H35-211_V2.5 HCIP-Access V2.5 Questions and Answers

SSH provides secure remote login and secure file transfer (SCP/SFTP) with encryption, integrity, and authentication. Clients validate the server/host and then perform user authentication (password, public key, etc.), often described as two layers of authentication. SSH runs over TCP (port 22) at the application layer, not at the network layer—therefore D is the incorrect statement.

OLT-level (device-level) protection is achieved by dual-homing ONUs to two independent OLT interfaces so that services can switch to another OLT when one fails. In Huawei protection taxonomy, the dual-homing scheme (as contrasted with single-homing) provides device-side redundancy for the OLT. By comparison, Ethernet port protection groups and LACP protect uplink links and bandwidth at Layer 2, not the OLT device itself; single-homing does not protect against OLT failure.

Huawei GPON service provisioning supports mapping upstream/downstream service flows to GEM Ports using multiple classifiers, including MAC address, physical port (PORT), VLAN ID, and 802.1p (priority). These classifiers are configured in line/service templates (and pushed via U2000) to ensure precise flow-to-GEM binding.

In NGN architectures, services (voice, video, data) converge over a packet-based backbone. The core switching layer provides the unified transport using IP/MPLS and related QoS mechanisms, delivering high reliability and large-capacity switching for all upper-layer services. The control and management layers orchestrate services, while the edge/access layer aggregates users—but the packet-based integrated transmission platform itself is the role of the core.

Huawei GPON design recommends at most two splitting stages and a total split ratio within the optical power budget (commonly up to 1:64 for standard budgets).

A: 1:2 × 1:16 = 1:32 (valid).

C: 1:8 × 1:8 = 1:64 (valid under standard budgets).

D: 1:2 × 1:8 = 1:16 (valid).

B: 1:16 × 1:16 = 1:256, which exceeds typical GPON budgets and recommended engineering practice. Hence B is the incorrect networking.

In Huawei IPTV troubleshooting, mosaic/flash/jerky or intermittent picture typically results from packet loss or bit errors. Common causes include: optical power near the receiver sensitivity threshold causing FEC/BER spikes (A); loss of I-frames (key frames) either in the encoder/compression stage (B) or due to line transmission loss/jitter (D); and device rate-limit (CAR/policing) misconfiguration that drops packets under burst traffic (C). Any of these can yield unstable display.

In GPON, DBA (Dynamic Bandwidth Allocation) operates in the upstream direction. The OLT grants upstream transmission opportunities to ONTs by assigning T-CONT bandwidth (Fixed/Assured/Non-Assured/Best-Effort) within upstream frames. The downstream direction is a continuous broadcast stream from the OLT at the fixed GPON line rate; user traffic is multiplexed without DBA. Hence, DBA is upstream-only; downstream traffic is not DBA-scheduled.

IPTV over FTTH relies on multicast control; therefore the essential U2000 template is the IGMP template, which defines IGMP behaviors, program authorization binding, and multicast parameters used by the OLT/ONT. MGC applies to voice (VoIP), and SNMP pertains to NMS communication rather than IPTV service logic; value-added templates are not mandatory for basic IPTV.

Huawei access security recommends limiting MAC learn counts per port/VLAN, and using anti-MAC-spoofing bindings: either automatic (dynamic) bindings generated by the system or manual static MAC bindings to the service/port. Simply replacing a terminal is not a network-side mitigation method and is not listed as a protection measure.

IGMP is the host-side membership protocol: the first-hop router (querier) uses IGMP Queries/Reports/Leaves to manage host participation in multicast groups and to ensure forwarding state reflects receiver interest. PIM-DM/PIM-SM build distribution trees between routers, and MSDP shares source information between PIM-SM domains—they are not used by hosts.

In Huawei GPON/EPON protection planning, Type B protection uses two PON ports on the same OLT with dual feeder (trunk) fibers into the same ODN. It protects the OLT PON port and the feeder/trunk optical path while branch/distribution fibers to ONUs are not protected. This exactly matches the requirement “protect trunk; do not protect branches.”

XGS-PON downstream line rate is ~10 Gbit/s. When 12 terminals share a PON tree concurrently, the rough per-terminal share is 10,000 Mbit/s ÷ 12 ≈ 833 Mbit/s, commonly expressed as “about 800 Mbit/s.” This aligns with planning examples in HCIP-Access where downstream concurrency on XGS-PON is calculated by dividing the port rate by the number of active ONUs/APs on the splitter.

Huawei Anti-MAC-Spoofing binds the source MAC to the service flow/port to prevent address forgery. It is functionally exclusive with certain per-VLAN MAC check features (e.g., WMAC, SC, PPPoe-SMAC) to avoid conflicting validation logic. For IPoE users with fixed IP, operators typically configure static bindings/entries so that address and access policies remain consistent.

Option D is wrong: disabling Anti-MAC-Spoofing and removing fixed entries can affect service behavior; if forwarding is interrupted, that does impact user service—so the statement is self-contradictory and incorrect.

In GPON protection schemes, Type B (dual-homing to the same OLT) provides redundancy by using two PON ports on the same OLT (working/standby) and a redundant feeder path via a 2×N splitter or equivalent ODN design. Thus, the protection covers the OLT PON interfaces and the feeder fiber segment. It does not provide protection for the branch (distribution) fibers from the splitter to the ONUs, and it does not involve dual OLTs—that is the scope of Type C.

With ONT Zero-Touch Provisioning (ZTP) enabled on eSight, newly discovered ONTs can be automatically identified and provisioned by pushing service templates from eSight. This removes the need for advance (preset) service configuration on the OLT during incremental onboarding; the OLT simply accepts the provisioning delivered by eSight.

In 10G-EPON (IEEE 802.3av), the wavelength plan uses 1577 nm downstream and 1270 nm upstream. The 1270 nm upstream is used in both asymmetric and symmetric 10G-EPON profiles.

With IGMP Snooping/Proxy on access devices (such as Huawei OLTs), multiple receiver joins for the same (VLAN, Group) are aggregated. The OLT maintains a per-group member table and typically forwards a single upstream IGMP Join toward the multicast router (or querier) for that group, regardless of how many downstream users in that VLAN have joined. Additional local joins add downstream interfaces to the OLT’s table but do not trigger extra upstream joins per user. Hence, stating that two same-program viewers cause “two join messages” upstream is wrong.

Right. The SIP Max-Forwards header limits how many SIP elements a request can traverse. Each proxy decrements the value by one; when it reaches zero, the message must not be forwarded, preventing infinite loops and yielding responses like 483 (Too Many Hops). RFC 3261 (Sections 8.1.1.6, 16.6, 20.22) defines this behavior; later work further discusses loop mitigation

With PITP enabled and Vendor-tag switching allowed, Huawei OLTs support transparent transmission and augmentation: the OLT keeps the user-carried Vendor tag and appends the local Vendor tag (e.g., slot/port/location), ensuring the upstream AAA/BRAS receives both the access-side identity and the OLT’s own location identity. Simply adding only the local tag (A) loses user-side info; forwarding unchanged (B) omits OLT location; discarding (D) contradicts the feature intent.

Type B provides redundancy with two OLT PON ports on the same OLT and two feeder (backbone) fibers to the ODN. Therefore it protects the PON ports and the backbone/feeder path. It does not protect the OLT itself (still a single OLT) and does not protect the ONU branch fibers.

IPv4 multicast (historically “Class D”) occupies the address block 224.0.0.0 through 239.255.255.255. Any upper bound of 238.255.255.255 is incorrect because it excludes the full 239/8 administratively scoped range. This is standardized in the IANA IPv4 Multicast Address Space registry and reflected in foundational multicast specifications.

In IEEE 802.1AX/802.3ad LACP operation, timeout detection relies on a multiplier of three consecutive LACP intervals. In short-timeout mode, the default period is ~1 s; if 3 intervals pass without receiving LACPDUs, the peer is considered expired and the member is removed (treated as Down for aggregation). Huawei implements this standard behavior for port-member validity in an Eth-Trunk.

(Reference: HCIP-Access V2.5 – Link Aggregation/LACP timers and member aging; IEEE LACP short-timeout 3× interval rule.)

A persistently high CPU on the OLT main control board is typically driven by excessive control-plane load or abnormal traffic patterns. Common causes include:

Illegal login attempts generating authentication and logging overhead (A)

Layer-2 loops leading to storms and protocol churn (B)

DoS/scan/attack traffic stressing control/management processing (C)

Rogue/misbehaving ONUs causing frequent state changes, registration flaps, or abnormal report traffic (D)

All listed factors are recognized contributors to elevated CPU on access OLTs.

Type C dual-homing provides device-level protection with two OLTs; when one OLT/uplink fails, services switch to the peer OLT. In single-homing, ONUs are associated with only one OLT; therefore an OLT failure interrupts services (C). Single-homing has simpler networking and management than dual-homing (D). It does not offer switchover to another OLT (so B is incorrect), and the “important-service” positioning in A is typically applied to dual-homing scenarios that require the highest availability.

A single-layer VLAN is limited by the IEEE 802.1Q VLAN ID space (1–4094), i.e., about 4K VLANs. In large PON deployments, when you must separate multiple services (e.g., HSI, VoIP, IPTV) and the user scale approaches or exceeds the 4K ceiling, a dual-layer VLAN (QinQ) design is required to extend the VLAN namespace and implement hierarchical isolation (access VLAN + service/aggregation VLAN).

A: Incorrect — RADIUS typically uses UDP (1812/1813), while HWTACACS/TACACS+ uses TCP (port 49).

B: Incorrect — In RADIUS, only the user-password attribute is encrypted; fields are not selectively encrypted by user choice. TACACS+ can encrypt the entire payload.

D: Incorrect — Because RADIUS uses UDP, transport is not inherently reliable.

C: Correct — RADIUS and HWTACACS differ in message structure and returned attributes after authentication (e.g., RADIUS attribute–value pairs for access control/QoS/VLAN vs. HWTACACS command/privilege oriented responses). Thus the returned content/format differs between the two.

Huawei’s alarm reference for PON ports lists the common possible causes of LOS (the OLT does not receive the expected optical signal) as:

The port laser is shut down;

The backbone optical fiber connected to the port is faulty;

All the ONTs/ONUs connected to the port are powered off or faulty;

(and potentially) port hardware faults.

These map directly to options D, B, and C. A rogue ONU generates specific “rogue ONU” alarms and is characterized by continuous/abnormal upstream emission; it is not a typical root cause of an LOS condition, which indicates absence of expected optical signal.

In U2000’s IPTV/IGMP service model, the IGMP template suite includes: Permission templates (program authorization), Multicast user templates (user IGMP attributes), Program templates (program/group definitions), and Preview parameter templates (preview/fast-zapping parameters). These cooperate to control user authorization, program mapping, and IGMP behavior.

Huawei multicast guidance stresses IGMP version compatibility: devices running an earlier version must interoperate only with hosts using the same or earlier version, otherwise v3 messages may not be processed. In Huawei’s multicast feature guidance for access devices (OLT side vs. user side), the behavior documented is that when the device is operating in IGMPv2, IGMPv3 Report messages from terminals are not processed—interoperation is restored only after the terminal/device side is downgraded to v2 (often driven by periodic queries that induce hosts to respond in v2). This maps operationally to dropping unsolicited IGMPv3 Reports when the OLT is fixed to v2. Huawei also recommends ensuring the device runs an IGMP version the same as or later than member hosts to avoid such loss. Therefore, with OLT fixed at v2, an incoming v3 Join is discarded.

Huawei QoS describes PQ (Priority Queuing) as the strict-priority scheduler ensuring that high-priority queues are served first before lower-priority queues. WRR/DRR/RR are weighted or round-robin modes intended for fair sharing and do not guarantee strict preemption for latency-sensitive traffic. Therefore, PQ is selected for higher-priority services (e.g., voice, control).