Practice Free H12-841_V1.5 HCIP-Datacom-Campus Network Planning and Deployment V1.5 Exam Questions Answers With Explanation

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In Huawei iMaster NCE-Campus and CloudCampus management systems, different log types are designed to record different categories of events to support auditing, troubleshooting, and security analysis. When anMSP administrator creates a tenant account, this action is considered amanagement operationperformed through the system’s management interface.

Such administrative actions are recorded in theOperation Log. Operation logs documentuser-initiated configuration and management activities, including tenant creation, modification, deletion, policy changes, and administrative actions performed by operators or administrators. These logs are essential for operation auditing and responsibility tracing in multi-tenant environments.

System logsmainly record internal system events, such as service startup, module status changes, or system exceptions, and do not track administrator operations.Security logsfocus on security-related events, such as login failures, abnormal access attempts, or permission violations, rather than routine administrative operations.Device channel logsrecord communication events between devices and controllers, such as device registration or channel status changes, and are unrelated to tenant management actions.

According to HCIP Datacom Campus Network and CloudCampus O&M documentation, tenant account creation performed by an MSP administrator is clearly categorized as anoperation behavior, and therefore it is recorded in theOperation Log.

In the Huawei Agile Distributed Wi-Fi Solution, the wireless architecture is designed to simplify deployment and reduce dependency on traditional centralized WLAN controllers. The solution is composed mainly of a **central AP** and multiple **Remote Units (RUs)**. The central AP integrates key control and management functions that are traditionally provided by a standalone AC. These functions include RU discovery and registration, radio parameter configuration, SSID and security policy delivery, traffic control, and basic WLAN service management.

Because the central AP performs these AC-like roles, RUs do not need to be managed individually, and a separate wireless controller is not required for the Agile Distributed Wi-Fi system to operate. This architecture is especially suitable for indoor distributed scenarios such as hotels, dormitories, hospitals, and office buildings, where RUs are deployed in rooms or corridors and centralized control is still required.

From the HCIP Datacom Campus Network perspective, this design reduces network complexity, lowers deployment and maintenance costs, and improves scalability. While an external AC or centralized management platform may still be introduced for unified management across multiple sites or for advanced O&M requirements, it is **not mandatory** for the basic Agile Distributed Wi-Fi solution. Therefore, the statement that no AC is needed because the central AP can manage multiple RUs is correct according to HCIP Datacom Campus Network documentation.

In Huawei campus network solutions,free mobilityis a user-centric access control mechanism designed to decouple network policies from physical locations and traditional network identifiers. According to HCIP Datacom Campus Network documentation, free mobility doesnotrely on VLAN IDs or IP addresses as the basis for policy management and permission control. Instead, it is implemented based onuser identity, such as user accounts, roles, user groups, or device identities.

Traditional networks often bind security policies to VLANs or IP subnets, which means users receive different permissions when they move to different access points or switch ports. This approach lacks flexibility and increases configuration complexity. Free mobility solves this problem by using centralized authentication and authorization mechanisms, such as 802.1X or MAC authentication combined with AAA, to dynamically assign policies after user authentication.

Once a user is authenticated, the network enforces access permissions based on predefined user roles or groups, regardless of where the user connects to the network. Even if the user’s IP address or VLAN changes due to roaming, the same security policy is consistently applied. This ensures seamless access experience, simplifies network management, and enhances security control.

Because free mobility isidentity-based rather than VLAN- or IP-based, the statement claiming that it implements policy management and permission control based on users' VLAN IDs and IP addresses is incorrect. Therefore, the correct answer isFALSE.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

Super VLAN is a Huawei campus network technology designed to solve broadcast domain and user isolation issues in large Layer 2 networks. It allows multiplesub-VLANsto be associated with a singleSuper VLAN, where the Super VLAN provides Layer 3 gateway services, and sub-VLANs remain Layer 2 isolated from each other. Users within different sub-VLANs cannot communicate directly at Layer 2, which effectively isolates users even though they share the same logical gateway.

This architecture significantly enhances user communication security by preventing direct Layer 2 attacks such as ARP spoofing or broadcast storms between users. In addition, broadcast packets generated within one sub-VLAN are confined to that sub-VLAN and do not propagate to others, preventing invalid or excessive broadcast traffic from impacting overall service quality.

Port isolation only isolates ports but does not provide centralized Layer 3 gateway management. IPSG focuses on IP address legitimacy enforcement rather than user isolation. Ethernet port security restricts MAC address access but does not control broadcast propagation or inter-user isolation across VLANs.

According to HCIP Datacom Campus Network design guidelines, Super VLAN is the correct technology for isolating users in the same VLAN scope while reducing broadcast impact and improving security, making option A correct.

VXLAN uses theVXLAN Network Identifier (VNI)to identify and isolate virtual Layer 2 or Layer 3 networks in an overlay environment. The VNI field is24 bits long, which allows a theoretical maximum of2²? (approximately 16 million) VNIs. This is a significant improvement over traditional VLAN technology, which supports only 4094 VLAN IDs, and is one of the main reasons VXLAN is adopted in large-scale campus and data center networks.

It is correct thata tenant can be mapped to one or more VNIs. For example, a tenant may use multiple VNIs to represent different broadcast domains or service segments, such as separate VNIs for different subnets or application tiers. However, the statement becomes incorrect when it claims that VXLAN supports a maximum of12 million tenants.

VXLAN does not directly define a fixed maximum number of tenants. VNIs represent virtual networks, not tenants themselves. The actual number of tenants supported depends on how VNIs are allocated and how the network design maps tenants to VNIs. In theory, the upper limit of VNIs is close to 16 million, not 12 million, and the number of tenants is typically much lower and design-dependent.

Therefore, while the description of VNIs being 24 bits long is correct, the conclusion about supporting a maximum of 12 million tenants is incorrect, making the overall statement false.

The command output shows an EVPNRoute Type 2 (MAC Advertisement Route), which is used in VXLAN BGP EVPN fabrics to advertise host reachability information. The route clearly carries both aMAC address(b0d5-9dc7-3c41/48) and ahost IP address(172.16.1.173/32). In HCIP Datacom Campus Network VXLAN design, when a Type 2 route includes both MAC and IP information, it is classified as anIRB (Integrated Routing and Bridging) Type 2 route, enabling distributed gateways to perform Layer 2 forwarding and Layer 3 routing based on the same control-plane information. Therefore, statement A is correct.

Statement B is incorrect because ARP-related learning is not represented as a separate “ARP Type 2” EVPN route. EVPN uses MAC/IP Advertisement routes to distribute host reachability, not ARP-only route types.

Statement C is correct. The route containsRoute Target extended communities RT 0:2 and RT 0:3, which control EVPN route import. Any VPN instance configured with an import RT of 0:2 or 0:3 can successfully import this route and learn the corresponding host MAC and IP information.

Statement D is also correct. The output explicitly showsRT extended communitiesand theEVPN Router’s MACextended community. These attributes are essential for VXLAN tunnel identification, split-horizon forwarding, and correct EVPN operation in a campus fabric.

Hence, the correct answers are A, C, and D.

In a VXLAN-based virtualized campus network, planning is divided intounderlay,fabric, andoverlaylayers, each with clear responsibilities:

Fabric Design ? Border Node DesignFabric design focuses on the VXLAN fabric structure and roles of fabric nodes.Border nodesare a core part of the fabric, responsible for VXLAN encapsulation/decapsulation, policy enforcement, and traffic exit/entry between the VXLAN fabric and external networks. Therefore, Border Node Design belongs to Fabric Design.

Overlay Network Design ? VN Access DesignVN Access Design defines how users and terminals access different Virtual Networks (VNs), including VLAN-to-VN mapping and authentication-based access. These are overlay-layer service constructs.

Overlay Network Design ? VN Interwork DesignVN Interwork Design focuses on communication between different VNs (for example, inter-VN routing and security group policy control), which is a classic overlay function.

Overlay Network Design ? External Network DesignExternal Network Design defines how overlay VNs communicate with non-VXLAN external networks, which is also an overlay service behavior implemented through border nodes.

This mapping strictly follows Huawei HCIP Datacom Campus Network VXLAN planning methodology.

In a CloudCampus VXLAN fabric,node role planningis a fundamental design task that directly affects scalability, performance, and manageability. Huawei defines clear roles for fabric nodes, includingedge nodes,border nodes, and optionallyroute reflectors (RRs).

Statements A, B, and C correctly describe recommended design practices. Core devices are commonly deployed asborder nodesbecause they have higher performance and are well suited to connect the VXLAN fabric to external networks such as WANs or data centers. Access or aggregation devices acting asedge nodesenable end-to-end VXLAN automation and allow user traffic to be encapsulated and decapsulated close to the access layer. Additionally, when external networks exist in different physical locations, deployingmultiple border nodesimproves reliability and optimizes traffic paths.

Statement D is incorrect. In a VXLAN network usingBGP EVPN with route reflectors,edge nodes do not need to establish BGP peer relationships with each other. Instead, edge nodes establish BGP EVPN peer relationshipsonly with the RR, which centrally reflects EVPN routes to other nodes. This design significantly reduces the number of BGP sessions and improves scalability in large networks. Border nodes may also peer with the RR, but full-mesh peering between edge nodes is not required.

Therefore, the false statement isD, making it the correct answer.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

To prevent users from accessing the network using statically configured IP addresses, Huawei campus networks rely on a combination ofDHCP SnoopingandIP Source Guard (IPSG). DHCP Snooping works by monitoring DHCP message exchanges and building atrusted binding tablethat records legitimate IP–MAC–VLAN–interface mappings learned dynamically from a legal DHCP server. This binding table becomes the foundation for several Layer 2 security mechanisms.

IP Source Guard uses the DHCP Snooping binding table to strictly control traffic entering an interface. When IPSG is enabled, the switch permits only packets whose source IP address and MAC address match an entry in the DHCP Snooping binding table. If a user manually configures a static IP address, no valid DHCP binding exists for that host, so IPSG drops the traffic and denies network access. This directly prevents statically configured IP addresses from being used to access the network.

Dynamic ARP Inspection (DAI) focuses on preventing ARP spoofing and man-in-the-middle attacks, not static IP misuse. Port Security limits MAC addresses per interface but does not verify IP address legitimacy. Therefore, neither DAI nor Port Security alone can prevent users from assigning static IP addresses.

According to HCIP Datacom Campus Network security design principles,only the combination of DHCP Snooping and IPSGeffectively enforces IP address legitimacy and blocks statically configured IP access, making optionCthe correct answer.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

IKEv1 negotiation consists of two phases.Phase 1is responsible for establishing a secure IKE Security Association (SA), including peer authentication, key exchange, and protection of subsequent negotiations. In Huawei IPsec implementations, IKEv1 Phase 1 supportsMain modeandAggressive mode.

Main modeuses six message exchanges to securely negotiate parameters, protect identity information, and establish a trusted channel. It provides higher security and is commonly used in site-to-site IPsec VPN scenarios.Aggressive mode, on the other hand, completes negotiation using only three message exchanges, offering faster setup at the cost of reduced identity protection.

Quick modeis not part of IKEv1 Phase 1; it is used inPhase 2to negotiate IPsec SAs for data traffic protection.Normal modeis not a valid IKEv1 negotiation mode.

According to HCIP Datacom Campus Network documentation and standard IPsec principles, the supported IKEv1 Phase 1 negotiation modes areMain mode and Aggressive mode, makingoptions B and Ccorrect.

iMaster NCE-Campus adopts amulti-plane architectureto improve system security, scalability, and operational stability. The planes are logically isolated so that different types of traffic and functions do not interfere with each other. The two most commonly referenced planes are themanagement planeand theservice plane.

Themanagement planeis mainly responsible for system-level operations such as device registration, controller maintenance, system management, and internal communication between system components. For this purpose, it uses a dedicated access interface and port number to ensure secure and stable management connectivity.

Theservice plane, on the other hand, is designed fordaily network service operations. Administrators access this plane to perform tasks such as campus network planning, configuration delivery, monitoring, alarm viewing, and intelligent O&M operations. To keep service access independent and secure, the service plane uses its own dedicated login port.

According to HCIP Datacom Campus Network documentation, theservice plane of iMaster NCE-Campus uses port 18009. Administrators log in to the service plane by accessing the service IP address together with this port number. This separation ensures that service operations remain available even when management-plane functions are restricted or under maintenance.

Therefore, the correct port number for theservice planeis18009, making optionBthe correct answer.

In Huawei campus networks, access authentication and authorization are implemented based on the AAA framework. After a user is successfully authenticated, the network enforces anauthorization result, which defines what network resources the user is allowed to access and how traffic is controlled. These authorization results are typically delivered by the authentication server or configured locally on network devices.

According to HCIP Datacom Campus Network documentation,authorization results focus on policy and access control attributes, not basic network parameter assignment. Common authorization items includeVLAN assignment,security group assignment, andACL application. VLANs determine the user’s logical network location, security groups enable group-based policy control, and ACLs restrict or permit traffic based on predefined rules. These elements directly affect access permissions and security enforcement.

AnIP address, however, does not need to be defined in the authorization result. In campus networks, IP addresses are usually assigned dynamically throughDHCP, either by a DHCP server or a DHCP relay function on network devices. The IP address allocation process is independent of user authorization and does not represent an access control policy.

Separating IP address assignment from authorization simplifies network design and improves scalability. It allows users to obtain IP addresses automatically while access rights are enforced consistently through identity-based policies. Therefore, among the given options,IP addressis not an item that must be defined in the authorization result.

Hence, the correct answer isB.

In a virtualized campus network managed byiMaster NCE-Campus, traffic control between users or user groups is implemented throughsecurity groupsand apolicy control matrix. The configuration shown clearly reflects this mechanism.

The ACL usesucl-group names, such asResearch_Group,Sales_Group, andGuest_Group. These ucl-groups correspond tosecurity groupsdefined on iMaster NCE-Campus. The ACL rules explicitly permit IP traffic from one security group to other security groups. This type of ACL is automatically generated and delivered by the controller when apolicy control matrixis deployed.

A policy control matrix defineswho can access whomby specifying allow or deny relationships between security groups. Once the matrix is configured on iMaster NCE-Campus, the controller translates these logical policies into device-level ACLs and applies them to the appropriate enforcement points in the VXLAN fabric. The presence of multiple rules permitting traffic from one group to multiple destination groups is a typical outcome of deploying such a matrix.

Creating a security group alone would not generate ACL rules. Deploying inter-VN communication would involve route exchange or gateway configuration, not ucl-group–based ACLs. Creating an authorization result would associate users with security groups but would not generate inter-group ACL rules.

Therefore, the administrator operation that resulted in this configuration wasdeploying a policy control matrix, making optionAthe correct answer.

In campus network design, theegressis a critical point that connects the internal campus network to external networks such as the Internet or WAN. According to HCIP Datacom Campus Network architecture guidelines, ensuringhigh reliability at the egressis essential, even for small- and medium-sized campus networks, because external connectivity directly affects business continuity.

Deployingmulti-carrier linksat the egress is a recommended design practice to enhance reliability. Multi-carrier links refer to connecting the campus network todifferent service providersor independent external links. If one carrier experiences a failure, congestion, or maintenance issue, traffic can be switched to the backup carrier, ensuring uninterrupted external access. This approach significantly reduces the risk of service disruption caused by single-link or single-carrier failures.

For small- and medium-sized campuses, full redundancy with complex architectures may not be cost-effective. Multi-carrier backup links provide acost-efficient and practical solutionthat balances reliability and investment. Technologies such as static route backup, dynamic routing protocols, or policy-based routing can be used to implement automatic failover at the egress.

HCIP Datacom documentation emphasizes that egress reliability is not only a concern for large networks. Even smaller campuses require stable Internet and WAN access for cloud services, remote access, and centralized management platforms. Therefore, deploying multi-carrier links as backup at the egress is a valid and recommended design strategy.

Hence, the statement isTRUE.

In a centralized VXLAN gateway architecture, all inter-subnet traffic is forwarded to a centralized Layer 3 gateway, typically deployed on a core or aggregation device. This design simplifies network planning, gateway configuration, and policy enforcement because routing, security, and traffic control are all handled at a single centralized point. From an operational perspective, deployment and management are straightforward, which makes centralized gateways suitable for small- to medium-sized campus networks or environments with limited endpoints.

However, according to HCIP Datacom Campus Network documentation, this architecture introduces scalability limitations. Since the centralized gateway performs Layer 3 forwarding for all VXLAN segments, it must maintain ARP entries for every terminal in the network. As the number of endpoints increases, the ARP table on the Layer 3 gateway grows rapidly. Hardware resources such as memory and processing capacity limit the maximum number of ARP entries that can be supported.

In large-scale campus scenarios with a high density of terminals—such as universities, hospitals, or enterprise office campuses—this ARP scalability bottleneck can impact performance and stability. Excessive ARP entries may lead to increased CPU utilization, delayed ARP resolution, and reduced forwarding efficiency. For such environments, HCIP Datacom recommends distributed VXLAN gateways, which distribute ARP and routing responsibilities across multiple devices. Therefore, the statement is correct, and the centralized VXLAN gateway is not suitable for scenarios with a large number of terminals.

In the Huawei CloudCampus Solution, switches must be able toautomatically connect to and be managed by iMaster NCE-Campus. To achieve this, Huawei provides specificdeployment and onboarding modesthat allow switches to discover the controller and establish a management relationship. According to HCIP Datacom Campus Network documentation, Huawei switches supportHuawei registration centerandDHCP Option 148as standard deployment modes.

TheHuawei registration centeris a cloud-based mechanism that enables devices to automatically register with iMaster NCE-Campus after they are powered on and connected to the network. Once registered, the controller can identify, authenticate, and centrally manage the switches without requiring manual configuration. This mode is commonly used in cloud-managed or large-scale deployments where zero-touch provisioning is required.

DHCP Option 148is another supported deployment mode. Through this option, the DHCP server provides the address information of iMaster NCE-Campus to the switch during IP address allocation. After receiving this information, the switch automatically establishes a management connection with the controller. This method is widely used in enterprise campus environments where DHCP services are already available.

In contrast, theWeb interfaceandCLIare local device management methods, not deployment modes in the CloudCampus architecture. They are mainly used for basic configuration, troubleshooting, or initial setup, rather than for controller-based deployment.

Therefore, the correct deployment modes supported by Huawei switches in the CloudCampus Solution areHuawei registration centerandDHCP Option 148.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

Telemetry is a next-generation network data collection technology designed to overcome the limitations of traditional SNMP polling. One of its major advantages is that it ismodel-driven, relying onYANG modelsto define structured and extensible data formats. This allows Telemetry to support various data types and provides stronger semantic meaning than SNMP MIBs, makingoption A correct.

Another key advantage ishigh-frequency data collection. Telemetry supportssecond-level or even sub-second-level reporting, enabling more precise and real-time network monitoring. This capability is critical for intelligent O&M scenarios such as fault prediction, traffic analysis, and SLA assurance. SNMP, by contrast, typically relies on periodic polling with much lower precision. Therefore,option D is correct.

Telemetry does not establish sessions based on SSH. Instead, it typically uses protocols such asgRPCover secure transport channels like TLS. Hence,option B is incorrect.

Option C is also incorrect because Telemetry focuses ondata subscription and reporting, not on configuring or managing device databases. Configuration management remains the responsibility of controllers or network management systems, not the Telemetry mechanism itself.

According to HCIP Datacom Campus Network documentation, Telemetry’s strengths lie in model-driven data representation and high-precision, real-time monitoring, making A and D the correct answers.

iMaster NCE-Campus classifies network alarms into different severity levels to help administrators quickly understand the health status of the campus network and take appropriate actions. According to HCIP Datacom Campus Network documentation, alarms are typically categorized intocritical,major,warning, andinformationallevels, each represented by a distinct icon and color in the management interface.

In the displayed alarm summary, four types of icons are shown with corresponding numbers. Thered flame iconrepresents critical alarms, and the number next to it is0, indicating no critical alarms. Theorange lightning iconrepresents major alarms, and the number displayed is5, indicating five major alarms. Theyellow exclamation mark iconrepresentswarning alarms, and the number next to it is1. Finally, theblue information iconrepresents informational alarms, with a total of10.

Warning alarms indicate potential issues that do not immediately affect network operation but may develop into more serious problems if not addressed. These alarms require administrator attention but are less urgent than critical or major alarms. Accurately identifying the number of warning alarms helps prioritize troubleshooting and maintenance tasks.

Since the yellow warning icon shows the number1, this means there isone warning alarmcurrently generated on the network. Therefore, the correct answer is1, corresponding to optionB.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In Huawei campus access authentication designs, network access is divided intopre-authentication,isolation, andpost-authenticationdomains to control user access at different stages of authentication.

Thepre-authentication domainprovides users with only the most basic network services required to initiate authentication. These services typically includeDHCPandDNS. DHCP allows unauthenticated terminals to obtain IP addresses and basic network parameters, while DNS enables domain name resolution so that users can reach authentication portals or admission servers. Therefore,DHCP and DNS servers are essential components of the pre-authentication domain, making optionsC and D correct.

AnFTP serveris a general-purpose file transfer service and is not required for user authentication. Anantivirus serverbelongs to theisolation domain, where users are redirected if authentication fails or if their devices do not meet security posture requirements, such as outdated virus signatures. These servers provide remediation resources but are not part of the pre-authentication process.

According to HCIP Datacom Campus Network documentation, limiting the pre-authentication domain to only essential services reduces security risks while ensuring successful user onboarding.

In VXLAN BGP EVPN, different EVPN route types carry different kinds of reachability information. The displayed entries areIP prefix routesbecause each record shows anIP prefix and prefix length(for example, 172.16.2.0:24 and 192.168.122.0:30) rather than a MAC address with a host /32. In HCIP Datacom Campus Network VXLAN EVPN, such network-segment routes are advertised usingEVPN Route Type 5 (IP Prefix Route). Type 5 routes are used to distributeLayer 3 reachabilitybetween VTEPs for inter-subnet/inter-VRF routing, and they inherently carrynetwork/mask information, which makes statement D correct.

These routes are associated with theL3 VXLAN forwarding plane, meaning they belong to theL3VNI(the VPN instance/VRF context). L3VNI is used for routing between IP subnets in an EVPN VXLAN fabric, while L2VNI is used for pure Layer 2 bridging within a broadcast domain. Because the entries shown are IP prefixes (not MAC learning information), they align withL3VNI-based routing, so statement B is correct and statement A is incorrect.

Statement C is incorrect becauseType 2routes are MAC/IP Advertisement routes typically used for host reachability (often /32) and include MAC information, which is not present in these entries.

Administrator:

– Defining a Security Group

– Defining a Policy Control Matrix

iMaster NCE-Campus:

– Delivering IP-Group Entries

– Delivering a Policy Control Matrix

In Huawei’s free mobility solution, responsibilities are clearly divided betweenadministratorsandiMaster NCE-Campusto achieve centralized control with automated policy delivery. Administrators are responsible forpolicy and security intent definition, while iMaster NCE-Campus handlesautomatic distribution and enforcement coordination.

Administrators firstdefine security groups, which represent logical user or terminal categories such as employees, guests, or IoT devices. These security groups form the basis of identity-based access control in the campus network. Administrators alsodefine the policy control matrix, which specifies communication permissions between different security groups, such as allow, deny, or redirect. This step represents business intent and security requirements and must be manually planned and configured.

Once these definitions are complete,iMaster NCE-Campus takes over the execution phase. It automaticallydelivers the policy control matrixto authentication points and policy enforcement points, translating high-level policies into device-level configurations. This ensures consistent policy enforcement across the entire campus network.

In addition, iMaster NCE-Campus automaticallydelivers IP-group entries, which bind user IP addresses to security groups. These entries are dynamically generated based on authentication results and are distributed to relevant devices so that traffic can be correctly identified and controlled as users move.

This division of labor aligns with HCIP Datacom Campus Network design principles, enabling simplified administration, reduced manual configuration, and truly seamless free mobility across the campus network.

In a Huawei VXLAN BGP EVPN architecture,Route Targets (RTs)play a critical role in controlling route import and export between VPN instances on different VTEPs. When a BGP EVPN route is received by a VTEP, the device determines whether the route should be accepted or discarded based on RT matching rules.

According to HCIP Datacom Campus Network documentation, a received EVPN route is considered validas long as its RT matches either the EVPN Import Route Target (EVPN IRT) or the IP VPN Import Route Target (IP VPN IRT)configured on the local device. This design enables flexible route sharing between Layer 2 EVPN services and Layer 3 VPN services, supporting integrated routing and bridging (IRB) scenarios and inter-VNI communication.

If the RT carried in the EVPN route matches at least one of these import RTs, the route is imported into the corresponding VPN instance and can be used for traffic forwarding. Only when the RT doesnot match both the EVPN IRT and the IP VPN IRTwill the route be discarded. This mechanism ensures proper isolation between tenants while still allowing controlled route exchange where required.

Therefore, the statement accurately describes the EVPN route filtering logic used between VTEPs in Huawei VXLAN networks. The route is discardedonly when the RT differs from both configured import RTs, making the statementTRUE.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

The Huawei CloudCampus Solution adopts afour-layer architecture, not a three-layer one. According to HCIP Datacom Campus Network documentation, the architecture consists of theterminal layer,network layer,management and control layer, andapplication layer.

Theterminal layerincludes user devices such as PCs, mobile terminals, IoT devices, and other endpoints that access the campus network. Thenetwork layeris responsible for data forwarding and includes access, aggregation, and core network devices. Themanagement and control layer, represented by platforms such as iMaster NCE-Campus, provides centralized management, automation, policy control, and orchestration. Theapplication layerdelivers value-added services and business applications.

Because the terminal layer is an essential and explicitly defined component of the CloudCampus architecture, stating that the solution has only three layers is incorrect. Therefore, the statement isFALSE, making optionBthe correct answer.

Huawei CloudCampus is an intelligent campus network solution designed to simplify deployment, improve O&M efficiency, and enhance user experience through cloud-based and automated technologies. Its advantages mainly focus onnetwork automation, unified management of campus network devices, and intelligent services, rather than full IT infrastructure management.

Option A is a core advantage of CloudCampus. Through cloud-based controllers and automation technologies, CloudCampus supportsautomatic deployment of physical networks, reducing manual configuration and shortening service rollout time.

Option B is also an important advantage. CloudCampus supportsplug-and-play of devices, where network devices can automatically go online, download configurations, and complete provisioning after being powered on and connected, significantly reducing on-site workload.

Option D is another key feature. Cloud Campus supportsfree mobility, allowing users to roam across different access points or areas while maintaining consistent network access policies and service experience, which is especially important in modern wireless campus environments.

Option C isnot an advantageof the Huawei Cloud Campus solution. Cloud Campus focuses on unified management ofcampus network devicessuch as switches, routers, and wireless devices. It does not provide unified management forstorage servers, which fall outside the scope of campus network management and belong to data center or IT infrastructure management solutions.

Therefore, unified management of Huawei switches, routers, and storage servers is not an advantage of the Cloud Campus solution.

Comprehensive and Detailed Explanation (200–250 words):

In this scenario,distributed VXLAN gatewaysare deployed, andlocal ARP proxyis enabled onVBDIF 10 of SW1. PC1 (172.16.1.1/24) needs to communicate with PC2 (172.16.1.2/24), which is located behind aremote distributed gateway (SW3).

Witharp-proxy local enable, SW1 doesnot flood ARP requests across the VXLAN tunnel. Instead, SW1 responds locally to PC1’s ARP request using theMAC address of its own VBDIF interface. Therefore, PC1 learns172.16.1.2 mapped to MAC D, which is the MAC address ofVBDIF 10 on SW1, not MAC B (the actual MAC of PC2). This makesstatement C trueandstatement A false.

Once PC1 sends traffic to PC2, the destination MAC in the frame isMAC D, meaning the packet is delivered to thelocal Layer 3 gateway. SW1 then performsLayer 3 routing, not Layer 2 switching. SW1 looks up theLayer 3 forwarding table, determines the remote VTEP, encapsulates the packet into VXLAN, and forwards it across the VXLAN tunnel. Therefore,statement D is true, whilestatement B is false.

This behavior aligns with HCIP Datacom Campus Network documentation fordistributed gateways with ARP proxy enabled, where traffic is routed locally and optimized across the VXLAN fabric.

In Huawei campus networks, user access authentication is implemented through a standardized AAA framework that supports flexible authentication, authorization, and accounting methods. Statements A, B, and D correctly describe the authentication configuration process defined in HCIP Datacom Campus Network documentation. Administrators must first identify user domains and corresponding AAA schemes to ensure users are authenticated using appropriate methods. This is a foundational step for implementing network access control.

Access profiles and authentication profiles work together to define how users are authenticated. An authentication profile specifies the authentication mode, such as 802.1X or MAC authentication, while the access profile defines access control behavior. Binding these profiles and applying them to interfaces or VAP profiles enables consistent enforcement of access policies across wired and wireless networks.

When external authentication servers such as RADIUS or HWTACACS are used, interconnection parameters—including server IP addresses, shared keys, and ports—must be configured within the AAA scheme. This ensures reliable communication between network devices and authentication servers.

Statement C is false becauseiMaster NCE-Campus does support interconnection with third-party RADIUS servers. This capability allows enterprises to integrate existing authentication systems with Huawei campus solutions, improving compatibility and deployment flexibility. Therefore, the incorrect statement is option C.