Free Huawei H12-711_V4.0 Practice Exam with Questions & Answers | Set: 2

Security zones are used to classify interfaces by trust level and simplify policy control. Traffic control decisions are usually applied between zones (interzone), and many firewall products (including Huawei) treat intrazone traffic differently from interzone traffic. Typically, communications between hosts within the same zone are not the primary target of security policy control, and mutual access within a zone does not have to be explicitly permitted by security policies in the same way as traffic between different zones. Therefore, statement A is correct in the context of zone-based policy control.

Firewall policies are created with a source zone and destination zone (and other match conditions), and they can be written to allow traffic in a specific direction (for example, Trust → Untrust) while denying the reverse direction (Untrust → Trust). That makes statement B correct: policies can be directional.

Statement C is incorrect because Huawei firewalls also include a default Local zone in addition to Trust, Untrust, and DMZ. Statement D is incorrect because an interface (or sub-interface) is assigned to one security zone; assigning the same interface to multiple zones would break the trust-boundary model and policy evaluation.

Explanation From HCIA-Security documents:

A packet filtering firewall mainly makes decisions based on L3/L4 header information such as source/destination IP address, protocol, and port, usually through static ACL rules . Because it does not deeply understand application behavior and typically does not track full session state like a stateful inspection firewall, it has several limitations.

A is a disadvantage because basic packet filtering is often implemented as rule-by-rule matching; under heavy traffic or intentionally flooded traffic, performance can degrade and the device may be pressured by DoS-style loads, especially if rules are long or the platform is resource-limited.

B is also a disadvantage: packet filtering that trusts only IP information can be bypassed by IP spoofing in certain scenarios, allowing traffic to appear as if it comes from an allowed address.

C is correct because packet filtering relies on static policies , which struggle to handle dynamic connections, complex services, and fine-grained user-based control.

D is not a disadvantage of packet filtering; dynamic connection status lists are a feature of stateful firewalls, not simple packet filters.