H12-711_V4.0 Exam Dumps : HCIA-Security V4.0 Exam

Huawei firewalls support creating multiple sub-interfaces on a single physical interface such as GE0/0/1 so that one physical link can carry traffic for multiple VLANs. Each sub-interface is configured with an 802.1Q VLAN tag, which allows it to logically represent one VLAN or one Layer 3 gateway interface for that VLAN. This design is commonly used when the firewall connects to a switch through a trunk and needs to provide routing and security control for several VLANs simultaneously.

The statement is incorrect because sub-interfaces can be added to security zones. A security zone is a logical security domain used for policy enforcement, and Huawei firewalls allow both physical interfaces and logical interfaces (including VLAN sub-interfaces) to be assigned to zones. This is essential for implementing interzone security policies between VLANs. For example, if two VLANs are mapped to two different sub-interfaces, placing each sub-interface into a different zone allows the firewall to apply access control, inspection profiles, and NAT based on zone-to-zone rules. Therefore, the claim that sub-interfaces cannot be added to security zones is false.

Explanation From HCIA-Security documents:

On a Huawei firewall, a security zone is a logical grouping of interfaces with similar security requirements. An interface can belong to only one security zone at a time , so option A is incorrect. Default zones such as trust, untrust, and local are system-defined and cannot be deleted, which makes B incorrect.

Different security zones are typically assigned different default security levels to define trust relationships and policy direction, so C is also incorrect.

However, multiple physical or logical interfaces can be assigned to the same security zone if they share the same security policy and trust level. For example, several internal LAN interfaces can all be placed in the trust zone, while multiple WAN interfaces can be placed in the untrust zone. Traffic policies are usually applied between zones rather than per interface. Therefore, the correct statement is D