Download Full Version H12-891_V1.0 Huawei Exam

Understanding User Authentication Points in a Network

Authentication points can be deployed at different network layers based on security and scalability needs:

✅ Access Layer Authentication:

Ensures high security & granular control (user-level authentication).

Preferred in high-security enterprise networks.

✅ Aggregation or Core Layer Authentication:

Reduces authentication overhead but provides less granular control.

Suitable for large-scale networks where authentication load needs to be balanced.

Analysis of the Answer Choices:

✅ A. Deploying user authentication points at the access layer achieves granular permission management and high network security.

Correct: Provides fine-grained control per user and prevents unauthorized access.

✅ B. Moving user authentication points from the access layer to the aggregation or core layer greatly reduces the number of user authentication points, thereby effectively mitigating the pressure on the AAA server.

Correct: Fewer authentication points mean less load on the AAA server.

✅ C. Deploying user authentication points at the access layer has both advantages and disadvantages when compared to doing so at the aggregation or core layer. Policy association can be applied if user authentication points are deployed at the access layer.

Correct: Policy-based authentication is best applied at the access layer for granular control.

❌ D. When user authentication points are moved from the access layer to the aggregation layer, MAC address authentication for users may fail.

Incorrect: MAC authentication works at both layers, but policy adjustments may be needed.

✅ Reference: Huawei HCIE-Datacom Guide – User Authentication Strategies in Enterprise Networks

BGP in Huawei SD-WAN

Huawei SD-WAN uses BGP (Border Gateway Protocol) as the primary routing protocol to exchange VPN routes between Customer Premises Equipment (CPEs) and the controller.

✅ Why BGP is Used in SD-WAN?

Scalability: BGP can handle a large number of VPN routes.

Policy-Based Routing: BGP allows traffic engineering and policy control across SD-WAN tunnels.

Multiprotocol Support: Huawei SD-WAN uses MP-BGP to exchange IPv4, IPv6, and VPNv4 routes.

For OSPF neighbors to reach Full state, they must exchange LSAs (Link State Advertisements) properly and synchronize their databases.

Possible Causes Preventing OSPF from Entering Full State:

✅ A. A link works abnormally

If the physical or Layer 2 link is unstable, OSPF Hello packets may be lost, preventing the Full state.

✅ B. The OSPF network types on both ends of the link are inconsistent

OSPF network types (Broadcast, P2P, NBMA, etc.) must match on both ends.

Example: If one router is P2P and the other is Broadcast, adjacency issues occur.

✅ C. The router IDs of neighbors are the same

Router ID conflicts prevent OSPF adjacencies from forming.

Each router must have a unique Router ID.

✅ D. The OSPF MTU values of interfaces on both ends of the link are different

If MTU settings do not match, OSPF Database Description (DD) packets may be dropped, preventing Full state.

Reference from Huawei HCIE-Datacom Documentation:

Huawei OSPF Configuration Guide – Troubleshooting OSPF Neighbor Issues

HCIE-Datacom Study Material – OSPF Adjacency and Route Synchronization

When Spanning Tree Protocol (STP) is not enabled on a network, loops can occur in Layer 2 Ethernet networks, leading to various network issues. STP is designed to prevent loops by blocking redundant paths, and its absence can cause broadcast storms, MAC address table instability, and resource exhaustion. Let’s analyze each option in the context of Huawei HCIE Datacom documentation and network behavior:

A. A loop alarm is generated on the LAN switch.

This option is incorrect. Huawei switches, as per HCIE Datacom standards, do not automatically generate a specific "loop alarm" unless configured with loop detection features (e.g., Huawei’s Loop Detection Protocol or similar mechanisms). Without STP or loop detection enabled, the switch may not explicitly generate an alarm for a loop; instead, it will exhibit symptoms like broadcast storms or flapping MAC entries. Therefore, this is not a direct symptom of an STP-less loop. Reference: Huawei HCIE Datacom V3.0 Training Materials, Section 4.2 – Spanning Tree Protocol and Loop Prevention.

B. CPU usage is too high.

This option is correct. When a loop occurs without STP, broadcast packets (and sometimes multicast or unknown unicast packets) circulate endlessly in the network. This leads to excessive processing by switches as they handle these packets, resulting in high CPU usage. Huawei switches, as described in HCIE Datacom documentation, can experience CPU overload due to continuous packet forwarding and processing in a looped environment. Reference: Huawei HCIE Datacom V3.0, Chapter 5 – Switch Performance and Loop Management.

C. MAC entries flap.

This option is correct. In a loop without STP, switches continuously receive frames from multiple ports, causing MAC address tables to update repeatedly as the same MAC address appears on different ports. This "flapping" of MAC entries destabilizes the network and can lead to incorrect frame forwarding. Huawei HCIE Datacom emphasizes MAC address table stability as a critical aspect affected by loops, as outlined in Section 4.3 – Ethernet Switching and Loop Mitigation. Reference: Huawei HCIE Datacom V3.0, Section 4.3.

D. Host receives a large number of broadcast packets.

This option is correct. A loop without STP causes broadcast packets to circulate indefinitely, creating a broadcast storm. Hosts connected to the network will receive an overwhelming number of these packets, potentially leading to performance degradation or even network timeouts. This is a well-documented symptom in Huawei HCIE Datacom training, specifically in discussions about loop prevention mechanisms. Reference: Huawei HCIE Datacom V3.0, Chapter 4 – Layer 2 Loop Prevention.

Thus, the correct symptoms of a loop occurring due to the absence of STP include high CPU usage, flapping MAC entries, and hosts receiving a large number of broadcast packets. Option A is incorrect as it requires specific loop detection configuration, which is not implied in the question.

References:

Huawei HCIE Datacom V3.0 Training Materials, Sections 4.2, 4.3, and 5 – Spanning Tree Protocol, Loop Prevention, and Switch Performance.

Huawei Official Documentation on Ethernet Switching and Loop Management, available in HCIE Datacom Certification Guides (2023 update).