Huawei H12-841_V1.5 HCIP-Datacom-Campus Network Planning and Deployment V1.5 Exam Practice Test

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

Port isolation is commonly used on access switches to preventwired terminalsfrom communicating directly with each other at Layer 2. This enhances security by blocking lateral attacks and unnecessary broadcast traffic.

Forwireless users, Huawei APs and WLAN controllers (or central APs in agile distributed scenarios) providewireless user isolationmechanisms. Wireless user isolation prevents clients connected to the same SSID or AP from directly communicating with each other, even though they share the same wireless medium. This is widely used in guest networks, dormitories, and public WLAN environments.

Therefore, the statement that APs cannot implement wireless user isolation is incorrect. According to HCIP Datacom Campus Network WLAN design principles,wireless user isolation is fully supported by APs, either locally or under centralized control.

Hence, the statement is FALSE, and option B is correct.

Explanation (Based on HCIP Datacom Campus Network Design)

Position 1 → 802.1X AuthenticationThis authentication point corresponds to aPC connected to an access switch. PCs typically support 802.1X clients, making802.1X authenticationthe preferred and most secure method for wired user access. It provides strong identity-based access control using a RADIUS server.

Position 2 → Portal AuthenticationThis point representswireless user access. Portal authentication is commonly used for wireless terminals, especially guest or mobile users, where browser-based authentication is required. Users authenticate through a web page redirected by the access device.

Position 3 → MAC Address AuthenticationThis point corresponds tonon-802.1X-capable terminals, such as IP phones or printers. These devices cannot initiate 802.1X or Portal authentication, soMAC address authenticationis used to identify and authenticate them based on their MAC addresses.

This authentication deployment aligns with Huawei NAC best practices:

802.1X for capable wired terminals

Portal for wireless or guest access

MAC authentication for dumb or IoT devices

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In a CloudCampus VXLAN fabric, theglobal resource poolcentrally manages identifiers such as VLANs, VNIs, and bridge domains to ensure consistent allocation across the fabric.

StatementAis correct because abridge domain (BD)is the VXLAN equivalent of a VLAN and represents a Layer 2 broadcast domain used for packet forwarding within a VXLAN network.

StatementCis also correct. AVXLAN Network Identifier (VNI)uniquely identifies a VXLAN segment and is a core VXLAN forwarding identifier.

StatementDis correct because theservice VLAN poolis used to allocate VLANs for multiple purposes, including external gateway interconnections, network service resource interconnections, policy association management, and VN access VLANs.

StatementBis false. VLANs used forunderlay device interconnectionsarenot allocated from the VLAN resource poolmanaged by the VXLAN fabric. Underlay VLANs belong to the traditional IP underlay network and are typically planned and configured independently. The VLAN resource pool is intended for overlay-related services and fabric-managed VLAN usage only.

Therefore, the incorrect statement isB.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In a Layer 2 VXLAN gateway, the MAC address table recordslocal and remote MAC addressesassociated with specific Bridge Domains (BDs) and outbound interfaces. Entries learned fromremote VTEPsare shown with an outbound interface that is aVXLAN tunnel endpoint IP address, such as10.3.3.3, indicating VXLAN-based learning.

StatementAis correct because both MAC addresses0000-0000-0010and5489-9893-48a3are associated withBD 10, meaning they are in the same Layer 2 broadcast domain.

StatementCis correct because MAC entries learned with an outbound interface displayed as an IP address representremote MAC addresses learned through the VXLAN tunnel.

StatementDis also correct. The MAC address5489-9893-48a3is learned from the local physical subinterfaceGE1/0/1.10, which belongs toBD 10, confirming local access.

StatementBis incorrect. Even though5489-982d-77e2is associated withGE1/0/1.20 (BD 20), hosts inBD 20 and BD 10 cannot communicate directly at Layer 2because they belong to different bridge domains.

Therefore, the correct answers areA, C, and D.

iMaster NCE-Campus adopts a flexiblemulti-plane networking architectureto meet different deployment scale and reliability requirements. According to HCIP Datacom Campus Network documentation, iMaster NCE-Campus supports bothsingle-plane networkingandmulti-plane networking, and the selection depends on the system deployment mode.

In asingle-node system deployment, all functional components of iMaster NCE-Campus run on a single node. In this scenario,single-plane networking is optionaland can be used to simplify network planning and reduce deployment complexity. Management traffic, service traffic, and internal communication share the same network plane, which is sufficient for small-scale or test environments where high availability and strict isolation are not mandatory.

However, inmulti-node or cluster deployments, iMaster NCE-Campus requiresmulti-plane networking. Different network planes—such as management plane, service plane, and internal communication plane—are deployed separately to ensure high availability, scalability, performance isolation, and security. Single-plane networking isnot supportedin these deployments because it cannot meet the reliability and performance requirements of clustered systems.

This design ensures that large-scale campus networks benefit from fault isolation and load separation, while smaller deployments can use a simplified architecture. Therefore, the statement that single-plane networking is optional only in single-node system deployment is consistent with HCIP Datacom Campus Network design principles.

Hence, the correct answer isTRUE.

DHCP is a core protocol used in campus networks to automatically assign IP addresses and deliver network parameters to hosts, improving deployment efficiency and simplifying address management. DHCP messages include several fixed fields and anOptions field, which plays a critical role in parameter delivery.

Option A isfalse. Even if only gateway and DNS server information needs to be delivered to a client, the DHCP Offer messagemust carry the Options field. Default gateway and DNS server information are delivered through specific DHCP options, such as Option 3 (Router) and Option 6 (DNS Server). Without the Options field, these parameters cannot be conveyed to the client.

Option B is correct. The Options field in DHCP messages uses aTLV (Type-Length-Value)format, allowing flexible extension and supporting various network parameters, including NTP server addresses, wireless AC addresses, and log server addresses, which aligns with HCIP Datacom Campus Network descriptions.

Option C is also correct. DHCP supportsstatic IP address allocationby binding a specific IP address to a client’s MAC address. This is commonly used for printers, servers, or network devices that require fixed IP addresses.

Option D is correct as well. Because DHCP uses broadcast messages that cannot cross Layer 3 boundaries, aDHCP relay agentis required when the client and server reside on different IP networks.

Therefore, option A is the only incorrect statement.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

To deploy802.1X authenticationon Huawei campus switches and use aRADIUS serverfor user authentication and authorization, several core configuration components are mandatory. All four options listed are required for a complete and functional deployment.

Anauthentication domainis mandatory because it defines where user authentication requests are processed and which AAA schemes are used. Without a domain, the switch cannot determine how to handle authentication requests, makingoption A mandatory.

Anauthentication profileis also required. This profile binds authentication methods (such as 802.1X), authentication domains, and access policies together. Interfaces reference the authentication profile to determine how users are authenticated, sooption B is mandatory.

An802.1X access profiledefines detailed 802.1X parameters, such as authentication mode, reauthentication behavior, and client handling. This profile is bound to interfaces to enable 802.1X authentication on specific ports, makingoption C mandatory.

Finally, anAAA schemeis essential because it defines the authentication, authorization, and accounting methods used by the device, including RADIUS server configuration. Without an AAA scheme, the device cannot communicate with the RADIUS server or obtain user authorization information. Therefore,option D is mandatory.

According to HCIP Datacom Campus Network documentation, all four configuration steps are required to successfully enable 802.1X authentication with RADIUS-based access control.

In the Huawei CloudCampus Solution for small- and medium-sized campus networks,AR series routersare commonly deployed asegress gatewaysto provide Internet access, WAN connectivity, and centralized management integration. According to HCIP Datacom Campus Network documentation, AR devices supportmultiple deployment and management modes, ensuring flexibility during initial deployment and ongoing operations.

It is correct that an AR functioning as an egress gateway supportsweb-based network management, which allows administrators to perform basic configuration through a graphical interface. AR devices also supportregistration center query, enabling zero-touch provisioning by automatically discovering and registering with iMaster NCE-Campus. In addition,DHCP Option 148-based deploymentis supported, allowing the AR to obtain controller address information dynamically and establish a management connection.

However, the statement becomes incorrect when it claims thatCLI-based deployment is not supported. In fact, AR routers fully supportCLI-based configuration and deployment, which remains a fundamental management method in Huawei network devices. CLI access is widely used for initial configuration, troubleshooting, advanced feature configuration, and scenarios where automated or graphical tools are not available.

HCIP Datacom documentation emphasizes that CloudCampus deployment modes areadditive, not mutually exclusive. Web-based management, registration center onboarding, DHCP Option 148, and CLI can all coexist, giving administrators flexibility to choose the most suitable method based on deployment conditions.

Therefore, since AR devicesdo support CLI-based deployment, the statement is incorrect, and the correct answer isFALSE.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

Encapsulating Security Payload (ESP) is one of the core IPsec protocols used to protect data confidentiality, integrity, and authenticity. To prevent replay attacks, ESP includes aSequence Numberfield in its header. This field plays a critical role in ensuring packet freshness.

Each ESP packet carries a monotonically increasing sequence number assigned by the sender. The receiving device maintains a sliding window and checks incoming packets against this window. If a packet arrives with a sequence number that has already been received or falls outside the valid window, the packet is considered a replay and is discarded. This mechanism effectively protects the network against replay attacks, where attackers capture legitimate packets and retransmit them to disrupt communication or bypass security controls.

TheSPI (Security Parameters Index)identifies the security association used for the packet but does not provide replay protection. TheNext Headerfield indicates the type of payload carried in the ESP packet.Authentication Dataensures packet integrity and data origin authentication but does not independently prevent replay attacks without the sequence number mechanism.

According to HCIP Datacom Campus Network documentation and IPsec standards, replay protection in ESP is implemented using the Sequence Number field, making option A the correct answer.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In iMaster NCE-Campus–based virtualized campus networks, thesiteis a fundamental management object used to organize and manage network resources. A site typically represents aphysical location or logical network scope, such as a campus, building, or branch, under a tenant. Tenants manage devices, configurations, and servicesby site, which makes statementB correct.

iMaster NCE-Campus allows administrators tocreate sites individually, enabling flexible deployment and incremental network construction. Therefore,statement C is correct. In addition, a site is created and owned by atenant administratorto represent the tenant’s network scope, makingstatement D correct.

StatementA is false. iMaster NCE-Campusdoes support batch site creation, which is commonly used in large-scale or MSP scenarios where many tenant sites or branch sites need to be deployed efficiently. Batch creation significantly reduces manual workload and improves deployment efficiency.

According to HCIP Datacom Campus Network documentation, site management supports bothsingle-site creation and batch site creation, enabling scalable and centralized O&M. Therefore, the statement claiming that batch site creation is not supported is incorrect.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

Huawei iMaster NCE-Campus supports multiplelicense business modelsto meet different customer deployment and commercial requirements.

TheGlobal perpetual license (N1 mode)is a traditional licensing model where licenses are purchased once and permanently authorized. It is commonly used in on-premises controller deployments and is therefore a supported model, makingoption A correct.

TheTenant Subscription license (SaaS mode)is designed for cloud-based deployments, especially in MSP or enterprise scenarios using Huawei Cloud services. In this model, tenants subscribe to services on a periodic basis, aligning with the SaaS delivery approach. This is a valid and supported licensing model, makingoption B correct.

TheGlobal perpetual license (a-la-carte mode)allows customers to flexibly purchase specific functional modules according to their needs rather than buying a bundled license. This model is also supported by iMaster NCE-Campus and is widely used for customized deployments, makingoption C correct.

TheGlobal subscription license (IaaS mode)is not a defined licensing business model for iMaster NCE-Campus. IaaS refers to infrastructure-level cloud services rather than application-level controller licensing. Therefore,option D is incorrect.

Hence, the correct answers are A, B, and C.

In this scenario, O&M personnel need toview packet exchange processesduring Wi-Fi access and precisely locate the root cause of the failure. According to HCIP Datacom Campus Network documentation, theProtocol Tracefunction of iMaster NCE-CampusInsight is specifically designed for this purpose.

Protocol trace allows administrators to analyzereal packet interaction processesbetween clients, APs, gateways, and servers during key access phases such as authentication, IP address assignment, and service establishment. By tracing protocols like DHCP, ARP, and authentication exchanges, O&M personnel can clearly identify where the access process fails.

In the given case, mobile terminals fail to obtain IP addresses due toDHCP address pool exhaustion. This problem can only be accurately identified by observing the DHCP request and response flow, such as repeated DHCP Discover messages without successful Offer messages. Protocol trace visualizes this interaction step by step, making it easy to confirm that the DHCP server cannot allocate new IP addresses.

Other options do not match the scenario.Simulation feedbackis used to simulate access behavior rather than analyze real traffic.Issue analysisfocuses on aggregated fault statistics and trend analysis, not detailed packet-level inspection.Client journeytracks the overall user access path and experience stages but does not provide deep protocol packet visibility.

Therefore, the function used by O&M personnel to view packet exchange processes and identify DHCP pool exhaustion isProtocol trace, making optionAthe correct answer.

Explanation (Concise and Technical)

Position 1 → 100This corresponds toVNI 100, which is associated with BD10 and is used for communication between PC1 and PC3.

Position 2 → 3.3.3.3This is theremote VTEP IP addressof VTEP3, configured as a head-end peer for VNI 100 on VTEP1.

Position 3 → 200This representsVNI 200, which is bound to BD20 and enables VXLAN communication between PC2 and PC4.

Position 4 → 1.1.1.1This is theremote VTEP IP addressof VTEP1, configured as a head-end peer for VNI 200 on VTEP2.

This mapping follows standardstatic VXLAN tunnel configuration logicon Huawei devices, where each VNI is explicitly associated with remote VTEP peer addresses using head-end peer-list.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In Huawei campus access authentication designs, network access is divided intopre-authentication,isolation, andpost-authenticationdomains to control user access at different stages of authentication.

Thepre-authentication domainprovides users with only the most basic network services required to initiate authentication. These services typically includeDHCPandDNS. DHCP allows unauthenticated terminals to obtain IP addresses and basic network parameters, while DNS enables domain name resolution so that users can reach authentication portals or admission servers. Therefore,DHCP and DNS servers are essential components of the pre-authentication domain, making optionsC and D correct.

AnFTP serveris a general-purpose file transfer service and is not required for user authentication. Anantivirus serverbelongs to theisolation domain, where users are redirected if authentication fails or if their devices do not meet security posture requirements, such as outdated virus signatures. These servers provide remediation resources but are not part of the pre-authentication process.

According to HCIP Datacom Campus Network documentation, limiting the pre-authentication domain to only essential services reduces security risks while ensuring successful user onboarding.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In a CloudCampus virtualized campus network,Virtual Networks (VNs)provide service isolation, whilesecurity groupsenable identity-based access control. Even when inter-VN routing is technically available, communication between users in different VNs isnot permitted by default. Access permissions are controlled bysecurity group–based policies.

To allowR&D personnel and sales personnelto communicate, the network administrator must explicitly define thesecurity policy relationshipbetween the two security groups. This is achieved by deploying apolicy control matrixon iMaster NCE-Campus. The policy control matrix specifies whether traffic between source and destination security groups is allowed or denied and enforces the policy on relevant network devices.

Deploying an external network is unnecessary because communication is required within the campus network. Configuring access management relates to authentication and authorization during network access, not inter-group communication control. Configuring inter-VN communication enables routing capability but does not definewhethercommunication is permitted at the security policy level.

According to HCIP Datacom Campus Network documentation,security group communication permissions are controlled through the policy control matrix, making optionAthe correct task to meet the requirement.

In campus network architecture, theegress zoneplays a critical role as the boundary between the internal campus network and external networks such as the Internet, WAN, or cloud services. According to HCIP Datacom Campus Network design principles, the egress zone must meet multiple functional and security requirements to ensure stable, secure, and flexible network operation.

First,network connectivityis a fundamental requirement. The egress zone must reliably connect the campus intranet to external networks, ensuring uninterrupted access to external resources and services. High availability and redundancy are often considered in this aspect to avoid single points of failure.

Second,network secure ensuranceis essential. As the main security boundary, the egress zone must protect the campus network from external threats. This typically involves deploying security mechanisms such as firewalls, intrusion prevention, traffic filtering, and attack defense to ensure data and service security.

Third, the egress zone must provide strongservice control capability. This includes traffic identification, policy-based forwarding, bandwidth management, and application control. These capabilities allow administrators to optimize service quality, prioritize critical applications, and manage user access to external services.

Finally,various and flexible access modesare required to support different external connection scenarios, such as Internet access, MPLS WAN access, VPN connections, and cloud interconnection. This flexibility enables the campus network to adapt to evolving business and service requirements.

Therefore, all listed options are essential requirements for proper egress zone design, makingA, B, C, and Dthe correct answers.

In HCIP Datacom Campus Network security design,port securityis used to limit the number of MAC addresses that can be learned on an access interface, preventing unauthorized device access and MAC address spoofing. When the number of learned MAC addresses reaches the configured upper limit, the switch behavior depends on the configuredviolation mode.

One possible action isshutdown mode, where the switch sets the interface to an error-down state and generates an alarm. This corresponds to option A. The interface must be manually or automatically recovered before normal communication can resume. This mode provides the highest level of security and clear fault notification.

Another supported behavior isprotect mode, in which the switch silently discards packets from unknown source MAC addresses after the limit is reached. No alarms are generated in this case, which matches option C. This mode minimizes network disruption while still blocking unauthorized devices.

Therestrict modeis also supported. In this mode, the switch discards packets with unknown source MAC addresses and generates an alarm or log entry, corresponding to option D. This allows administrators to detect violations without shutting down the interface.

Option B is incorrect because when an interface enters the error-down state due to a port security violation, an alarm or log notification is always generated according to HCIP Datacom Campus Network behavior. Therefore, the valid actions are A, C, and D.

In the Huawei Agile Distributed Wi-Fi Solution, the wireless architecture is designed to simplify deployment and reduce dependency on traditional centralized WLAN controllers. The solution is composed mainly of a **central AP** and multiple **Remote Units (RUs)**. The central AP integrates key control and management functions that are traditionally provided by a standalone AC. These functions include RU discovery and registration, radio parameter configuration, SSID and security policy delivery, traffic control, and basic WLAN service management.

Because the central AP performs these AC-like roles, RUs do not need to be managed individually, and a separate wireless controller is not required for the Agile Distributed Wi-Fi system to operate. This architecture is especially suitable for indoor distributed scenarios such as hotels, dormitories, hospitals, and office buildings, where RUs are deployed in rooms or corridors and centralized control is still required.

From the HCIP Datacom Campus Network perspective, this design reduces network complexity, lowers deployment and maintenance costs, and improves scalability. While an external AC or centralized management platform may still be introduced for unified management across multiple sites or for advanced O&M requirements, it is **not mandatory** for the basic Agile Distributed Wi-Fi solution. Therefore, the statement that no AC is needed because the central AP can manage multiple RUs is correct according to HCIP Datacom Campus Network documentation.

In Huawei CloudCampus wireless solutions for small- and medium-sized campus networks,refined traffic controlmeans the ability to precisely limit and manage bandwidth consumption at theindividual user level. Among the available rate limiting modes,user-based rate limitingis specifically designed to meet this requirement.

User-based rate limiting applies bandwidth control policiesper authenticated user, regardless of which SSID, AP, or radio the user is connected to. This allows administrators to ensure fair bandwidth allocation, prevent a single user from monopolizing wireless resources, and provide differentiated service levels for different user roles, such as employees, guests, or VIP users. This fine-grained control aligns with identity-based access and policy management promoted in HCIP Datacom Campus Network design.

In contrast,SSID-based rate limitingcontrols bandwidth at the service level. It limits total traffic for an entire SSID, which affects all users connected to that SSID collectively, rather than individually.Radio-based rate limitingcontrols bandwidth per radio interface, focusing on wireless resource optimization instead of user-level fairness.ACL-based rate limitingis mainly used for traffic classification and control in wired or advanced scenarios and is not suitable for per-user refined wireless traffic control in CloudCampus WLAN deployments.

Therefore, when the requirement is refined traffic control foreach individual wireless user,user-based rate limitingis the most appropriate and effective option. Hence, the correct answer isA.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

Huawei iMaster NCE-Campus supports advanced networking solutions tailored for industry-specific scenarios, including thefinancial SD-WAN SRv6 solution. This solution leverages Segment Routing over IPv6 (SRv6) to enable precise traffic steering, deterministic forwarding, and end-to-end service scheduling across the network.

Because SRv6 introduces enhanced forwarding capabilities and control-plane features beyond standard campus networking functions, Huawei licenses these capabilities separately. To activate SRv6-based financial SD-WAN features on iMaster NCE-Campus, customers must obtain theSRv6 function package license. Without this license, SRv6-specific orchestration, scheduling, and optimization functions cannot be enabled.

According to HCIP Datacom Campus Network documentation, licensing ensures controlled feature activation and aligns with Huawei’s modular service enablement strategy. Therefore, the statement is TRUE, and option A is correct.

In a CloudCampus VXLAN fabric,node role planningis a fundamental design task that directly affects scalability, performance, and manageability. Huawei defines clear roles for fabric nodes, includingedge nodes,border nodes, and optionallyroute reflectors (RRs).

Statements A, B, and C correctly describe recommended design practices. Core devices are commonly deployed asborder nodesbecause they have higher performance and are well suited to connect the VXLAN fabric to external networks such as WANs or data centers. Access or aggregation devices acting asedge nodesenable end-to-end VXLAN automation and allow user traffic to be encapsulated and decapsulated close to the access layer. Additionally, when external networks exist in different physical locations, deployingmultiple border nodesimproves reliability and optimizes traffic paths.

Statement D is incorrect. In a VXLAN network usingBGP EVPN with route reflectors,edge nodes do not need to establish BGP peer relationships with each other. Instead, edge nodes establish BGP EVPN peer relationshipsonly with the RR, which centrally reflects EVPN routes to other nodes. This design significantly reduces the number of BGP sessions and improves scalability in large networks. Border nodes may also peer with the RR, but full-mesh peering between edge nodes is not required.

Therefore, the false statement isD, making it the correct answer.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In anasymmetric IRB (Integrated Routing and Bridging)VXLAN forwarding model, Layer 2 forwarding and Layer 3 routing occur ondifferent VTEPs. When PC1 sends traffic to PC2, the packet is first forwarded to thelocal gateway (VBDIF interface)on VTEP1 for Layer 3 routing.

After routing is performed, VTEP1 encapsulates the packet into a VXLAN packet and forwards it to VTEP2. Importantly, theoriginal data frame inside the VXLAN packethas already been rewritten after routing. The destination MAC address in the original Ethernet frame is no longer the MAC address of PC2, but theMAC address of the next-hop gateway on the remote VTEP.

In the figure, this next-hop MAC address isMAC C, which belongs to the VBDIF interface on VTEP2. MAC D (PC2’s MAC address) is only used after the packet is decapsulated and forwarded locally by VTEP2.

According to HCIP Datacom Campus Network VXLAN forwarding behavior, the correct destination MAC address of the original data frame sent from VTEP1 to VTEP2 isMAC C, making optionCcorrect.

The delivered configuration clearly indicates that aVPN instancenamedMKThas been created and bound to a VXLAN identifier. In Huawei virtualized campus networks that useVXLAN + BGP EVPN, aVN (Virtual Network)configured on iMaster NCE-Campus is typically instantiated on devices as anip vpn-instance. This VPN instance represents the logical tenant or virtual routing domain used for service isolation.

Several key lines confirm this mapping. The commandip vpn-instance MKTis the core object created for a VN. Theroute-distinguisher (RD)is configured to ensure route uniqueness for that VPN instance. The presence ofvpn-target import/export extcommunityandvpn-target … evpnshows that routes are controlled and exchanged using BGP extended communities, including EVPN-related RTs for VXLAN EVPN route import/export. This is exactly what iMaster NCE-Campus generates when a VN is created and needs to participate in EVPN route distribution.

Finally, vxlan vni 6 binds the VPN instance to a VNI, which is how VXLAN identifies and separates virtualized networks. Creating a fabric or external network would not directly generate an ip vpn-instance with RD/RTs and a VNI binding. Therefore, the administrator operation was to create a VN named MKT.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

Telemetry is a next-generation network data collection technology designed to overcome the limitations of traditional SNMP polling. One of its major advantages is that it ismodel-driven, relying onYANG modelsto define structured and extensible data formats. This allows Telemetry to support various data types and provides stronger semantic meaning than SNMP MIBs, makingoption A correct.

Another key advantage ishigh-frequency data collection. Telemetry supportssecond-level or even sub-second-level reporting, enabling more precise and real-time network monitoring. This capability is critical for intelligent O&M scenarios such as fault prediction, traffic analysis, and SLA assurance. SNMP, by contrast, typically relies on periodic polling with much lower precision. Therefore,option D is correct.

Telemetry does not establish sessions based on SSH. Instead, it typically uses protocols such asgRPCover secure transport channels like TLS. Hence,option B is incorrect.

Option C is also incorrect because Telemetry focuses ondata subscription and reporting, not on configuring or managing device databases. Configuration management remains the responsibility of controllers or network management systems, not the Telemetry mechanism itself.

According to HCIP Datacom Campus Network documentation, Telemetry’s strengths lie in model-driven data representation and high-precision, real-time monitoring, making A and D the correct answers.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

DHCP snooping works by distinguishing trusted and untrusted interfaces and controlling DHCP message forwarding behavior. After DHCP snooping is enabled, interfaces connected tolegal DHCP servers must be explicitly configured as trusted interfaces, otherwise DHCP server messages will be blocked. Therefore, statementB is correct.

On untrusted interfaces, the switchdrops DHCP server–type messages, such as DHCP Offer and DHCP ACK, to prevent rogue DHCP servers from assigning incorrect IP addresses. This validatesstatement C as correct.

Statement A is incorrect because DHCP snooping records client binding information mainly fromDHCP ACK messages, not from DHCP Offer messages. The ACK confirms the final IP assignment and lease parameters, making it the authoritative source for the binding table.

Statement D is also incorrect. When the interface connected to a DHCP client goes down, the corresponding DHCP snooping entry is immediately removed, rather than waiting for the lease to expire. This ensures real-time accuracy of the binding table.

In a Huawei VXLAN BGP EVPN architecture,Route Targets (RTs)play a critical role in controlling route import and export between VPN instances on different VTEPs. When a BGP EVPN route is received by a VTEP, the device determines whether the route should be accepted or discarded based on RT matching rules.

According to HCIP Datacom Campus Network documentation, a received EVPN route is considered validas long as its RT matches either the EVPN Import Route Target (EVPN IRT) or the IP VPN Import Route Target (IP VPN IRT)configured on the local device. This design enables flexible route sharing between Layer 2 EVPN services and Layer 3 VPN services, supporting integrated routing and bridging (IRB) scenarios and inter-VNI communication.

If the RT carried in the EVPN route matches at least one of these import RTs, the route is imported into the corresponding VPN instance and can be used for traffic forwarding. Only when the RT doesnot match both the EVPN IRT and the IP VPN IRTwill the route be discarded. This mechanism ensures proper isolation between tenants while still allowing controlled route exchange where required.

Therefore, the statement accurately describes the EVPN route filtering logic used between VTEPs in Huawei VXLAN networks. The route is discardedonly when the RT differs from both configured import RTs, making the statementTRUE.

In a VXLAN BGP EVPN deployment, interconnection between Layer 2 and Layer 3 networks relies onIntegrated Routing and Bridging (IRB). According to HCIP Datacom Campus Network documentation, for a VPN instance to advertise its IP routes to the BGP EVPN control plane, the device must explicitly enable IRB route advertisement in the BGP view.

Theadvertise irbcommand is used to allow IP routes learned in a VPN instance to be advertised as EVPN Type 5 (IP Prefix) routes. These routes enable communication between different VNIs or between VXLAN segments and external Layer 3 networks. Without this command, the VPN instance routes remain local and are not distributed through the EVPN control plane, preventing proper Layer 3 connectivity across the VXLAN fabric.

The other options are incorrect in this context. Theadvertise vpnv4command is used in traditional MPLS VPN scenarios, not in BGP EVPN-based VXLAN networks. Theadvertise irbv6command is specific to IPv6 IRB scenarios and does not apply to IPv4 route advertisement unless explicitly required. Theadvertise l2vpn evpncommand is used to enable the EVPN address family itself but does not control the advertisement of IP routes from a VPN instance.

Therefore, to enable a VPN instance to advertise IP routes to the BGP EVPN address family in a VXLAN network, the correct command isadvertise irb.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In VXLAN-based networks, inter-subnet communication and external network access requireLayer 3 forwarding capabilities. ALayer 3 VXLAN gatewayperforms routing between different VXLAN segments (VNIs) and enables traffic to exit the VXLAN overlay toward traditional non-VXLAN networks.

The NVE interface is responsible only for VXLAN encapsulation and decapsulation and does not perform routing. VLANIF interfaces are used in traditional VLAN environments and do not provide VXLAN interworking. A Layer 2 VXLAN gateway supports bridging only and cannot route between subnets.

Therefore, the Layer 3 VXLAN gateway is the correct solution for inter-subnet communication and external access.

1 →dh group1

2 →main

3 →esp

4 →tunnel

In the IKE proposal, the Diffie-Hellman group defines the key exchange strength used during IKE Phase 1 negotiation, which is whydh group1corresponds to position 1 under the IKE proposal configuration. Theexchange-mode mainsetting is part of IKEv1 Phase 1 and therefore correctly matches position 2 under the IKE peer configuration.

For the IPsec proposal, thetransformspecifies the protocol used to protect data traffic; since ESP is explicitly required,espcorrectly maps to position 3. Finally, theencapsulation-mode tunneldefines how packets are encapsulated in IPsec VPNs between gateways, makingtunnelthe correct match for position 4.

This mapping strictly follows HCIP Datacom Campus Network IPsec and IKE configuration logic and aligns with standard Huawei VRP command behavior.

In the Huawei SD-WAN Interconnection Solution,enhanced BGP EVPNis used as the core control-plane technology to distribute not only traditional routing information but also SD-WAN–specific service and tunnel-related data. This enhancement allows centralized control and automated service deployment across branch and hub sites.

TNP routesare one of the key information types transmitted through enhanced BGP EVPN. TNP (Transport Network Plane) routes describe the reachability of transport tunnels between SD-WAN nodes and are essential for establishing and maintaining overlay connectivity across different transport networks such as Internet, MPLS, or LTE.

IPsec SA (Security Association) informationis also carried through enhanced BGP EVPN. This allows SD-WAN devices to dynamically establish secure IPsec tunnels without manual configuration, ensuring encrypted communication between sites while supporting fast deployment and scalability.

In addition,service routesare distributed using enhanced BGP EVPN. Service routes identify application or service-level reachability and enable intelligent traffic steering, policy-based forwarding, and service chaining across the SD-WAN fabric.

GRE configuration, however, is not transmitted through enhanced BGP EVPN. GRE parameters are typically configured locally and do not belong to the control information exchanged by EVPN in the Huawei SD-WAN solution. Therefore, the correct information types are TNP routes, IPsec SA information, and service routes.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In the Huawei CloudCampus Solution, devices such as switches and APs support multipleprovisioning modesto integrate with iMaster NCE-Campus, including Web interface provisioning, CLI-based provisioning, and registration center query. These methods allow devices to obtain controller information and register successfully.

Firewalls, however, have stricter provisioning mechanisms due to security considerations. They do not supportDHCP Option 148, which is commonly used by switches and APs to automatically discover the management controller.

Instead, firewalls must be provisioned manually through the Web interface or CLI, or discovered via registration center mechanisms. According to HCIP Datacom Campus Network documentation,DHCP Option 148 is not supported by firewalls, makingoption Cthe correct answer.