By default, a firewall’s security policy is mainly used to control unicast traffic between security zones. Unicast packets are the normal one-to-one communication packets exchanged between a single source host and a single destination host. Because most user service traffic, such as web access, file transfer, remote login, and application communication, is carried in unicast form, firewall security policies are primarily designed to inspect and control this type of traffic.

Broadcast packets are typically used for local network discovery or service announcements within the same broadcast domain, and they are not the standard focus of interzone security policy control. Multicast traffic is one-to-many communication and usually requires additional multicast-specific handling or routing mechanisms rather than ordinary default security policy treatment. Anycast is a special addressing and routing method rather than the usual packet-control category emphasized in firewall default policy behavior.

In Huawei firewall policy design, when administrators configure permit or deny rules between zones, those rules are generally intended to manage unicast service traffic . Therefore, among the options listed, the packet type controlled by a firewall’s security policy by default is Unicast .

Explanation From HCIA-Security documents:

All four statements describe standard PKI roles and structure. A PKI entity is any certificate holder or relying participant that uses PKI services, which includes people, organizations, network devices, servers, and even application processes, so A is correct. PKI trust is commonly built using a CA hierarchy, where the root CA anchors trust and subordinate CAs issue certificates under the root’s authority, so B is correct. The CA is the core trusted component that signs (issues) certificates and manages their lifecycle activities such as renewal, suspension or revocation publication, and certificate status services, so C is correct. In many enterprise implementations, the PKI system is presented as three major roles: entities that request/use certificates, the RA that performs identity verification and approval of requests, and the CA that issues certificates based on validated requests, so D is also correct.