Secure Shell (SSH) is a cryptographic network protocol for operating network services securely over an unsecured network. Several application-layer protocols are designed to run over SSH to leverage its security features. STelnet (Secure Telnet) and SFTP (SSH File Transfer Protocol) are direct replacements for their insecure counterparts (Telnet and FTP) and are explicitly built upon the SSH protocol. NETCONF (Network Configuration Protocol) is a network management protocol that uses SSH as its primary transport layer to ensure secure and reliable communication with network devices. DNS, however, operates primarily over UDP or TCP on port 53 and does not use SSH.

A. DNS (Domain Name System) is a protocol for name resolution and does not use SSH for its transport. It typically uses UDP/TCP port 53.

1. Huawei HedEx Documentation

NE40E V800R012C10 Configuration Guide - User Access and Authentication

"SSH Configuration" section. This document describes how SSH provides a security mechanism for protocols like STelnet and SFTP.

2. Huawei HedEx Documentation

NE40E V800R012C10 Configuration Guide - Network Management and Monitoring

"NETCONF Configuration" section

"NETCONF Overview". It states

"NETCONF uses SSH as the transport layer protocol to ensure reliable and secure data transmission."

3. RFC 6241

Network Configuration Protocol (NETCONF)

Section 2.2 "Transport Protocol". It specifies that "NETCONF can be layered over any transport protocol that provides a set of basic requirements. The mandatory transport protocol for NETCONF is SSH."

Statement A is correct; it defines the core purpose of a Wireless Access Controller (WAC), which is to centralize the management, configuration, and monitoring of all associated Fit APs on the network. Statement D is also correct; a Fit AP's fundamental role is to provide the 802.11 wireless interface for client stations (STAs) and to bridge the traffic between the wireless medium and the wired network infrastructure, regardless of whether it is centrally managed or not.

B. This is false. This describes a Fat AP. In a WAC + Fit AP architecture, all configurations are performed on the WAC and then provisioned to the Fit APs.

C. This is false. The CAPWAP protocol, used for communication between a WAC and its APs, is IP-based and can operate over a Layer 3 network. The WAC and APs do not need to be in the same Layer 2 broadcast domain.

1. Huawei

"HCIA-WLAN V3.0 Training Material"

Chapter "WLAN Overview". This material explains the WAC+Fit AP architecture

stating

"The WAC is responsible for WLAN access control

AP configuration and management... The Fit AP is managed by the WAC in a centralized manner." (Supports A

contradicts B).

2. Huawei

"HCIA-WLAN V3.0 Training Material"

Chapter "WLAN Networking Mode". This chapter clarifies the roles

stating a Fit AP is "responsible for bridging and forwarding 802.11 packets and 802.3 packets." (Supports D).

3. IETF RFC 5415

"Control And Provisioning of Wireless Access Points (CAPWAP) Protocol Specification"

Section 1. Introduction. The RFC specifies that CAPWAP is designed to be independent of the underlying transport

running over UDP/IP

thus enabling communication across Layer 3 networks. (Contradicts C).

The configuration implements source NAT using a policy-based approach with an address pool and Port Address Translation (PAT). The mode pat command in the address group configuration is key. PAT allows multiple internal (private) IP addresses to be translated to a single external (public) IP address by using different port numbers to distinguish between the connections. Therefore, the statement that post-NAT IP addresses for different intranet users must be different is false. Multiple users from the 192.168.0.0/16 network can be mapped to the same public IP address (e.g., 100.1.23.1) simultaneously, each with a unique source port number.

A. This is true. The address pool ranges from 100.1.23.1 to 100.1.23.254, so this IP is a valid post-NAT address.

B. This is true. The nat enable command is applied to interface GE0/0/2, so only traffic exiting this interface will have the NAT policy applied.

D. This is true. The IP address 192.168.1.100 falls within the source-address range 192.168.0.0 192.168.255.255 and will be translated.

1. Huawei HedEx Documentation

NE40E V800R012C10 Configuration Guide - IP Service

"NAT Configuration" section

"Configuring Policy-based NAT". This guide details the configuration of NAT policies.

2. Huawei HedEx Documentation

NE40E V800R012C10 Command Reference - IP Service

"nat address-group" command. The documentation for the mode pat parameter explicitly states it enables Port Address Translation

allowing multiple private users to share one or more public IP addresses.

3. RFC 2663

IP Network Address Translator (NAT) Terminology and Considerations

Section 2. "Basic NAT vs. NAPT". This RFC defines NAPT (Network Address Port Translation)

which is what PAT implements

as a method for mapping multiple private addresses to a single public address.

A Layer 2 switch maintains a MAC address table to map MAC addresses to their corresponding egress ports. When SW1 receives a frame from PC1 on port GE1/0/2, it inspects the source MAC address. SW1 finds an existing entry for PC1's MAC address associated with port GE1/0/1. Because the frame arrived on a different port (GE1/0/2), the switch concludes that the device has moved. It updates the MAC address table by overwriting the old entry, associating PC1's MAC address with the new port, GE1/0/2. This ensures future frames destined for PC1 are correctly forwarded to its new location.

A: A switch's MAC address table cannot have two different port entries for the same unicast MAC address. This would create forwarding ambiguity.

C: A single MAC address move does not trigger a flush of the entire MAC address table. This would be inefficient and cause unnecessary flooding for all other traffic.

D: Waiting for the original entry to age out would cause a temporary loss of connectivity for PC1, as frames would be forwarded to the old, disconnected port. Switches are designed to update MAC entries immediately to support device mobility.

1. Huawei HCIA-Datacom V1.0 Training Material

"Ethernet Switching Principles

" Section: MAC Address Table Operation. This section describes the process of dynamic MAC address learning

including how a switch updates an entry when a device moves from one port to another.

2. Computer Networking: A Top-Down Approach

8th Edition by J. Kurose and K. Ross

Chapter 6

"The Link Layer and LANs." The section on Link-Layer Switches explains the self-learning process

including how switch tables are updated when a host moves to a different port on the same switch.

The command display ip routing-table protocol ospf is used to view the global IP routing table and filter the output to show only the routes that were learned through the OSPF protocol and have been successfully installed. This command directly shows the active OSPF routes used for packet forwarding.

B. display ospf peer shows the status of OSPF neighbor adjacencies, not the routes in the routing table.

C. display ospf interface provides OSPF-related details for each interface, such as cost and state, not routes.

D. display ospf routing displays the OSPF routing database (LSDB), which contains raw LSA information before the SPF algorithm calculation.

1. Huawei VRP V800R019C00 Command Reference

"IP Routing Commands > Routing Table Commands > display ip routing-table". The documentation details the usage of the protocol keyword to filter the routing table display based on the route's origin protocol

such as OSPF.

2. Huawei HCIA-Datacom V1.0 Training Material

"Section 5.3.4 OSPF Troubleshooting". This material distinguishes between checking the routing table (display ip routing-table)

the LSDB (display ospf lsdb)

and neighbor states (display ospf peer).

The statement is incorrect. When a downstream device on an STP-enabled network detects a topology change, it does not send configuration BPDUs. Instead, it sends a special type of BPDU called a Topology Change Notification (TCN) BPDU out of its root port. This TCN BPDU is sent repeatedly until the upstream switch acknowledges it by setting the Topology Change Acknowledgment (TCA) bit in its next configuration BPDU. The process is designed to inform the root bridge of the change, which then instructs all switches to shorten their MAC address aging time.

The statement is presented as a factual claim. It is false because the type of BPDU sent by the downstream device to signal a topology change is a TCN BPDU, not a standard configuration BPDU.

1. Huawei HCIA-Datacom V1.0 Training Material

"STP Topology Change

" Section: STP Other Concepts. This section details the TCN process

specifying that TCN BPDUs

not configuration BPDUs

are sent upstream to notify the network of a topology change.

2. IEEE Std 802.1D-2004

"IEEE Standard for Local and metropolitan area networks--Media Access Control (MAC) Bridges

" Clause 17.5

"Topology change." This standard defines the protocol behavior

stating that a bridge detecting a topology change shall transmit TCN messages on its root port.

VLANs (Virtual Local Area Networks) are used to segment a physical network into multiple logical broadcast domains. An ARP (Address Resolution Protocol) request is a broadcast message used to map an IP address to a MAC address. By design, broadcast traffic, including ARP requests, is confined to the VLAN in which it originates and is not forwarded by the switch to other VLANs. Therefore, if PC1 and PC2 are placed in different VLANs on the same switch, they belong to separate broadcast domains. As a result, an ARP request from PC1 cannot reach PC2, and they will be unable to learn each other's MAC addresses via ARP. This is a fundamental mechanism of Layer 2 isolation provided by VLANs.

This is a True/False question. The alternative, "False," is incorrect because it contradicts the core principle of VLANs, which is to create isolated broadcast domains at Layer 2. The scenario described is a classic symptom of VLAN misconfiguration where two devices that need to communicate directly are placed in different VLANs.

1. Huawei. (2020). HCIA-Datacom V1.0 Training Material (GAUSS-DB-V1.0.0.2). Section: "VLAN Principles". This material explains that VLANs logically divide a network into different broadcast domains and that communication between VLANs requires a Layer 3 device.

2. Huawei. S Series Switches Configuration Guide - VLAN. In the documentation for switches like the S5700 series

the section on "VLAN Principles" details how VLANs isolate broadcast domains

explicitly preventing Layer 2 traffic

such as ARP broadcasts

from crossing VLAN boundaries.

The statement is false. A basic communication model fundamentally consists of at least four essential elements: a source (sender), a message (content), a transmission medium (channel), and a destination (receiver). Communication is the process of conveying information from a sender to a receiver. Without a receiver to interpret the message, the process is incomplete and cannot be considered communication. Therefore, the receiver is a mandatory element.

A. This option is not provided, but if it were "True," it would be incorrect because a receiver is a non-negotiable component of any complete communication model, including the Shannon-Weaver model.

1. Shannon

C. E. (1948). A Mathematical Theory of Communication. Bell System Technical Journal

27(3)

379-423. https://doi.org/10.1002/j.1538-7305.1948.tb01338.x. The foundational model explicitly includes a "destination" (receiver).

2. Kurose

J. F.

& Ross

K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson. Chapter 1

Section 1.1 "What Is the Internet?"

implicitly defines communication as occurring between end systems (which act as senders and receivers).

The statement accurately describes a key difference between SNMP Trap and Inform Request messages. Both are used by an SNMP agent (managed device) to asynchronously notify an NMS of an event. However, a Trap is an unconfirmed notification; the agent sends the message and does not expect a reply. An Inform Request is a confirmed notification; the agent sends the message and waits for an acknowledgment from the NMS. If no acknowledgment is received, the agent may resend the Inform Request. This confirmation mechanism makes Inform more reliable than Trap for critical notifications.

This is a True/False question. The statement is factually correct, so option A (True) is the only correct choice.

1. Huawei. (2020). HCIA-Datacom V1.0 Training Material (Model H12-811). Section: Network Management and O&M

Subsection: SNMP Protocol Basics

Chapter: SNMP Operations. (This chapter explicitly contrasts Trap and Inform

stating that Inform messages require acknowledgment from the NMS

unlike Trap messages).

2. Case

J.

Fedor

M.

Schoffstall

M.

& Davin

J. (1990). RFC 1157: A Simple Network Management Protocol (SNMP). Section 4.1.3

"The Trap-PDU." (Describes the unconfirmed nature of Traps).

3. Levi

D.

Meyer

P.

& Stewart

B. (2002). RFC 3416: Version 2 of the Protocol Operations for the Simple Network Management Protocol (SNMP). Section 4.2.7

"The InformRequest-PDU." (Defines the InformRequest and its requirement for a response PDU as acknowledgment).

This statement is true based on the principles of the TCP/IP layered architecture. The transport layer (e.g., TCP, UDP) provides logical end-to-end communication between processes on the source and destination hosts. Intermediate routers operate at the network layer (Layer 3). A router's fundamental role is to forward packets based on the network layer header (IP address). It does not need to process the transport layer header for this core function. The transport layer information is encapsulated within the IP datagram and is intended only for the destination end system.

B. This option is not provided, but if it were "False," it would be considered incorrect in the context of an exam testing the pure TCP/IP model, despite real-world exceptions like NAT or ACLs.

1. Huawei HCIA-Datacom V1.0 Training Material. (2020). Section: "TCP/IP Protocol Stack"

pp. 1-52 to 1-54. This material describes the distinct functions of each layer

assigning end-to-end communication to the transport layer and routing to the network layer.

2. Clark

D. D. (1988). The design philosophy of the DARPA internet protocols. ACM SIGCOMM Computer Communication Review

18(4)

106-114. https://doi.org/10.1145/52325.52336. This paper outlines the "end-to-end argument

" a core principle stating that functions like transport-level communication should reside in the end hosts

not intermediate network nodes.