H12-821_V1.0 HCIP-Datacom-Core Technology V1.0 Questions and Answers

 ACL Matching in Huawei Routers:

Access Control Lists (ACLs) are used to filter packets based on specific criteria, such as source/destination IP, ports, or protocols.

When a packet arrives, the Huawei router processes it against the configured ACL rules to decide whether to permit or deny the packet.

 GMP Snooping Proxy

IGMP snooping proxy allows the switch to substitute for upstream Layer 3 devices and downstream hosts, reducing unnecessary bandwidth consumption by consolidating IGMP messages.

 HCIP-Datacom-Core Reference

The IGMP snooping proxy functionality is described in multicast optimization and IGMP configuration chapters​​

In the provided configuration, IS-IS is enabled on Loopback0 but not on Loopback3 of R2. As a result, R2 will advertise the route 10.0.2.2/32 (from Loopback0) to R1 through IS-IS. However, the route 10.0.2.3/32 will not be advertised because IS-IS is not enabled on that loopback interface. The import-route direct command does not override this behavior ​.

IGMPv3 builds on IGMPv1 and IGMPv2 by supporting all previous query types, including General Query and Group-Specific Query, while introducing Source/Group-Specific Query. This enhancement allows finer control over multicast group membership ​.

 DIS and DR Election

The IS-IS Designated Intermediate System (DIS) is responsible for generating and updating pseudonode LSPs on a broadcast network.

Unlike OSPF DR, the IS-IS DIS does not preempt by default. This behavior avoids unnecessary flapping in the network due to frequent DIS re-elections.

 HCIP-Datacom-Core Reference

The characteristics of DIS and DR behavior are explained in IS-IS network operation chapters​​.

IGMPv1 supports general queries but does not define a Leave message. IGMPv2 introduces the Leave message type, which allows hosts to notify routers when they wish to leave a multicast group, improving efficiency. These distinctions align with the functionality of IGMP versions ​.

 Non-Client Definition in IBGP

In an IBGP setup with a Route Reflector (RR), a non-client is an IBGP peer that is neither the RR itself nor its client.

Non-clients must establish fully meshed IBGP connections with all other non-clients and the RR because IBGP rules prohibit route propagation between non-clients without a direct connection.

 HCIP-Datacom-Core Reference

The behavior of non-clients in an RR topology is clearly outlined in the BGP implementation chapters​​.

 BGP Route Flapping and Mitigation

While route flapping is a concern in large-scale networks, BGP employs mechanisms such as Route Dampening to mitigate its impact. Route dampening suppresses frequently flapping routes for a period of time to reduce resource consumption and network instability.

Therefore, it is incorrect to state that the issue cannot be resolved in BGP.

 HCIP-Datacom-Core Reference

The mechanism of route dampening is detailed in the BGP optimization chapters​​.

In inter-AC roaming scenarios, an AC (Access Controller) can serve as the mobility server for multiple mobility groups, enabling it to manage roaming among multiple groups. However, an AC can only belong to one specific mobility group. This constraint ensures that mobility management remains streamlined and avoids conflicts. Huawei WLAN mobility configuration guides validate this setup ​.

When two BGP peers negotiate the Hold Time, the shorter value between the two configured Hold Time values is selected. This ensures compatibility and maintains the stability of the BGP session ​.

BFD control packets are encapsulated in UDP packets, and the destination port number for multi-hop BFD control packets is 4784. This is a standardized port for multi-hop BFD operation ​.

DIS Election in IS-IS:

In IS-IS, the Designated Intermediate System (DIS) is elected on broadcast networks to reduce the number of LSAs exchanged and maintain the LSDB.

The DIS is elected based on priority:

The router with the highest priority is elected as the DIS.

If priorities are equal, the System ID is used as a tie-breaker, and the router with the highest System ID becomes the DIS.

If VRRP is not configured to track uplink interfaces, a failure in the master device's uplink or link will not trigger a switchover, resulting in a traffic blackhole. The VRRP mechanism relies on interface tracking to monitor connectivity and ensure role transitions upon faults. Without this configuration, no failover occurs, and traffic directed toward the master device is lost ​.

In BGP, the AS-Path attribute is mandatory and must be included in all UPDATE messages. It records the autonomous systems a route has traversed. Attributes like Local-Preference, MED, and Prefval are optional and may not always be included. The AS-Path is crucial for loop prevention and route selection ​.

Access Control Lists (ACLs) can be classified into several types, including Basic ACL (filters based on source IP), Advanced ACL (filters based on multiple parameters like source and destination IP, protocol, and ports), and Layer 2 ACL (filters based on MAC addresses). User-defined ACLs are not a standard classification ​.

In dual-link MSB networking with load balancing, the new AP will connect to the AC with the lower number of connected APs. In this case, AC2 has only 20 connected APs, while AC1 has 100. Therefore, the new AP will connect to AC2 ​.

The information provided indicates that the configured query interval is 60 seconds, which applies to general queries. Group-specific queries are sent at a shorter interval, usually derived from the maximum response time. Therefore, the statement about a 60-second interval for group-specific queries is false. Other statements regarding maximum response time (10s), IP address, and IGMP version (V2) are correct ​.

 In asynchronous mode, BFD control packets are exchanged periodically to detect faults.

 In demand mode, once the session is established, BFD stops sending periodic control packets and relies on external mechanisms to verify connectivity.

 Asynchronous mode is the most commonly used mode. However, the Echo function is supported in asynchronous mode, making Option B incorrect ​.

 RST BPDU Handling

On an RSTP network, if a port receives an RST BPDU and determines its own buffered BPDU is superior, it discards the received BPDU without responding. This ensures stability and proper convergence in the network.

 HCIP-Datacom-Core Reference

BPDU handling is described in the RSTP operation chapters​​.

When a stack splits, the MAC addresses of the newly formed stacks do not change immediately. Instead, they retain their original MAC addresses until new ones are reassigned during topology updates. This delayed update prevents immediate conflicts and allows MAD (Multiple Active Detection) to handle any resulting issues ​.

By default, Huawei firewalls create security zones named untrust, dmz, trust, and local. These zones facilitate security policies for inbound, outbound, and inter-zone traffic control ​.

The Local-Preference attribute is used within an AS to influence outbound traffic paths. The default value is 100, and it is a well-known discretionary attribute, meaning it is not mandatory and does not travel across AS boundaries ​.

The correct command for configuring the VRRP (Virtual Router Redundancy Protocol) preemption delay is vrrp vrid 1 preempt-delay 20. This command sets the delay before a higher-priority VRRP router preempts the master role, ensuring stable operation during network transitions ​.

 ACL in Routing Policies

ACLs are frequently used in routing policies to match specific routes based on criteria such as source IP, destination IP, and more. This allows ACLs to influence route redistribution, filtering, and forwarding decisions.

 HCIP-Datacom-Core Reference

ACL applications in routing policies are discussed in the routing policy chapters​​.

Understanding the LSDB and Level-2 DIS Election in IS-IS:

In IS-IS, the Designated Intermediate System (DIS) is elected for both Level-1 and Level-2 on broadcast networks to manage the link-state database (LSDB) and reduce the number of LSAs exchanged.

The election of the DIS is based on the highest priority. If the priority is the same, the router with the highest System ID becomes the DIS.

In SNMP (Simple Network Management Protocol), the MIB (Management Information Base) defines the attributes of a managed device. It acts as a structured database of managed objects, each described by a unique OID (Object Identifier). These objects provide critical information and control interfaces for network management. Other elements like the agent (manages the MIB) and NMS (queries the agent) do not define attributes but interact with the MIB ​.

OSPF routers refresh and flood LSAs in the Link-State Database (LSDB) every 30 minutes by default to maintain topology consistency. OSPF does not rely on TCP; it uses its own acknowledgment mechanism. It also uses the Dijkstra algorithm, not Bellman-Ford. The flooding interval for LSU packets is shorter, typically 5 seconds ​.

 OSPF Authentication Overview

The Auth Type field in the OSPF packet header determines the authentication mode. If the Auth Type is 1, plaintext authentication is used.

Plaintext authentication involves transmitting the password in an easily readable format, which is less secure compared to MD5.

 HCIP-Datacom-Core Reference

Authentication mechanisms, including plaintext authentication, are detailed in the OSPF security configuration chapter, confirming that Auth Type = 1 corresponds to plaintext​​.

AI-driven networks focus on maximizing efficiency by minimizing latency to enhance data processing and decision-making speed. The AI era emphasizes leveraging large data volumes and ensuring rapid data center interconnectivity. This makes low latency a critical requirement for AI-ready data center networks, as highlighted in Huawei's AI and data center network optimization materials ​.

ARP spoofing is a Layer 2 attack, as it targets ARP tables in switches or end devices. All other attacks, including IP spoofing, ICMP attacks, and Smurf attacks, are network layer (Layer 3) attacks ​.

 Silent Interface Explanation

The silent-interface command is used to prevent OSPF from sending or receiving OSPF packets on the specified interface (GE 0/0/1). This disables OSPF adjacency establishment and stops route advertisement for that interface.

 Network Observations

Statement A: R2 can access the server.This is correct, as the silent interface does not impact data traffic, only OSPF-related communication.

Statement B: GE 0/0/1 of R1 cannot send OSPF packets.Correct due to the silent-interface configuration.

Statement C: The network segment to which GE 0/0/1 of R1 belongs cannot be advertised.This is correct, as the silent interface prevents route advertisement.

Statement D: GE 0/0/1 of R1 cannot accept OSPF packets.Correct, as the silent interface configuration blocks packet reception.

 HCIP-Datacom-Core Reference

OSPF interface command behavior is outlined in the configuration and lab examples sections​​.

A stateful inspection firewall tracks the state of active connections. If a packet matches an existing session in the firewall's state table, it is allowed to pass. The diagram indicates that the TCP packet matches the session state, so the firewall forwards it ​.

OSPF supports both area-level and interface-level authentication. When both are configured, interface authentication takes precedence over area authentication. This hierarchy ensures that specific interface-level configurations override the broader area-level settings when applicable ​.

 OSPF LSA Flooding Mechanism

If a router receives an LSA identical to one already in its LSDB, it does not flood the LSA again unless the LSA has changed (i.e., the sequence number or content has been updated).

OSPF ensures efficient use of bandwidth by avoiding redundant flooding of unchanged LSAs.

 HCIP-Datacom-Core Reference

The OSPF LSDB synchronization process explains that unchanged LSAs are not reflooded, ensuring stability and resource optimization​​.

For first-time configuration of a newly purchased network device, administrators typically use the console port. This direct connection is secure and independent of network configuration, making it suitable for initial setups. Telnet, SNMP, or FTP require prior IP configuration, which is not feasible during the initial setup phase ​.

One multicast MAC address maps to 32 multicast IP addresses due to the limited number of bits used in the mapping process. Specifically, the lower 23 bits of the MAC address map to the lower 23 bits of the multicast IP address, while the high 24 bits of the MAC address are fixed as 0x01005E. Thus, Option B is false ​.

When the router ID is configured in both the system view and the BGP view, the router ID in the BGP view takes precedence because BGP-specific configurations override global settings. This ensures that BGP operates with the most relevant configurations ​.

The command output confirms that the VLANs with IDs 2 and 4 are part of the VLAN pool named "STA." The VLAN pool concept is used to allocate VLANs dynamically to devices or subnets, which reduces broadcast domain size and improves network efficiency. The total number of VLAN pools is unrelated to this output, and the assignment algorithm (hash or even) is not explicitly mentioned in the output. Huawei VLAN pool management references align with this analysis ​.

By default, Huawei firewalls create security zones such as Trust, Untrust, and Local. The DMZ (Demilitarized Zone) is a security zone explicitly created by users. A DMZ is used to isolate an internal network from the external one, providing an additional layer of security by placing public-facing services (e.g., web servers) in this intermediary zone. This setup ensures that if a public-facing service is compromised, the internal network remains secure. Huawei Firewall configuration steps confirm this zoning principle, making DMZ creation an explicit user-driven action ​.

In the PIM protocol, Register Stop and Graft messages are sent with unicast destination addresses, typically to specific neighbors or RP (Rendezvous Point) routers. Other messages like Bootstrap and Assert use multicast addresses for broader dissemination across the network ​.

BGP does not advertise all routes learned from peers to other peers. By default, only the best (optimal) routes selected by BGP are advertised to other peers. Additionally, routes learned from IBGP peers are not forwarded to other IBGP peers unless a route reflector or confederation setup is used. The statement claiming all learned routes are advertised is false ​.

In the given topology, the route from R4 to 10.0.2.2/32 traverses R3, which performs route leaking from Level-2 to Level-1. The cost is calculated as follows: R4 to R3 (40) + R3 to R2 (10) + R2 to the destination (30), resulting in a total cost of 80 ​.

The CAPWAP heartbeat detection interval is typically multiplied by a predefined factor to determine the switchover time. For instance, in Huawei devices, a common default is three missed heartbeats before a switchover is triggered. With a detection interval of 20 seconds, the switchover occurs after 60 seconds (20 x 3). This ensures that transient network issues do not cause unnecessary switchovers ​.

 BGP Open Message Components

The Open message contains the following critical parameters:

Local AS Number: The autonomous system of the router.

Router ID: A unique identifier for the router.

Hold Time: The maximum time the router will wait for Keepalive or other messages from its peer.

 Incorrect Option

C. NLRI: Network Layer Reachability Information is not included in Open messages; it is carried in Update messages.

 HCIP-Datacom-Core Reference

The structure and contents of Open messages are explained in BGP protocol details​​.

Network Types and Corresponding Link Layer Protocols

Broadcast: Ethernet

Point-to-Point (P2P): PPP, HDLC

Point-to-Multipoint (P2MP): PPP

Non-Broadcast Multi-Access (NBMA): Frame Relay

 OSPF Network Types:OSPF classifies networks based on link layer protocols into the following types:

Broadcast: This type assumes that all routers on the network can communicate directly with one another using multicast or broadcast frames. Ethernet networks are typical examples.

Point-to-Point (P2P): This type is used for links that connect two routers directly. Common protocols include PPP (Point-to-Point Protocol) and HDLC.

Point-to-Multipoint (P2MP): This type simulates multiple point-to-point connections over a single physical network, often used in WAN scenarios where PPP is employed.

Non-Broadcast Multi-Access (NBMA): These networks connect multiple devices but lack native broadcast capability, such as Frame Relay.

In Layer 3 roaming scenarios, STAs (stations) remain on different subnets before and after roaming. To ensure that user traffic reaches the original subnet, it must be tunneled back over a CAPWAP tunnel. This technique prevents disruptions in communication and enables seamless roaming. Huawei’s Layer 3 roaming design guidelines emphasize the use of CAPWAP tunnels for user traffic forwarding ​.

An IP prefix filter is designed to match both the IP address and its prefix length, making it suitable for filtering routing information rather than data packets. Options A and D are incorrect because IP prefix filters do not work directly on data packets, and they can match both prefix numbers and lengths ​.

On Huawei devices, multiple BGP processes can be configured on the same router, but they are typically used for specific use cases such as multi-instance deployments or virtual routers. This flexibility is supported by Huawei's routing protocols ​.

In Huawei firewalls, the security level of a zone can be reconfigured by an administrator, making the statement that it cannot be changed false. Other statements accurately describe security level restrictions or defaults ​.