H12-891_V1.0 Huawei HCIE-Datacom V1.0 Free Practice Exam Questions (2026 Updated)

Huawei telemetry supports multiple transport protocols such as gRPC, HTTP2, and Kafka. When using gRPC, it is typically paired with TLS for secure encrypted transmission. TLS ensures that telemetry data is not intercepted or modified during transport.

Exact Extract – Huawei HCIE-Datacom Guide – Telemetry Security Section:

“When using gRPC for telemetry data push, TLS must be configured to encrypt the transport channel between devices and collectors.”

Comprehensive and Detailed In-Depth Explanation:

In the Label Distribution Protocol (LDP) session establishment process, the Initialization message is sent by the initiator to propose parameters for the session. If the responder finds that the proposed parameters are not acceptable, it responds with an Error Notification Message. This message indicates that the session could not be established due to incompatible or incorrect parameters.

The Error Notification Message typically includes details about why the session could not be established, such as parameter mismatch or unsupported features. If the parameters are acceptable, the responder would instead reply with a Keepalive Message to maintain the session.

Comprehensive and Detailed In-Depth Explanation:

1. Free Mobility in Huawei Campus Networks:

Free mobility allows users to move freely within a campus network while retaining their access rights and security policies. It leverages iMaster NCE-Campus as the controller to simplify the deployment and management of user policies.

2. Role of the Administrator:

Administrators are responsible for defining high-level policies and security configurations. Specifically:

Define a Policy Control Matrix:

Administrators create a matrix that specifies how users from different security groups interact.

This matrix outlines access permissions and is a part of the policy planning phase.

Define Security Groups:

Administrators categorize users, devices, or endpoints into security groups based on their roles or functions.

These groups form the basis for applying uniform policies within the network.

3. Role of iMaster NCE-Campus (Controller):

The controller handles the automatic delivery of configured policies and security settings to network devices.

Deliver IP-Security Group Entries:

Once the administrator defines the policies and groups, iMaster NCE-Campus automatically distributes the IP-Security Group Binding entries to the relevant network devices.

This ensures consistent policy enforcement across the campus.

4. Why This Mapping Is Correct:

Administrators define the structure and policies, while the controller (iMaster NCE-Campus) handles the implementation and distribution.

This division of responsibilities optimizes the network management process, reducing human error and ensuring that policies are consistently applied.

NETCONF defines datastores to manage device configurations:

running: Active configuration in use

candidate: Staging area for changes before applying

startup: Configuration loaded on reboot

NETCONF operations:

< commit > : Applies changes from candidate → running → ✅

< delete-config > : Deletes a specified datastore (e.g., startup) → ✅

< validate > : Validates syntax/logic in the candidate datastore → ✅

Statement D is incorrect: < commit > never submits config from startup to running — that’s handled automatically at boot time, not through NETCONF commands.

Correct answer: D

Let’s analyze the scenario and each statement carefully based on OSPF path selection and BGP behavior in Huawei routers.

✅ Option A: The preferred path is R1–R3–R4.

According to the OSPF cost values:

R1–R3–R4: Cost = 1 + 1 = 2

R1–R2–R4: Cost = 2 + 2 = 4

OSPF chooses the lowest-cost path to reach a destination. Therefore, R1 will prefer the R1–R3–R4 path to reach 172.20.1.4/32.

Huawei Datacom Reference:

" OSPF selects routes based on the shortest path calculated using link costs. The router always selects the path with the lowest cost. "

(Source: HCIE-Datacom Study Guide v3.0 – OSPF Path Selection, Chapter 5)

✅ Option B: If the stub router on-startup command is run on R3, packet loss occurs during the power-off process of R3 but no packet loss occurs during the startup process of R3.

When R3 is powered off, OSPF needs to reconverge, which causes temporary packet loss.

When R3 starts up, it will advertise itself as a stub router using the stub-router on-startup command. This tells OSPF not to use R3 as a transit path during the startup period, thus preventing traffic blackholing.

Huawei Datacom Reference:

" stub-router on-startup command prevents a newly started router from being used as a transit node by OSPF, allowing routing to remain stable during convergence. "

(Source: HCIE-Datacom Study Guide v3.0 – OSPF Stub Router Functionality, Chapter 6.2)

❌ Option C: The preferred path is R1–R2–R4.

This is incorrect because the OSPF path cost via R2 is higher (4) than the cost via R3 (2).

❌ Option D: Packet loss occurs during both the power-off and startup processes of R3.

Incorrect. As explained above, when the stub-router on-startup command is used, packet loss is avoided during startup, but still occurs during power-off since the alternate path requires convergence.

Comprehensive and Detailed In-Depth Explanation:

NSR (Non-Stop Routing) and NSF (Non-Stop Forwarding) are high-availability mechanisms used to maintain network stability during routing process failures:

NSR (Non-Stop Routing):

Operates within the local router only.

Keeps routing information synchronized between the active and standby processes.

Does not require collaboration from neighboring routers.

NSF (Non-Stop Forwarding):

Requires collaboration from neighboring routers that support graceful restart.

The router undergoing failover relies on its neighbors to maintain forwarding tables while control plane recovery takes place.

Neighboring routers must support GR (Graceful Restart) for NSF to function correctly.

Therefore, the correct answer is B because NSF requires neighboring router collaboration, while NSR does not.

To determine R3’s role (Level-1, Level-2, or Level-1-2) based on the provided output of the display ipv6 routing-table protocol isis command on R3, we need to analyze the IS-IS routing information and understand IS-IS hierarchy and behavior, particularly in the context of IPv6 routing. Let’s break it down step by step:

Understanding the IS-IS Levels and Hierarchy:

IS-IS (Intermediate System to Intermediate System) is a link-state routing protocol that supports a two-level hierarchy:

Level-1: Routers within the same area, responsible for intra-area routing. Level-1 routers only maintain routing information for their area and rely on Level-1-2 routers to reach other areas.

Level-2: Routers that form the backbone, connecting different areas for inter-area routing. Level-2 routers maintain routing information across areas.

Level-1-2: Routers that operate both at Level-1 (within their area) and Level-2 (to connect to other areas). These routers act as boundary routers between Level-1 areas and the Level-2 backbone.

A router’s role (Level-1, Level-2, or Level-1-2) determines which types of adjacencies it can form and what routing information it advertises or receives.

Analyzing the Output:

The output shows R3’s IPv6 routing table with routes learned via IS-IS, specifically:

Destination: 2082:EDFC:DDCC::B824:0/127, Protocol: ISIS-L1

This route is learned via IS-IS Level-1 (ISIS-L1), indicating that R3 has a Level-1 adjacency and is receiving or advertising routes within its area.

The next hop (FE80::2E0:FCFF:FE45:6A3E) and interface (GigabitEthernet0/0/0) suggest this route is intra-area.

Destination: 2082:EDFC:DDCC::B891:0/127, Protocol: ISIS-L2

This route is learned via IS-IS Level-2 (ISIS-L2), indicating that R3 has a Level-2 adjacency and is receiving or advertising routes for inter-area or backbone routing.

The next hop (FE80::2E0:FCFF:FE50:406F) and interface (GigabitEthernet0/0/1) suggest this route is for a different area or the backbone.

Both Level-1 and Level-2 routes are present in R3’s routing table, which provides critical insight into R3’s role.

Determining R3’s Role:

Level-1 Routers:

Level-1 routers only participate in Level-1 adjacencies and maintain routing information for their area. They do not have Level-2 routes or adjacencies unless connected to a Level-1-2 router. Since R3 has a Level-2 route (ISIS-L2), it cannot be exclusively a Level-1 router.

Level-2 Routers:

Level-2 routers focus on inter-area routing and typically do not maintain Level-1 routes unless they are also configured as Level-1-2. Since R3 has a Level-1 route (ISIS-L1), it cannot be exclusively a Level-2 router.

Level-1-2 Routers:

Level-1-2 routers operate both at Level-1 (for intra-area routing) and Level-2 (for inter-area routing). They can form adjacencies with both Level-1 and Level-2 neighbors and maintain both types of routes. The presence of both ISIS-L1 and ISIS-L2 routes in R3’s routing table indicates that R3 is participating in both Level-1 and Level-2 adjacencies, making it a Level-1-2 router.

Evaluating Each Option:

A. R3 must be a Level-2 device.

This is incorrect because R3 has ISIS-L1 routes, indicating it is also participating in Level-1 adjacencies, which Level-2-only devices do not do. Level-2 devices focus solely on inter-area routing and do not maintain Level-1 routes.

B. The device role of R3 cannot be determined.

This is incorrect because the presence of both ISIS-L1 and ISIS-L2 routes in the routing table clearly indicates R3’s role. The combination of Level-1 and Level-2 routes confirms R3 is a Level-1-2 router.

C. R3 must be a Level-1-2 device.

This is correct. The routing table shows both ISIS-L1 (Level-1) and ISIS-L2 (Level-2) routes, meaning R3 is operating as both a Level-1 and Level-2 router, which defines a Level-1-2 device.

D. R3 must be a Level-1 device.

This is incorrect because R3 has ISIS-L2 routes, indicating it is also participating in Level-2 adjacencies, which Level-1-only devices do not do. Level-1 devices only maintain intra-area routes and rely on Level-1-2 routers for inter-area reachability.

Additional Considerations:

The Flags: D in the output typically indicates a directly connected route or a route downloaded to the forwarding table, but it does not affect the determination of R3’s IS-IS level.

The preference (15) and cost (20) are standard for IS-IS routes and do not impact the level determination.

In Huawei’s IS-IS implementation, routers can be configured explicitly as Level-1, Level-2, or Level-1-2 using commands like isis level-1-2 under the IS-IS process. The presence of both Level-1 and Level-2 routes confirms R3’s configuration as Level-1-2.

Huawei HCIE-Datacom Context:

According to Huawei HCIE-Datacom documentation, IS-IS routers can operate at different levels, and the routing table’s protocol type (ISIS-L1 or ISIS-L2) indicates the level of adjacency. A router with both Level-1 and Level-2 routes is necessarily a Level-1-2 device, as it participates in both intra-area and inter-area routing.

The display ipv6 routing-table protocol isis command on Huawei devices shows routes learned via IS-IS, and the protocol type (L1 or L2) directly reflects the router’s role in the IS-IS hierarchy.

Conclusion:

Based on the presence of both ISIS-L1 and ISIS-L2 routes in R3’s IPv6 routing table, R3 must be a Level-1-2 device, as it is participating in both Level-1 (intra-area) and Level-2 (inter-area) adjacencies. Therefore, the correct answer is C.

References to Huawei HCIE-Datacom Documents:

Huawei HCIE-Datacom V1.0 Training Material, Chapter on IS-IS Configuration and Hierarchy.

Huawei NE Series Router Configuration Guide, IS-IS Section (Level-1, Level-2, and Level-1-2 Operations).

Huawei Technical Whitepaper on IS-IS Protocol, discussing IPv6 Routing and Level Determination.

Option B is incorrect because it falsely states that EBGP cannot be configured on Spoke-PE or Spoke-CE if the Hub-CE and Hub-PE run IGP. In reality, EBGP can still be used between Spoke sites and PE devices, regardless of the protocol between the Hub PE and CE. EBGP is often used for PE-CE communication, including in Hub-and-Spoke architectures.

Exact Extract - Huawei HCIE-Datacom VPN Section:

“In Hub & Spoke deployments, EBGP can be deployed between Spoke-CE and Spoke-PE. The choice of routing protocol between Hub-CE and Hub-PE does not limit this.”

IS-IS was originally designed for IPv4, but extensions via TLVs (Type-Length-Value) allow it to support IPv6. These are referred to as New IS-IS TLVs, including TLV 236 (IPv6 Reachability), TLV 232 (IPv6 Interface Address), etc. These TLVs are crucial for IPv6 route computation within IS-IS.

Exact Extract - HCIE-Datacom Guide – IPv6 Routing Protocols Chapter

“IS-IS uses new TLVs such as TLV 236 and TLV 232 to carry IPv6 prefix and interface address information. These TLVs are essential to enable IPv6 route calculation.”

Comprehensive and Detailed In-Depth Explanation:

1. Understanding VXLAN Asymmetric IRB Forwarding:

In VXLAN (Virtual Extensible LAN) networks, there are two types of IRB forwarding: Symmetric IRB and Asymmetric IRB.

In Asymmetric IRB, routing occurs only at the ingress VTEP (Virtual Tunnel Endpoint).

The ingress VTEP (VTEP1) encapsulates the original data frame and sends it to the egress VTEP (VTEP2) over the VXLAN tunnel.

The destination MAC address of the original Ethernet frame is the MAC address of the Layer 3 gateway (VBDIF) at the egress VTEP.

2. Analyzing the Topology:

PC1 (172.16.2.1/24) with MAC A is sending traffic to PC2 (172.16.1.2/24) with MAC D.

Both PCs are in different subnets, so inter-subnet routing is required.

VTEP1 (1.1.1.1) on SW1 is the ingress VTEP.

VTEP2 (2.2.2.2) on SW2 is the egress VTEP.

The VXLAN Network Identifier (VNI) for the traffic is 100.

SW1 has two VBDIF interfaces:

VBDIF10 (MAC B) - Interface for BD10 (172.16.2.254).

VBDIF20 (MAC C) - Interface for BD20 (172.16.1.254).

3. Packet Flow in Asymmetric IRB:

Step 1: PC1 sends a packet destined for PC2. The packet is routed at the ingress VTEP (SW1) using the VBDIF interface (VBDIF10 with MAC B).

Step 2: The ingress VTEP (SW1) encapsulates the packet in a VXLAN header (VNI 100) and sends it to VTEP2.

Step 3: The original data frame inside the VXLAN packet must have a destination MAC address that matches the gateway MAC address (VBDIF20 - MAC C) at the egress VTEP (SW2).

Step 4: On reaching VTEP2, the encapsulation is removed, and the original frame with destination MAC C is forwarded.

Step 5: VTEP2 performs Layer 3 routing to forward the packet to PC2.

4. Why MAC C is Correct:

In asymmetric IRB forwarding, the routing decision at the ingress VTEP ensures that the destination MAC in the original frame is set to the VBDIF (gateway) MAC of the egress VTEP.

Since the egress VTEP (SW2) has VBDIF20 (MAC C) for the destination subnet (172.16.1.0/24), the destination MAC address of the original frame is MAC C.

IPsec (Internet Protocol Security) provides secure communication over IP networks through several essential functions. Let’s explain each function and its purpose:

1. Data Origin Authentication:

Description: The receiver verifies the identity of the sender.

Explanation:

This function ensures that the data received actually comes from the claimed source.

IPsec achieves this using IKE (Internet Key Exchange) and digital signatures.

The Authentication Header (AH) and Encapsulating Security Payload (ESP) support authentication.

Use Case: Verifying that a message claiming to be from a specific IP address is genuinely from that source.

2. Data Encryption:

Description: The sender encrypts the data, and the receiver decrypts the data.

Explanation:

Encryption ensures data confidentiality by transforming readable data (plaintext) into unreadable data (ciphertext).

Only the intended receiver with the correct decryption key can convert the ciphertext back to plaintext.

Common encryption algorithms used include AES (Advanced Encryption Standard) and DES (Data Encryption Standard).

Use Case: Protecting sensitive data transferred over public networks.

3. Data Integrity:

Description: The receiver verifies received data to determine whether the data has been tampered with.

Explanation:

Ensures that the data was not altered during transmission.

Uses cryptographic hash functions (e.g., SHA-1, SHA-256) to generate a message digest.

The digest is sent with the data and verified on the receiving side.

Use Case: Detecting any changes made to the data packet during transmission.

4. Anti-Replay:

Description: The receiver rejects duplicate data packets.

Explanation:

Prevents attackers from capturing packets and replaying them later.

Uses sequence numbers to detect replayed or duplicated packets.

The receiver keeps a sliding window of sequence numbers to compare incoming packets.

Use Case: Blocking malicious actors from sending previously intercepted packets to disrupt communication.

Why This Mapping Is Correct:

The functions and descriptions are aligned based on the core concepts of IPsec and the roles they play in ensuring secure data transmission.

Each function addresses a specific aspect of security: authentication, confidentiality, integrity, and replay protection.

Huawei Open Programmability System (OPS) and Scripting Support

Huawei OPS (Open Programmability System) enables network automation using script-based programming for device management and configuration.

✅ Python is the primary language integrated into Huawei OPS.

Python scripts can automate device configurations, monitoring, and troubleshooting.

OPS supports Python libraries for interacting with network APIs and CLI commands.

Used for Huawei CloudCampus, SDN, and Datacom devices.

BGP in Huawei SD-WAN

Huawei SD-WAN uses BGP (Border Gateway Protocol) as the primary routing protocol to exchange VPN routes between Customer Premises Equipment (CPEs) and the controller.

✅ Why BGP is Used in SD-WAN?

Scalability: BGP can handle a large number of VPN routes.

Policy-Based Routing: BGP allows traffic engineering and policy control across SD-WAN tunnels.

Multiprotocol Support: Huawei SD-WAN uses MP-BGP to exchange IPv4, IPv6, and VPNv4 routes.

SRv6 Instruction Naming Conventions

SRv6 (Segment Routing over IPv6) uses segment identifiers (SIDs) with specific functions, indicated by instruction keywords:

✅ A. T: Searches a specified routing table to forward packets.

T (Table Lookup) → Performs a lookup in a specified routing table and forwards packets accordingly.

❌ B. M: Searches a Layer 2 forwarding table for unicast forwarding.

Incorrect! SRv6 does not use M for Layer 2 unicast forwarding.

✅ C. V: Searches a VPN instance routing table to forward packets.

V (VPN Routing Table Lookup) → Performs a lookup in a VPN instance (VRF) table for forwarding.

✅ D. X: Forwards packets through one or a group of specified Layer 3 interfaces.

X (Cross-connect forwarding) → Forwards packets via a specified Layer 3 interface or group of interfaces.

Reference from Huawei HCIE-Datacom Documentation:

Huawei SRv6 Configuration Guide – SRv6 SID Naming and Instruction Set

HCIE-Datacom Study Material – Segment Routing over IPv6 (SRv6) Functionality

SSH (Secure Shell) is a protocol designed for secure remote access and is always built on TCP, typically on port 22. UDP is not supported for SSH, as it is connectionless and doesn ' t provide the required reliability and order.

Exact Extract – Huawei Security Protocol Fundamentals:

“SSH is a TCP-based protocol. It does not support UDP. TCP ensures session reliability and data integrity, which are critical for SSH.”

In Huawei’s Free Mobility solution:

Authentication Point (AP): Identifies users and associates them with a Security Group Tag (SGT) upon access.

Policy Enforcement Point (PEP): Enforces policies between different security groups, such as allowing or denying traffic.

Key points:

A is correct — The PEP enforces inter-group access based on defined policies.

B is incorrect — AP and PEP can be on separate devices, offering deployment flexibility.

C is incorrect — The policy enforcement happens at the PEP, not the AP. AP ' s job is to authenticate and tag traffic.

D is correct — AP and PEP can be deployed on different devices.

Correct answers: A, D

Comprehensive and Detailed In-Depth Explanation:

In Huawei Open Programmability System (OPS), the URL structure is used to specify managed objects in a standardized way.

The URL path /ifm/interfaces/interface is used in NETCONF/YANG-based APIs to represent interface-related data on a device.

This path allows users to query, configure, or manage network interfaces through programmatic means.

The IFM (Interface Management) model is commonly used for managing network interfaces, and this URL path correctly follows the convention.

Therefore, the statement is TRUE.

The MPLS header consists of:

Label (20 bits) – Label value used for forwarding.

EXP (3 bits) – QoS field (Class of Service).

S bit (1 bit) – Bottom-of-Stack indicator.

TTL (8 bits) – Time-to-Live, similar to the TTL field in the IP header.

Function of TTL in MPLS:

It is used to prevent infinite loops.

Every LSR decrements the TTL by 1.

When TTL reaches 0, the packet is discarded.

This mirrors the behavior of IP TTL and ensures loop prevention in MPLS networks.

Correct answer: D. This field is used to prevent packet forwarding loops, similar to the TTL field in an IP header.