H12-891_V1.0 Huawei HCIE-Datacom V1.0 Free Practice Exam Questions (2025 Updated)

SSH Public Key Authentication

Inpublic key authentication mode, the SSH client must generate akey pair (public and private keys)before connecting to an SSH server.

✅C. ssh-keygen -t dsa (Correct Answer)

DSA (Digital Signature Algorithm) key generationfor SSH authentication.

Generates aprivate key (id_dsa)and apublic key (id_dsa.pub).

When port security is enabled and the maximum number of learned MAC addresses is reached, the switch can trigger multiple security actions depending on configuration:

Discard packets with unknown source MACs

Generate alarms

Shut down the port (set to error-down)

Do all the above combined (default behavior)

The most comprehensive and commonly configured behavior is error-down + alarm generation, which corresponds to Option D.

Exact Extract - Huawei HCIE-Datacom Switching Guide:

“When the MAC address limit is reached on a port with port security enabled, the system can generate alarms and set the port to error-down state based on security policies.”

In Huawei’sCloudCampus Solution, VNs (Virtual Networks) areisolated by defaultfor security purposes. To enableinter-VN communication, you must explicitly configure policies that allow traffic between different VNs.

The correct way to control and enable this communication is viarouting policies, especiallyinter-VN routing policieson thecore or border nodes.

Static routesorOSPF deploymentsare not sufficient or appropriate for policy-controlled VN communication in this context.

Correct answer: D. Deploy a routing policy

The command port-isolate enable is used on Huawei switches to completely isolate traffic at both Layer 2 and Layer 3 between different interfaces within the same VLAN. This isolation prevents any communication between isolated ports—even if they belong to the same subnet or VLAN—making it a critical security feature in multi-tenant environments.

Usage Context:

Often used in shared service or hotel network scenarios.

Can be applied in access port configurations.

Does not require additional VLAN creation or private VLAN features.

Huawei Datacom Reference:

"To completely isolate Layer 2 and Layer 3 communication between interfaces in the same VLAN, run the port-isolate enable command under the interface view."

(Source: HCIE-Datacom Study Guide V3.0 – Chapter: VLAN & Security Technologies, Section: Port Isolation)

Comprehensive and Detailed In-Depth Explanation:

The traceroute output shows that the path from R1 to the destination 172.17.1.5 is looping. After reaching the IP 10.1.13.1, the path goes back to 10.1.12.2, repeating the previous hops. This indicates a routing loop, where R1 continuously forwards packets through a circular path, never reaching the destination. Routing loops typically occur due to inconsistent or incorrect routing table entries, often because of routing protocol misconfigurations.

The Protocol Trace function of iMaster NCE-CampusInsight allows O&M teams to analyze the full packet exchange process (e.g., DHCP, authentication, IP acquisition) between clients and the network. In this scenario, it helped pinpoint DHCP address pool exhaustion as the cause.

Exact Extract - Huawei iMaster NCE-CampusInsight Product Documentation:

“The Protocol Trace function visualizes packet-level interaction processes for DHCP, ARP, 802.1X, and others, allowing fast identification of root causes for network access issues.”

Understanding the Command Components:

This is aHuawei CLI commandused fordiagnosing connectivitywithin aVPN instancein an MPLS network.

ping -aX→ Specifies thesource IP address(X) of the ping packets.

-cY→ Specifies thenumber of ICMP Echo Request packetsto send (Y).

-sZ→ Defines thesize (in bytes) of each ICMP Echo Requestpacket (Z).

-vpn-instance M→ Specifies theVPN instance (VRF) Mto which the ping packets belong.

Why are all options correct?

✅A. The source IP address of the ping packets is X.

The -aX optionforces the ping to originate from IP Xinstead of the default interface IP.

✅B. The ping packets belong to VPN instance M.

The -vpn-instance M optionensures the ping is sent within VPN instance M, allowing verification ofMPLS L3VPN routing.

✅C. During the ping operation, the quantity of ICMP Request packets is Y.

The -cY parameter sets thenumber of ICMP Echo Requeststo be sent, making Y the total count.

✅D. The size of each ICMP Request packet for the ping operation is Z bytes.

The -sZ parameterdefines packet size, helping to testMTU (Maximum Transmission Unit)issues.

Real-World Application:

Verifying MPLS VPN connectivity:Ensure customer networks are reachable withinseparate VRFs.

Testing MTU & fragmentation:Using -sZ, operators can check ifpacket fragmentationoccurs.

Debugging asymmetric routing issues:By forcing -aX, engineers can trace return paths.

✅Reference:Huawei HCIE-Datacom Official Guide – MPLS VPN Troubleshooting & Ping Options

IGP Metric Design in Enterprise WANs

In anenterprise bearer WAN, routingmetrics determine path selection. Theaggregation layerconnects multiple access-layer devices to the core network, so it should have alower metricto:

✅Ensure traffic is forwarded through higher-capacity aggregation links instead of lower-bandwidth access links.

✅Optimize traffic flow, reduce congestion, and improve network efficiency.

✅Enhance reliability by preferring more stable aggregation links.

IGP Routing Protocols Considerations:

OSPF: Lower cost values indicate preferred paths.

IS-IS: Lower link metrics result in preferred forwarding paths.

Reference from Huawei HCIE-Datacom Documentation:

Huawei IGP Design Guide – Enterprise WAN Routing Optimization

HCIE-Datacom Training Material – Metric Calculation and Path Selection in OSPF/IS-IS

OSPF (Open Shortest Path First) Router-LSA (Type 1 LSA)describesall directly connected OSPF linksof a router and their types. Thefollowing link types can appear in a Router-LSA:

Point-to-Point (P-2-P) (B)– Represents adirect connection between two routers.

Virtual Link (Vlink) (C)– Used toconnect an area to the backbone (Area 0)when a direct connection is unavailable.

Stub Network (StubNet) (D)– Represents anetwork with only one exit point(e.g., a loopback interface or passive interface).

Incorrect Option:

TransNet (A) – Incorrect!

Transit networks appear in Network LSAs (Type 2), not Router LSAs.

Reference from Huawei HCIE-Datacom Documentation:

Huawei OSPF Configuration Guide – Router-LSAs and Link Types

HCIE-Datacom Training Material – OSPF LSAs and Topology Advertisement

Comprehensive and Detailed In-Depth Explanation:

BGP4+ (BGP for IPv6) uses theMP_REACH_NLRI(Multiprotocol Reachable Network Layer Reachability Information) attribute to advertise IPv6 routes. This attribute is part of BGP's multiprotocol extensions (RFC 2858), allowing BGP to support multiple address families, including IPv6.

MP_REACH_NLRI:Advertises reachable IPv6 prefixes along with next-hop information.

MP_UNREACH_NLRI:Used to withdraw previously advertised IPv6 routes.

Since IPv6 addresses are significantly different from IPv4 addresses in structure and length (128 bits), the traditional BGP update message format (which supports only IPv4) is insufficient. TheMP_REACH_NLRIattribute solves this by carrying IPv6-specific information.

Huawei IPsec supports multiple modes for establishing Security Associations (SAs):

A. Template negotiation — Used in IPsec policy templates and dynamic VPNs.

B. IKE auto-negotiation mode — Automatically negotiates parameters via IKE Phase 1/2.

C. Certificate negotiation — IPsec peers can authenticate each other using certificates during IKE negotiation.

D. Manual mode — Static IPsec SAs can be manually configured without IKE, often used in simple or static topologies.

Exact Extract - Huawei Security Configuration Guide (USG Series):

“IPsec SAs can be established manually or dynamically through IKE, including using PSKs or certificates. Template-based approaches simplify large-scale deployment.”

Huawei AR routers used as egress gateways in CloudCampus solutions support multiple onboarding and deployment methods, including:

DHCP Option 148-based auto-deployment

Web-based management

CLI-based deployment and configuration (also supported)

So, the statement is incorrect—CLI-based deployment is supported.

Exact Extract - Huawei CloudCampus AR Router Deployment Guide:

“AR series routers support multiple deployment methods including CLI, DHCP Option 148, and web-based registration.”

Comprehensive and Detailed In-Depth Explanation:

In large- and medium-sized campus networks,Multi-mode authenticationis commonly used for PCs connected to IP phones. This is because multi-mode authentication allows:

Multiple authentication methods on the same interface,such as MAC address authentication for the IP phone and802.1X authentication for the PC.

This setup is ideal for scenarios where both devices share a single network port but require different authentication mechanisms.

MAC address authentication (A)and802.1X authentication (B)individually cannot accommodate both devices efficiently.

Portal authentication (D)is mainly used for guest access and is not practical for IP phone and PC connections.

Comprehensive and Detailed In-Depth Explanation:

A. When planning paths based on bandwidth:Correct. The available bandwidth of each interface must beset in advanceto allow path planning based on bandwidth requirements.

B. When planning paths based on delay:Correct. To plan paths considering delay, you need to deployTWAMP (Two-Way Active Measurement Protocol)oriFIT (Intelligent Flow Information Telemetry)to measure thereal-time delayon network links.

C. If the controller plans SR-MPLS Policy paths:Incorrect. The controller can planprimary, backup, and load-balanced paths, enablingtraffic distribution across multiple paths.

D. Statically planned SR-MPLS Policy paths:Correct. You canmanually configure load balancingfor the primary path when planning the SR-MPLS Policy path statically.

Let’s analyze the scenario and each statement carefully based on OSPF path selection and BGP behavior in Huawei routers.

✅ Option A: The preferred path is R1–R3–R4.

According to the OSPF cost values:

R1–R3–R4: Cost = 1 + 1 = 2

R1–R2–R4: Cost = 2 + 2 = 4

OSPF chooses the lowest-cost path to reach a destination. Therefore, R1 will prefer the R1–R3–R4 path to reach 172.20.1.4/32.

Huawei Datacom Reference:

"OSPF selects routes based on the shortest path calculated using link costs. The router always selects the path with the lowest cost."

(Source: HCIE-Datacom Study Guide v3.0 – OSPF Path Selection, Chapter 5)

✅ Option B: If the stub router on-startup command is run on R3, packet loss occurs during the power-off process of R3 but no packet loss occurs during the startup process of R3.

When R3 is powered off, OSPF needs to reconverge, which causes temporary packet loss.

When R3 starts up, it will advertise itself as a stub router using the stub-router on-startup command. This tells OSPF not to use R3 as a transit path during the startup period, thus preventing traffic blackholing.

Huawei Datacom Reference:

"stub-router on-startup command prevents a newly started router from being used as a transit node by OSPF, allowing routing to remain stable during convergence."

(Source: HCIE-Datacom Study Guide v3.0 – OSPF Stub Router Functionality, Chapter 6.2)

❌ Option C: The preferred path is R1–R2–R4.

This is incorrect because the OSPF path cost via R2 is higher (4) than the cost via R3 (2).

❌ Option D: Packet loss occurs during both the power-off and startup processes of R3.

Incorrect. As explained above, when the stub-router on-startup command is used, packet loss is avoided during startup, but still occurs during power-off since the alternate path requires convergence.

Node segments in SR-MPLS (Segment Routing over MPLS) are typically automatically generated and distributed via IGP protocols (such as IS-IS or OSPF) using SR extensions. There is no need to manually configure node segments on every router.

Exact Extract – Huawei HCIE-Datacom Study Guide – Segment Routing:

“Node SIDs are automatically generated and advertised by IGPs with SR extensions. Manual configuration is not required except in special cases like adjacency SIDs.”

Why is Free Mobility Not Based on VLANs or IP Addresses?

Free mobilityin Huawei CloudCampus implementspolicy-based user access controlbased onuser identity (rather than VLANs or IP addresses).

Users canmove across different network locationswhile maintaining their assignedsecurity and access policies.

✅How Free Mobility Works:

Policies are applied based onUser Groupsinstead of VLAN or IP.

UsesGroup-Based Policy Control (GBP)andSoftware-Defined Access (SDA)principles.

❌Incorrect Statement Explanation:

Traditional networks rely on VLANs and IP addresses for segmentation, butFree Mobility applies policies at the user level, allowing seamless access anywhere on the network.

Reference from Huawei HCIE-Datacom Documentation:

Huawei CloudCampus Solution Guide – Free Mobility and Policy Control

HCIE-Datacom Training Material – Identity-Based Networking

Comparison Between Paramiko (SSH) and Telnetlib (Telnet)

✅Paramiko (SSH) is more secure than Telnetlib (Telnet).

SSH (Secure Shell) encrypts login credentials and session datausing encryption protocols likeAES and RSA.

Telnet transmits data in plaintext, making it vulnerable to eavesdropping and man-in-the-middle attacks.

✅Why is Telnet Insecure?

No encryption→ Credentials (username/password) are sent in plaintext.

Easily interceptedby attackers using packet sniffers (e.g., Wireshark).

Correct Method for Secure Remote Login in Python:

UseParamiko for SSH-based secure automation.

Example of logging in withParamiko (SSH)in Python:

import paramiko

ssh = paramiko.SSHClient()

ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())

ssh.connect("192.168.1.1", username="admin", password="password")

stdin, stdout, stderr = ssh.exec_command("display version")

print(stdout.read().decode())

ssh.close()

Reference from Huawei HCIE-Datacom Documentation:

Huawei Security Best Practices – Avoiding Telnet and Using SSH for Secure Access

HCIE-Datacom Training Material – Network Automation with Python (Paramiko & Telnetlib)

A screenshot of a computer AI-generated content may be incorrect.

IPsec (Internet Protocol Security) provides secure communication over IP networks through several essential functions. Let’s explain each function and its purpose:

1. Data Origin Authentication:

Description:The receiver verifies the identity of the sender.

This function ensures that the data received actually comes from the claimed source.

IPsec achieves this usingIKE (Internet Key Exchange)anddigital signatures.

TheAuthentication Header (AH)andEncapsulating Security Payload (ESP)support authentication.

Use Case:Verifying that a message claiming to be from a specific IP address is genuinely from that source.

2. Data Encryption:

Description:The sender encrypts the data, and the receiver decrypts the data.

Encryption ensuresdata confidentialityby transforming readable data (plaintext) into unreadable data (ciphertext).

Only the intended receiver with the correct decryption key can convert the ciphertext back to plaintext.

Common encryption algorithms used includeAES (Advanced Encryption Standard)andDES (Data Encryption Standard).

Use Case:Protecting sensitive data transferred over public networks.

3. Data Integrity:

Description:The receiver verifies received data to determine whether the data has been tampered with.

Ensures that the data was not altered during transmission.

Uses cryptographichash functions(e.g.,SHA-1, SHA-256) to generate amessage digest.

The digest is sent with the data and verified on the receiving side.

Use Case:Detecting any changes made to the data packet during transmission.

4. Anti-Replay:

Description:The receiver rejects duplicate data packets.

Prevents attackers from capturing packets and replaying them later.

Usessequence numbersto detect replayed or duplicated packets.

The receiver keeps asliding windowof sequence numbers to compare incoming packets.

Use Case:Blocking malicious actors from sending previously intercepted packets to disrupt communication.

Why This Mapping Is Correct:

The functions and descriptions are aligned based on the core concepts of IPsec and the roles they play in ensuring secure data transmission.

Each function addresses a specific aspect of security:authentication, confidentiality, integrity, and replay protection.