H12-841_V1.5 HCIP-Datacom-Campus Network Planning and Deployment V1.5 Questions and Answers

The displayed entries match the format of EVPN routes that carryVTEP reachability informationrather than host MAC/IP bindings or IP prefixes. The key clue is the field naming style shown asNetwork(EthTagId/IpAddrLen/OriginalIp)along with values like0:32:1.1.1.0, which indicates an IP address with a /32 length carried as the “OriginalIp”. In Huawei VXLAN BGP EVPN implementations described in HCIP Datacom Campus Network materials, this type of information corresponds toEVPN Route Type 3 (Inclusive Multicast Ethernet Tag Route).

Type 3 routes are used by VTEPs to signal membership information for a broadcast domain and to supportBUM (Broadcast, Unknown unicast, Multicast)forwarding behavior in the VXLAN fabric. Practically, they also provide the remote VTEP IP information needed so that, once the underlay can reach that VTEP IP address at Layer 3 (for example via IGP/BGP underlay routes), the local device can establish VXLAN encapsulation forwarding to that peer.

By contrast,Type 2routes would display MAC address information (and possibly a host /32 IP together with the MAC), andType 5routes would show IP prefixes like /24 or /30 used for inter-subnet routing.Type 1routes are related to Ethernet segments for multihoming (ESI), which is not what this output shows. Therefore, only statement A is true.

In the Huawei free mobility solution based on iMaster NCE-Campus,IP-security groupsare used to associate user identities with IP addresses so that consistent security policies can be enforced regardless of user location. Apolicy enforcement point (PEP)must obtain IP-security group entries to correctly match traffic against security policies.

When the policy enforcement pointis not an authentication point, it cannot directly learn user identity information during access authentication. In this scenario, one supported method is to configureIP-security group entry subscriptionon iMaster NCE-Campus. After subscription is configured, iMaster NCE-Campus pushes the corresponding IP-security group entries to the policy enforcement point, which matches option A.

Another valid approach in this case is described in option B. If the authentication point and policy enforcement point are separate devices, theauthentication point can push IP-security group entriesto the policy enforcement point after successful user authentication. This ensures that enforcement devices receive real-time identity information.

If the policy enforcement pointalso functions as an authentication point, it can directly interact with iMaster NCE-Campus. In this scenario, iMaster NCE-Campusproactively pushes IP-security group entriesto the device, as stated in option C.

Option D is incorrect because iMaster NCE-Campus does not push IP-security group entries indiscriminately in all scenarios. The distribution mechanism depends on the role of the device and whether subscription or authentication-based pushing is configured.

Therefore, the correct answers are A, B, and C.

iMaster NCE-Campus adopts amulti-plane architectureto improve system security, scalability, and operational stability. The planes are logically isolated so that different types of traffic and functions do not interfere with each other. The two most commonly referenced planes are themanagement planeand theservice plane.

Themanagement planeis mainly responsible for system-level operations such as device registration, controller maintenance, system management, and internal communication between system components. For this purpose, it uses a dedicated access interface and port number to ensure secure and stable management connectivity.

Theservice plane, on the other hand, is designed fordaily network service operations. Administrators access this plane to perform tasks such as campus network planning, configuration delivery, monitoring, alarm viewing, and intelligent O&M operations. To keep service access independent and secure, the service plane uses its own dedicated login port.

According to HCIP Datacom Campus Network documentation, theservice plane of iMaster NCE-Campus uses port 18009. Administrators log in to the service plane by accessing the service IP address together with this port number. This separation ensures that service operations remain available even when management-plane functions are restricted or under maintenance.

Therefore, the correct port number for theservice planeis18009, making optionBthe correct answer.

In a VXLAN BGP EVPN architecture,EVPN Type 5 routes, also known asIP Prefix routes, are used to advertiseLayer 3 reachability informationbetween VXLAN segments. These routes are essential for implementing inter-VNI communication and external network connectivity through distributed or centralized gateways.

According to HCIP Datacom Campus Network documentation, a Type 5 route carriesIP prefix information, including theIP prefix and its prefix length, allowing VTEPs to learn network-level routing information rather than host-level details. TheRoute Distinguisher (RD)is also included to ensure uniqueness of routes across different VPN instances, which is critical in multi-tenant environments. Additionally, thegateway IP addressis carried to identify the next-hop gateway responsible for forwarding traffic toward the advertised prefix.

Unlike EVPN Type 2 routes, which advertiseMAC address and optional host IP address information, Type 5 routes donotcarry MAC addresses. Type 5 routes operate purely at the Layer 3 level and are independent of Layer 2 forwarding. Their purpose is to exchange subnet-level routing information rather than endpoint-level details.

MAC addresses are only relevant for Layer 2 forwarding and ARP/ND suppression, which are functions of EVPN Type 2 routes. Including MAC information in Type 5 routes would be unnecessary and inefficient for Layer 3 routing purposes.

Therefore, the field that isnot carriedin a BGP EVPN Type 5 route is theMAC Address, making optionCthe correct answer.

Explanation (Based on HCIP Datacom Campus Network Design)

Position 1 → 802.1X AuthenticationThis authentication point corresponds to aPC connected to an access switch. PCs typically support 802.1X clients, making802.1X authenticationthe preferred and most secure method for wired user access. It provides strong identity-based access control using a RADIUS server.

Position 2 → Portal AuthenticationThis point representswireless user access. Portal authentication is commonly used for wireless terminals, especially guest or mobile users, where browser-based authentication is required. Users authenticate through a web page redirected by the access device.

Position 3 → MAC Address AuthenticationThis point corresponds tonon-802.1X-capable terminals, such as IP phones or printers. These devices cannot initiate 802.1X or Portal authentication, soMAC address authenticationis used to identify and authenticate them based on their MAC addresses.

This authentication deployment aligns with Huawei NAC best practices:

802.1X for capable wired terminals

Portal for wireless or guest access

MAC authentication for dumb or IoT devices

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In a CloudCampus virtualized campus network,Virtual Networks (VNs)provide service isolation, whilesecurity groupsenable identity-based access control. Even when inter-VN routing is technically available, communication between users in different VNs isnot permitted by default. Access permissions are controlled bysecurity group–based policies.

To allowR&D personnel and sales personnelto communicate, the network administrator must explicitly define thesecurity policy relationshipbetween the two security groups. This is achieved by deploying apolicy control matrixon iMaster NCE-Campus. The policy control matrix specifies whether traffic between source and destination security groups is allowed or denied and enforces the policy on relevant network devices.

Deploying an external network is unnecessary because communication is required within the campus network. Configuring access management relates to authentication and authorization during network access, not inter-group communication control. Configuring inter-VN communication enables routing capability but does not definewhethercommunication is permitted at the security policy level.

According to HCIP Datacom Campus Network documentation,security group communication permissions are controlled through the policy control matrix, making optionAthe correct task to meet the requirement.

In Huawei campus networks, user access authentication is implemented through a standardized AAA framework that supports flexible authentication, authorization, and accounting methods. Statements A, B, and D correctly describe the authentication configuration process defined in HCIP Datacom Campus Network documentation. Administrators must first identify user domains and corresponding AAA schemes to ensure users are authenticated using appropriate methods. This is a foundational step for implementing network access control.

Access profiles and authentication profiles work together to define how users are authenticated. An authentication profile specifies the authentication mode, such as 802.1X or MAC authentication, while the access profile defines access control behavior. Binding these profiles and applying them to interfaces or VAP profiles enables consistent enforcement of access policies across wired and wireless networks.

When external authentication servers such as RADIUS or HWTACACS are used, interconnection parameters—including server IP addresses, shared keys, and ports—must be configured within the AAA scheme. This ensures reliable communication between network devices and authentication servers.

Statement C is false becauseiMaster NCE-Campus does support interconnection with third-party RADIUS servers. This capability allows enterprises to integrate existing authentication systems with Huawei campus solutions, improving compatibility and deployment flexibility. Therefore, the incorrect statement is option C.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

IKEv1 negotiation consists of two phases.Phase 1is responsible for establishing a secure IKE Security Association (SA), including peer authentication, key exchange, and protection of subsequent negotiations. In Huawei IPsec implementations, IKEv1 Phase 1 supportsMain modeandAggressive mode.

Main modeuses six message exchanges to securely negotiate parameters, protect identity information, and establish a trusted channel. It provides higher security and is commonly used in site-to-site IPsec VPN scenarios.Aggressive mode, on the other hand, completes negotiation using only three message exchanges, offering faster setup at the cost of reduced identity protection.

Quick modeis not part of IKEv1 Phase 1; it is used inPhase 2to negotiate IPsec SAs for data traffic protection.Normal modeis not a valid IKEv1 negotiation mode.

According to HCIP Datacom Campus Network documentation and standard IPsec principles, the supported IKEv1 Phase 1 negotiation modes areMain mode and Aggressive mode, makingoptions B and Ccorrect.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

Huawei’s free mobility solution is based onsecurity group–based policy control. In this architecture, users are dynamically associated with security groups after authentication. These security group identifiers are thencarried in user trafficas metadata when packets traverse the campus network.

When traffic reaches apolicy enforcement device, such as an edge node or border node, the device does not rely on traditional attributes like IP address, MAC address, or port number to make forwarding decisions. Instead, it extracts thesource and destination security group informationembedded in the traffic and matches it against the security policy matrix configured on the controller.

This mechanism enables identity-based and location-independent access control. Even if a user moves to a different access point or changes an IP address, the same security policies continue to apply as long as the user remains in the same security group. This is the core advantage of free mobility in Huawei campus networks.

Port numbers, MAC addresses, and IP addresses are traditional Layer 2 and Layer 3 identifiers, but they do not provide sufficient context for identity-based policy enforcement. According to HCIP Datacom Campus Network documentation, security group information is the key attribute used for policy lookup and enforcement in free mobility solutions. Therefore, option A is correct.

In a centralized VXLAN gateway architecture, all inter-subnet traffic is forwarded to a centralized Layer 3 gateway, typically deployed on a core or aggregation device. This design simplifies network planning, gateway configuration, and policy enforcement because routing, security, and traffic control are all handled at a single centralized point. From an operational perspective, deployment and management are straightforward, which makes centralized gateways suitable for small- to medium-sized campus networks or environments with limited endpoints.

However, according to HCIP Datacom Campus Network documentation, this architecture introduces scalability limitations. Since the centralized gateway performs Layer 3 forwarding for all VXLAN segments, it must maintain ARP entries for every terminal in the network. As the number of endpoints increases, the ARP table on the Layer 3 gateway grows rapidly. Hardware resources such as memory and processing capacity limit the maximum number of ARP entries that can be supported.

In large-scale campus scenarios with a high density of terminals—such as universities, hospitals, or enterprise office campuses—this ARP scalability bottleneck can impact performance and stability. Excessive ARP entries may lead to increased CPU utilization, delayed ARP resolution, and reduced forwarding efficiency. For such environments, HCIP Datacom recommends distributed VXLAN gateways, which distribute ARP and routing responsibilities across multiple devices. Therefore, the statement is correct, and the centralized VXLAN gateway is not suitable for scenarios with a large number of terminals.

In HCIP Datacom Campus Network VXLAN architecture, VXLAN tunnels are classified based onhow the tunnel endpoints are created and maintained, which is referred to as the VXLAN tunnel creation mode. According to Huawei VXLAN design principles, there aretwo valid VXLAN tunnel types: static VXLAN tunnels and dynamic VXLAN tunnels.

Astatic VXLAN tunnelis manually configured by an administrator. In this mode, the source VTEP IP address, destination VTEP IP address, and related parameters are explicitly specified on devices. Static VXLAN tunnels are typically used in small-scale networks or test environments where the number of VTEPs is limited and network topology is simple. However, static configuration lacks scalability and flexibility, making it unsuitable for large campus fabrics.

Adynamic VXLAN tunnelis automatically created based on control-plane learning mechanisms, such asBGP EVPN. In this mode, VTEPs learn remote VTEP IP addresses dynamically through EVPN route advertisements (for example, Type 3 routes). When a remote VTEP becomes reachable at the underlay Layer 3 level, the VXLAN tunnel is automatically established without manual intervention. This mode is widely used in modern campus and data center networks due to its scalability and automation capabilities.

Options A and D are incorrect becausestatelessandstatefulare not official VXLAN tunnel creation classifications in Huawei’s VXLAN implementation. VXLAN itself is an encapsulation mechanism, and tunnel state is not categorized in this manner.

Therefore, the correct VXLAN tunnel types based on creation mode arestatic VXLAN tunnels and dynamic VXLAN tunnels.

In small- and medium-sized campus networks, the Huawei CloudCampus Solution focuses onsimple, flexible, and easy-to-manage traffic control mechanismsthat align with wireless access characteristics. According to HCIP Datacom Campus Network documentation, several rate limiting modes are supported to ensure fair bandwidth usage and stable user experience in WLAN environments.

Radio-based rate limitingis supported and commonly used in small and medium campuses. This mode limits the total bandwidth available on a radio interface, preventing congestion when multiple users access the same radio. It is especially effective in high-density wireless scenarios where multiple terminals compete for limited wireless resources.

SSID-based rate limitingis also supported. This allows administrators to limit bandwidth per SSID, ensuring that different wireless services—such as guest access and internal employee access—receive appropriate bandwidth allocations. This method is easy to configure and aligns well with service-oriented WLAN design.

User-based rate limitingis another supported mode. It enables bandwidth control on a per-user basis, ensuring fair usage among users and preventing individual users from consuming excessive bandwidth. This approach is particularly useful in environments like classrooms, retail stores, or offices.

ACL-based rate limiting, however, is not typically used or recommended in small- and medium-sized CloudCampus WLAN scenarios. ACL-based rate limiting is more complex and is generally applied in wired or advanced traffic engineering environments rather than simplified campus WLAN deployments.

Therefore, the supported rate limiting modes areRadio-based,SSID-based, andUser-based, makingA, C, and Dthe correct answers.

Comprehensive and Detailed Explanation (200–250 words):

In a VXLAN-based virtualized campus network, user terminals located in different access locations communicate with each other overVXLAN tunnelsestablished between VXLAN Tunnel Endpoints (VTEPs). These VXLAN tunnels form the overlay network, which abstracts the physical underlay and enables flexible Layer 2 and Layer 3 connectivity across the campus.

When communication is confined within the virtualized campus network, traffic remains inside the VXLAN overlay and is encapsulated and forwarded between VTEPs. However, when users or services inside the VXLAN network need to accessexternal networks, such as traditional IP networks, the Internet, or data centers that do not support VXLAN, traffic must exit the VXLAN overlay. This function is performed byborder nodes.

Border nodes act as the boundary between the VXLAN overlay and non-VXLAN networks. They are responsible for VXLAN encapsulation and decapsulation, routing between VXLAN segments and external networks, and enforcing security and policy controls at the network edge. According to HCIP Datacom Campus Network architecture principles, all traffic entering or leaving the VXLAN-based campus must pass through border nodes to ensure proper routing, policy enforcement, and service control.

Therefore, the statement is TRUE, and option A is correct.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

Port isolation is commonly used on access switches to preventwired terminalsfrom communicating directly with each other at Layer 2. This enhances security by blocking lateral attacks and unnecessary broadcast traffic.

Forwireless users, Huawei APs and WLAN controllers (or central APs in agile distributed scenarios) providewireless user isolationmechanisms. Wireless user isolation prevents clients connected to the same SSID or AP from directly communicating with each other, even though they share the same wireless medium. This is widely used in guest networks, dormitories, and public WLAN environments.

Therefore, the statement that APs cannot implement wireless user isolation is incorrect. According to HCIP Datacom Campus Network WLAN design principles,wireless user isolation is fully supported by APs, either locally or under centralized control.

Hence, the statement is FALSE, and option B is correct.

In HCIP Datacom Campus Network security design,port securityis used to limit the number of MAC addresses that can be learned on an access interface, preventing unauthorized device access and MAC address spoofing. When the number of learned MAC addresses reaches the configured upper limit, the switch behavior depends on the configuredviolation mode.

One possible action isshutdown mode, where the switch sets the interface to an error-down state and generates an alarm. This corresponds to option A. The interface must be manually or automatically recovered before normal communication can resume. This mode provides the highest level of security and clear fault notification.

Another supported behavior isprotect mode, in which the switch silently discards packets from unknown source MAC addresses after the limit is reached. No alarms are generated in this case, which matches option C. This mode minimizes network disruption while still blocking unauthorized devices.

Therestrict modeis also supported. In this mode, the switch discards packets with unknown source MAC addresses and generates an alarm or log entry, corresponding to option D. This allows administrators to detect violations without shutting down the interface.

Option B is incorrect because when an interface enters the error-down state due to a port security violation, an alarm or log notification is always generated according to HCIP Datacom Campus Network behavior. Therefore, the valid actions are A, C, and D.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In astatic VXLAN tunneldeployment, Huawei devices use anNVE (Network Virtualization Edge) interfaceas the logical tunnel interface for VXLAN encapsulation and decapsulation. The NVE interface represents the VTEP and does not have a one-to-one relationship with Bridge Domains (BDs) or VXLAN tunnels.

AnNVE interface can be associated with multiple VNIs, each corresponding to a different BD. Therefore, when multiple BDs exist on a VTEP,only one NVE interface is required, makingstatement B correctandstatement A incorrect.

In static VXLAN, thedestination VTEP addressesare specified usingingress replication listsunder each VNI. This allows a single NVE interface to establishmultiple VXLAN tunnelsto different remote VTEPs. As a result, there is no requirement to create a separate NVE interface for each tunnel, makingstatement D correctandstatement C incorrect.

According to HCIP Datacom Campus Network VXLAN configuration principles, the correct practice is to createone NVE interface per VTEP, associate multiple VNIs with it, and define remote peers through ingress replication. Therefore, the correct answers areB and D.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In a VXLAN-based campus network,VBDIF interfacesserve as Layer 3 gateway interfaces for Bridge Domains (BDs) and provide routing capabilities. However, not all VXLAN gateways must maintain VBDIF interfaces. This makes statementA false.

ALayer 2 VXLAN gatewayoperates purely at Layer 2 and is responsible for VXLAN encapsulation and decapsulation, enabling intra-subnet communication within the same VXLAN network. It doesnot require a VBDIF interface, because no Layer 3 routing is involved. Therefore, claiming that both Layer 2 and Layer 3 VXLAN gateways must maintain VBDIF interfaces is incorrect.

Statement B is correct because a VBDIF interface is a logical Layer 3 interface bound to a BD and functions similarly to a VLANIF interface in traditional VLAN-based networks. Statement C is also correct, as aLayer 3 VXLAN gatewayenables inter-subnet routing between different VNIs and allows traffic to exit the VXLAN network toward non-VXLAN external networks. Statement D correctly describes the function of a Layer 2 VXLAN gateway.

According to HCIP Datacom Campus Network documentation, VBDIF interfaces are mandatory only for Layer 3 VXLAN gateways, not for Layer 2 VXLAN gateways.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

Telemetry is a next-generation network data collection technology designed to overcome the limitations of traditional SNMP polling. One of its major advantages is that it ismodel-driven, relying onYANG modelsto define structured and extensible data formats. This allows Telemetry to support various data types and provides stronger semantic meaning than SNMP MIBs, makingoption A correct.

Another key advantage ishigh-frequency data collection. Telemetry supportssecond-level or even sub-second-level reporting, enabling more precise and real-time network monitoring. This capability is critical for intelligent O&M scenarios such as fault prediction, traffic analysis, and SLA assurance. SNMP, by contrast, typically relies on periodic polling with much lower precision. Therefore,option D is correct.

Telemetry does not establish sessions based on SSH. Instead, it typically uses protocols such asgRPCover secure transport channels like TLS. Hence,option B is incorrect.

Option C is also incorrect because Telemetry focuses ondata subscription and reporting, not on configuring or managing device databases. Configuration management remains the responsibility of controllers or network management systems, not the Telemetry mechanism itself.

According to HCIP Datacom Campus Network documentation, Telemetry’s strengths lie in model-driven data representation and high-precision, real-time monitoring, making A and D the correct answers.

WLAN planning and design aim to minimize co-channel and adjacent-channel interference while maximizing spectrum utilization and user experience. According to HCIP Datacom Campus Network WLAN design principles, proper channel planning is a core task, especially in environments with high user density.

On the2.4 GHz frequency band, only three non-overlapping channels—1, 6, and 11—are traditionally recommended. These channels do not overlap in frequency, which helps reduce interference between adjacent APs. Inhigh-density scenarios, to further improve spectrum utilization,channels 1, 5, 9, and 13can be used. This approach shortens the channel spacing but is acceptable when transmit power is well controlled and AP placement is carefully planned, enabling higher AP density while keeping interference manageable.

On the5 GHz frequency band, there are more available channels and less interference compared to 2.4 GHz. HCIP Datacom documentation recommendsstaggering high-frequency and low-frequency channels between adjacent APs. This staggered channel allocation reduces the likelihood of co-channel interference and improves overall throughput and roaming performance, especially in large or high-density campus deployments.

These channel planning strategies are standard WLAN design best practices supported by Huawei and are widely applied in enterprise campus networks. Therefore, the statement accurately reflects recommended WLAN planning principles and isTRUE.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In a CloudCampus VXLAN fabric, theglobal resource poolcentrally manages identifiers such as VLANs, VNIs, and bridge domains to ensure consistent allocation across the fabric.

StatementAis correct because abridge domain (BD)is the VXLAN equivalent of a VLAN and represents a Layer 2 broadcast domain used for packet forwarding within a VXLAN network.

StatementCis also correct. AVXLAN Network Identifier (VNI)uniquely identifies a VXLAN segment and is a core VXLAN forwarding identifier.

StatementDis correct because theservice VLAN poolis used to allocate VLANs for multiple purposes, including external gateway interconnections, network service resource interconnections, policy association management, and VN access VLANs.

StatementBis false. VLANs used forunderlay device interconnectionsarenot allocated from the VLAN resource poolmanaged by the VXLAN fabric. Underlay VLANs belong to the traditional IP underlay network and are typically planned and configured independently. The VLAN resource pool is intended for overlay-related services and fabric-managed VLAN usage only.

Therefore, the incorrect statement isB.

VXLAN uses theVXLAN Network Identifier (VNI)to identify and isolate virtual Layer 2 or Layer 3 networks in an overlay environment. The VNI field is24 bits long, which allows a theoretical maximum of2²⁴ (approximately 16 million) VNIs. This is a significant improvement over traditional VLAN technology, which supports only 4094 VLAN IDs, and is one of the main reasons VXLAN is adopted in large-scale campus and data center networks.

It is correct thata tenant can be mapped to one or more VNIs. For example, a tenant may use multiple VNIs to represent different broadcast domains or service segments, such as separate VNIs for different subnets or application tiers. However, the statement becomes incorrect when it claims that VXLAN supports a maximum of12 million tenants.

VXLAN does not directly define a fixed maximum number of tenants. VNIs represent virtual networks, not tenants themselves. The actual number of tenants supported depends on how VNIs are allocated and how the network design maps tenants to VNIs. In theory, the upper limit of VNIs is close to 16 million, not 12 million, and the number of tenants is typically much lower and design-dependent.

Therefore, while the description of VNIs being 24 bits long is correct, the conclusion about supporting a maximum of 12 million tenants is incorrect, making the overall statement false.

DHCP is a core protocol used in campus networks to automatically assign IP addresses and deliver network parameters to hosts, improving deployment efficiency and simplifying address management. DHCP messages include several fixed fields and anOptions field, which plays a critical role in parameter delivery.

Option A isfalse. Even if only gateway and DNS server information needs to be delivered to a client, the DHCP Offer messagemust carry the Options field. Default gateway and DNS server information are delivered through specific DHCP options, such as Option 3 (Router) and Option 6 (DNS Server). Without the Options field, these parameters cannot be conveyed to the client.

Option B is correct. The Options field in DHCP messages uses aTLV (Type-Length-Value)format, allowing flexible extension and supporting various network parameters, including NTP server addresses, wireless AC addresses, and log server addresses, which aligns with HCIP Datacom Campus Network descriptions.

Option C is also correct. DHCP supportsstatic IP address allocationby binding a specific IP address to a client’s MAC address. This is commonly used for printers, servers, or network devices that require fixed IP addresses.

Option D is correct as well. Because DHCP uses broadcast messages that cannot cross Layer 3 boundaries, aDHCP relay agentis required when the client and server reside on different IP networks.

Therefore, option A is the only incorrect statement.

In the Huawei Agile Distributed Wi-Fi Solution, the wireless architecture is designed to simplify deployment and reduce dependency on traditional centralized WLAN controllers. The solution is composed mainly of a **central AP** and multiple **Remote Units (RUs)**. The central AP integrates key control and management functions that are traditionally provided by a standalone AC. These functions include RU discovery and registration, radio parameter configuration, SSID and security policy delivery, traffic control, and basic WLAN service management.

Because the central AP performs these AC-like roles, RUs do not need to be managed individually, and a separate wireless controller is not required for the Agile Distributed Wi-Fi system to operate. This architecture is especially suitable for indoor distributed scenarios such as hotels, dormitories, hospitals, and office buildings, where RUs are deployed in rooms or corridors and centralized control is still required.

From the HCIP Datacom Campus Network perspective, this design reduces network complexity, lowers deployment and maintenance costs, and improves scalability. While an external AC or centralized management platform may still be introduced for unified management across multiple sites or for advanced O&M requirements, it is **not mandatory** for the basic Agile Distributed Wi-Fi solution. Therefore, the statement that no AC is needed because the central AP can manage multiple RUs is correct according to HCIP Datacom Campus Network documentation.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

IPsec VPN supports a variety ofsymmetric encryption algorithmsto protect data confidentiality during transmission. Commonly supported algorithms includeDES,3DES, andAES, all of which are used to encrypt the payload of IP packets in ESP.

AESis the most widely recommended algorithm due to its strong security and high performance.3DESandDESare legacy algorithms that are still supported for compatibility reasons, although they are considered less secure and are gradually being phased out in modern deployments.

DSA (Digital Signature Algorithm), however, isnot an encryption algorithm. It is an asymmetric algorithm used fordigital signatures and authentication, not for encrypting data. IPsec uses DSA only indirectly in certificate-based authentication scenarios, but it is never used as a data encryption algorithm in IPsec VPNs.

According to HCIP Datacom Campus Network documentation, IPsec VPN encryption relies exclusively on symmetric encryption algorithms such as DES, 3DES, and AES. Therefore,DSA is not supported as an IPsec encryption algorithm, makingoption Athe correct answer.

According to HCIP Datacom Campus Network architecture principles, campus networks can be classified from multiple dimensions to support scientific planning, design, and deployment. These classification methods help network designers select appropriate architectures, devices, and technologies based on actual service requirements.

Network scaleis a primary classification dimension. Campus networks are commonly divided into small, medium, and large-scale networks based on the number of users, terminals, access points, and network devices. This classification directly influences topology design, such as whether a simple two-layer architecture or a more scalable three-layer architecture is required.

Served objectsis another important classification method. Campus networks may serve office users, guests, teaching staff, students, production terminals, IoT devices, or video surveillance systems. Different served objects have different requirements for bandwidth, security, and access control, making this dimension critical for policy and service design.

Access moderefers to how users and devices connect to the campus network, including wired access, wireless access, or a hybrid of both. This classification impacts WLAN planning, authentication methods, and network access control strategies.

Service complexityreflects the types and number of services carried by the network. A campus network may provide basic data services or support complex services such as voice, video, cloud access, and industry applications. Higher service complexity requires more advanced network design and management capabilities.

Therefore, all listed options are valid classification methods for campus networks.

In the Huawei CloudCampus Solution, access points can operate in different modes depending on network size, architecture, and management requirements. For asmall- or medium-sized campus networkwhere asingle AP is used as the network egressand must becentrally managed by iMaster NCE-Campus, the recommended operating mode isCloud mode.

When an AP works inCloud mode, it establishes a direct management connection with iMaster NCE-Campus through the cloud. The AP can independently provide wireless access services while also performing gateway and egress functions, such as user traffic forwarding and policy enforcement. This eliminates the need to deploy a dedicated wireless AC or additional gateway devices, significantly simplifying network architecture and reducing deployment cost.

Fit modeAPs rely on a local or centralized AC for control and therefore cannot independently function as a network egress.RU modeis used only in Agile Distributed Wi-Fi scenarios and depends on a central AP, making it unsuitable for this scenario.Fat modeAPs can operate independently but lack deep integration with iMaster NCE-Campus for cloud-based centralized management and automated service provisioning.

HCIP Datacom Campus Network documentation highlights Cloud APs as the optimal choice for small and medium campuses that require simplified deployment, cloud-based management, and integrated gateway capabilities. Therefore, to meet both the management and egress requirements described, the AP should operate inCloud mode.

Hence, the correct answer isC.

In a VXLAN BGP EVPN deployment, interconnection between Layer 2 and Layer 3 networks relies onIntegrated Routing and Bridging (IRB). According to HCIP Datacom Campus Network documentation, for a VPN instance to advertise its IP routes to the BGP EVPN control plane, the device must explicitly enable IRB route advertisement in the BGP view.

Theadvertise irbcommand is used to allow IP routes learned in a VPN instance to be advertised as EVPN Type 5 (IP Prefix) routes. These routes enable communication between different VNIs or between VXLAN segments and external Layer 3 networks. Without this command, the VPN instance routes remain local and are not distributed through the EVPN control plane, preventing proper Layer 3 connectivity across the VXLAN fabric.

The other options are incorrect in this context. Theadvertise vpnv4command is used in traditional MPLS VPN scenarios, not in BGP EVPN-based VXLAN networks. Theadvertise irbv6command is specific to IPv6 IRB scenarios and does not apply to IPv4 route advertisement unless explicitly required. Theadvertise l2vpn evpncommand is used to enable the EVPN address family itself but does not control the advertisement of IP routes from a VPN instance.

Therefore, to enable a VPN instance to advertise IP routes to the BGP EVPN address family in a VXLAN network, the correct command isadvertise irb.

SNMP and NETCONF are both commonly used network management protocols in campus networks, but they differ significantly in architecture, capabilities, and configuration management mechanisms. According to HCIP Datacom Campus Network documentation,NETCONF is designed for modern, model-driven network management, while SNMP is mainly used for monitoring and simple management.

Option A is incorrect because although both protocols use a client/server model, their roles are different. In SNMP, the managed device operates as an SNMP agent (server), while the NMS acts as the client. In NETCONF, the network device functions as the NETCONF server, and the management system is the client, not the other way around.

Option B is also incorrect because SNMP manages data using MIBs, whereas NETCONF usesdata models, typically based on YANG, instead of MIBs.

Option D is incorrect because SNMP does not support multiple configuration databases. It mainly provides basic read and write operations and is not suitable for complex configuration management or rollback.

Option C is correct. NETCONF provides alocking mechanismthat allows a client to lock a configuration datastore during configuration changes. This prevents multiple users or systems from modifying the same configuration simultaneously, avoiding conflicts and ensuring configuration consistency. This capability is a key advantage of NETCONF in intelligent campus network management and aligns with HCIP Datacom Campus Network best practices.