H12-841_V1.5 HCIP-Datacom-Campus Network Planning and Deployment V1.5 Questions and Answers

In HCIP Datacom Campus Network VXLAN architecture, VXLAN tunnels are classified based onhow the tunnel endpoints are created and maintained, which is referred to as the VXLAN tunnel creation mode. According to Huawei VXLAN design principles, there aretwo valid VXLAN tunnel types: static VXLAN tunnels and dynamic VXLAN tunnels.

Astatic VXLAN tunnelis manually configured by an administrator. In this mode, the source VTEP IP address, destination VTEP IP address, and related parameters are explicitly specified on devices. Static VXLAN tunnels are typically used in small-scale networks or test environments where the number of VTEPs is limited and network topology is simple. However, static configuration lacks scalability and flexibility, making it unsuitable for large campus fabrics.

Adynamic VXLAN tunnelis automatically created based on control-plane learning mechanisms, such asBGP EVPN. In this mode, VTEPs learn remote VTEP IP addresses dynamically through EVPN route advertisements (for example, Type 3 routes). When a remote VTEP becomes reachable at the underlay Layer 3 level, the VXLAN tunnel is automatically established without manual intervention. This mode is widely used in modern campus and data center networks due to its scalability and automation capabilities.

Options A and D are incorrect becausestatelessandstatefulare not official VXLAN tunnel creation classifications in Huawei’s VXLAN implementation. VXLAN itself is an encapsulation mechanism, and tunnel state is not categorized in this manner.

Therefore, the correct VXLAN tunnel types based on creation mode arestatic VXLAN tunnels and dynamic VXLAN tunnels.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

Super VLAN is a Huawei campus network technology designed to solve broadcast domain and user isolation issues in large Layer 2 networks. It allows multiplesub-VLANsto be associated with a singleSuper VLAN, where the Super VLAN provides Layer 3 gateway services, and sub-VLANs remain Layer 2 isolated from each other. Users within different sub-VLANs cannot communicate directly at Layer 2, which effectively isolates users even though they share the same logical gateway.

This architecture significantly enhances user communication security by preventing direct Layer 2 attacks such as ARP spoofing or broadcast storms between users. In addition, broadcast packets generated within one sub-VLAN are confined to that sub-VLAN and do not propagate to others, preventing invalid or excessive broadcast traffic from impacting overall service quality.

Port isolation only isolates ports but does not provide centralized Layer 3 gateway management. IPSG focuses on IP address legitimacy enforcement rather than user isolation. Ethernet port security restricts MAC address access but does not control broadcast propagation or inter-user isolation across VLANs.

According to HCIP Datacom Campus Network design guidelines, Super VLAN is the correct technology for isolating users in the same VLAN scope while reducing broadcast impact and improving security, making option A correct.

iMaster NCE-Campus adopts amulti-plane architectureto improve system security, scalability, and operational stability. The planes are logically isolated so that different types of traffic and functions do not interfere with each other. The two most commonly referenced planes are themanagement planeand theservice plane.

Themanagement planeis mainly responsible for system-level operations such as device registration, controller maintenance, system management, and internal communication between system components. For this purpose, it uses a dedicated access interface and port number to ensure secure and stable management connectivity.

Theservice plane, on the other hand, is designed fordaily network service operations. Administrators access this plane to perform tasks such as campus network planning, configuration delivery, monitoring, alarm viewing, and intelligent O&M operations. To keep service access independent and secure, the service plane uses its own dedicated login port.

According to HCIP Datacom Campus Network documentation, theservice plane of iMaster NCE-Campus uses port 18009. Administrators log in to the service plane by accessing the service IP address together with this port number. This separation ensures that service operations remain available even when management-plane functions are restricted or under maintenance.

Therefore, the correct port number for theservice planeis18009, making optionBthe correct answer.

In a VXLAN BGP EVPN architecture,EVPN Type 5 routes, also known asIP Prefix routes, are used to advertiseLayer 3 reachability informationbetween VXLAN segments. These routes are essential for implementing inter-VNI communication and external network connectivity through distributed or centralized gateways.

According to HCIP Datacom Campus Network documentation, a Type 5 route carriesIP prefix information, including theIP prefix and its prefix length, allowing VTEPs to learn network-level routing information rather than host-level details. TheRoute Distinguisher (RD)is also included to ensure uniqueness of routes across different VPN instances, which is critical in multi-tenant environments. Additionally, thegateway IP addressis carried to identify the next-hop gateway responsible for forwarding traffic toward the advertised prefix.

Unlike EVPN Type 2 routes, which advertiseMAC address and optional host IP address information, Type 5 routes donotcarry MAC addresses. Type 5 routes operate purely at the Layer 3 level and are independent of Layer 2 forwarding. Their purpose is to exchange subnet-level routing information rather than endpoint-level details.

MAC addresses are only relevant for Layer 2 forwarding and ARP/ND suppression, which are functions of EVPN Type 2 routes. Including MAC information in Type 5 routes would be unnecessary and inefficient for Layer 3 routing purposes.

Therefore, the field that isnot carriedin a BGP EVPN Type 5 route is theMAC Address, making optionCthe correct answer.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In Huawei iMaster NCE-Campus and CloudCampus management systems, different log types are designed to record different categories of events to support auditing, troubleshooting, and security analysis. When anMSP administrator creates a tenant account, this action is considered amanagement operationperformed through the system’s management interface.

Such administrative actions are recorded in theOperation Log. Operation logs documentuser-initiated configuration and management activities, including tenant creation, modification, deletion, policy changes, and administrative actions performed by operators or administrators. These logs are essential for operation auditing and responsibility tracing in multi-tenant environments.

System logsmainly record internal system events, such as service startup, module status changes, or system exceptions, and do not track administrator operations.Security logsfocus on security-related events, such as login failures, abnormal access attempts, or permission violations, rather than routine administrative operations.Device channel logsrecord communication events between devices and controllers, such as device registration or channel status changes, and are unrelated to tenant management actions.

According to HCIP Datacom Campus Network and CloudCampus O&M documentation, tenant account creation performed by an MSP administrator is clearly categorized as anoperation behavior, and therefore it is recorded in theOperation Log.

Comprehensive and Detailed Explanation (200–250 words):

In an iMaster NCE-Campus policy control matrix, rows representsource security groupsand columns representdestination security groups. A green check mark indicates that communication is allowed, while a red cross indicates that communication is denied. This matrix enables fine-grained user access control in VXLAN-based virtualized campus networks.

From the figure, communication betweenGuest_Group and Research_Groupis explicitly denied in both directions, as indicated by red crosses. Therefore, statementsAandDare both correct. The matrix also shows a green check mark forSales_Group communicating with itself, meaning intra-group communication is permitted, makingstatement B correct.

Theunknowngroup represents users that are not classified into Guest_Group, Research_Group, or Sales_Group. In the matrix, the unknown group is not completely blocked from all resources by default; access behavior depends on explicit policy configuration. Since the figure does not indicate a universal deny policy for unknown users toward all destinations,statement C is incorrect.

According to HCIP Datacom Campus Network policy control design, security group–based access control allows administrators to precisely define which user groups can communicate, improving security and service isolation. Hence, the correct answers areA, B, and D.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

IPsec defines two standard encapsulation modes that determine how IP packets are protected during transmission:Tunnel modeandTransport mode. Tunnel mode encapsulates the entire original IP packet within a new IP header and is typically used forsite-to-site VPNs. Transport mode encrypts only the payload of the IP packet and is commonly used forhost-to-host communication.

Switching mode and routing mode are not valid IPsec encapsulation modes and are unrelated to IPsec protocol behavior.

According to HCIP Datacom Campus Network documentation, onlyTunnel mode and Transport modeare supported in IPsec, makingoptions B and C correct.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In a CloudCampus VXLAN fabric, theglobal resource poolcentrally manages identifiers such as VLANs, VNIs, and bridge domains to ensure consistent allocation across the fabric.

StatementAis correct because abridge domain (BD)is the VXLAN equivalent of a VLAN and represents a Layer 2 broadcast domain used for packet forwarding within a VXLAN network.

StatementCis also correct. AVXLAN Network Identifier (VNI)uniquely identifies a VXLAN segment and is a core VXLAN forwarding identifier.

StatementDis correct because theservice VLAN poolis used to allocate VLANs for multiple purposes, including external gateway interconnections, network service resource interconnections, policy association management, and VN access VLANs.

StatementBis false. VLANs used forunderlay device interconnectionsarenot allocated from the VLAN resource poolmanaged by the VXLAN fabric. Underlay VLANs belong to the traditional IP underlay network and are typically planned and configured independently. The VLAN resource pool is intended for overlay-related services and fabric-managed VLAN usage only.

Therefore, the incorrect statement isB.

Comprehensive and Detailed Explanation (200–250 words):

In a VXLAN-based virtualized campus network, user terminals located in different access locations communicate with each other overVXLAN tunnelsestablished between VXLAN Tunnel Endpoints (VTEPs). These VXLAN tunnels form the overlay network, which abstracts the physical underlay and enables flexible Layer 2 and Layer 3 connectivity across the campus.

When communication is confined within the virtualized campus network, traffic remains inside the VXLAN overlay and is encapsulated and forwarded between VTEPs. However, when users or services inside the VXLAN network need to accessexternal networks, such as traditional IP networks, the Internet, or data centers that do not support VXLAN, traffic must exit the VXLAN overlay. This function is performed byborder nodes.

Border nodes act as the boundary between the VXLAN overlay and non-VXLAN networks. They are responsible for VXLAN encapsulation and decapsulation, routing between VXLAN segments and external networks, and enforcing security and policy controls at the network edge. According to HCIP Datacom Campus Network architecture principles, all traffic entering or leaving the VXLAN-based campus must pass through border nodes to ensure proper routing, policy enforcement, and service control.

Therefore, the statement is TRUE, and option A is correct.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In large- and medium-sized Huawei campus network admission designs, it is common forPCs to be connected downstream of IP phones. In such scenarios, both the IP phone and the PC share the same physical access port on the switch, but they have different authentication and service requirements.

To support this deployment model, Huawei recommendsmulti-mode authentication. Multi-mode authentication allowsmultiple authentication methods to coexist on the same interface. Typically, the IP phone usesMAC address authenticationto quickly obtain voice service access, while the connected PC uses802.1X authenticationto obtain data network access. This ensures that voice and data services are securely and independently authenticated without requiring additional ports.

Portal authentication is mainly used for web-based access and is not suitable for chained device scenarios. Pure 802.1X or MAC authentication alone cannot meet the requirement because they do not support differentiated authentication for multiple terminals behind a single interface.

According to HCIP Datacom Campus Network admission control guidelines, multi-mode authentication is the correct solution for PCs connected to IP phones, making option A correct.

In IPsec VPN deployment, NAT traversal (NAT-T) is a critical mechanism used when one or both IPsec gateways are located behind a NAT device. Traditional ESP packets use IP protocol number 50 and do not contain TCP or UDP port numbers, which causes problems for NAT devices that rely on port information to maintain session mappings. As a result, ESP packets may be dropped by the NAT device.

During IKE negotiation, the two gateways detect whether a NAT device exists between them by exchanging NAT-detection payloads. If NAT is detected,NAT traversal is automatically enabled. When NAT-T is active, ESP packets are encapsulated insideUDP packetsso that they can traverse the NAT device successfully.

According to HCIP Datacom Campus Network security documentation, when ESP is encapsulated using NAT-T,both the source and destination UDP port numbers are set to 4500. UDP port 4500 is the standardized port reserved specifically for IPsec NAT traversal. This allows NAT devices to correctly track sessions and forward packets based on UDP port information.

Initially, IKE negotiations use UDP port 500. After NAT detection and NAT-T activation, subsequent IKE and ESP traffic switches toUDP port 4500. This encapsulation ensures compatibility with NAT environments while maintaining IPsec security.

Therefore, the correct value that enables ESP packets to pass through NAT devices is4500, which is a key operational detail in secure campus network VPN deployments.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In astatic VXLAN tunneldeployment, Huawei devices use anNVE (Network Virtualization Edge) interfaceas the logical tunnel interface for VXLAN encapsulation and decapsulation. The NVE interface represents the VTEP and does not have a one-to-one relationship with Bridge Domains (BDs) or VXLAN tunnels.

AnNVE interface can be associated with multiple VNIs, each corresponding to a different BD. Therefore, when multiple BDs exist on a VTEP,only one NVE interface is required, makingstatement B correctandstatement A incorrect.

In static VXLAN, thedestination VTEP addressesare specified usingingress replication listsunder each VNI. This allows a single NVE interface to establishmultiple VXLAN tunnelsto different remote VTEPs. As a result, there is no requirement to create a separate NVE interface for each tunnel, makingstatement D correctandstatement C incorrect.

According to HCIP Datacom Campus Network VXLAN configuration principles, the correct practice is to createone NVE interface per VTEP, associate multiple VNIs with it, and define remote peers through ingress replication. Therefore, the correct answers areB and D.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

Huawei iMaster NCE-Campus supports advanced networking solutions tailored for industry-specific scenarios, including thefinancial SD-WAN SRv6 solution. This solution leverages Segment Routing over IPv6 (SRv6) to enable precise traffic steering, deterministic forwarding, and end-to-end service scheduling across the network.

Because SRv6 introduces enhanced forwarding capabilities and control-plane features beyond standard campus networking functions, Huawei licenses these capabilities separately. To activate SRv6-based financial SD-WAN features on iMaster NCE-Campus, customers must obtain theSRv6 function package license. Without this license, SRv6-specific orchestration, scheduling, and optimization functions cannot be enabled.

According to HCIP Datacom Campus Network documentation, licensing ensures controlled feature activation and aligns with Huawei’s modular service enablement strategy. Therefore, the statement is TRUE, and option A is correct.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In a VXLAN-based campus network,VBDIF interfacesserve as Layer 3 gateway interfaces for Bridge Domains (BDs) and provide routing capabilities. However, not all VXLAN gateways must maintain VBDIF interfaces. This makes statementA false.

ALayer 2 VXLAN gatewayoperates purely at Layer 2 and is responsible for VXLAN encapsulation and decapsulation, enabling intra-subnet communication within the same VXLAN network. It doesnot require a VBDIF interface, because no Layer 3 routing is involved. Therefore, claiming that both Layer 2 and Layer 3 VXLAN gateways must maintain VBDIF interfaces is incorrect.

Statement B is correct because a VBDIF interface is a logical Layer 3 interface bound to a BD and functions similarly to a VLANIF interface in traditional VLAN-based networks. Statement C is also correct, as aLayer 3 VXLAN gatewayenables inter-subnet routing between different VNIs and allows traffic to exit the VXLAN network toward non-VXLAN external networks. Statement D correctly describes the function of a Layer 2 VXLAN gateway.

According to HCIP Datacom Campus Network documentation, VBDIF interfaces are mandatory only for Layer 3 VXLAN gateways, not for Layer 2 VXLAN gateways.

In a virtualized campus network managed byiMaster NCE-Campus, traffic control between users or user groups is implemented throughsecurity groupsand apolicy control matrix. The configuration shown clearly reflects this mechanism.

The ACL usesucl-group names, such asResearch_Group,Sales_Group, andGuest_Group. These ucl-groups correspond tosecurity groupsdefined on iMaster NCE-Campus. The ACL rules explicitly permit IP traffic from one security group to other security groups. This type of ACL is automatically generated and delivered by the controller when apolicy control matrixis deployed.

A policy control matrix defineswho can access whomby specifying allow or deny relationships between security groups. Once the matrix is configured on iMaster NCE-Campus, the controller translates these logical policies into device-level ACLs and applies them to the appropriate enforcement points in the VXLAN fabric. The presence of multiple rules permitting traffic from one group to multiple destination groups is a typical outcome of deploying such a matrix.

Creating a security group alone would not generate ACL rules. Deploying inter-VN communication would involve route exchange or gateway configuration, not ucl-group–based ACLs. Creating an authorization result would associate users with security groups but would not generate inter-group ACL rules.

Therefore, the administrator operation that resulted in this configuration wasdeploying a policy control matrix, making optionAthe correct answer.

In iMaster NCE-Campus–based virtualized campus networks,user network segmentsare logical subnets created within aVirtual Network (VN)to provide Layer 2 or Layer 3 connectivity for users. HCIP Datacom Campus Network documentation describes multiple flexible methods for creating these network segments during VN deployment, allowing administrators to balance efficiency and control.

Administrators canmanually create user network segments one by one, which is suitable for small-scale deployments or scenarios requiring precise customization of subnet parameters such as gateway address, VLAN, and IP pool. This method provides maximum control but is less efficient for large networks.

For medium- or large-scale deployments,batch import using templatesis widely supported and recommended. Templates allow administrators to define network segment parameters in advance and import multiple segments at once, significantly improving deployment efficiency and reducing configuration errors.

Another supported method isautomatic batch allocation, where iMaster NCE-Campus automatically allocates VNIs, VLANs, and IP resources from predefined resource pools. This method is commonly used in VXLAN Fabric deployments and enables fast, standardized VN provisioning with minimal manual input.

However,directly invoking user network segments from the global fabric resource poolis not supported during VN creation. The global resource pool is used for automatic allocation reference but does not allow direct binding of pre-created segments to a VN.

Therefore, the valid methods aremanual creation,template-based batch import, andautomatic batch allocation, making optionsA, B, and Dcorrect.

According to HCIP Datacom Campus Network architecture principles, campus networks can be classified from multiple dimensions to support scientific planning, design, and deployment. These classification methods help network designers select appropriate architectures, devices, and technologies based on actual service requirements.

Network scaleis a primary classification dimension. Campus networks are commonly divided into small, medium, and large-scale networks based on the number of users, terminals, access points, and network devices. This classification directly influences topology design, such as whether a simple two-layer architecture or a more scalable three-layer architecture is required.

Served objectsis another important classification method. Campus networks may serve office users, guests, teaching staff, students, production terminals, IoT devices, or video surveillance systems. Different served objects have different requirements for bandwidth, security, and access control, making this dimension critical for policy and service design.

Access moderefers to how users and devices connect to the campus network, including wired access, wireless access, or a hybrid of both. This classification impacts WLAN planning, authentication methods, and network access control strategies.

Service complexityreflects the types and number of services carried by the network. A campus network may provide basic data services or support complex services such as voice, video, cloud access, and industry applications. Higher service complexity requires more advanced network design and management capabilities.

Therefore, all listed options are valid classification methods for campus networks.

The delivered configuration clearly indicates that aVPN instancenamedMKThas been created and bound to a VXLAN identifier. In Huawei virtualized campus networks that useVXLAN + BGP EVPN, aVN (Virtual Network)configured on iMaster NCE-Campus is typically instantiated on devices as anip vpn-instance. This VPN instance represents the logical tenant or virtual routing domain used for service isolation.

Several key lines confirm this mapping. The commandip vpn-instance MKTis the core object created for a VN. Theroute-distinguisher (RD)is configured to ensure route uniqueness for that VPN instance. The presence ofvpn-target import/export extcommunityandvpn-target … evpnshows that routes are controlled and exchanged using BGP extended communities, including EVPN-related RTs for VXLAN EVPN route import/export. This is exactly what iMaster NCE-Campus generates when a VN is created and needs to participate in EVPN route distribution.

Finally, vxlan vni 6 binds the VPN instance to a VNI, which is how VXLAN identifies and separates virtualized networks. Creating a fabric or external network would not directly generate an ip vpn-instance with RD/RTs and a VNI binding. Therefore, the administrator operation was to create a VN named MKT.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In VXLAN-based networks, inter-subnet communication and external network access requireLayer 3 forwarding capabilities. ALayer 3 VXLAN gatewayperforms routing between different VXLAN segments (VNIs) and enables traffic to exit the VXLAN overlay toward traditional non-VXLAN networks.

The NVE interface is responsible only for VXLAN encapsulation and decapsulation and does not perform routing. VLANIF interfaces are used in traditional VLAN environments and do not provide VXLAN interworking. A Layer 2 VXLAN gateway supports bridging only and cannot route between subnets.

Therefore, the Layer 3 VXLAN gateway is the correct solution for inter-subnet communication and external access.

The displayed routes are EVPN routes shown in the formatNetwork(EthTagId/IpAddrLen/OriginalIp)with a /32 “OriginalIp” value (for example,0:32:1.1.1.0). In Huawei VXLAN BGP EVPN as described in HCIP Datacom Campus Network materials, this format corresponds toEVPN Route Type 3 (Inclusive Multicast Ethernet Tag Route). Type 3 routes are used by VTEPs to advertise participation information for a VXLAN broadcast domain (BD) and to provide the remote endpoint information needed for BUM (broadcast, unknown unicast, multicast) traffic handling.

Type 3 routes effectively carry theremote VTEP address information(the VTEP IP that serves as the tunnel destination in the underlay). Once the underlay Layer 3 network can reach that VTEP IP (for example, via IGP/BGP underlay routes), the VXLAN overlay can build forwarding toward the peer VTEP, so statementAis true and statementDis also true.

When ingress replication is used for BUM forwarding, the local VTEP needs a replication list of remote VTEPs in the BD. Receiving Type 3 routes provides the membership information required to form this list, making statementBtrue.

StatementCis false becauseType 2routes are MAC/IP Advertisement routes that include MAC information (and optionally a host /32 IP). The shown output contains no MAC fields, so it is not Type 2.

HuaweiCloudEngine S series switchesare designed for modern campus access scenarios that require flexible device deployment, especially for wireless APs, IP phones, cameras, and IoT terminals. According to HCIP Datacom Campus Network documentation, these switches supportPoE long-distance power supply, allowing power and data to be transmitted overCat5e Ethernet cables for distances of up to 200 metersunder specific conditions.

Traditionally, standard Ethernet transmission and PoE delivery are limited to 100 meters. However, Huawei CloudEngine S series switches introducePoE Long Distance (PoE LD) mode, which extends the maximum transmission distance while maintaining stable power delivery and communication. This capability is particularly valuable in campus environments such as schools, hospitals, warehouses, and outdoor corridors, where powered devices may be located far from access switches.

When PoE long-distance mode is enabled, the switch optimizes signal transmission and power output to ensure reliable operation over extended cabling. This reduces the need for additional intermediate switches or power supplies, simplifying network architecture and lowering deployment and maintenance costs.

It is important to note that this feature applies to supported CloudEngine S models and compliant powered devices, and appropriate cable quality such as Cat5e is required. Within these design constraints, CloudEngine S series switches are fully capable of delivering PoE over distances up to 200 meters.

Therefore, the statement is correct, and the answer isTRUE.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

Telemetry is a next-generation network data collection technology designed to overcome the limitations of traditional SNMP polling. One of its major advantages is that it ismodel-driven, relying onYANG modelsto define structured and extensible data formats. This allows Telemetry to support various data types and provides stronger semantic meaning than SNMP MIBs, makingoption A correct.

Another key advantage ishigh-frequency data collection. Telemetry supportssecond-level or even sub-second-level reporting, enabling more precise and real-time network monitoring. This capability is critical for intelligent O&M scenarios such as fault prediction, traffic analysis, and SLA assurance. SNMP, by contrast, typically relies on periodic polling with much lower precision. Therefore,option D is correct.

Telemetry does not establish sessions based on SSH. Instead, it typically uses protocols such asgRPCover secure transport channels like TLS. Hence,option B is incorrect.

Option C is also incorrect because Telemetry focuses ondata subscription and reporting, not on configuring or managing device databases. Configuration management remains the responsibility of controllers or network management systems, not the Telemetry mechanism itself.

According to HCIP Datacom Campus Network documentation, Telemetry’s strengths lie in model-driven data representation and high-precision, real-time monitoring, making A and D the correct answers.

iMaster NCE-Campus adopts a flexiblemulti-plane networking architectureto meet different deployment scale and reliability requirements. According to HCIP Datacom Campus Network documentation, iMaster NCE-Campus supports bothsingle-plane networkingandmulti-plane networking, and the selection depends on the system deployment mode.

In asingle-node system deployment, all functional components of iMaster NCE-Campus run on a single node. In this scenario,single-plane networking is optionaland can be used to simplify network planning and reduce deployment complexity. Management traffic, service traffic, and internal communication share the same network plane, which is sufficient for small-scale or test environments where high availability and strict isolation are not mandatory.

However, inmulti-node or cluster deployments, iMaster NCE-Campus requiresmulti-plane networking. Different network planes—such as management plane, service plane, and internal communication plane—are deployed separately to ensure high availability, scalability, performance isolation, and security. Single-plane networking isnot supportedin these deployments because it cannot meet the reliability and performance requirements of clustered systems.

This design ensures that large-scale campus networks benefit from fault isolation and load separation, while smaller deployments can use a simplified architecture. Therefore, the statement that single-plane networking is optional only in single-node system deployment is consistent with HCIP Datacom Campus Network design principles.

Hence, the correct answer isTRUE.

In BGP EVPN-based VXLAN networks, route advertisement follows clearly defined standards regarding how endpoint and tunnel information is carried. According to HCIP Datacom Campus Network documentation,BGP EVPN does not use an EVPN Router MAC Extended Community to advertise the Router MAC of a VTEP. This statement is therefore incorrect.

In EVPN, different route types serve specific purposes. For example,EVPN Route Type 2 (MAC/IP Advertisement routes)are used to advertise MAC addresses (and optionally IP addresses) of endpoints. These routes associate endpoint information with a VTEP by using theBGP next-hop attribute, which contains the VTEP IP address. Similarly,EVPN Route Type 3 (Inclusive Multicast Ethernet Tag routes)also relies on the BGP next hop to identify the VTEP for VXLAN tunnel establishment and BUM traffic forwarding.

The Router MAC of a VTEP is alocal forwarding attribute, primarily used during VXLAN encapsulation and decapsulation on the device itself. It is not distributed through EVPN extended communities. While EVPN does define several extended communities for control and policy purposes, there is no standard or HCIP-defined “EVPN Router MAC Extended Community” used to carry the Router MAC field of a VTEP during route advertisement.

Therefore, based on HCIP Datacom Campus Network VXLAN EVPN principles, the statement is false.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In campus networks, devices such as servers, print servers, and video surveillance systems requirestable and predictable IP addressesto ensure reliable access, simplified maintenance, and consistent policy enforcement. While fully dynamic DHCP allocation is easy to deploy, it does not guarantee IP address consistency, which complicates device management, monitoring, and troubleshooting.

Huawei campus network design best practices recommendstatic address allocation through DHCP based on MAC addresses, also known as DHCP reservation or static binding. With this approach, the DHCP server assigns a fixed IP address to a device according to its MAC address. This method combines the advantages of centralized DHCP management with the stability of static IP addresses.

PPPoE address binding is typically used in broadband access scenarios and is unsuitable for enterprise campus devices. The BOOT protocol is obsolete and not used in modern campus networks. Pure dynamic DHCP allocation does not meet the stability requirements of infrastructure and service devices.

According to HCIP Datacom Campus Network documentation, MAC-based DHCP static allocation is the recommended solution for managing critical campus devices, making option D correct.

In the Huawei Agile Distributed Wi-Fi Solution, the wireless architecture is designed to simplify deployment and reduce dependency on traditional centralized WLAN controllers. The solution is composed mainly of a **central AP** and multiple **Remote Units (RUs)**. The central AP integrates key control and management functions that are traditionally provided by a standalone AC. These functions include RU discovery and registration, radio parameter configuration, SSID and security policy delivery, traffic control, and basic WLAN service management.

Because the central AP performs these AC-like roles, RUs do not need to be managed individually, and a separate wireless controller is not required for the Agile Distributed Wi-Fi system to operate. This architecture is especially suitable for indoor distributed scenarios such as hotels, dormitories, hospitals, and office buildings, where RUs are deployed in rooms or corridors and centralized control is still required.

From the HCIP Datacom Campus Network perspective, this design reduces network complexity, lowers deployment and maintenance costs, and improves scalability. While an external AC or centralized management platform may still be introduced for unified management across multiple sites or for advanced O&M requirements, it is **not mandatory** for the basic Agile Distributed Wi-Fi solution. Therefore, the statement that no AC is needed because the central AP can manage multiple RUs is correct according to HCIP Datacom Campus Network documentation.

DHCP is a core protocol used in campus networks to automatically assign IP addresses and deliver network parameters to hosts, improving deployment efficiency and simplifying address management. DHCP messages include several fixed fields and anOptions field, which plays a critical role in parameter delivery.

Option A isfalse. Even if only gateway and DNS server information needs to be delivered to a client, the DHCP Offer messagemust carry the Options field. Default gateway and DNS server information are delivered through specific DHCP options, such as Option 3 (Router) and Option 6 (DNS Server). Without the Options field, these parameters cannot be conveyed to the client.

Option B is correct. The Options field in DHCP messages uses aTLV (Type-Length-Value)format, allowing flexible extension and supporting various network parameters, including NTP server addresses, wireless AC addresses, and log server addresses, which aligns with HCIP Datacom Campus Network descriptions.

Option C is also correct. DHCP supportsstatic IP address allocationby binding a specific IP address to a client’s MAC address. This is commonly used for printers, servers, or network devices that require fixed IP addresses.

Option D is correct as well. Because DHCP uses broadcast messages that cannot cross Layer 3 boundaries, aDHCP relay agentis required when the client and server reside on different IP networks.

Therefore, option A is the only incorrect statement.

In Huawei CloudCampus wireless solutions for small- and medium-sized campus networks,refined traffic controlmeans the ability to precisely limit and manage bandwidth consumption at theindividual user level. Among the available rate limiting modes,user-based rate limitingis specifically designed to meet this requirement.

User-based rate limiting applies bandwidth control policiesper authenticated user, regardless of which SSID, AP, or radio the user is connected to. This allows administrators to ensure fair bandwidth allocation, prevent a single user from monopolizing wireless resources, and provide differentiated service levels for different user roles, such as employees, guests, or VIP users. This fine-grained control aligns with identity-based access and policy management promoted in HCIP Datacom Campus Network design.

In contrast,SSID-based rate limitingcontrols bandwidth at the service level. It limits total traffic for an entire SSID, which affects all users connected to that SSID collectively, rather than individually.Radio-based rate limitingcontrols bandwidth per radio interface, focusing on wireless resource optimization instead of user-level fairness.ACL-based rate limitingis mainly used for traffic classification and control in wired or advanced scenarios and is not suitable for per-user refined wireless traffic control in CloudCampus WLAN deployments.

Therefore, when the requirement is refined traffic control foreach individual wireless user,user-based rate limitingis the most appropriate and effective option. Hence, the correct answer isA.