Huawei Updated H12-711_V4.0 Exam Questions and Answers by king

Explanation From HCIA-Security documents:

A server mapping entry is a lightweight record used to describe a static or semi-static mapping relationship that helps the device forward traffic from an external user to an internal server. Compared with a session entry, it contains fewer fields because it does not need to maintain full connection state information such as TCP state, sequence-related tracking, timers for each direction, and the complete flow 5-tuple details used for every active connection.

In NAT scenarios, server mapping is commonly created for NAT Server (port mapping/port forwarding). This lets Internet users initiate connections to a public IP address and port, and the device translates and forwards the traffic to the specified intranet server and service port.

In ASPF scenarios, server mapping can be used to support certain protocols and service openings by creating an association that guides traffic handling, while the detailed per-connection information is still maintained later in the session table after the connection is established. Because server mapping enables inbound reachability to internal servers with fewer parameters than a full session, the statement is TRUE.

Explanation From HCIA-Security documents:

In the TCP/IP and OSI reference models, the transport layer is responsible for end-to-end communication between hosts. It provides services such as segmentation, multiplexing through port numbers, and (depending on the protocol) reliability, flow control, and congestion control. The two core transport layer protocols are TCP and UDP.

TCP is connection-oriented and reliable: it establishes a session using the three-way handshake, uses sequence numbers and acknowledgments for retransmission, and supports flow and congestion control to ensure ordered delivery. UDP is connectionless and best-effort: it does not build a session or guarantee delivery, which makes it lightweight and suitable for scenarios such as voice/video streaming and simple query/response services.

By contrast, FTP and DHCP are application layer protocols. FTP provides file transfer services and runs over TCP ports, while DHCP provides dynamic IP address assignment and uses UDP at the transport layer but is itself an application-layer protocol. Therefore, the transport-layer protocols in the options are UDP and TCP.

Huawei firewalls use security zones to group interfaces that share the same trust level and security policy requirements. In the default configuration, Huawei firewalls provide four built-in zones that cover the most common deployment scenarios.

Trust represents the internal network where users and servers are typically considered more reliable. Untrust represents external networks such as the Internet, where traffic is considered untrusted and usually requires stricter access control and security inspection. DMZ is designed for semi-public servers (for example, web or mail servers) that must be reachable from Untrust but should be isolated from the Trust network to reduce lateral movement risk if a DMZ host is compromised. Local is a special zone that represents the firewall device itself (management plane and control plane). Traffic destined to or originating from the firewall (such as management access, routing protocol packets, or local services) is associated with the Local zone and is controlled using dedicated policies.

Because these four zones are pre-defined and available by default, all listed options are correct.