As shown in the figure below, in order to allow PC1 (12.1.1.1) to access PC2 (23.1.1.3), please fill in the corresponding commands to the corresponding blanks in the security-policy rule name 1…

Question

Options

• ACommand 1 (source-zone) maps to 'trust'; Command 2 (destination-zone) maps to 'untrust'; Command 3 (source-address) maps to '12.1.1.1'; Command 4 (destination-address) maps to '23.1.1.0'
• BNot provided in the source.
• CNot provided in the source.
• DNot provided in the source.

• A
  78% (18)
• B
  4% (1)
• C
  4% (1)
• D
  13% (3)

Explanation

Option A is correct because it correctly maps PC1's network zone and PC2's network zone to the appropriate security policy fields: PC1 (12.1.1.1) sits in the internal trusted network, so its zone is "trust," while PC2 (23.1.1.3) sits in the external untrusted network, so its zone is "untrust." The source address is set to PC1's specific IP (12.1.1.1), and the destination address is set to the subnet containing PC2 (23.1.1.0, covering 23.1.1.x), which is the standard way to define a network range in a security policy permit rule. Options B, C, and D are not provided, meaning A is the only viable answer and aligns with standard firewall zone-based policy logic used in platforms like Huawei USG firewalls.

Memory tip: Think of traffic flow direction - source is always where the traffic comes FROM (internal/trust = PC1), and destination is where it goes TO (external/untrust = PC2). Source-address matches the initiating host's IP, and destination-address typically matches the subnet rather than a single host unless specified otherwise.

No community discussion yet for this question.