Huawei H19-404_V1.0 HCSE-Presales-Campus Network Planning and Design V1.0 Exam Practice Test

Hardware-based encryption is the unambiguously correct statement. MACsec protects Ethernet frames at Layer 2 using AES-GCM-based authenticated encryption. On enterprise switches and routers, the encryption and integrity operations are commonly implemented in forwarding ASICs or dedicated hardware so that frames can be protected at high throughput with low latency.

Option A is incorrect because complex manual configuration is not an inherent requirement. MACsec can use manually configured connectivity-association keys, but IEEE 802.1X MACsec Key Agreement can automate peer authentication, secure-channel establishment, key distribution, and rekeying. The operational complexity therefore depends on the deployment model and management platform.

Option C is also inaccurate. MACsec is media-independent, meaning it can operate over supported copper or fiber Ethernet; however, it does not eliminate the requirement for appropriate Layer 2 connectivity between participating MACsec entities. Standard hop-by-hop MACsec protects Ethernet links or LAN connectivity between peers and is not a general Layer 3 tunneling mechanism.

MACsec supplies Layer 2 confidentiality, integrity, origin authentication, and replay protection. Its encryption can be performed directly in network-device hardware, enabling substantially better forwarding performance than software-only encryption implementations.

SM4 is the supported SM-series cryptographic algorithm intended by this question. SM4 is a standardized symmetric block cipher that uses a 128-bit block size and a 128-bit key. It is suitable for high-volume data encryption because symmetric cryptography can process service traffic efficiently compared with public-key algorithms.

Within an SD-WAN or IPsec context, the bulk traffic carried through secure data channels requires a symmetric encryption algorithm. SM4 can therefore be used as the encryption component of an approved cryptographic suite where compliance with Chinese commercial cryptography requirements is necessary.

SM2 is an asymmetric public-key cryptographic suite used for functions such as digital signatures, key exchange, and public-key encryption. It is not the bulk data-encryption algorithm requested in this item. SM1 is a restricted proprietary algorithm whose implementation details are not publicly standardized in the same manner, while SM5 is not the supported option represented by the Huawei course question.

Huawei’s SD-WAN architecture uses IPsec to protect site-to-site services and supports secure GRE-over-IPsec data channels between edge devices. In the SM-series selection presented here, the correct supported traffic-encryption algorithm is SM4.

==================

A central switch in the relevant passive Ethernet network architecture supports a maximum of 48 access units. The architecture replaces a conventional multi-layer access design with a centralized switch and distributed remote or access units. The access units function as extensions of the central switch’s ports, simplifying device management, configuration, and topology maintenance.

Huawei’s CloudEngine S5731-H fixed central-switch specification provides models with 24 or 48 hybrid optical-electrical downlink ports. The 48-port model can therefore directly manage up to 48 associated access or remote units under the design limits represented by this question. The same hybrid links can provide data transmission and remote PoE power, enabling access units to be installed closer to terminals without requiring conventional active aggregation equipment at every location.

The central switch automatically discovers the topology, while remote units behave as extended ports rather than independently managed switches. This reduces management nodes and simplifies a traditional three-layer network into a two-layer architecture. The larger values of 64, 72, and 96 exceed the supported maximum for the specified central-switch implementation. Therefore, option C is correct.

==================

A terminal-type survey primarily determines the appropriate network admission control solution. Different terminal categories have different authentication capabilities and security requirements. Corporate laptops may support 802.1X authentication, guests may require Portal authentication, and printers, cameras, sensors, and other dumb terminals commonly require MAC-address authentication or automatic terminal identification.

Huawei recommends selecting authentication technologies according to the terminal type and usage scenario. For example, access switches can serve as authentication points for wired dumb terminals, while APs or other access devices can perform authentication for wireless users. After terminal identification is enabled, iMaster NCE-Campus can automatically assign VLANs, ACLs, security groups, QoS parameters, and other authorization policies according to terminal category.

The survey therefore establishes which endpoints support interactive authentication, which require non-interactive admission, and which must receive special isolation or compliance policies. It does not independently determine the complete physical network architecture or the overall O & M platform. Consequently, the terminal survey is used to formulate the network admission control solution, making option C correct.

==================

AFI 1 with SAFI 74 is the correct combination. In Multiprotocol BGP, the Address Family Identifier defines the basic network-layer address family, while the Subsequent Address Family Identifier specifies how the associated NLRI is interpreted. AFI 1 represents IPv4. SAFI 74 is assigned for SD-WAN capabilities and is used to distribute information required for SD-WAN edge discovery and tunnel establishment, including transport and encapsulation-related attributes.

The other combinations represent different forms of reachability information. AFI 1/SAFI 1 is ordinary IPv4 unicast NLRI. AFI 1/SAFI 2 represents IPv4 multicast reachability. AFI 25 represents Layer 2 VPN information, while SAFI 70 represents Ethernet VPN routes; that combination is associated with EVPN rather than the specific SD-WAN capability NLRI requested.

Huawei’s architecture uses BGP-based control channels to exchange transport network port information, IPsec security-association information, and service routes. These parameters allow edge devices to determine peer endpoints and create GRE or GRE-over-IPsec data channels after the relevant service routes trigger tunnel establishment.

==================

Non-authenticated terminals can access a virtual network by using statically configured VLANs. Such terminals may include printers, cameras, sensors, industrial devices, and other dumb terminals that cannot perform 802.1X, Portal, or comparable interactive authentication. Their access interfaces and service VLANs are therefore configured in advance and mapped to the required VN.

Dynamic VLAN authorization requires a completed authentication or identification process. Normally, an authentication server returns a VLAN or other authorization attribute after validating the user or terminal. Because the question specifically refers to non-authenticated terminals, dynamically authorizing a VLAN is not the applicable mechanism. The wired-mode and wireless-mode authorization options are likewise associated with authentication-based policy delivery rather than unconditional VN access.

Huawei’s VN design guidance states that LAN-side physical interfaces and VLANs are assigned to the appropriate departments or services and then associated with corresponding VRFs or VNs. It also explains that a department may use an independent physical interface or share an interface while maintaining isolation through VLANs. Therefore, configuring a static VLAN is the correct method.

==================

Huawei switches’ unauthorized access prevention function can prevent users from connecting unauthorized hubs and sharing network access through unauthorized Wi-Fi hotspots. An unauthorized hub allows multiple terminals to enter the network through a port intended for a single managed endpoint. This can bypass normal terminal-count limitations, admission controls, and access-policy enforcement.

Unauthorized Wi-Fi hotspot sharing occurs when a user connects an authenticated endpoint to the enterprise network and then enables hotspot or connection-sharing functionality. Other terminals can subsequently access the network through that endpoint without completing the required authentication process. Huawei switches can analyze terminal behavior, MAC-address relationships, packet characteristics, and access patterns to identify and restrict this behavior.

A USB flash drive is a local storage device and does not provide Ethernet network access, so option A is unrelated to switch-based unauthorized network access prevention. An unauthorized router is normally controlled through device identification, NAC, port security, or explicit access policies rather than the specific hub and hotspot-sharing prevention function described by this question.

Huawei intelligent terminal management combines terminal identification, authorization, traffic analysis, and bogus-terminal detection to achieve visualized access and prevent unauthorized connectivity.

==================

WIPS is the correct technology because it provides wireless intrusion prevention capabilities, including detecting and containing rogue access points, rogue stations, ad hoc devices, spoofing attempts, flood attacks, and other malicious activity on the radio interface. Huawei’s security-design material groups WIDS and WIPS with wireless attack detection and rogue-device containment. It recommends attack detection in public areas and primary or secondary education environments with high security requirements.

WIDS primarily detects and reports suspicious behavior, while WIPS adds active prevention or containment actions according to the configured policy. The other options serve different purposes. Mesh is a wireless networking architecture used to provide backhaul connectivity or extend coverage between APs; it is not an attack-detection mechanism. Spectrum analysis identifies non-Wi-Fi interference sources and evaluates radio-frequency utilization, but does not provide complete security attack detection and containment. Protected Management Frames protects selected 802.11 management frames against forgery, deauthentication, and disassociation attacks, but it is a protection mechanism rather than the comprehensive detection system requested. Therefore, WIPS is the correct answer.

==================

Authentication points should generally be placed on access devices close to the terminals. For wireless users, the AP or WLAN access device is the natural admission point because it directly controls the station’s wireless association and service access. For wired users, the access switch directly connects the endpoint and can enforce 802.1X, MAC-address authentication, VLAN authorization, ACLs, and security-group policies.

Huawei recommends access devices as authentication points for employees and specifically recommends access switches as authentication points for wired dumb terminals using MAC-address authentication. Deploying enforcement close to endpoints prevents unauthenticated or unauthorized traffic from traversing deeper into the campus network. It also improves fault isolation, policy granularity, and scalability because admission processing is distributed across access devices.

Option A is incorrect. A centralized authentication point can simplify configuration and policy management, but it does not inherently provide higher performance. It can create concentrated processing pressure, enlarge the Layer 2 scope, and allow unauthenticated traffic to travel farther before being evaluated. Therefore, the recommended principles are represented by B, C, and D.

==================

iMaster NCE-Campus primarily improves the operations and maintenance experience in this solution. It provides centralized planning, deployment, configuration, policy orchestration, monitoring, topology management, device management, alarm handling, and maintenance through a unified graphical interface.

Instead of configuring each switch, AP, WAC, firewall, or router separately, administrators can define services and policies centrally and deliver them across the network. Huawei states that iMaster NCE-Campus provides integrated LAN and WAN management, integrated deployment, integrated policies, and integrated O & M, thereby improving deployment and O & M efficiency. It also provides network monitoring, service alarms, file management, log management, device maintenance, user management, and virtual-network management from one platform.

Wireless, wired, and application experience analysis is more directly associated with iMaster NCE-CampusInsight, which uses telemetry, AI, protocol tracing, and predictive analysis to quantify user and application experience. iMaster NCE-Campus serves as the management and control platform that simplifies administrators’ daily work. Therefore, the experience specifically improved by iMaster NCE-Campus is the O & M experience, making option C correct.

==================

The intended answer is AES-256. In certification material, this question normally refers to the enhanced WPA3-Enterprise 192-bit security suite, which uses the GCMP-256 data-protection algorithm based on AES-256, together with stronger integrity and key-management components. AES-512 is not a standardized AES variant, and RC4 is the obsolete stream cipher associated with legacy WEP and TKIP-era protection rather than WPA3.

There is an important technical qualification: WPA3 is a family of certification modes, not one universal cipher suite. WPA3-Personal commonly uses Simultaneous Authentication of Equals for password-authenticated key establishment and requires CCMP-128, which is based on AES-128. WPA3-Enterprise 192-bit mode, however, uses AES-256 in GCM mode. Therefore, the original wording is broader than it should be. A technically precise version would ask which algorithm is associated with the WPA3-Enterprise 192-bit security suite. Under the intended Huawei examination scope and the supplied single-choice options, option B is correct. That distinction is crucial when interpreting this simplified examination item.

==================

All four options represent objectives of a next-generation advanced industrial network. IP-based connections establish a standardized communications foundation, allowing production systems, controllers, sensors, machines, and management platforms to communicate through scalable Ethernet and IP technologies instead of isolated proprietary field networks.

Networked devices extend connectivity across operational technology assets so that equipment status, production data, and control information can be shared across production lines, plants, data centers, and cloud platforms. Network intelligence introduces automated provisioning, telemetry, analytics, fault prediction, policy optimization, and closed-loop operations. These capabilities reduce manual configuration and improve production availability.

Network-security integration is equally essential because greater openness and interconnection increase the potential attack surface. Security must therefore be integrated into access control, segmentation, device identification, encrypted communication, anomaly detection, and policy enforcement rather than added as an isolated external system. Huawei’s broader CloudCampus architecture similarly emphasizes automated provisioning, intelligent O & M, secure interconnection, integrated wired and wireless management, and open network capabilities. The four objectives collectively create an open, connected, intelligent, and secure industrial communications architecture.

==================

The capabilities introduced with Wi-Fi 7 are 4096-QAM and channel bandwidth of up to 320 MHz. Wi-Fi 7, based on IEEE 802.11be Extremely High Throughput, doubles the maximum channel width available under Wi-Fi 6 and Wi-Fi 6E from 160 MHz to 320 MHz where sufficient regulatory spectrum is available. It also introduces 4096-QAM, encoding 12 bits per modulation symbol compared with 10 bits for Wi-Fi 6’s 1024-QAM. This can increase peak spectral efficiency when the signal-to-noise ratio is sufficiently high.

The other options were available before Wi-Fi 7. Support for up to eight spatial streams existed in earlier IEEE 802.11 generations, and MU-MIMO was already supported before Wi-Fi 7, with major uplink and downlink enhancements delivered by Wi-Fi 6. The 6 GHz band was commercially introduced through Wi-Fi 6E. Huawei’s material specifically describes Wi-Fi 6E as extending Wi-Fi 6 into the 6 GHz spectrum. Wi-Fi 7 continues using 6 GHz but did not introduce it. Therefore, only A and C are correct.

==================

Huawei firewalls provide four commonly predefined security zones: Local, Trust, DMZ, and Untrust. The Local zone represents the firewall itself, including traffic generated by or destined for the device, and has the highest default security priority of 100. The Trust zone normally represents an organization’s protected internal network and has a default priority of 85, not 95. Therefore, option C is false.

The DMZ typically hosts public-facing or semi-trusted resources, such as web, email, and application servers. Its default priority is 50, placing it between the trusted internal network and the external untrusted network. The Untrust zone normally represents the Internet or another uncontrolled network and has the lowest predefined priority of 5.

Zone priority expresses the relative security level used to classify inbound and outbound traffic direction; it does not independently permit traffic. Security policies still determine whether matched traffic is allowed or denied. Huawei’s SD-WAN design uses Trust and Untrust zones on CPEs, and iMaster NCE can orchestrate the corresponding zones and firewall policies for Internet-access protection.

==================

Option B is false because a station retains its original IP address during Layer 3 roaming. Preserving the IP address is essential for maintaining active application sessions when the station moves between APs associated with different service VLANs, Layer 2 domains, and gateways. Huawei’s training diagram shows the same station IP address before and after roaming, while the service VLAN changes.

When the STA initially accesses the WLAN, a Home AP or HAP is selected for it. After the STA roams to a Foreign AP, the new AP obtains the station information and establishes the required forwarding relationship with the HAP. In direct-forwarding implementations, the STA’s traffic is encapsulated and forwarded to the HAP, which preserves access through the original network and gateway.

Therefore, A and C accurately describe HAP-based Layer 3 roaming. Option D is also correct: the APs use the same SSID and authentication mode but different service VLANs. The station’s IP address does not change, so B is the false statement.

==================

GRE is a multiprotocol encapsulation mechanism and can carry all the listed packet types. It inserts a GRE header around the original payload and then places the resulting GRE packet inside a delivery-protocol packet. Because the GRE header contains a Protocol Type field identifying the encapsulated payload, GRE is not restricted to ordinary IPv4 unicast traffic.

IPv6 packets can be transported as GRE payloads when supported by the tunnel endpoints. IP unicast traffic is the most common use case. GRE can also carry IP multicast and broadcast packets, which is one of its major advantages over basic IPsec tunnel selectors that traditionally focus on IP unicast traffic. This enables routing protocols, multicast applications, discovery traffic, and other non-unicast services to operate across a logical point-to-point tunnel.

RFC 2784 defines GRE as a general mechanism for encapsulating an arbitrary network-layer protocol over another network-layer protocol. It also defines the Protocol Type field used to identify the carried payload. Huawei uses GRE as an SD-WAN overlay data-channel option and can additionally secure it using IPsec when confidentiality and integrity are required.

==================

Huawei SD-WAN provides all four technologies. Per-flow load balancing distributes separate application flows among multiple links that have the same priority and satisfy the required SLA. Per-packet load balancing can transmit packets from one flow across multiple eligible links, improving aggregate bandwidth utilization for large file transfers, backups, and replication.

Multi-fed and selective receiving duplicates critical traffic across different links. The receiving device selects valid packets, removes duplicates, and preserves packet order. Packet loss or failure on one path therefore does not interrupt the service, enabling zero-millisecond link switchover in applicable deployments.

A-FEC dynamically generates redundant packets and adjusts the redundancy ratio according to measured packet loss. The receiving device reconstructs lost packets, reducing video freezing and voice-quality deterioration. Huawei describes both adaptive FEC and multi-fed selective receiving as WAN-optimization mechanisms for key traffic.

Intelligent traffic steering selects links according to application identity, quality, bandwidth, priority, and load. Therefore, A, B, C, and D are all correct.

==================

Broadcast TWT, Individual TWT, and Implicit TWT are valid Target Wake Time concepts. Individual TWT establishes a wake schedule between an AP and a specific station. Broadcast TWT advertises scheduling information that multiple stations can use, reducing individual negotiation overhead and coordinating groups of devices. An implicit TWT agreement defines a repeating schedule in which subsequent wake times are calculated from the agreed wake interval instead of being renegotiated for every service period.

These mechanisms allow stations, particularly battery-powered IoT devices, to sleep for predictable periods and wake only when transmission or reception is scheduled. TWT consequently reduces power consumption, channel contention, collisions, and unnecessary medium access in dense WLAN environments. Research describing IEEE 802.11ax TWT confirms that the mechanism schedules station transmission periods and allows stations to remain asleep outside their negotiated service periods.

“Multicast TWT” is not one of the standard TWT concepts represented by this question. Broadcast scheduling can cover multiple stations, but that does not create a separate mechanism formally identified here as Multicast TWT. Therefore, the correct answers are A, B, and C.

==================