H12-841_V1.5 Practice Questions

In HCIP Datacom Campus Network security design,port securityis used to limit the number of MAC addresses that can be learned on an access interface, preventing unauthorized device access and MAC address spoofing. When the number of learned MAC addresses reaches the configured upper limit, the switch behavior depends on the configuredviolation mode.

One possible action isshutdown mode, where the switch sets the interface to an error-down state and generates an alarm. This corresponds to option

A.  

Another supported behavior isprotect mode, in which the switch silently discards packets from unknown source MAC addresses after the limit is reached. No alarms are generated in this case, which matches option

C.  

Therestrict modeis also supported. In this mode, the switch discards packets with unknown source MAC addresses and generates an alarm or log entry, corresponding to option

D.  

Option B is incorrect because when an interface enters the error-down state due to a port security violation, an alarm or log notification is always generated according to HCIP Datacom Campus Network behavior. Therefore, the valid actions are A, C, and

D.  

In a VXLAN-based virtualized campus network, planning is divided intounderlay,fabric, andoverlaylayers, each with clear responsibilities:

Fabric Design → Border Node DesignFabric design focuses on the VXLAN fabric structure and roles of fabric nodes.Border nodesare a core part of the fabric, responsible for VXLAN encapsulation/decapsulation, policy enforcement, and traffic exit/entry between the VXLAN fabric and external networks. Therefore, Border Node Design belongs to Fabric Design.

Overlay Network Design → VN Access DesignVN Access Design defines how users and terminals access different Virtual Networks (VNs), including VLAN-to-VN mapping and authentication-based access. These are overlay-layer service constructs.

Overlay Network Design → VN Interwork DesignVN Interwork Design focuses on communication between different VNs (for example, inter-VN routing and security group policy control), which is a classic overlay function.

Overlay Network Design → External Network DesignExternal Network Design defines how overlay VNs communicate with non-VXLAN external networks, which is also an overlay service behavior implemented through border nodes.

This mapping strictly follows Huawei HCIP Datacom Campus Network VXLAN planning methodology.

In HCIP Datacom Campus Network VXLAN architecture, VXLAN tunnels are classified based onhow the tunnel endpoints are created and maintained, which is referred to as the VXLAN tunnel creation mode. According to Huawei VXLAN design principles, there aretwo valid VXLAN tunnel types: static VXLAN tunnels and dynamic VXLAN tunnels.

Astatic VXLAN tunnelis manually configured by an administrator. In this mode, the source VTEP IP address, destination VTEP IP address, and related parameters are explicitly specified on devices. Static VXLAN tunnels are typically used in small-scale networks or test environments where the number of VTEPs is limited and network topology is simple. However, static configuration lacks scalability and flexibility, making it unsuitable for large campus fabrics.

Adynamic VXLAN tunnelis automatically created based on control-plane learning mechanisms, such asBGP EVPN. In this mode, VTEPs learn remote VTEP IP addresses dynamically through EVPN route advertisements (for example, Type 3 routes). When a remote VTEP becomes reachable at the underlay Layer 3 level, the VXLAN tunnel is automatically established without manual intervention. This mode is widely used in modern campus and data center networks due to its scalability and automation capabilities.

Options A and D are incorrect becausestatelessandstatefulare not official VXLAN tunnel creation classifications in Huawei’s VXLAN implementation. VXLAN itself is an encapsulation mechanism, and tunnel state is not categorized in this manner.

Therefore, the correct VXLAN tunnel types based on creation mode arestatic VXLAN tunnels and dynamic VXLAN tunnels.

In the Huawei free mobility solution based on iMaster NCE-Campus,IP-security groupsare used to associate user identities with IP addresses so that consistent security policies can be enforced regardless of user location. Apolicy enforcement point (PEP)must obtain IP-security group entries to correctly match traffic against security policies.

When the policy enforcement pointis not an authentication point, it cannot directly learn user identity information during access authentication. In this scenario, one supported method is to configureIP-security group entry subscriptionon iMaster NCE-Campus. After subscription is configured, iMaster NCE-Campus pushes the corresponding IP-security group entries to the policy enforcement point, which matches option

A.  

Another valid approach in this case is described in option

B.  

If the policy enforcement pointalso functions as an authentication point, it can directly interact with iMaster NCE-Campus. In this scenario, iMaster NCE-Campusproactively pushes IP-security group entriesto the device, as stated in option

C.  

Option D is incorrect because iMaster NCE-Campus does not push IP-security group entries indiscriminately in all scenarios. The distribution mechanism depends on the role of the device and whether subscription or authentication-based pushing is configured.

Therefore, the correct answers are A, B, and

C.