Huawei Updated H12-711_V4.0 Exam Questions and Answers by audrey

A packet filtering firewall mainly works by examining the header information of packets and making forwarding or blocking decisions based on predefined rules. Its inspection is primarily focused on the network layer , where it checks information such as the source IP address , destination IP address , protocol type, and related packet header fields. Because of this, the correct answer is Network layer .

Packet filtering firewalls can also use some transport-layer information such as TCP or UDP port numbers in practical policy matching, but their fundamental classification in traditional firewall technology is based on network-layer packet filtering rather than deep inspection of application content. They do not analyze user data in the same detailed way as application-layer gateways or next-generation firewalls.

The physical layer only deals with bit transmission and hardware signaling, so it is not the layer used for packet filtering decisions. The data link layer focuses on MAC addresses and frame transmission within a local segment, while the application layer deals with application protocols such as HTTP, FTP, and DNS. Therefore, for a packet filtering firewall, the correct layer checked is the Network layer .

This statement is TRUE . On Huawei firewalls, security policies are mainly used to control traffic between different security zones . The firewall determines policy matching based on the source zone and destination zone , and these interzone policies decide whether traffic is permitted or denied.

For traffic between users in the same zone , permit security policies generally do not need to be configured. This is because hosts and interfaces belonging to the same security zone are considered to have the same trust level, and their communication is not normally controlled by interzone security policy rules in the same way as traffic moving from one zone to another. In other words, the main purpose of zoning is to define boundaries between different trust levels, not to force permit rules for communications inside a single zone.

This behavior simplifies firewall policy deployment. Administrators mainly need to focus on policy design for traffic such as Trust to Untrust , Untrust to DMZ , or DMZ to Trust , where different trust levels exist. Therefore, for traffic between users in the same zone , a permit action security policy is generally not required .