H12-841_V1.5 Sample Questions Answers

In a virtualized campus network managed byiMaster NCE-Campus, traffic control between users or user groups is implemented throughsecurity groupsand apolicy control matrix. The configuration shown clearly reflects this mechanism.

The ACL usesucl-group names, such asResearch_Group,Sales_Group, andGuest_Group. These ucl-groups correspond tosecurity groupsdefined on iMaster NCE-Campus. The ACL rules explicitly permit IP traffic from one security group to other security groups. This type of ACL is automatically generated and delivered by the controller when apolicy control matrixis deployed.

A policy control matrix defineswho can access whomby specifying allow or deny relationships between security groups. Once the matrix is configured on iMaster NCE-Campus, the controller translates these logical policies into device-level ACLs and applies them to the appropriate enforcement points in the VXLAN fabric. The presence of multiple rules permitting traffic from one group to multiple destination groups is a typical outcome of deploying such a matrix.

Creating a security group alone would not generate ACL rules. Deploying inter-VN communication would involve route exchange or gateway configuration, not ucl-group–based ACLs. Creating an authorization result would associate users with security groups but would not generate inter-group ACL rules.

Therefore, the administrator operation that resulted in this configuration wasdeploying a policy control matrix, making optionAthe correct answer.

According to HCIP Datacom Campus Network architecture principles, campus networks can be classified from multiple dimensions to support scientific planning, design, and deployment. These classification methods help network designers select appropriate architectures, devices, and technologies based on actual service requirements.

Network scaleis a primary classification dimension. Campus networks are commonly divided into small, medium, and large-scale networks based on the number of users, terminals, access points, and network devices. This classification directly influences topology design, such as whether a simple two-layer architecture or a more scalable three-layer architecture is required.

Served objectsis another important classification method. Campus networks may serve office users, guests, teaching staff, students, production terminals, IoT devices, or video surveillance systems. Different served objects have different requirements for bandwidth, security, and access control, making this dimension critical for policy and service design.

Access moderefers to how users and devices connect to the campus network, including wired access, wireless access, or a hybrid of both. This classification impacts WLAN planning, authentication methods, and network access control strategies.

Service complexityreflects the types and number of services carried by the network. A campus network may provide basic data services or support complex services such as voice, video, cloud access, and industry applications. Higher service complexity requires more advanced network design and management capabilities.

Therefore, all listed options are valid classification methods for campus networks.

iMaster NCE-Campus adopts amulti-plane architectureto improve system security, scalability, and operational stability. The planes are logically isolated so that different types of traffic and functions do not interfere with each other. The two most commonly referenced planes are themanagement planeand theservice plane.

Themanagement planeis mainly responsible for system-level operations such as device registration, controller maintenance, system management, and internal communication between system components. For this purpose, it uses a dedicated access interface and port number to ensure secure and stable management connectivity.

Theservice plane, on the other hand, is designed fordaily network service operations. Administrators access this plane to perform tasks such as campus network planning, configuration delivery, monitoring, alarm viewing, and intelligent O&M operations. To keep service access independent and secure, the service plane uses its own dedicated login port.

According to HCIP Datacom Campus Network documentation, theservice plane of iMaster NCE-Campus uses port 18009. Administrators log in to the service plane by accessing the service IP address together with this port number. This separation ensures that service operations remain available even when management-plane functions are restricted or under maintenance.

Therefore, the correct port number for theservice planeis18009, making optionBthe correct answer.

Encapsulating Security Payload (ESP) is one of the core protocols of the IPsec framework and is widely used in Huawei campus and SD-WAN network solutions to provide secure data transmission. ESP operates directly over IP and is identified by a uniqueIP protocol number, which allows network devices to recognize and process ESP packets correctly.

According to HCIP Datacom Campus Network documentation and standard IP protocol definitions,ESP uses protocol number 50. ESP provides essential security services such as data confidentiality through encryption, data integrity verification, authentication, and anti-replay protection. It can operate in bothtransport modeandtunnel mode, making it suitable for scenarios such as site-to-site VPNs and remote access VPNs.

The other options listed are incorrect.Protocol number 47is used by GRE (Generic Routing Encapsulation), which is a tunneling protocol and does not provide encryption.Protocol number 51is assigned to AH (Authentication Header), another IPsec protocol that provides integrity and authentication but does not support encryption.Protocol number 102is not associated with ESP or commonly used IPsec-related protocols.

Correct identification of ESP traffic using protocol number 50 is critical for firewall configuration, security policy enforcement, and proper forwarding of encrypted traffic in campus and WAN environments. Therefore, the correct answer is50, which corresponds to optionB.

iMaster NCE-CampusInsight is anintelligent O&M analysis componentin Huawei’s CloudCampus Solution, designed to provide deep visibility, experience assurance, and fault diagnosis based onreal service traffic and user behavior. The statement is incorrect because CampusInsight doesnot rely on SNMP technologyto achieve its core capabilities.

According to HCIP Datacom Campus Network documentation, traditional SNMP is mainly used for basic device monitoring, such as interface status, CPU usage, memory usage, and simple alarms. SNMP focuses ondevice-level metricsand does not provide sufficient granularity to analyze application performance, user experience, or end-to-end service paths.

In contrast, iMaster NCE-CampusInsight usestelemetry, traffic sampling, flow analysis, and packet-level inspection technologiesto collect real-time and fine-grained data directly from network devices. These technologies allow CampusInsight to analyzeactual service traffic, identify application behavior, locate faults across the network path, and proactively detect network exceptions that affect user experience.

CampusInsight correlates data such as flow information, latency, packet loss, and service reachability to perform intelligent analysis and root cause identification. This enables capabilities like application experience assurance, abnormal traffic detection, and proactive fault prediction, which are beyond the scope of SNMP-based monitoring.

Therefore, because iMaster NCE-CampusInsight does not use SNMP as its primary data collection method and instead relies on advanced telemetry and traffic analysis technologies, the statement isFALSE.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

Huawei iMaster NCE-Campus supports multiplelicense business modelsto meet different customer deployment and commercial requirements.

TheGlobal perpetual license (N1 mode)is a traditional licensing model where licenses are purchased once and permanently authorized. It is commonly used in on-premises controller deployments and is therefore a supported model, makingoption A correct.

TheTenant Subscription license (SaaS mode)is designed for cloud-based deployments, especially in MSP or enterprise scenarios using Huawei Cloud services. In this model, tenants subscribe to services on a periodic basis, aligning with the SaaS delivery approach. This is a valid and supported licensing model, makingoption B correct.

TheGlobal perpetual license (a-la-carte mode)allows customers to flexibly purchase specific functional modules according to their needs rather than buying a bundled license. This model is also supported by iMaster NCE-Campus and is widely used for customized deployments, makingoption C correct.

TheGlobal subscription license (IaaS mode)is not a defined licensing business model for iMaster NCE-Campus. IaaS refers to infrastructure-level cloud services rather than application-level controller licensing. Therefore,option D is incorrect.

Hence, the correct answers are A, B, and C.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In a VXLAN-based virtualized campus network, theunderlay networkis responsible for providing basic IP connectivity between VXLAN Tunnel Endpoints (VTEPs). Statement D correctly describes this fundamental role of the underlay. Statement C is also correct, as VXLAN usesMAC-in-UDP encapsulationto overlay Layer 2 networks on top of a traditional IP infrastructure.

When iMaster NCE-Campus is used for automatic orchestration of the underlay routing domain,multiple routing protocols can be supported, depending on the solution version and design. Therefore, statementA is false, because OSPF is not the only supported routing protocol.

Statement B is correct in the context of standard automated deployment: iMaster NCE-Campus supportsOSPF single-area deploymentfor simplified orchestration and maintenance of the underlay network.

According to HCIP Datacom Campus Network architecture principles, the underlay must be stable, simple, and highly available, but it is not limited to a single routing protocol. Thus,option Ais the incorrect statement and the correct answer.

The displayed entries match the format of EVPN routes that carryVTEP reachability informationrather than host MAC/IP bindings or IP prefixes. The key clue is the field naming style shown asNetwork(EthTagId/IpAddrLen/OriginalIp)along with values like0:32:1.1.1.0, which indicates an IP address with a /32 length carried as the “OriginalIp”. In Huawei VXLAN BGP EVPN implementations described in HCIP Datacom Campus Network materials, this type of information corresponds toEVPN Route Type 3 (Inclusive Multicast Ethernet Tag Route).

Type 3 routes are used by VTEPs to signal membership information for a broadcast domain and to supportBUM (Broadcast, Unknown unicast, Multicast)forwarding behavior in the VXLAN fabric. Practically, they also provide the remote VTEP IP information needed so that, once the underlay can reach that VTEP IP address at Layer 3 (for example via IGP/BGP underlay routes), the local device can establish VXLAN encapsulation forwarding to that peer.

By contrast,Type 2routes would display MAC address information (and possibly a host /32 IP together with the MAC), andType 5routes would show IP prefixes like /24 or /30 used for inter-subnet routing.Type 1routes are related to Ethernet segments for multihoming (ESI), which is not what this output shows. Therefore, only statement A is true.

In BGP EVPN-based VXLAN networks, route advertisement follows clearly defined standards regarding how endpoint and tunnel information is carried. According to HCIP Datacom Campus Network documentation,BGP EVPN does not use an EVPN Router MAC Extended Community to advertise the Router MAC of a VTEP. This statement is therefore incorrect.

In EVPN, different route types serve specific purposes. For example,EVPN Route Type 2 (MAC/IP Advertisement routes)are used to advertise MAC addresses (and optionally IP addresses) of endpoints. These routes associate endpoint information with a VTEP by using theBGP next-hop attribute, which contains the VTEP IP address. Similarly,EVPN Route Type 3 (Inclusive Multicast Ethernet Tag routes)also relies on the BGP next hop to identify the VTEP for VXLAN tunnel establishment and BUM traffic forwarding.

The Router MAC of a VTEP is alocal forwarding attribute, primarily used during VXLAN encapsulation and decapsulation on the device itself. It is not distributed through EVPN extended communities. While EVPN does define several extended communities for control and policy purposes, there is no standard or HCIP-defined “EVPN Router MAC Extended Community” used to carry the Router MAC field of a VTEP during route advertisement.

Therefore, based on HCIP Datacom Campus Network VXLAN EVPN principles, the statement is false.

In a VXLAN BGP EVPN deployment, interconnection between Layer 2 and Layer 3 networks relies onIntegrated Routing and Bridging (IRB). According to HCIP Datacom Campus Network documentation, for a VPN instance to advertise its IP routes to the BGP EVPN control plane, the device must explicitly enable IRB route advertisement in the BGP view.

Theadvertise irbcommand is used to allow IP routes learned in a VPN instance to be advertised as EVPN Type 5 (IP Prefix) routes. These routes enable communication between different VNIs or between VXLAN segments and external Layer 3 networks. Without this command, the VPN instance routes remain local and are not distributed through the EVPN control plane, preventing proper Layer 3 connectivity across the VXLAN fabric.

The other options are incorrect in this context. Theadvertise vpnv4command is used in traditional MPLS VPN scenarios, not in BGP EVPN-based VXLAN networks. Theadvertise irbv6command is specific to IPv6 IRB scenarios and does not apply to IPv4 route advertisement unless explicitly required. Theadvertise l2vpn evpncommand is used to enable the EVPN address family itself but does not control the advertisement of IP routes from a VPN instance.

Therefore, to enable a VPN instance to advertise IP routes to the BGP EVPN address family in a VXLAN network, the correct command isadvertise irb.

In small- and medium-sized campus networks, the Huawei CloudCampus Solution focuses onsimple, flexible, and easy-to-manage traffic control mechanismsthat align with wireless access characteristics. According to HCIP Datacom Campus Network documentation, several rate limiting modes are supported to ensure fair bandwidth usage and stable user experience in WLAN environments.

Radio-based rate limitingis supported and commonly used in small and medium campuses. This mode limits the total bandwidth available on a radio interface, preventing congestion when multiple users access the same radio. It is especially effective in high-density wireless scenarios where multiple terminals compete for limited wireless resources.

SSID-based rate limitingis also supported. This allows administrators to limit bandwidth per SSID, ensuring that different wireless services—such as guest access and internal employee access—receive appropriate bandwidth allocations. This method is easy to configure and aligns well with service-oriented WLAN design.

User-based rate limitingis another supported mode. It enables bandwidth control on a per-user basis, ensuring fair usage among users and preventing individual users from consuming excessive bandwidth. This approach is particularly useful in environments like classrooms, retail stores, or offices.

ACL-based rate limiting, however, is not typically used or recommended in small- and medium-sized CloudCampus WLAN scenarios. ACL-based rate limiting is more complex and is generally applied in wired or advanced traffic engineering environments rather than simplified campus WLAN deployments.

Therefore, the supported rate limiting modes areRadio-based,SSID-based, andUser-based, makingA, C, and Dthe correct answers.

In the Huawei free mobility solution based on iMaster NCE-Campus,IP-security groupsare used to associate user identities with IP addresses so that consistent security policies can be enforced regardless of user location. Apolicy enforcement point (PEP)must obtain IP-security group entries to correctly match traffic against security policies.

When the policy enforcement pointis not an authentication point, it cannot directly learn user identity information during access authentication. In this scenario, one supported method is to configureIP-security group entry subscriptionon iMaster NCE-Campus. After subscription is configured, iMaster NCE-Campus pushes the corresponding IP-security group entries to the policy enforcement point, which matches option A.

Another valid approach in this case is described in option B. If the authentication point and policy enforcement point are separate devices, theauthentication point can push IP-security group entriesto the policy enforcement point after successful user authentication. This ensures that enforcement devices receive real-time identity information.

If the policy enforcement pointalso functions as an authentication point, it can directly interact with iMaster NCE-Campus. In this scenario, iMaster NCE-Campusproactively pushes IP-security group entriesto the device, as stated in option C.

Option D is incorrect because iMaster NCE-Campus does not push IP-security group entries indiscriminately in all scenarios. The distribution mechanism depends on the role of the device and whether subscription or authentication-based pushing is configured.

Therefore, the correct answers are A, B, and C.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

The Huawei CloudCampus Solution adopts afour-layer architecture, not a three-layer one. According to HCIP Datacom Campus Network documentation, the architecture consists of theterminal layer,network layer,management and control layer, andapplication layer.

Theterminal layerincludes user devices such as PCs, mobile terminals, IoT devices, and other endpoints that access the campus network. Thenetwork layeris responsible for data forwarding and includes access, aggregation, and core network devices. Themanagement and control layer, represented by platforms such as iMaster NCE-Campus, provides centralized management, automation, policy control, and orchestration. Theapplication layerdelivers value-added services and business applications.

Because the terminal layer is an essential and explicitly defined component of the CloudCampus architecture, stating that the solution has only three layers is incorrect. Therefore, the statement isFALSE, making optionBthe correct answer.

In a VXLAN BGP EVPN architecture,EVPN Type 5 routes, also known asIP Prefix routes, are used to advertiseLayer 3 reachability informationbetween VXLAN segments. These routes are essential for implementing inter-VNI communication and external network connectivity through distributed or centralized gateways.

According to HCIP Datacom Campus Network documentation, a Type 5 route carriesIP prefix information, including theIP prefix and its prefix length, allowing VTEPs to learn network-level routing information rather than host-level details. TheRoute Distinguisher (RD)is also included to ensure uniqueness of routes across different VPN instances, which is critical in multi-tenant environments. Additionally, thegateway IP addressis carried to identify the next-hop gateway responsible for forwarding traffic toward the advertised prefix.

Unlike EVPN Type 2 routes, which advertiseMAC address and optional host IP address information, Type 5 routes donotcarry MAC addresses. Type 5 routes operate purely at the Layer 3 level and are independent of Layer 2 forwarding. Their purpose is to exchange subnet-level routing information rather than endpoint-level details.

MAC addresses are only relevant for Layer 2 forwarding and ARP/ND suppression, which are functions of EVPN Type 2 routes. Including MAC information in Type 5 routes would be unnecessary and inefficient for Layer 3 routing purposes.

Therefore, the field that isnot carriedin a BGP EVPN Type 5 route is theMAC Address, making optionCthe correct answer.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

To prevent users from accessing the network using statically configured IP addresses, Huawei campus networks rely on a combination ofDHCP SnoopingandIP Source Guard (IPSG). DHCP Snooping works by monitoring DHCP message exchanges and building atrusted binding tablethat records legitimate IP–MAC–VLAN–interface mappings learned dynamically from a legal DHCP server. This binding table becomes the foundation for several Layer 2 security mechanisms.

IP Source Guard uses the DHCP Snooping binding table to strictly control traffic entering an interface. When IPSG is enabled, the switch permits only packets whose source IP address and MAC address match an entry in the DHCP Snooping binding table. If a user manually configures a static IP address, no valid DHCP binding exists for that host, so IPSG drops the traffic and denies network access. This directly prevents statically configured IP addresses from being used to access the network.

Dynamic ARP Inspection (DAI) focuses on preventing ARP spoofing and man-in-the-middle attacks, not static IP misuse. Port Security limits MAC addresses per interface but does not verify IP address legitimacy. Therefore, neither DAI nor Port Security alone can prevent users from assigning static IP addresses.

According to HCIP Datacom Campus Network security design principles,only the combination of DHCP Snooping and IPSGeffectively enforces IP address legitimacy and blocks statically configured IP access, making optionCthe correct answer.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In astatic VXLAN tunneldeployment, Huawei devices use anNVE (Network Virtualization Edge) interfaceas the logical tunnel interface for VXLAN encapsulation and decapsulation. The NVE interface represents the VTEP and does not have a one-to-one relationship with Bridge Domains (BDs) or VXLAN tunnels.

AnNVE interface can be associated with multiple VNIs, each corresponding to a different BD. Therefore, when multiple BDs exist on a VTEP,only one NVE interface is required, makingstatement B correctandstatement A incorrect.

In static VXLAN, thedestination VTEP addressesare specified usingingress replication listsunder each VNI. This allows a single NVE interface to establishmultiple VXLAN tunnelsto different remote VTEPs. As a result, there is no requirement to create a separate NVE interface for each tunnel, makingstatement D correctandstatement C incorrect.

According to HCIP Datacom Campus Network VXLAN configuration principles, the correct practice is to createone NVE interface per VTEP, associate multiple VNIs with it, and define remote peers through ingress replication. Therefore, the correct answers areB and D.

In the Huawei CloudCampus Solution,device registrationis a key step that allows network devices such as switches, routers, and APs to establish a trusted management relationship withiMaster NCE-Campus. When a device is powered on and configured for cloud or controller-based management, it sends a registration request to the controller using a predefined service port.

According to HCIP Datacom Campus Network documentation,port 18008is used as thedestination portfor device registration requests sent to iMaster NCE-Campus. This port is specifically reserved for device onboarding and registration services, ensuring secure and standardized communication during the initial connection phase. Once the registration is successful, the controller can authenticate the device, assign it to a site, and push management and service configurations.

The other options are not correct in this context.Port 53is used for DNS services and has no role in controller registration.Port 179is used by BGP for routing protocol communication and is unrelated to device management.Port 10020is commonly associated with other management or telemetry functions but is not used for device registration in CloudCampus solutions.

Correctly configuring network connectivity and firewall rules to allow traffic to destination port18008is essential for successful zero-touch provisioning and automatic onboarding of devices. Therefore, the correct destination port number for device registration requests to iMaster NCE-Campus is18008, making optionDthe correct answer.

In a Huawei virtualized campus network managed byiMaster NCE-Campus,Fit APs do not go online immediatelyafter being added to the management platform. According to HCIP Datacom Campus Network documentation, Fit APs depend on awireless access controller (AC)for control, configuration delivery, and service provisioning. Simply adding a Fit AP to iMaster NCE-Campus only completes thedevice registration step, not the full service enablement process.

After a Fit AP is added, several additional steps are required before it can go online and provide wireless services. First, the AP must successfullydiscover and establish a control tunnel with the AC. Then, the AP typically needs to beapproved, assigned to a site, and bound to the correctAP group. Configuration data such as radio parameters, SSIDs, security policies, and authentication profiles must also be delivered from the AC to the AP.

In addition, firmware version checks or upgrades may occur during the onboarding process to ensure compatibility with the controller and management platform. Only after these steps are completed can the Fit AP enter thenormal online stateand start providing WLAN services.

This multi-step process ensures centralized control, consistent configuration, and reliable operation across large-scale campus networks, but it also means Fit APs cannot immediately go online upon being added to iMaster NCE-Campus.

Therefore, the statement is incorrect, and the correct answer isFALSE.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

IPsec defines two standard encapsulation modes that determine how IP packets are protected during transmission:Tunnel modeandTransport mode. Tunnel mode encapsulates the entire original IP packet within a new IP header and is typically used forsite-to-site VPNs. Transport mode encrypts only the payload of the IP packet and is commonly used forhost-to-host communication.

Switching mode and routing mode are not valid IPsec encapsulation modes and are unrelated to IPsec protocol behavior.

According to HCIP Datacom Campus Network documentation, onlyTunnel mode and Transport modeare supported in IPsec, makingoptions B and C correct.

In a CloudCampus VXLAN fabric,node role planningis a fundamental design task that directly affects scalability, performance, and manageability. Huawei defines clear roles for fabric nodes, includingedge nodes,border nodes, and optionallyroute reflectors (RRs).

Statements A, B, and C correctly describe recommended design practices. Core devices are commonly deployed asborder nodesbecause they have higher performance and are well suited to connect the VXLAN fabric to external networks such as WANs or data centers. Access or aggregation devices acting asedge nodesenable end-to-end VXLAN automation and allow user traffic to be encapsulated and decapsulated close to the access layer. Additionally, when external networks exist in different physical locations, deployingmultiple border nodesimproves reliability and optimizes traffic paths.

Statement D is incorrect. In a VXLAN network usingBGP EVPN with route reflectors,edge nodes do not need to establish BGP peer relationships with each other. Instead, edge nodes establish BGP EVPN peer relationshipsonly with the RR, which centrally reflects EVPN routes to other nodes. This design significantly reduces the number of BGP sessions and improves scalability in large networks. Border nodes may also peer with the RR, but full-mesh peering between edge nodes is not required.

Therefore, the false statement isD, making it the correct answer.

HuaweiCloudEngine S series switchesare designed for modern campus access scenarios that require flexible device deployment, especially for wireless APs, IP phones, cameras, and IoT terminals. According to HCIP Datacom Campus Network documentation, these switches supportPoE long-distance power supply, allowing power and data to be transmitted overCat5e Ethernet cables for distances of up to 200 metersunder specific conditions.

Traditionally, standard Ethernet transmission and PoE delivery are limited to 100 meters. However, Huawei CloudEngine S series switches introducePoE Long Distance (PoE LD) mode, which extends the maximum transmission distance while maintaining stable power delivery and communication. This capability is particularly valuable in campus environments such as schools, hospitals, warehouses, and outdoor corridors, where powered devices may be located far from access switches.

When PoE long-distance mode is enabled, the switch optimizes signal transmission and power output to ensure reliable operation over extended cabling. This reduces the need for additional intermediate switches or power supplies, simplifying network architecture and lowering deployment and maintenance costs.

It is important to note that this feature applies to supported CloudEngine S models and compliant powered devices, and appropriate cable quality such as Cat5e is required. Within these design constraints, CloudEngine S series switches are fully capable of delivering PoE over distances up to 200 meters.

Therefore, the statement is correct, and the answer isTRUE.

In Huawei campus networks, user access authentication is implemented through a standardized AAA framework that supports flexible authentication, authorization, and accounting methods. Statements A, B, and D correctly describe the authentication configuration process defined in HCIP Datacom Campus Network documentation. Administrators must first identify user domains and corresponding AAA schemes to ensure users are authenticated using appropriate methods. This is a foundational step for implementing network access control.

Access profiles and authentication profiles work together to define how users are authenticated. An authentication profile specifies the authentication mode, such as 802.1X or MAC authentication, while the access profile defines access control behavior. Binding these profiles and applying them to interfaces or VAP profiles enables consistent enforcement of access policies across wired and wireless networks.

When external authentication servers such as RADIUS or HWTACACS are used, interconnection parameters—including server IP addresses, shared keys, and ports—must be configured within the AAA scheme. This ensures reliable communication between network devices and authentication servers.

Statement C is false becauseiMaster NCE-Campus does support interconnection with third-party RADIUS servers. This capability allows enterprises to integrate existing authentication systems with Huawei campus solutions, improving compatibility and deployment flexibility. Therefore, the incorrect statement is option C.

Comprehensive and Detailed Explanation (200–250 words):

In a VXLAN-based virtualized campus network, user terminals located in different access locations communicate with each other overVXLAN tunnelsestablished between VXLAN Tunnel Endpoints (VTEPs). These VXLAN tunnels form the overlay network, which abstracts the physical underlay and enables flexible Layer 2 and Layer 3 connectivity across the campus.

When communication is confined within the virtualized campus network, traffic remains inside the VXLAN overlay and is encapsulated and forwarded between VTEPs. However, when users or services inside the VXLAN network need to accessexternal networks, such as traditional IP networks, the Internet, or data centers that do not support VXLAN, traffic must exit the VXLAN overlay. This function is performed byborder nodes.

Border nodes act as the boundary between the VXLAN overlay and non-VXLAN networks. They are responsible for VXLAN encapsulation and decapsulation, routing between VXLAN segments and external networks, and enforcing security and policy controls at the network edge. According to HCIP Datacom Campus Network architecture principles, all traffic entering or leaving the VXLAN-based campus must pass through border nodes to ensure proper routing, policy enforcement, and service control.

Therefore, the statement is TRUE, and option A is correct.

iMaster NCE-Campus classifies network alarms into different severity levels to help administrators quickly understand the health status of the campus network and take appropriate actions. According to HCIP Datacom Campus Network documentation, alarms are typically categorized intocritical,major,warning, andinformationallevels, each represented by a distinct icon and color in the management interface.

In the displayed alarm summary, four types of icons are shown with corresponding numbers. Thered flame iconrepresents critical alarms, and the number next to it is0, indicating no critical alarms. Theorange lightning iconrepresents major alarms, and the number displayed is5, indicating five major alarms. Theyellow exclamation mark iconrepresentswarning alarms, and the number next to it is1. Finally, theblue information iconrepresents informational alarms, with a total of10.

Warning alarms indicate potential issues that do not immediately affect network operation but may develop into more serious problems if not addressed. These alarms require administrator attention but are less urgent than critical or major alarms. Accurately identifying the number of warning alarms helps prioritize troubleshooting and maintenance tasks.

Since the yellow warning icon shows the number1, this means there isone warning alarmcurrently generated on the network. Therefore, the correct answer is1, corresponding to optionB.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In a CloudCampus VXLAN fabric, theglobal resource poolcentrally manages identifiers such as VLANs, VNIs, and bridge domains to ensure consistent allocation across the fabric.

StatementAis correct because abridge domain (BD)is the VXLAN equivalent of a VLAN and represents a Layer 2 broadcast domain used for packet forwarding within a VXLAN network.

StatementCis also correct. AVXLAN Network Identifier (VNI)uniquely identifies a VXLAN segment and is a core VXLAN forwarding identifier.

StatementDis correct because theservice VLAN poolis used to allocate VLANs for multiple purposes, including external gateway interconnections, network service resource interconnections, policy association management, and VN access VLANs.

StatementBis false. VLANs used forunderlay device interconnectionsarenot allocated from the VLAN resource poolmanaged by the VXLAN fabric. Underlay VLANs belong to the traditional IP underlay network and are typically planned and configured independently. The VLAN resource pool is intended for overlay-related services and fabric-managed VLAN usage only.

Therefore, the incorrect statement isB.

In a centralized VXLAN gateway architecture, all inter-subnet traffic is forwarded to a centralized Layer 3 gateway, typically deployed on a core or aggregation device. This design simplifies network planning, gateway configuration, and policy enforcement because routing, security, and traffic control are all handled at a single centralized point. From an operational perspective, deployment and management are straightforward, which makes centralized gateways suitable for small- to medium-sized campus networks or environments with limited endpoints.

However, according to HCIP Datacom Campus Network documentation, this architecture introduces scalability limitations. Since the centralized gateway performs Layer 3 forwarding for all VXLAN segments, it must maintain ARP entries for every terminal in the network. As the number of endpoints increases, the ARP table on the Layer 3 gateway grows rapidly. Hardware resources such as memory and processing capacity limit the maximum number of ARP entries that can be supported.

In large-scale campus scenarios with a high density of terminals—such as universities, hospitals, or enterprise office campuses—this ARP scalability bottleneck can impact performance and stability. Excessive ARP entries may lead to increased CPU utilization, delayed ARP resolution, and reduced forwarding efficiency. For such environments, HCIP Datacom recommends distributed VXLAN gateways, which distribute ARP and routing responsibilities across multiple devices. Therefore, the statement is correct, and the centralized VXLAN gateway is not suitable for scenarios with a large number of terminals.

In iMaster NCE-Campus–based virtualized campus networks,user network segmentsare logical subnets created within aVirtual Network (VN)to provide Layer 2 or Layer 3 connectivity for users. HCIP Datacom Campus Network documentation describes multiple flexible methods for creating these network segments during VN deployment, allowing administrators to balance efficiency and control.

Administrators canmanually create user network segments one by one, which is suitable for small-scale deployments or scenarios requiring precise customization of subnet parameters such as gateway address, VLAN, and IP pool. This method provides maximum control but is less efficient for large networks.

For medium- or large-scale deployments,batch import using templatesis widely supported and recommended. Templates allow administrators to define network segment parameters in advance and import multiple segments at once, significantly improving deployment efficiency and reducing configuration errors.

Another supported method isautomatic batch allocation, where iMaster NCE-Campus automatically allocates VNIs, VLANs, and IP resources from predefined resource pools. This method is commonly used in VXLAN Fabric deployments and enables fast, standardized VN provisioning with minimal manual input.

However,directly invoking user network segments from the global fabric resource poolis not supported during VN creation. The global resource pool is used for automatic allocation reference but does not allow direct binding of pre-created segments to a VN.

Therefore, the valid methods aremanual creation,template-based batch import, andautomatic batch allocation, making optionsA, B, and Dcorrect.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

Huawei iMaster NCE-Campus supports advanced networking solutions tailored for industry-specific scenarios, including thefinancial SD-WAN SRv6 solution. This solution leverages Segment Routing over IPv6 (SRv6) to enable precise traffic steering, deterministic forwarding, and end-to-end service scheduling across the network.

Because SRv6 introduces enhanced forwarding capabilities and control-plane features beyond standard campus networking functions, Huawei licenses these capabilities separately. To activate SRv6-based financial SD-WAN features on iMaster NCE-Campus, customers must obtain theSRv6 function package license. Without this license, SRv6-specific orchestration, scheduling, and optimization functions cannot be enabled.

According to HCIP Datacom Campus Network documentation, licensing ensures controlled feature activation and aligns with Huawei’s modular service enablement strategy. Therefore, the statement is TRUE, and option A is correct.