H12-841_V1.5 Huawei HCIP-Datacom-Campus Network Planning and Deployment V1.5 Free Practice Exam Questions (2026 Updated)

In Huawei campus WLAN solutions, different WLAN architectures are designed to meet varying network scales, cost requirements, and management complexity. The architecture described in this question matches theLeader APsolution.

ALeader APcan operate independently without a dedicated wireless controller, while also having the capability to manage asmall number of subordinate APs. The Leader AP takes on lightweight control functions, such as basic configuration management and simple roaming coordination among the managed APs. This allows wireless users to roam between APs with minimal service interruption, meeting basic mobility requirements.

According to HCIP Datacom Campus Network documentation, the Leader AP architecture is characterized bylow deployment cost and simple maintenance. Since no separate AC is required and the number of APs is limited, network planning and configuration are straightforward. This significantly reduces the technical skill level required for daily operation and maintenance, making it suitable for small campuses, retail stores, branch offices, and small enterprises.

In contrast,Fat APsoperate completely independently and do not support centralized roaming management.AC + Fit AParchitectures are designed for medium to large networks and require higher investment and professional maintenance.Agile distributed APsolutions focus on centralized APs and RUs, which do not align with the independent AP management described.

Therefore, the WLAN architecture that best fits the given characteristics isLeader AP, making optionAthe correct answer.

In a VXLAN BGP EVPN deployment, interconnection between Layer 2 and Layer 3 networks relies onIntegrated Routing and Bridging (IRB). According to HCIP Datacom Campus Network documentation, for a VPN instance to advertise its IP routes to the BGP EVPN control plane, the device must explicitly enable IRB route advertisement in the BGP view.

Theadvertise irbcommand is used to allow IP routes learned in a VPN instance to be advertised as EVPN Type 5 (IP Prefix) routes. These routes enable communication between different VNIs or between VXLAN segments and external Layer 3 networks. Without this command, the VPN instance routes remain local and are not distributed through the EVPN control plane, preventing proper Layer 3 connectivity across the VXLAN fabric.

The other options are incorrect in this context. Theadvertise vpnv4command is used in traditional MPLS VPN scenarios, not in BGP EVPN-based VXLAN networks. Theadvertise irbv6command is specific to IPv6 IRB scenarios and does not apply to IPv4 route advertisement unless explicitly required. Theadvertise l2vpn evpncommand is used to enable the EVPN address family itself but does not control the advertisement of IP routes from a VPN instance.

Therefore, to enable a VPN instance to advertise IP routes to the BGP EVPN address family in a VXLAN network, the correct command isadvertise irb.

The command output shows an EVPNRoute Type 2 (MAC Advertisement Route), which is used in VXLAN BGP EVPN fabrics to advertise host reachability information. The route clearly carries both aMAC address(b0d5-9dc7-3c41/48) and ahost IP address(172.16.1.173/32). In HCIP Datacom Campus Network VXLAN design, when a Type 2 route includes both MAC and IP information, it is classified as anIRB (Integrated Routing and Bridging) Type 2 route, enabling distributed gateways to perform Layer 2 forwarding and Layer 3 routing based on the same control-plane information. Therefore, statement A is correct.

Statement B is incorrect because ARP-related learning is not represented as a separate “ARP Type 2” EVPN route. EVPN uses MAC/IP Advertisement routes to distribute host reachability, not ARP-only route types.

Statement C is correct. The route containsRoute Target extended communities RT 0:2 and RT 0:3, which control EVPN route import. Any VPN instance configured with an import RT of 0:2 or 0:3 can successfully import this route and learn the corresponding host MAC and IP information.

Statement D is also correct. The output explicitly showsRT extended communitiesand theEVPN Router’s MACextended community. These attributes are essential for VXLAN tunnel identification, split-horizon forwarding, and correct EVPN operation in a campus fabric.

Hence, the correct answers are A, C, and D.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

Telemetry is a next-generation network data collection technology designed to overcome the limitations of traditional SNMP polling. One of its major advantages is that it ismodel-driven, relying onYANG modelsto define structured and extensible data formats. This allows Telemetry to support various data types and provides stronger semantic meaning than SNMP MIBs, makingoption A correct.

Another key advantage ishigh-frequency data collection. Telemetry supportssecond-level or even sub-second-level reporting, enabling more precise and real-time network monitoring. This capability is critical for intelligent O&M scenarios such as fault prediction, traffic analysis, and SLA assurance. SNMP, by contrast, typically relies on periodic polling with much lower precision. Therefore,option D is correct.

Telemetry does not establish sessions based on SSH. Instead, it typically uses protocols such asgRPCover secure transport channels like TLS. Hence,option B is incorrect.

Option C is also incorrect because Telemetry focuses ondata subscription and reporting, not on configuring or managing device databases. Configuration management remains the responsibility of controllers or network management systems, not the Telemetry mechanism itself.

According to HCIP Datacom Campus Network documentation, Telemetry’s strengths lie in model-driven data representation and high-precision, real-time monitoring, making A and D the correct answers.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In the Huawei CloudCampus Solution, devices such as switches and APs support multipleprovisioning modesto integrate with iMaster NCE-Campus, including Web interface provisioning, CLI-based provisioning, and registration center query. These methods allow devices to obtain controller information and register successfully.

Firewalls, however, have stricter provisioning mechanisms due to security considerations. They do not supportDHCP Option 148, which is commonly used by switches and APs to automatically discover the management controller.

Instead, firewalls must be provisioned manually through the Web interface or CLI, or discovered via registration center mechanisms. According to HCIP Datacom Campus Network documentation,DHCP Option 148 is not supported by firewalls, makingoption Cthe correct answer.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

Huawei campus switches support multiple flexible VLAN assignment methods to meet diverse access control and service deployment requirements. The most basic method isinterface-based VLAN assignment, where a physical or logical port is statically assigned to a specific VLAN. This method is simple and widely used in traditional access layer designs.

Huawei switches also supportMAC address–based VLAN assignment, allowing devices to be dynamically placed into VLANs based on their MAC addresses. This is useful in scenarios where users frequently move between access ports but require consistent VLAN membership.

Protocol-based VLAN assignmentenables traffic to be classified into VLANs based on upper-layer protocol types, which can be useful in special service separation scenarios. Additionally,IP subnet–based VLAN assignmentallows switches to assign VLANs according to the source IP address of packets, enabling logical grouping of users based on network layer addressing rather than physical location.

These VLAN assignment mechanisms enhance network flexibility, simplify user mobility, and improve access-layer service management. According to HCIP Datacom Campus Network documentation, Huawei switches indeed support VLAN assignment based on interface, MAC address, protocol, and IP address. Therefore, the statement is TRUE, and option A is correct.

The displayed entries match the format of EVPN routes that carryVTEP reachability informationrather than host MAC/IP bindings or IP prefixes. The key clue is the field naming style shown asNetwork(EthTagId/IpAddrLen/OriginalIp)along with values like0:32:1.1.1.0, which indicates an IP address with a /32 length carried as the “OriginalIp”. In Huawei VXLAN BGP EVPN implementations described in HCIP Datacom Campus Network materials, this type of information corresponds toEVPN Route Type 3 (Inclusive Multicast Ethernet Tag Route).

Type 3 routes are used by VTEPs to signal membership information for a broadcast domain and to supportBUM (Broadcast, Unknown unicast, Multicast)forwarding behavior in the VXLAN fabric. Practically, they also provide the remote VTEP IP information needed so that, once the underlay can reach that VTEP IP address at Layer 3 (for example via IGP/BGP underlay routes), the local device can establish VXLAN encapsulation forwarding to that peer.

By contrast,Type 2routes would display MAC address information (and possibly a host /32 IP together with the MAC), andType 5routes would show IP prefixes like /24 or /30 used for inter-subnet routing.Type 1routes are related to Ethernet segments for multihoming (ESI), which is not what this output shows. Therefore, only statement A is true.

iMaster NCE-Campus adopts amulti-plane architectureto improve system security, scalability, and operational stability. The planes are logically isolated so that different types of traffic and functions do not interfere with each other. The two most commonly referenced planes are themanagement planeand theservice plane.

Themanagement planeis mainly responsible for system-level operations such as device registration, controller maintenance, system management, and internal communication between system components. For this purpose, it uses a dedicated access interface and port number to ensure secure and stable management connectivity.

Theservice plane, on the other hand, is designed fordaily network service operations. Administrators access this plane to perform tasks such as campus network planning, configuration delivery, monitoring, alarm viewing, and intelligent O&M operations. To keep service access independent and secure, the service plane uses its own dedicated login port.

According to HCIP Datacom Campus Network documentation, theservice plane of iMaster NCE-Campus uses port 18009. Administrators log in to the service plane by accessing the service IP address together with this port number. This separation ensures that service operations remain available even when management-plane functions are restricted or under maintenance.

Therefore, the correct port number for theservice planeis18009, making optionBthe correct answer.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

Authentication Header (AH) is one of the core IPsec security protocols and is designed to provideauthentication and integrity protectionfor IP packets. AH ensures that the received packet is from a legitimate sender and that the packet has not been altered during transmission.

AH supportsdata origin authenticationby verifying the identity of the sender using cryptographic algorithms. It also providesdata integrity checking, ensuring that packet contents are not modified in transit. Additionally, AH supportsanti-replay protectionby using sequence numbers to prevent attackers from capturing and retransmitting valid packets.

However, AHdoes not provide data encryption. All packet contents, including payload data, remain visible on the network. This limitation is inherent to the AH protocol design and is one of the main reasons ESP is more widely used in modern IPsec deployments.

According to HCIP Datacom Campus Network documentation, if confidentiality through encryption is required, ESP must be used instead of AH. Therefore, the function not supported by AH is data encryption, making option D the correct answer.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

Policy association is a core concept in Huawei campus network security design and is used to associate users, devices, and control elements for unified policy enforcement. According to HCIP Datacom Campus Network documentation, policy association definesthree fixed roles:Terminal,Access device, andControl device.

TheTerminalrepresents the end user or user device accessing the network. TheAccess deviceis typically a switch or wireless access device that provides network access and enforces authentication and authorization policies. TheControl device, such as an authentication or policy control node, is responsible for policy decision-making and centralized management.

APortal serveris not a role within policy association. Instead, it is aservice componentthat provides web-based authentication pages and user interaction during Portal authentication. While it participates in the overall authentication process, it does not belong to the policy association role model.

Therefore, among the given options,Portal serveris not one of the three defined policy association roles. This makesoption Bthe correct answer.

iMaster NCE-Campus is Huawei’s centralized management and control platform specifically designed forcampus network scenarios. According to HCIP Datacom Campus Network documentation, its primary purpose is to provide unified planning, automated deployment, policy control, and intelligent O&M for campus environments. Therefore,campus networksare one of the most typical and core deployment scenarios for iMaster NCE-Campus.

In addition, iMaster NCE-Campus is widely used to deployVXLAN Fabric networkswithin campuses. VXLAN Fabric is a key technology for building scalable, virtualized, and multi-tenant campus networks. iMaster NCE-Campus simplifies VXLAN Fabric deployment by automating underlay and overlay configuration, VN creation, VNI assignment, and BGP EVPN policy distribution. This makes VXLAN Fabric networks another standard and typical deployment scenario supported by the platform.

Branch networksare not considered a typical deployment scenario for iMaster NCE-Campus. Branch network management is usually handled by iMaster NCE-WAN in SD-WAN solutions, which focuses on WAN connectivity, branch access, and centralized WAN control rather than campus-oriented services.

Similarly,small-sized networksare not defined as a deployment scenario category in iMaster NCE-Campus documentation. The platform is designed for medium to large campus environments where centralized management and automation provide the most value.

Therefore, the typical deployment scenarios when using iMaster NCE-Campus areCampus networksandVXLAN Fabric networks, making optionsA and Bthe correct answers.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

Port isolation is commonly used on access switches to preventwired terminalsfrom communicating directly with each other at Layer 2. This enhances security by blocking lateral attacks and unnecessary broadcast traffic.

Forwireless users, Huawei APs and WLAN controllers (or central APs in agile distributed scenarios) providewireless user isolationmechanisms. Wireless user isolation prevents clients connected to the same SSID or AP from directly communicating with each other, even though they share the same wireless medium. This is widely used in guest networks, dormitories, and public WLAN environments.

Therefore, the statement that APs cannot implement wireless user isolation is incorrect. According to HCIP Datacom Campus Network WLAN design principles,wireless user isolation is fully supported by APs, either locally or under centralized control.

Hence, the statement is FALSE, and option B is correct.

Explanation (Concise and Technical)

Position 1 → 100This corresponds toVNI 100, which is associated with BD10 and is used for communication between PC1 and PC3.

Position 2 → 3.3.3.3This is theremote VTEP IP addressof VTEP3, configured as a head-end peer for VNI 100 on VTEP1.

Position 3 → 200This representsVNI 200, which is bound to BD20 and enables VXLAN communication between PC2 and PC4.

Position 4 → 1.1.1.1This is theremote VTEP IP addressof VTEP1, configured as a head-end peer for VNI 200 on VTEP2.

This mapping follows standardstatic VXLAN tunnel configuration logicon Huawei devices, where each VNI is explicitly associated with remote VTEP peer addresses using head-end peer-list.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

Encapsulating Security Payload (ESP) is one of the core IPsec protocols used to protect data confidentiality, integrity, and authenticity. To prevent replay attacks, ESP includes aSequence Numberfield in its header. This field plays a critical role in ensuring packet freshness.

Each ESP packet carries a monotonically increasing sequence number assigned by the sender. The receiving device maintains a sliding window and checks incoming packets against this window. If a packet arrives with a sequence number that has already been received or falls outside the valid window, the packet is considered a replay and is discarded. This mechanism effectively protects the network against replay attacks, where attackers capture legitimate packets and retransmit them to disrupt communication or bypass security controls.

TheSPI (Security Parameters Index)identifies the security association used for the packet but does not provide replay protection. TheNext Headerfield indicates the type of payload carried in the ESP packet.Authentication Dataensures packet integrity and data origin authentication but does not independently prevent replay attacks without the sequence number mechanism.

According to HCIP Datacom Campus Network documentation and IPsec standards, replay protection in ESP is implemented using the Sequence Number field, making option A the correct answer.

The displayed routes are EVPN routes shown in the formatNetwork(EthTagId/IpAddrLen/OriginalIp)with a /32 “OriginalIp” value (for example,0:32:1.1.1.0). In Huawei VXLAN BGP EVPN as described in HCIP Datacom Campus Network materials, this format corresponds toEVPN Route Type 3 (Inclusive Multicast Ethernet Tag Route). Type 3 routes are used by VTEPs to advertise participation information for a VXLAN broadcast domain (BD) and to provide the remote endpoint information needed for BUM (broadcast, unknown unicast, multicast) traffic handling.

Type 3 routes effectively carry theremote VTEP address information(the VTEP IP that serves as the tunnel destination in the underlay). Once the underlay Layer 3 network can reach that VTEP IP (for example, via IGP/BGP underlay routes), the VXLAN overlay can build forwarding toward the peer VTEP, so statementAis true and statementDis also true.

When ingress replication is used for BUM forwarding, the local VTEP needs a replication list of remote VTEPs in the BD. Receiving Type 3 routes provides the membership information required to form this list, making statementBtrue.

StatementCis false becauseType 2routes are MAC/IP Advertisement routes that include MAC information (and optionally a host /32 IP). The shown output contains no MAC fields, so it is not Type 2.

In a Huawei virtualized campus network managed byiMaster NCE-Campus,Fit APs do not go online immediatelyafter being added to the management platform. According to HCIP Datacom Campus Network documentation, Fit APs depend on awireless access controller (AC)for control, configuration delivery, and service provisioning. Simply adding a Fit AP to iMaster NCE-Campus only completes thedevice registration step, not the full service enablement process.

After a Fit AP is added, several additional steps are required before it can go online and provide wireless services. First, the AP must successfullydiscover and establish a control tunnel with the AC. Then, the AP typically needs to beapproved, assigned to a site, and bound to the correctAP group. Configuration data such as radio parameters, SSIDs, security policies, and authentication profiles must also be delivered from the AC to the AP.

In addition, firmware version checks or upgrades may occur during the onboarding process to ensure compatibility with the controller and management platform. Only after these steps are completed can the Fit AP enter thenormal online stateand start providing WLAN services.

This multi-step process ensures centralized control, consistent configuration, and reliable operation across large-scale campus networks, but it also means Fit APs cannot immediately go online upon being added to iMaster NCE-Campus.

Therefore, the statement is incorrect, and the correct answer isFALSE.

BGP EVPN is an extension of the BGP protocol designed to support large-scale Layer 2 and Layer 3 virtualization, such as VXLAN-based campus and data center networks. To achieve this, BGP EVPN defines multipleEVPN route typesthrough BGP extensions, including MAC/IP Advertisement routes, Inclusive Multicast routes, Ethernet Segment routes, and IP Prefix routes. Therefore, statement A is correct.

In BGP EVPN, routing information is carried using theMP_REACH_NLRI (Multiprotocol Reachable Network Layer Reachability Information)attribute. EVPN-specific NLRI formats are encapsulated within MP_REACH_NLRI, making statement C correct.

Each EVPN route includes aRoute Distinguisher (RD), which is part of the EVPN NLRI itself. The RD is used to ensure route uniqueness across different EVPN instances. Since the EVPN NLRI is carried inside MP_REACH_NLRI, the RD is effectively carried through MP_REACH_NLRI as well, which makes statement B correct.

Statement D is incorrect.Route Targets (RTs)are not carried in MP_REACH_NLRI. Instead, RTs are transmitted usingBGP extended community attributes, which control route import and export policies between EVPN instances. RTs are used for VPN membership control, not for route reachability advertisement.

In summary, BGP EVPN relies on BGP extensions and MP_REACH_NLRI to transport EVPN routing information and RDs, while RTs are carried separately as extended community attributes. Hence, the correct answers are A, B, and C.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In a VXLAN-based campus network,VBDIF interfacesserve as Layer 3 gateway interfaces for Bridge Domains (BDs) and provide routing capabilities. However, not all VXLAN gateways must maintain VBDIF interfaces. This makes statementA false.

ALayer 2 VXLAN gatewayoperates purely at Layer 2 and is responsible for VXLAN encapsulation and decapsulation, enabling intra-subnet communication within the same VXLAN network. It doesnot require a VBDIF interface, because no Layer 3 routing is involved. Therefore, claiming that both Layer 2 and Layer 3 VXLAN gateways must maintain VBDIF interfaces is incorrect.

Statement B is correct because a VBDIF interface is a logical Layer 3 interface bound to a BD and functions similarly to a VLANIF interface in traditional VLAN-based networks. Statement C is also correct, as aLayer 3 VXLAN gatewayenables inter-subnet routing between different VNIs and allows traffic to exit the VXLAN network toward non-VXLAN external networks. Statement D correctly describes the function of a Layer 2 VXLAN gateway.

According to HCIP Datacom Campus Network documentation, VBDIF interfaces are mandatory only for Layer 3 VXLAN gateways, not for Layer 2 VXLAN gateways.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In the Huawei CloudCampus virtualized campus architecture, aVirtual Network (VN)is a logical service container used to isolate different types of services and user traffic. When a VN is created on iMaster NCE-Campus, it is internally mapped to aVPN instanceon network devices. This VPN instance provides traffic isolation at the control plane and forwarding plane levels.

Each VN has its own independent routing table and forwarding context, ensuring that traffic belonging to different services cannot interfere with each other unless explicitly permitted through policy. This mechanism is similar to traditional VPN technologies and is fundamental to service segmentation in VXLAN-based campus networks.

According to HCIP Datacom Campus Network documentation, creating a VN effectively achieves service isolation in the same way as creating a VPN instance. Therefore, the statement is TRUE.