H19-404_V1.0 HCSE-Presales-Campus Network Planning and Design V1.0 Questions and Answers

WAPI, or WLAN Authentication and Privacy Infrastructure, is the wireless LAN security standard proposed by China. It provides wireless link authentication and data-protection mechanisms and was developed as an alternative security framework for WLAN environments. Huawei’s training material explicitly identifies WAPI as a WLAN security standard proposed in China and states that it provides stronger protection than legacy WEP and WPA mechanisms.

WPA, WPA2, and WPA3 belong to the Wi-Fi Protected Access family maintained through Wi-Fi industry certification. WPA was introduced as an interim improvement over WEP. WPA2 adopted stronger IEEE 802.11i security mechanisms, including AES-based CCMP. WPA3 later introduced stronger password-authentication and enterprise-security options.

WAPI incorporates authentication and encryption as part of an integrated wireless security architecture. Its deployment depends on regional requirements, terminal compatibility, AP support, and the organization’s regulatory or cryptographic-policy obligations. The question asks which standard originated as a Chinese wireless security standard, not which standard is most widely deployed internationally. Therefore, WAPI is the only correct choice, making option B the verified answer.

==================

A central switch in the relevant passive Ethernet network architecture supports a maximum of 48 access units. The architecture replaces a conventional multi-layer access design with a centralized switch and distributed remote or access units. The access units function as extensions of the central switch’s ports, simplifying device management, configuration, and topology maintenance.

Huawei’s CloudEngine S5731-H fixed central-switch specification provides models with 24 or 48 hybrid optical-electrical downlink ports. The 48-port model can therefore directly manage up to 48 associated access or remote units under the design limits represented by this question. The same hybrid links can provide data transmission and remote PoE power, enabling access units to be installed closer to terminals without requiring conventional active aggregation equipment at every location.

The central switch automatically discovers the topology, while remote units behave as extended ports rather than independently managed switches. This reduces management nodes and simplifies a traditional three-layer network into a two-layer architecture. The larger values of 64, 72, and 96 exceed the supported maximum for the specified central-switch implementation. Therefore, option C is correct.

==================

The distinguishing function supported by the AR6177 is VDSL. VDSL, or Very-high-bit-rate Digital Subscriber Line, enables a branch router to obtain WAN connectivity over existing copper telephone infrastructure. It is appropriate for small branches and distributed sites where Ethernet private lines, fiber, or mobile connections are unavailable or commercially impractical.

The AR6177 can terminate the VDSL access circuit and provide routing, NAT, DHCP, VPN, and other branch-gateway functions for the connected LAN. In this single-answer question, Wi-Fi and PoE are not the defining integrated capabilities of the AR6177 model. Similarly, the complete combination of IPS, antivirus, and URL filtering belongs to a security-enhanced product profile rather than the function used to distinguish the AR6177.

Huawei’s campus design material recognizes DSL links as a specific WAN-access category and notes that deployments involving complex or low-speed links, including DSL, may require an appropriate branch-device deployment method. The model is therefore selected when direct VDSL-based WAN access is required. Consequently, VDSL is the supported capability intended by this question, and option C is correct.

==================

The statement is false because Huawei SD-WAN supports both priority-based link selection and load balancing. Multiple Internet or WAN links do not have to be treated equally. An administrator can define a preferred or primary link and designate another link as secondary or backup according to application requirements, link quality, cost, bandwidth, or operational policy.

For delay- and packet-loss-sensitive services such as voice and video, a higher-quality link can be configured as the primary path and another link as the backup. If the primary link no longer satisfies the configured SLA thresholds, traffic can be dynamically switched to a better path. Huawei’s material explicitly describes primary and secondary link selection based on SLA and also presents load-balancing-based steering as a separate option.

Load balancing is useful when an enterprise wants to utilize the bandwidth of multiple links concurrently. Priority-based active/standby forwarding is preferable when one provider offers better quality or when one circuit should be reserved for critical services. Intelligent traffic steering can additionally consider application priority and current bandwidth utilization. Therefore, multiple links can be prioritized, load-balanced, or used in a policy-controlled combination, making option B correct.

==================

PROFINET DCP, meaning Discovery and Basic Configuration Protocol, is used during device discovery and initial network configuration. It operates at the data-link layer and enables an engineering station or PROFINET IO controller to locate devices on the local Ethernet segment, identify them by MAC address or station name, assign a PROFINET device name, and configure IP parameters such as the IP address, subnet mask, and default gateway.

DCP is therefore not responsible for normal cyclic process-data exchange. Real-time PROFINET communication performs that function after the controller and I/O device have been configured and an application relationship has been established. Alarm exchange and acyclic parameterization are also handled through other PROFINET communication relationships and services.

The distinction matters during commissioning. A new I/O device may initially have no usable IP configuration. DCP allows the controller or engineering tool to discover it at Layer 2 and provision the identity and addressing information required before higher-layer communication can begin. PROFINET documentation identifies DCP as mandatory for assigning IP addresses and configuring station names on the local network.

==================

The statement is true. iMaster NCE-Campus supports multiple on-premises deployment combinations rather than being restricted exclusively to Huawei-branded physical servers and Huawei virtualization platforms. The training material explicitly lists physical-server deployment using SUSE Linux and a third-party server, as well as virtual-machine deployment using VMware.

The platform can also be deployed using Huawei server and virtualization combinations, including Huawei 2288X servers, EulerOS, FusionCompute, and TaiShan-based environments. The availability of several combinations enables customers to select an architecture consistent with their existing data-center standards, procurement strategy, virtualization environment, and operational requirements.

Huawei nevertheless identifies a recommended platform combination in the training material. A recommendation does not mean that the other listed combinations are unsupported; it identifies the preferred configuration for standardized deployment and support. The material displays third-party server plus SUSE Linux and VMware-based virtual-machine deployment as valid alternatives while recommending Huawei 2288X V5 plus EulerOS.

The deployment must still satisfy the specified CPU, memory, storage, network-interface, software-version, and compatibility requirements. Therefore, the statement is True.

==================

Non-authenticated terminals can access a virtual network by using statically configured VLANs. Such terminals may include printers, cameras, sensors, industrial devices, and other dumb terminals that cannot perform 802.1X, Portal, or comparable interactive authentication. Their access interfaces and service VLANs are therefore configured in advance and mapped to the required VN.

Dynamic VLAN authorization requires a completed authentication or identification process. Normally, an authentication server returns a VLAN or other authorization attribute after validating the user or terminal. Because the question specifically refers to non-authenticated terminals, dynamically authorizing a VLAN is not the applicable mechanism. The wired-mode and wireless-mode authorization options are likewise associated with authentication-based policy delivery rather than unconditional VN access.

Huawei’s VN design guidance states that LAN-side physical interfaces and VLANs are assigned to the appropriate departments or services and then associated with corresponding VRFs or VNs. It also explains that a department may use an independent physical interface or share an interface while maintaining isolation through VLANs. Therefore, configuring a static VLAN is the correct method.

==================

The AR5710-S8T1XWE-NRGL supports all four listed 5G-Advanced capabilities. Support for 3GPP Release 16 enables enhanced 5G New Radio functions and provides the standards foundation for improved mobile-WAN capacity, reliability, and service performance.

Carrier aggregation combines multiple component carriers to increase available throughput. Downlink 3CC allows three component carriers to be aggregated for received traffic, while uplink 2CC combines two carriers for transmitted traffic. This is valuable for high-bandwidth branch access, video backhaul, and mobile private-network scenarios.

Support for eight APNs permits multiple logically separated mobile services or provider profiles to be configured. Different APNs can represent enterprise services, management traffic, production systems, backup connectivity, or isolated customer networks. Global-frequency-band support improves deployment flexibility across countries and carrier networks, subject to local spectrum regulation and the supported modem variant.

Huawei SD-WAN can use 5G as a primary, secondary, or bypass link and supports combinations such as dual 5G and 5G plus wired connectivity for service assurance. Therefore, NR Release 16, carrier aggregation, eight APNs, and global frequency bands are all supported.

==================

Option C is false. The digital-map energy-saving function provides network-wide energy visibility, identifies periods of low wireless demand, and recommends appropriate energy-saving time windows. During an approved energy-saving period, selected wireless APs or radio resources can be placed into an energy-saving state after the system evaluates coverage, traffic, and capacity requirements.

Automatically powering off switches is not the intended function. Campus switches may carry essential wired services, provide uplinks for other network devices, and supply PoE power to APs, cameras, phones, sensors, and access-control systems. Automatically shutting down a complete switch could therefore interrupt many unrelated services and potentially disconnect downstream network segments.

Huawei identifies low-carbon and energy-saving operation as a characteristic of cloud campus networks and combines this objective with AI-based intelligent O & M and proactive optimization. Its intelligent O & M architecture analyzes AP load trends and performs predictive wireless-network optimization, providing the analytical foundation for selecting safe energy-saving periods and resources.

Therefore, A, B, and D describe supported digital-map energy-saving capabilities. Automatic switch power-off is the false statement, making C correct.

Option B is false because a station retains its original IP address during Layer 3 roaming. Preserving the IP address is essential for maintaining active application sessions when the station moves between APs associated with different service VLANs, Layer 2 domains, and gateways. Huawei’s training diagram shows the same station IP address before and after roaming, while the service VLAN changes.

When the STA initially accesses the WLAN, a Home AP or HAP is selected for it. After the STA roams to a Foreign AP, the new AP obtains the station information and establishes the required forwarding relationship with the HAP. In direct-forwarding implementations, the STA’s traffic is encapsulated and forwarded to the HAP, which preserves access through the original network and gateway.

Therefore, A and C accurately describe HAP-based Layer 3 roaming. Option D is also correct: the APs use the same SSID and authentication mode but different service VLANs. The station’s IP address does not change, so B is the false statement.

==================

A terminal-type survey primarily determines the appropriate network admission control solution. Different terminal categories have different authentication capabilities and security requirements. Corporate laptops may support 802.1X authentication, guests may require Portal authentication, and printers, cameras, sensors, and other dumb terminals commonly require MAC-address authentication or automatic terminal identification.

Huawei recommends selecting authentication technologies according to the terminal type and usage scenario. For example, access switches can serve as authentication points for wired dumb terminals, while APs or other access devices can perform authentication for wireless users. After terminal identification is enabled, iMaster NCE-Campus can automatically assign VLANs, ACLs, security groups, QoS parameters, and other authorization policies according to terminal category.

The survey therefore establishes which endpoints support interactive authentication, which require non-interactive admission, and which must receive special isolation or compliance policies. It does not independently determine the complete physical network architecture or the overall O & M platform. Consequently, the terminal survey is used to formulate the network admission control solution, making option C correct.

==================

Broadcast TWT, Individual TWT, and Implicit TWT are valid Target Wake Time concepts. Individual TWT establishes a wake schedule between an AP and a specific station. Broadcast TWT advertises scheduling information that multiple stations can use, reducing individual negotiation overhead and coordinating groups of devices. An implicit TWT agreement defines a repeating schedule in which subsequent wake times are calculated from the agreed wake interval instead of being renegotiated for every service period.

These mechanisms allow stations, particularly battery-powered IoT devices, to sleep for predictable periods and wake only when transmission or reception is scheduled. TWT consequently reduces power consumption, channel contention, collisions, and unnecessary medium access in dense WLAN environments. Research describing IEEE 802.11ax TWT confirms that the mechanism schedules station transmission periods and allows stations to remain asleep outside their negotiated service periods.

“Multicast TWT” is not one of the standard TWT concepts represented by this question. Broadcast scheduling can cover multiple stations, but that does not create a separate mechanism formally identified here as Multicast TWT. Therefore, the correct answers are A, B, and C.

==================

AR routers support registration query center–based deployment, email-based deployment, and DHCP Option 148–based deployment. In registration query center deployment, the router obtains basic network connectivity, resolves or contacts Huawei’s registration service, retrieves the address and port of iMaster NCE, and then initiates registration. Huawei identifies AR routers, firewalls, switches, and APs as applicable devices for this method.

Email-based deployment is a major SD-WAN ZTP method for AR routers operating as CPEs. An administrator creates the site and ZTP configuration on iMaster NCE and sends a deployment URL to the onsite engineer. After the URL is opened and the parameters are written to the router, the device connects to the WAN and automatically registers with the controller.

DHCP Option 148 can provide the controller’s southbound IP address and port number to an IPv4 AR router, enabling automatic registration. Barcode scanning through the CloudCampus APP is specifically presented as an AP onboarding method, not an AR-router deployment method. Therefore, A, C, and D are correct.

AFI 1 with SAFI 74 is the correct combination. In Multiprotocol BGP, the Address Family Identifier defines the basic network-layer address family, while the Subsequent Address Family Identifier specifies how the associated NLRI is interpreted. AFI 1 represents IPv4. SAFI 74 is assigned for SD-WAN capabilities and is used to distribute information required for SD-WAN edge discovery and tunnel establishment, including transport and encapsulation-related attributes.

The other combinations represent different forms of reachability information. AFI 1/SAFI 1 is ordinary IPv4 unicast NLRI. AFI 1/SAFI 2 represents IPv4 multicast reachability. AFI 25 represents Layer 2 VPN information, while SAFI 70 represents Ethernet VPN routes; that combination is associated with EVPN rather than the specific SD-WAN capability NLRI requested.

Huawei’s architecture uses BGP-based control channels to exchange transport network port information, IPsec security-association information, and service routes. These parameters allow edge devices to determine peer endpoints and create GRE or GRE-over-IPsec data channels after the relevant service routes trigger tunnel establishment.

==================

The statement is true as a WLAN design recommendation. Inter-WAC roaming is supported, but it introduces more control-plane interaction and forwarding complexity than intra-WAC roaming. The Home WAC and Foreign WAC must belong to the same mobility group, synchronize station and AP information, and establish an inter-WAC CAPWAP tunnel for control information and, in some scenarios, service forwarding.

Additional synchronization, tunnel processing, route handling, and failure dependencies can increase roaming delay and complicate troubleshooting. This is especially relevant for delay-sensitive applications such as voice, video, automated guided vehicles, and real-time production systems. A better design places APs between which users frequently move under the same WAC wherever controller capacity and physical topology permit.

Avoiding inter-WAC roaming does not mean disabling the function entirely. Large campuses may require multiple WACs for scale, redundancy, or geographic distribution. Mobility groups should still be configured for unavoidable cross-controller movement. However, buildings, floors, and continuous roaming areas should be assigned carefully so that normal roaming remains intra-WAC. Therefore, the recommendation in the statement is correct, and the answer is True.

==================