Huawei H12-841_V1.5 HCIP-Datacom-Campus Network Planning and Deployment V1.5 Exam Practice Test

In a centralized VXLAN gateway architecture, all inter-subnet traffic is forwarded to a centralized Layer 3 gateway, typically deployed on a core or aggregation device. This design simplifies network planning, gateway configuration, and policy enforcement because routing, security, and traffic control are all handled at a single centralized point. From an operational perspective, deployment and management are straightforward, which makes centralized gateways suitable for small- to medium-sized campus networks or environments with limited endpoints.

However, according to HCIP Datacom Campus Network documentation, this architecture introduces scalability limitations. Since the centralized gateway performs Layer 3 forwarding for all VXLAN segments, it must maintain ARP entries for every terminal in the network. As the number of endpoints increases, the ARP table on the Layer 3 gateway grows rapidly. Hardware resources such as memory and processing capacity limit the maximum number of ARP entries that can be supported.

In large-scale campus scenarios with a high density of terminals—such as universities, hospitals, or enterprise office campuses—this ARP scalability bottleneck can impact performance and stability. Excessive ARP entries may lead to increased CPU utilization, delayed ARP resolution, and reduced forwarding efficiency. For such environments, HCIP Datacom recommends distributed VXLAN gateways, which distribute ARP and routing responsibilities across multiple devices. Therefore, the statement is correct, and the centralized VXLAN gateway is not suitable for scenarios with a large number of terminals.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

IPsec VPN supports a variety ofsymmetric encryption algorithmsto protect data confidentiality during transmission. Commonly supported algorithms includeDES,3DES, andAES, all of which are used to encrypt the payload of IP packets in ESP.

AESis the most widely recommended algorithm due to its strong security and high performance.3DESandDESare legacy algorithms that are still supported for compatibility reasons, although they are considered less secure and are gradually being phased out in modern deployments.

DSA (Digital Signature Algorithm), however, isnot an encryption algorithm. It is an asymmetric algorithm used fordigital signatures and authentication, not for encrypting data. IPsec uses DSA only indirectly in certificate-based authentication scenarios, but it is never used as a data encryption algorithm in IPsec VPNs.

According to HCIP Datacom Campus Network documentation, IPsec VPN encryption relies exclusively on symmetric encryption algorithms such as DES, 3DES, and AES. Therefore,DSA is not supported as an IPsec encryption algorithm, makingoption Athe correct answer.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In a CloudCampus virtualized campus network,Virtual Networks (VNs)provide service isolation, whilesecurity groupsenable identity-based access control. Even when inter-VN routing is technically available, communication between users in different VNs isnot permitted by default. Access permissions are controlled bysecurity group–based policies.

To allowR&D personnel and sales personnelto communicate, the network administrator must explicitly define thesecurity policy relationshipbetween the two security groups. This is achieved by deploying apolicy control matrixon iMaster NCE-Campus. The policy control matrix specifies whether traffic between source and destination security groups is allowed or denied and enforces the policy on relevant network devices.

Deploying an external network is unnecessary because communication is required within the campus network. Configuring access management relates to authentication and authorization during network access, not inter-group communication control. Configuring inter-VN communication enables routing capability but does not definewhethercommunication is permitted at the security policy level.

According to HCIP Datacom Campus Network documentation,security group communication permissions are controlled through the policy control matrix, making optionAthe correct task to meet the requirement.

iMaster NCE-Campus is Huawei’s centralized management and control platform specifically designed forcampus network scenarios. According to HCIP Datacom Campus Network documentation, its primary purpose is to provide unified planning, automated deployment, policy control, and intelligent O&M for campus environments. Therefore,campus networksare one of the most typical and core deployment scenarios for iMaster NCE-Campus.

In addition, iMaster NCE-Campus is widely used to deployVXLAN Fabric networkswithin campuses. VXLAN Fabric is a key technology for building scalable, virtualized, and multi-tenant campus networks. iMaster NCE-Campus simplifies VXLAN Fabric deployment by automating underlay and overlay configuration, VN creation, VNI assignment, and BGP EVPN policy distribution. This makes VXLAN Fabric networks another standard and typical deployment scenario supported by the platform.

Branch networksare not considered a typical deployment scenario for iMaster NCE-Campus. Branch network management is usually handled by iMaster NCE-WAN in SD-WAN solutions, which focuses on WAN connectivity, branch access, and centralized WAN control rather than campus-oriented services.

Similarly,small-sized networksare not defined as a deployment scenario category in iMaster NCE-Campus documentation. The platform is designed for medium to large campus environments where centralized management and automation provide the most value.

Therefore, the typical deployment scenarios when using iMaster NCE-Campus areCampus networksandVXLAN Fabric networks, making optionsA and Bthe correct answers.

SNMP and NETCONF are both commonly used network management protocols in campus networks, but they differ significantly in architecture, capabilities, and configuration management mechanisms. According to HCIP Datacom Campus Network documentation,NETCONF is designed for modern, model-driven network management, while SNMP is mainly used for monitoring and simple management.

Option A is incorrect because although both protocols use a client/server model, their roles are different. In SNMP, the managed device operates as an SNMP agent (server), while the NMS acts as the client. In NETCONF, the network device functions as the NETCONF server, and the management system is the client, not the other way around.

Option B is also incorrect because SNMP manages data using MIBs, whereas NETCONF usesdata models, typically based on YANG, instead of MIBs.

Option D is incorrect because SNMP does not support multiple configuration databases. It mainly provides basic read and write operations and is not suitable for complex configuration management or rollback.

Option C is correct. NETCONF provides alocking mechanismthat allows a client to lock a configuration datastore during configuration changes. This prevents multiple users or systems from modifying the same configuration simultaneously, avoiding conflicts and ensuring configuration consistency. This capability is a key advantage of NETCONF in intelligent campus network management and aligns with HCIP Datacom Campus Network best practices.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In campus networks, devices such as servers, print servers, and video surveillance systems requirestable and predictable IP addressesto ensure reliable access, simplified maintenance, and consistent policy enforcement. While fully dynamic DHCP allocation is easy to deploy, it does not guarantee IP address consistency, which complicates device management, monitoring, and troubleshooting.

Huawei campus network design best practices recommendstatic address allocation through DHCP based on MAC addresses, also known as DHCP reservation or static binding. With this approach, the DHCP server assigns a fixed IP address to a device according to its MAC address. This method combines the advantages of centralized DHCP management with the stability of static IP addresses.

PPPoE address binding is typically used in broadband access scenarios and is unsuitable for enterprise campus devices. The BOOT protocol is obsolete and not used in modern campus networks. Pure dynamic DHCP allocation does not meet the stability requirements of infrastructure and service devices.

According to HCIP Datacom Campus Network documentation, MAC-based DHCP static allocation is the recommended solution for managing critical campus devices, making option D correct.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In astatic VXLAN tunneldeployment, Huawei devices use anNVE (Network Virtualization Edge) interfaceas the logical tunnel interface for VXLAN encapsulation and decapsulation. The NVE interface represents the VTEP and does not have a one-to-one relationship with Bridge Domains (BDs) or VXLAN tunnels.

AnNVE interface can be associated with multiple VNIs, each corresponding to a different BD. Therefore, when multiple BDs exist on a VTEP,only one NVE interface is required, makingstatement B correctandstatement A incorrect.

In static VXLAN, thedestination VTEP addressesare specified usingingress replication listsunder each VNI. This allows a single NVE interface to establishmultiple VXLAN tunnelsto different remote VTEPs. As a result, there is no requirement to create a separate NVE interface for each tunnel, makingstatement D correctandstatement C incorrect.

According to HCIP Datacom Campus Network VXLAN configuration principles, the correct practice is to createone NVE interface per VTEP, associate multiple VNIs with it, and define remote peers through ingress replication. Therefore, the correct answers areB and D.

In Huawei campus network access control solutions, different authentication methods are selected based onterminal capabilities, user mobility requirements, and service scenarios. According to HCIP Datacom Campus Network documentation,Portal authenticationandMAC address authenticationare designed for distinct use cases, and the statement correctly describes their recommended application scenarios.

Portal authenticationis well suited for environments withhigh user mobility and a wide variety of terminal types, such as shopping malls, supermarkets, airports, and exhibition centers. In these scenarios, users frequently connect and disconnect from the network using mobile phones, tablets, and laptops. Portal authentication provides a flexible and user-friendly access method, typically through a web page where users enter credentials, accept terms, or obtain temporary access. It does not require pre-installed client software and supports fast onboarding of diverse devices, making it ideal for public or semi-public access networks.

On the other hand,MAC address authenticationis recommended fordumb terminalsthat lack interactive user interfaces or browser capabilities. Devices such as printers, fax machines, IP phones, and some IoT terminals cannot complete Portal authentication. MAC authentication allows the network to authenticate these devices based on their MAC addresses, enabling automatic and seamless access once the MAC address is registered in the authentication system.

Using the appropriate authentication method improves user experience, simplifies network management, and enhances security. Therefore, the statement accurately reflects Huawei’s recommended authentication practices and isTRUE.

iMaster NCE-Campus adopts a flexiblemulti-plane networking architectureto meet different deployment scale and reliability requirements. According to HCIP Datacom Campus Network documentation, iMaster NCE-Campus supports bothsingle-plane networkingandmulti-plane networking, and the selection depends on the system deployment mode.

In asingle-node system deployment, all functional components of iMaster NCE-Campus run on a single node. In this scenario,single-plane networking is optionaland can be used to simplify network planning and reduce deployment complexity. Management traffic, service traffic, and internal communication share the same network plane, which is sufficient for small-scale or test environments where high availability and strict isolation are not mandatory.

However, inmulti-node or cluster deployments, iMaster NCE-Campus requiresmulti-plane networking. Different network planes—such as management plane, service plane, and internal communication plane—are deployed separately to ensure high availability, scalability, performance isolation, and security. Single-plane networking isnot supportedin these deployments because it cannot meet the reliability and performance requirements of clustered systems.

This design ensures that large-scale campus networks benefit from fault isolation and load separation, while smaller deployments can use a simplified architecture. Therefore, the statement that single-plane networking is optional only in single-node system deployment is consistent with HCIP Datacom Campus Network design principles.

Hence, the correct answer isTRUE.

DHCP is a core protocol used in campus networks to automatically assign IP addresses and deliver network parameters to hosts, improving deployment efficiency and simplifying address management. DHCP messages include several fixed fields and anOptions field, which plays a critical role in parameter delivery.

Option A isfalse. Even if only gateway and DNS server information needs to be delivered to a client, the DHCP Offer messagemust carry the Options field. Default gateway and DNS server information are delivered through specific DHCP options, such as Option 3 (Router) and Option 6 (DNS Server). Without the Options field, these parameters cannot be conveyed to the client.

Option B is correct. The Options field in DHCP messages uses aTLV (Type-Length-Value)format, allowing flexible extension and supporting various network parameters, including NTP server addresses, wireless AC addresses, and log server addresses, which aligns with HCIP Datacom Campus Network descriptions.

Option C is also correct. DHCP supportsstatic IP address allocationby binding a specific IP address to a client’s MAC address. This is commonly used for printers, servers, or network devices that require fixed IP addresses.

Option D is correct as well. Because DHCP uses broadcast messages that cannot cross Layer 3 boundaries, aDHCP relay agentis required when the client and server reside on different IP networks.

Therefore, option A is the only incorrect statement.

In the Huawei CloudCampus Solution, the architecture is typically divided into themanagement layerand thenetwork layer. The management layer, represented by platforms such as iMaster NCE-Campus, is responsible for centralized configuration, monitoring, policy delivery, and intelligent O&M. Communication between these two layers relies on standardizedmanagement and control protocols.

NETCONFis a key protocol used between the management layer and network devices. It provides a structured and reliable mechanism for delivering configurations, querying device status, and performing automated service deployment. NETCONF works closely with data models to ensure consistency and accuracy in configuration management.

SNMPis also widely used in the CloudCampus Solution for monitoring and fault management. Through SNMP, network devices report performance data, alarms, and status information to the management platform, enabling real-time visibility and proactive maintenance.

YANGis not a transport protocol but a data modeling language; however, it plays a critical role in management-layer communication. YANG models define the structure of configuration and operational data exchanged between the controller and devices, typically carried over NETCONF. Therefore, YANG-related information is effectively exchanged between the management and network layers.

RADIUS, on the other hand, is used for user authentication, authorization, and accounting. It operates between network devices and authentication servers, not between the management layer and the network layer.

Thus, the correct options areNETCONF, SNMP, and YANG.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In Huawei iMaster NCE-Campus and CloudCampus management systems, different log types are designed to record different categories of events to support auditing, troubleshooting, and security analysis. When anMSP administrator creates a tenant account, this action is considered amanagement operationperformed through the system’s management interface.

Such administrative actions are recorded in theOperation Log. Operation logs documentuser-initiated configuration and management activities, including tenant creation, modification, deletion, policy changes, and administrative actions performed by operators or administrators. These logs are essential for operation auditing and responsibility tracing in multi-tenant environments.

System logsmainly record internal system events, such as service startup, module status changes, or system exceptions, and do not track administrator operations.Security logsfocus on security-related events, such as login failures, abnormal access attempts, or permission violations, rather than routine administrative operations.Device channel logsrecord communication events between devices and controllers, such as device registration or channel status changes, and are unrelated to tenant management actions.

According to HCIP Datacom Campus Network and CloudCampus O&M documentation, tenant account creation performed by an MSP administrator is clearly categorized as anoperation behavior, and therefore it is recorded in theOperation Log.

In IPsec VPN deployment, NAT traversal (NAT-T) is a critical mechanism used when one or both IPsec gateways are located behind a NAT device. Traditional ESP packets use IP protocol number 50 and do not contain TCP or UDP port numbers, which causes problems for NAT devices that rely on port information to maintain session mappings. As a result, ESP packets may be dropped by the NAT device.

During IKE negotiation, the two gateways detect whether a NAT device exists between them by exchanging NAT-detection payloads. If NAT is detected,NAT traversal is automatically enabled. When NAT-T is active, ESP packets are encapsulated insideUDP packetsso that they can traverse the NAT device successfully.

According to HCIP Datacom Campus Network security documentation, when ESP is encapsulated using NAT-T,both the source and destination UDP port numbers are set to 4500. UDP port 4500 is the standardized port reserved specifically for IPsec NAT traversal. This allows NAT devices to correctly track sessions and forward packets based on UDP port information.

Initially, IKE negotiations use UDP port 500. After NAT detection and NAT-T activation, subsequent IKE and ESP traffic switches toUDP port 4500. This encapsulation ensures compatibility with NAT environments while maintaining IPsec security.

Therefore, the correct value that enables ESP packets to pass through NAT devices is4500, which is a key operational detail in secure campus network VPN deployments.

Comprehensive and Detailed Explanation (200–250 words):

In a VXLAN-based virtualized campus network, user terminals located in different access locations communicate with each other overVXLAN tunnelsestablished between VXLAN Tunnel Endpoints (VTEPs). These VXLAN tunnels form the overlay network, which abstracts the physical underlay and enables flexible Layer 2 and Layer 3 connectivity across the campus.

When communication is confined within the virtualized campus network, traffic remains inside the VXLAN overlay and is encapsulated and forwarded between VTEPs. However, when users or services inside the VXLAN network need to accessexternal networks, such as traditional IP networks, the Internet, or data centers that do not support VXLAN, traffic must exit the VXLAN overlay. This function is performed byborder nodes.

Border nodes act as the boundary between the VXLAN overlay and non-VXLAN networks. They are responsible for VXLAN encapsulation and decapsulation, routing between VXLAN segments and external networks, and enforcing security and policy controls at the network edge. According to HCIP Datacom Campus Network architecture principles, all traffic entering or leaving the VXLAN-based campus must pass through border nodes to ensure proper routing, policy enforcement, and service control.

Therefore, the statement is TRUE, and option A is correct.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

NQA on Huawei devices is designed to actively measure network performance by simulating service traffic and monitoring protocol behavior. It supports commonconnectivity and routing-related protocolsto detect delay, jitter, packet loss, and reachability.

NQA supportsICMP, which is widely used to test network connectivity and latency, makingoption D correct. It also supportsrouting protocol detection, including OSPF, enabling administrators to monitor routing convergence and path availability, validatingoption A.

DHCP and SNMP are management and configuration protocols rather than traffic or routing performance protocols. NQA does not actively simulate or monitor DHCP address allocation behavior or SNMP management communication, makingoptions B and C incorrect.

Thus, NQA focuses on traffic forwarding and routing health rather than control-plane management protocols.

iMaster NCE-Campus adopts amulti-plane architectureto improve system security, scalability, and operational stability. The planes are logically isolated so that different types of traffic and functions do not interfere with each other. The two most commonly referenced planes are themanagement planeand theservice plane.

Themanagement planeis mainly responsible for system-level operations such as device registration, controller maintenance, system management, and internal communication between system components. For this purpose, it uses a dedicated access interface and port number to ensure secure and stable management connectivity.

Theservice plane, on the other hand, is designed fordaily network service operations. Administrators access this plane to perform tasks such as campus network planning, configuration delivery, monitoring, alarm viewing, and intelligent O&M operations. To keep service access independent and secure, the service plane uses its own dedicated login port.

According to HCIP Datacom Campus Network documentation, theservice plane of iMaster NCE-Campus uses port 18009. Administrators log in to the service plane by accessing the service IP address together with this port number. This separation ensures that service operations remain available even when management-plane functions are restricted or under maintenance.

Therefore, the correct port number for theservice planeis18009, making optionBthe correct answer.

iMaster NCE-Campus classifies network alarms into different severity levels to help administrators quickly understand the health status of the campus network and take appropriate actions. According to HCIP Datacom Campus Network documentation, alarms are typically categorized intocritical,major,warning, andinformationallevels, each represented by a distinct icon and color in the management interface.

In the displayed alarm summary, four types of icons are shown with corresponding numbers. Thered flame iconrepresents critical alarms, and the number next to it is0, indicating no critical alarms. Theorange lightning iconrepresents major alarms, and the number displayed is5, indicating five major alarms. Theyellow exclamation mark iconrepresentswarning alarms, and the number next to it is1. Finally, theblue information iconrepresents informational alarms, with a total of10.

Warning alarms indicate potential issues that do not immediately affect network operation but may develop into more serious problems if not addressed. These alarms require administrator attention but are less urgent than critical or major alarms. Accurately identifying the number of warning alarms helps prioritize troubleshooting and maintenance tasks.

Since the yellow warning icon shows the number1, this means there isone warning alarmcurrently generated on the network. Therefore, the correct answer is1, corresponding to optionB.

Encapsulating Security Payload (ESP) is one of the core protocols of the IPsec framework and is widely used in Huawei campus and SD-WAN network solutions to provide secure data transmission. ESP operates directly over IP and is identified by a uniqueIP protocol number, which allows network devices to recognize and process ESP packets correctly.

According to HCIP Datacom Campus Network documentation and standard IP protocol definitions,ESP uses protocol number 50. ESP provides essential security services such as data confidentiality through encryption, data integrity verification, authentication, and anti-replay protection. It can operate in bothtransport modeandtunnel mode, making it suitable for scenarios such as site-to-site VPNs and remote access VPNs.

The other options listed are incorrect.Protocol number 47is used by GRE (Generic Routing Encapsulation), which is a tunneling protocol and does not provide encryption.Protocol number 51is assigned to AH (Authentication Header), another IPsec protocol that provides integrity and authentication but does not support encryption.Protocol number 102is not associated with ESP or commonly used IPsec-related protocols.

Correct identification of ESP traffic using protocol number 50 is critical for firewall configuration, security policy enforcement, and proper forwarding of encrypted traffic in campus and WAN environments. Therefore, the correct answer is50, which corresponds to optionB.

In Huawei CloudCampus wireless solutions for small- and medium-sized campus networks,refined traffic controlmeans the ability to precisely limit and manage bandwidth consumption at theindividual user level. Among the available rate limiting modes,user-based rate limitingis specifically designed to meet this requirement.

User-based rate limiting applies bandwidth control policiesper authenticated user, regardless of which SSID, AP, or radio the user is connected to. This allows administrators to ensure fair bandwidth allocation, prevent a single user from monopolizing wireless resources, and provide differentiated service levels for different user roles, such as employees, guests, or VIP users. This fine-grained control aligns with identity-based access and policy management promoted in HCIP Datacom Campus Network design.

In contrast,SSID-based rate limitingcontrols bandwidth at the service level. It limits total traffic for an entire SSID, which affects all users connected to that SSID collectively, rather than individually.Radio-based rate limitingcontrols bandwidth per radio interface, focusing on wireless resource optimization instead of user-level fairness.ACL-based rate limitingis mainly used for traffic classification and control in wired or advanced scenarios and is not suitable for per-user refined wireless traffic control in CloudCampus WLAN deployments.

Therefore, when the requirement is refined traffic control foreach individual wireless user,user-based rate limitingis the most appropriate and effective option. Hence, the correct answer isA.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In Huawei campus authentication architecture, anauthentication profiledefines how users are authenticated and which domain is used during authentication. A key concept is theforcible domain, which has the highest priority during domain selection. If a forcible domain is configured, the device ignores any domain information carried in the user name and forcibly authenticates the user in the specified domain. Therefore, statementD is correct.

Statement A is incorrect because the default domaincan be modifiedusing CLI commands, allowing administrators to flexibly control user authentication behavior. Statement B is also incorrect; on the same interface, different authentication types (such as 802.1X, MAC authentication, and Portal)can be configured with different domains, depending on access control requirements.

Statement C is incorrect because the default authentication triggering sequence on Huawei devices is802.1X → MAC address authentication → Portal authentication, not the order described. This sequence ensures strong authentication is attempted first before falling back to weaker mechanisms.

According to HCIP Datacom Campus Network documentation, forcible domain configuration guarantees unified policy enforcement and simplifies authentication control, making option D the only correct statement.

WLAN planning and design aim to minimize co-channel and adjacent-channel interference while maximizing spectrum utilization and user experience. According to HCIP Datacom Campus Network WLAN design principles, proper channel planning is a core task, especially in environments with high user density.

On the2.4 GHz frequency band, only three non-overlapping channels—1, 6, and 11—are traditionally recommended. These channels do not overlap in frequency, which helps reduce interference between adjacent APs. Inhigh-density scenarios, to further improve spectrum utilization,channels 1, 5, 9, and 13can be used. This approach shortens the channel spacing but is acceptable when transmit power is well controlled and AP placement is carefully planned, enabling higher AP density while keeping interference manageable.

On the5 GHz frequency band, there are more available channels and less interference compared to 2.4 GHz. HCIP Datacom documentation recommendsstaggering high-frequency and low-frequency channels between adjacent APs. This staggered channel allocation reduces the likelihood of co-channel interference and improves overall throughput and roaming performance, especially in large or high-density campus deployments.

These channel planning strategies are standard WLAN design best practices supported by Huawei and are widely applied in enterprise campus networks. Therefore, the statement accurately reflects recommended WLAN planning principles and isTRUE.

Comprehensive and Detailed Explanation (200–250 words):

In an iMaster NCE-Campus policy control matrix, rows representsource security groupsand columns representdestination security groups. A green check mark indicates that communication is allowed, while a red cross indicates that communication is denied. This matrix enables fine-grained user access control in VXLAN-based virtualized campus networks.

From the figure, communication betweenGuest_Group and Research_Groupis explicitly denied in both directions, as indicated by red crosses. Therefore, statementsAandDare both correct. The matrix also shows a green check mark forSales_Group communicating with itself, meaning intra-group communication is permitted, makingstatement B correct.

Theunknowngroup represents users that are not classified into Guest_Group, Research_Group, or Sales_Group. In the matrix, the unknown group is not completely blocked from all resources by default; access behavior depends on explicit policy configuration. Since the figure does not indicate a universal deny policy for unknown users toward all destinations,statement C is incorrect.

According to HCIP Datacom Campus Network policy control design, security group–based access control allows administrators to precisely define which user groups can communicate, improving security and service isolation. Hence, the correct answers areA, B, and D.

Position 1 → Before authenticationBefore users are authenticated, they are placed in thepre-authentication domain. At this stage, access is strictly limited to basic network services such as theAdmission server,DHCP server, andDNS server. This allows users to obtain IP addresses and reach authentication-related services only.

Position 2 → Upon authentication failuresIf user authentication fails or security posture checks (such as antivirus or patch verification) do not pass, users are redirected to theisolation domain. In this domain, access is restricted to remediation resources likevirus signature database serversandpatch servers, preventing users from accessing business services while allowing problem resolution.

Position 3 → After successful authenticationAfter authentication succeeds, users enter thepost-authentication domain. At this stage, full or role-based access is granted to enterprise resources such asoffice data,R&D data,marketing systems, as well asintranet or Internet services, based on assigned policies.

This mapping reflects Huawei’s standardNAC domain-based access control model, ensuring secure, staged network access.

In a VXLAN BGP EVPN network, different EVPN route types are used to advertise specific kinds of control-plane information.BGP EVPN Type 2 routes, also known asMAC/IP Advertisement routes, are primarily used to advertise Layer 2 and host-level Layer 3 reachability information between VTEPs.

According to HCIP Datacom Campus Network documentation, a Type 2 route carriesMAC address information, and it can optionally carry ahost IP addressassociated with that MAC. This enables efficient MAC learning and ARP suppression within the VXLAN fabric. TheL2VNIis also included in Type 2 routes, as it identifies the Layer 2 broadcast domain to which the MAC and IP information belongs.

TheL3VNIis not used to identify a Layer 2 broadcast domain but is associated with Layer 3 VPN forwarding and inter-VNI routing. While L3VNI information is relevant in EVPN-based Layer 3 services, it is not the primary identifier in a Type 2 route. However, the key distinction in this question lies in the difference between host routes and prefix routes.

AnIP prefixrepresents a network segment rather than a single host and is advertised usingEVPN Type 5 (IP Prefix) routes, not Type 2 routes. Type 2 routes only carry host IP addresses, not IP prefixes. Therefore,IP Prefixis not carried in a BGP EVPN Type 2 route, making optionCthe correct answer.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In astatic VXLAN tunneldeployment, MAC address learning relies ondata-plane trafficrather than a control-plane protocol. Unlike BGP EVPN-based VXLAN, where MAC and IP information is distributed through BGP, static VXLAN does not have a centralized or dynamic control mechanism to advertise host information.

As a result, VTEPs learn remote MAC addresses by inspectingencapsulated traffic, such as ARP request and reply packets, exchanged between hosts in the same VXLAN segment. When a host sends an ARP request, the local VTEP encapsulates the frame into a VXLAN packet and forwards it to the remote VTEP. Upon receiving the packet, the remote VTEP extracts the source MAC address and associates it with the corresponding VNI and tunnel endpoint.

This data-plane learning mechanism means that MAC address entries are built dynamically as traffic flows, which is why initial host communication may require broadcast or unknown unicast flooding. According to HCIP Datacom Campus Network documentation, this behavior is a defining characteristic of static VXLAN deployments.

Therefore, the statement isTRUE, and optionAis correct.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In VXLAN-based networks, inter-subnet communication and external network access requireLayer 3 forwarding capabilities. ALayer 3 VXLAN gatewayperforms routing between different VXLAN segments (VNIs) and enables traffic to exit the VXLAN overlay toward traditional non-VXLAN networks.

The NVE interface is responsible only for VXLAN encapsulation and decapsulation and does not perform routing. VLANIF interfaces are used in traditional VLAN environments and do not provide VXLAN interworking. A Layer 2 VXLAN gateway supports bridging only and cannot route between subnets.

Therefore, the Layer 3 VXLAN gateway is the correct solution for inter-subnet communication and external access.

In the Huawei free mobility solution based on iMaster NCE-Campus,IP-security groupsare used to associate user identities with IP addresses so that consistent security policies can be enforced regardless of user location. Apolicy enforcement point (PEP)must obtain IP-security group entries to correctly match traffic against security policies.

When the policy enforcement pointis not an authentication point, it cannot directly learn user identity information during access authentication. In this scenario, one supported method is to configureIP-security group entry subscriptionon iMaster NCE-Campus. After subscription is configured, iMaster NCE-Campus pushes the corresponding IP-security group entries to the policy enforcement point, which matches option A.

Another valid approach in this case is described in option B. If the authentication point and policy enforcement point are separate devices, theauthentication point can push IP-security group entriesto the policy enforcement point after successful user authentication. This ensures that enforcement devices receive real-time identity information.

If the policy enforcement pointalso functions as an authentication point, it can directly interact with iMaster NCE-Campus. In this scenario, iMaster NCE-Campusproactively pushes IP-security group entriesto the device, as stated in option C.

Option D is incorrect because iMaster NCE-Campus does not push IP-security group entries indiscriminately in all scenarios. The distribution mechanism depends on the role of the device and whether subscription or authentication-based pushing is configured.

Therefore, the correct answers are A, B, and C.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

The Huawei CloudCampus Solution adopts afour-layer architecture, not a three-layer one. According to HCIP Datacom Campus Network documentation, the architecture consists of theterminal layer,network layer,management and control layer, andapplication layer.

Theterminal layerincludes user devices such as PCs, mobile terminals, IoT devices, and other endpoints that access the campus network. Thenetwork layeris responsible for data forwarding and includes access, aggregation, and core network devices. Themanagement and control layer, represented by platforms such as iMaster NCE-Campus, provides centralized management, automation, policy control, and orchestration. Theapplication layerdelivers value-added services and business applications.

Because the terminal layer is an essential and explicitly defined component of the CloudCampus architecture, stating that the solution has only three layers is incorrect. Therefore, the statement isFALSE, making optionBthe correct answer.

In a virtualized campus network managed byiMaster NCE-Campus, traffic control between users or user groups is implemented throughsecurity groupsand apolicy control matrix. The configuration shown clearly reflects this mechanism.

The ACL usesucl-group names, such asResearch_Group,Sales_Group, andGuest_Group. These ucl-groups correspond tosecurity groupsdefined on iMaster NCE-Campus. The ACL rules explicitly permit IP traffic from one security group to other security groups. This type of ACL is automatically generated and delivered by the controller when apolicy control matrixis deployed.

A policy control matrix defineswho can access whomby specifying allow or deny relationships between security groups. Once the matrix is configured on iMaster NCE-Campus, the controller translates these logical policies into device-level ACLs and applies them to the appropriate enforcement points in the VXLAN fabric. The presence of multiple rules permitting traffic from one group to multiple destination groups is a typical outcome of deploying such a matrix.

Creating a security group alone would not generate ACL rules. Deploying inter-VN communication would involve route exchange or gateway configuration, not ucl-group–based ACLs. Creating an authorization result would associate users with security groups but would not generate inter-group ACL rules.

Therefore, the administrator operation that resulted in this configuration wasdeploying a policy control matrix, making optionAthe correct answer.

Huawei’s free mobility solution is designed to provide consistent user access control and policy enforcement across the campus network, regardless of user location. According to HCIP Datacom Campus Network documentation, the solution is built around severalclearly defined core roles, each with specific responsibilities.

Theauthentication deviceis a core role. It performs user authentication using methods such as 802.1X, MAC authentication, or portal authentication, and associates user identity information with IP addresses or security groups.

Thepolicy enforcement deviceis also a core role. It enforces security and access control policies based on IP-security group information, ensuring that traffic complies with defined policies wherever the user is connected.

iMaster NCE-Campusis another core component of the free mobility solution. It acts as the centralized management and control platform, responsible for policy definition, IP-security group management, and coordination of information distribution between authentication points and policy enforcement points.

Thepolicy control device, however, isnot a core roleexplicitly defined in Huawei’s free mobility architecture. Policy control functions are integrated into iMaster NCE-Campus rather than implemented as a separate standalone device role. Therefore, “policy control device” is not recognized as a core role in the free mobility solution.

As a result, option B is the correct answer, while the other options represent essential components of Huawei’s free mobility solution as defined in HCIP Datacom Campus Network materials.

The delivered configuration clearly indicates that aVPN instancenamedMKThas been created and bound to a VXLAN identifier. In Huawei virtualized campus networks that useVXLAN + BGP EVPN, aVN (Virtual Network)configured on iMaster NCE-Campus is typically instantiated on devices as anip vpn-instance. This VPN instance represents the logical tenant or virtual routing domain used for service isolation.

Several key lines confirm this mapping. The commandip vpn-instance MKTis the core object created for a VN. Theroute-distinguisher (RD)is configured to ensure route uniqueness for that VPN instance. The presence ofvpn-target import/export extcommunityandvpn-target … evpnshows that routes are controlled and exchanged using BGP extended communities, including EVPN-related RTs for VXLAN EVPN route import/export. This is exactly what iMaster NCE-Campus generates when a VN is created and needs to participate in EVPN route distribution.

Finally, vxlan vni 6 binds the VPN instance to a VNI, which is how VXLAN identifies and separates virtualized networks. Creating a fabric or external network would not directly generate an ip vpn-instance with RD/RTs and a VNI binding. Therefore, the administrator operation was to create a VN named MKT.