H19-404_V1.0 Huawei HCSE-Presales-Campus Network Planning and Design V1.0 Free Practice Exam Questions (2026 Updated)

All four options are recognized terminal identification methods. MAC OUI examines the first three bytes of a device’s MAC address to determine its manufacturer, although it generally cannot identify the exact model or operating system. DHCP option identification analyzes fields such as DHCP options 12, 55, and 60, which can reveal the hostname, parameter-request list, vendor class, and other terminal characteristics. SNMP query is an active identification method that retrieves device details from relevant MIB objects and is particularly useful for printers, network devices, and other SNMP-capable equipment.

Nmap is also an active scanning method. It analyzes open ports, service responses, protocol behavior, and operating-system fingerprints to estimate a terminal’s device type and OS. Huawei distinguishes information-reporting methods from proactive scanning methods: MAC OUI and DHCP options generally use information observed in traffic, whereas SNMP and Nmap actively query or scan the endpoint. iMaster NCE-Campus can correlate multiple fingerprints to improve identification accuracy and automatically apply terminal-specific access policies.

==================

The statement is true. In this three-layer campus design, aggregation switches function as VXLAN edge nodes and distributed gateways, while access switches provide terminal connectivity. Policy association allows the access switches to participate in user admission and policy enforcement without requiring them to support full VXLAN functions.

The access switch collects terminal access information and associates user traffic with the appropriate service or policy. The aggregation switch, acting as the fabric edge and VXLAN tunnel endpoint, performs VXLAN encapsulation, distributed gateway forwarding, and policy-related operations. Huawei specifically states that when aggregation switches operate as edge nodes, access switches do not need to support VXLAN and can cooperate with aggregation switches through policy association. This also permits legacy access switches to be reused.

The design reduces upgrade costs and avoids extending complex overlay configurations to every access device. Huawei’s automated virtual-network deployment model also explicitly includes policy association between the aggregation and access layers, allowing access switches without VXLAN capability to operate as transparent or associated access nodes. Therefore, option A is correct.

==================

The statement is true. AI-based energy-saving systems analyze historical traffic and usage patterns to predict periods of low network demand. Ordinary AP radios or access devices can then enter an energy-saving state when their capacity is not required, while surrounding devices maintain sufficient coverage and service availability.

IoT APs, however, may host continuously operating IoT cards, sensors, electronic shelf-label services, Bluetooth location functions, RFID services, healthcare devices, or asset-tracking terminals. Placing such an AP into an energy-saving or hibernation state could interrupt more than ordinary Wi-Fi connectivity. It could also disable an IoT module’s power supply, management channel, data backhaul, or persistent sensing function. Huawei’s Wi-Fi and IoT convergence architecture uses APs as shared locations, power sources, and communication channels for IoT services.

Huawei also applies intelligent technologies to analyze AP load trends and perform predictive network optimization. The safer default is therefore to exclude IoT APs from automatic energy-saving actions unless the administrator confirms that their attached IoT services tolerate interruption. Accordingly, the answer is True.

==================

The statement is false. In Parallel Redundancy Protocol, LAN A and LAN B must remain two separate, failure-independent networks. A PRP RedBox connects a singly attached node or conventional network to both parallel LANs and behaves toward the PRP network like a doubly attached node. It duplicates outgoing frames and transmits one copy through each PRP port. For incoming traffic, it accepts the first valid copy and discards the later duplicate before forwarding the frame through its interlink port.

The RedBox must not operate as a normal bridge that directly forwards frames from its LAN A port to its LAN B port. Doing so would connect the two redundant LANs, potentially creating loops, duplicate propagation, broadcast amplification, and a common failure path. That would defeat the fundamental PRP requirement that failure or disruption in one LAN must not affect the other.

The original video contains the typing error “PPR RedBox”; the correct term is PRP RedBox , meaning Parallel Redundancy Protocol Redundancy Box. PRP topology requires two separate networks with no direct links between them, while the RedBox provides controlled redundant attachment for non-PRP devices.

==================

APs support barcode scanning through the CloudCampus APP, DHCP Option 148–based deployment, and deployment through Huawei’s registration query center. With barcode scanning, the installer scans the AP’s label using the CloudCampus APP. The application obtains information such as the electronic serial number and MAC address, associates the AP with the correct tenant and site, and allows the AP to register with iMaster NCE.

With DHCP Option 148, the DHCP server supplies the AP with its IP configuration and the IP address and port number of iMaster NCE. The AP changes to cloud-management mode and automatically initiates registration. Huawei lists AR routers, switches, and APs as supported devices for this mode.

The registration query center can also provide the controller address after the AP contacts Huawei’s query service. It supports APs together with ARs, firewalls, and switches. Email-based deployment is primarily an SD-WAN CPE or AR-router ZTP method, not an AP deployment mode. Therefore, A, C, and D are correct.

==================

The statement is false because “AP” is a generic term covering several operating architectures. A Fit AP requires a WAC, and a cloud-managed AP is centrally managed through iMaster NCE-Campus. However, a Fat AP is autonomous: it can operate and be configured independently without a centralized controller. Huawei also describes the leader AP architecture, in which a capable AP integrates part of the WAC functionality, operates independently, and manages a limited number of Fit APs.

Therefore, the absolute claim that an AP cannot work independently is technically incorrect. The correct interpretation depends on the AP mode. Fit APs depend on a WAC or leader AP for centralized configuration and CAPWAP-based management, whereas Fat APs provide local control and forwarding. Huawei explicitly states that the Fat AP architecture is autonomous and requires no additional centralized control device. Because at least one recognized AP architecture operates independently, the correct answer is False.

==================

A central switch in the relevant passive Ethernet network architecture supports a maximum of 48 access units. The architecture replaces a conventional multi-layer access design with a centralized switch and distributed remote or access units. The access units function as extensions of the central switch’s ports, simplifying device management, configuration, and topology maintenance.

Huawei’s CloudEngine S5731-H fixed central-switch specification provides models with 24 or 48 hybrid optical-electrical downlink ports. The 48-port model can therefore directly manage up to 48 associated access or remote units under the design limits represented by this question. The same hybrid links can provide data transmission and remote PoE power, enabling access units to be installed closer to terminals without requiring conventional active aggregation equipment at every location.

The central switch automatically discovers the topology, while remote units behave as extended ports rather than independently managed switches. This reduces management nodes and simplifies a traditional three-layer network into a two-layer architecture. The larger values of 64, 72, and 96 exceed the supported maximum for the specified central-switch implementation. Therefore, option C is correct.

==================

The Network Management System is not an element of the IFIT measurement model. An IFIT measurement definition identifies the traffic to be measured, the locations where measurement actions occur, and the direction in which the flow is evaluated. The measurement flow specifies the target packets, usually through flow-identification fields. Measurement points define where packets are marked, counted, timestamped, or reported, such as ingress, transit, and egress nodes. Measurement direction distinguishes forward and reverse monitoring so that packet loss, delay, and path behavior can be analyzed correctly for each direction.

An NMS or controller remains operationally important because it creates measurement tasks, distributes configurations, receives telemetry data, correlates the results, and presents fault-location information. However, it is the management and analysis system surrounding the measurement model, not one of the model’s constituent measurement parameters.

Huawei positions IFIT as a high-precision telemetry mechanism used to delimit and locate application-quality faults. The training material highlights IFIT’s capability to locate faults rapidly and detect packet loss with extremely high reliability. Therefore, the component that is not part of the measurement model is the NMS.

==================

The statement is true. Intelligent policy recommendation does not consider only the traffic load of an individual interface or device. iMaster NCE-Campus obtains network topology, application, link-quality, bandwidth-utilization, and traffic-distribution information from multiple devices. It can then recommend or orchestrate policies that distribute traffic across the network’s available paths and resources.

For example, when multiple WAN links have the same priority and satisfy an application’s SLA requirements, per-flow load balancing can distribute different application flows among those links. Bandwidth-proportional balancing can also account for differences in link capacity, preventing a lower-bandwidth link from being overloaded. Huawei explains that load-balancing-based traffic steering can fully utilize multiple links and distribute flows across links meeting the required SLA.

Because iMaster NCE-Campus centrally manages CPEs and uniformly orchestrates service intent across the overlay network, recommendations can be evaluated from a network-wide perspective instead of through isolated local decisions. Therefore, intelligent policy recommendation can implement network-level load balancing.

==================

Huawei SD-WAN provides all four technologies. Per-flow load balancing distributes separate application flows among multiple links that have the same priority and satisfy the required SLA. Per-packet load balancing can transmit packets from one flow across multiple eligible links, improving aggregate bandwidth utilization for large file transfers, backups, and replication.

Multi-fed and selective receiving duplicates critical traffic across different links. The receiving device selects valid packets, removes duplicates, and preserves packet order. Packet loss or failure on one path therefore does not interrupt the service, enabling zero-millisecond link switchover in applicable deployments.

A-FEC dynamically generates redundant packets and adjusts the redundancy ratio according to measured packet loss. The receiving device reconstructs lost packets, reducing video freezing and voice-quality deterioration. Huawei describes both adaptive FEC and multi-fed selective receiving as WAN-optimization mechanisms for key traffic.

Intelligent traffic steering selects links according to application identity, quality, bandwidth, priority, and load. Therefore, A, B, C, and D are all correct.

==================

The statement is true as a WLAN design recommendation. Inter-WAC roaming is supported, but it introduces more control-plane interaction and forwarding complexity than intra-WAC roaming. The Home WAC and Foreign WAC must belong to the same mobility group, synchronize station and AP information, and establish an inter-WAC CAPWAP tunnel for control information and, in some scenarios, service forwarding.

Additional synchronization, tunnel processing, route handling, and failure dependencies can increase roaming delay and complicate troubleshooting. This is especially relevant for delay-sensitive applications such as voice, video, automated guided vehicles, and real-time production systems. A better design places APs between which users frequently move under the same WAC wherever controller capacity and physical topology permit.

Avoiding inter-WAC roaming does not mean disabling the function entirely. Large campuses may require multiple WACs for scale, redundancy, or geographic distribution. Mobility groups should still be configured for unavoidable cross-controller movement. However, buildings, floors, and continuous roaming areas should be assigned carefully so that normal roaming remains intra-WAC. Therefore, the recommendation in the statement is correct, and the answer is True.

==================

An industrial RedBox can provide all four listed interconnection modes. In HSR-SAN mode, it connects a singly attached node that does not natively support High-availability Seamless Redundancy to an HSR network. The RedBox duplicates frames entering the HSR domain and removes duplicate frames before delivering traffic to the SAN.

HSR-PRP mode interconnects an HSR ring with a Parallel Redundancy Protocol network while preserving seamless redundancy. PRP-PRP mode couples two PRP network domains, while HSR-HSR mode connects separate HSR rings. Depending on the implementation, the HSR-HSR interconnection function may also be described as a QuadBox function because four HSR-facing ports can be involved.

The essential RedBox responsibilities are frame conversion, duplication, duplicate elimination, sequence-number handling, and prevention of unintended forwarding loops between redundancy domains. HSR and PRP use compatible duplicate-identification principles, enabling controlled interconnection between these network types without introducing a single point of failure. RedBoxes also provide redundant connectivity for devices that have only one ordinary Ethernet interface.

==================

Option B is false because it reverses the encapsulation behavior. In IPsec transport mode, the IPsec security header is inserted after the existing IP header; a new outer IP header is not normally added. In tunnel mode, the complete original IP packet is encapsulated and a new outer IP header is added. Tunnel mode therefore generally introduces greater overhead and produces a longer packet than transport mode, not the reverse.

The remaining statements are correct. IPsec supports both transport and tunnel modes. GRE over IPsec performs GRE encapsulation first, allowing GRE to transport the original payload, and then applies IPsec protection to the resulting GRE packet. The IPsec security association is established between the GRE tunnel endpoints, protecting the GRE-encapsulated traffic as it traverses an untrusted transport network.

Huawei SD-WAN data channels can use either GRE or GRE over IPsec. GRE provides flexible overlay encapsulation, while IPsec adds confidentiality, integrity, origin authentication, and anti-replay protection for site-to-site traffic. Huawei specifically identifies IPsec encryption as the mechanism securing site-to-site SD-WAN services.

==================

The AR5710-SE is the security-enhanced model that supports intrusion prevention, antivirus, and URL filtering concurrently. The “SE” variant is designed for branch scenarios requiring integrated routing and advanced security processing instead of only basic WAN connectivity and packet forwarding.

IPS examines network traffic for attack signatures and abnormal behavior and can block detected intrusions. Antivirus inspection identifies malicious files or content using security-signature databases. URL filtering controls access to websites based on categories, reputation, or explicitly configured allowlists and blocklists. Supporting all three functions simultaneously allows the AR5710-SE to operate as both an SD-WAN CPE and a secure branch egress gateway, reducing the requirement for an additional branch firewall.

Huawei’s SD-WAN security architecture identifies firewall protection, antivirus, IPS, and URL filtering as its principal service-traffic security functions. Huawei also recommends advanced security functions such as URL filtering, IPS, and antivirus for branch scenarios requiring stronger Internet-egress protection. Among the listed models, the AR5710-SE provides the combined feature set. Therefore, option A is correct.

==================

A border device, or more precisely a device at a border site, provides communication between different areas in a hierarchical SD-WAN topology. The hierarchical model divides a large WAN into multiple areas. Each area can independently use a hub-spoke or full-mesh topology, while selected border sites connect the local area to a centralized backbone area.

When a non-border site receives a route originating in another area, the route’s next-hop site ID is changed to the border site in its own area. The local border device then forwards traffic toward the border site in the destination area or toward an interconnected hub site. Ordinary edge devices provide connectivity for their own sites but do not automatically perform cross-area transit.

Huawei describes border sites as members of both the level-2 area network and the level-1 backbone network. These sites collectively implement interconnection between areas. Huawei further explains that inter-area routes point to border sites and recommends two border sites operating in active/standby mode for reliability. Therefore, the correct answer is B.

==================

Hardware-based encryption is the unambiguously correct statement. MACsec protects Ethernet frames at Layer 2 using AES-GCM-based authenticated encryption. On enterprise switches and routers, the encryption and integrity operations are commonly implemented in forwarding ASICs or dedicated hardware so that frames can be protected at high throughput with low latency.

Option A is incorrect because complex manual configuration is not an inherent requirement. MACsec can use manually configured connectivity-association keys, but IEEE 802.1X MACsec Key Agreement can automate peer authentication, secure-channel establishment, key distribution, and rekeying. The operational complexity therefore depends on the deployment model and management platform.

Option C is also inaccurate. MACsec is media-independent, meaning it can operate over supported copper or fiber Ethernet; however, it does not eliminate the requirement for appropriate Layer 2 connectivity between participating MACsec entities. Standard hop-by-hop MACsec protects Ethernet links or LAN connectivity between peers and is not a general Layer 3 tunneling mechanism.

MACsec supplies Layer 2 confidentiality, integrity, origin authentication, and replay protection. Its encryption can be performed directly in network-device hardware, enabling substantially better forwarding performance than software-only encryption implementations.

The AR5710-S8T1XWE-NRGL supports all four listed 5G-Advanced capabilities. Support for 3GPP Release 16 enables enhanced 5G New Radio functions and provides the standards foundation for improved mobile-WAN capacity, reliability, and service performance.

Carrier aggregation combines multiple component carriers to increase available throughput. Downlink 3CC allows three component carriers to be aggregated for received traffic, while uplink 2CC combines two carriers for transmitted traffic. This is valuable for high-bandwidth branch access, video backhaul, and mobile private-network scenarios.

Support for eight APNs permits multiple logically separated mobile services or provider profiles to be configured. Different APNs can represent enterprise services, management traffic, production systems, backup connectivity, or isolated customer networks. Global-frequency-band support improves deployment flexibility across countries and carrier networks, subject to local spectrum regulation and the supported modem variant.

Huawei SD-WAN can use 5G as a primary, secondary, or bypass link and supports combinations such as dual 5G and 5G plus wired connectivity for service assurance. Therefore, NR Release 16, carrier aggregation, eight APNs, and global frequency bands are all supported.

==================