre-share[FIREWALL1-ike-proposal-10] authentication-algorithm sha2-256[FIREWALL1-ike-proposal-10] quit# 配置IKE用户信息表。[FIREWALL1] ike user-table 1[FIREWALL1-ike-user-table-1] user id-type ip 202.1.5.1 pre-shared-key Admin@gkys[FIREWALL1-ike-user-table-1] quit# 配置IKE Peer。[FIREWALL1] ike peer b[FIREWALL1-ike-peer-b] ike-proposal 10[FIREWALL1-ike-peer-b] user-table 1[FIREWALL1-ike-peer-b] quit# 配置名称为map_temp序号为1的IPSec安全策略模板。[FIREWALL1] ipsec policy-template map_temp 1[FIREWALL1-ipsec-policy-template-map_temp-1] security acl 3000[FIREWALL1-ipsec-policy-template-map_temp-1] proposal tran1[FIREWALL1-ipsec-policy-template-map_temp-1] ike-peer b[FIREWALL1-ipsec-policy-template-map_temp-1] reverse-route enable[FIREWALL1-ipsec-policy-template-map_temp-1] quit# 在IPSec安全策略map1中引用安全策略模板map_temp。[FIREWALL1] ipsec policy map1 10 isakmp template map_temp# 在接口GigabitEthernet 1/0/1上应用安全策略map1。[FIREWALL1] interface GigabitEthernet 1/0/1[FIREWALL1-GigabitEthernet1/0/1] ipsec policy map1[FIREWALL1-GigabitEthernet1/0/1] quit[问题3](1)AH。认证头(Authentication Header,AH)是IPSec体系结构中的一种主要协议,它为IP数据报提供完整性检查与数据源认证,并防止重放攻击。AH不支持数据加密。AH常用摘要算法(单向Hash函数)MD5和SHA1实现摘要和认证,确保数据完整。(2)ESP。封装安全载荷(Encapsulating Security Payload,ESP)可以同时提供数据完整性确认和数据加密等服务。ESP通常使用DES、3DES、AES等加密算法实现数据加密,使用MD5或SHA-1来实现摘要和认证,确保数据完整。