All four statements accurately describe the characteristics and trade-offs of wireless traffic forwarding modes in a Huawei fabric network.

Tunnel Forwarding: All wireless traffic is encapsulated and sent to a central Wireless Access Controller (WAC). This centralizes traffic, enabling unified policy enforcement and management (A). However, this creates a traffic detour, concentrating the forwarding load on the WAC and potentially creating a performance bottleneck (C).

Direct Forwarding: Wireless traffic is forwarded directly from the Access Point (AP) to the wired network. This avoids the WAC bottleneck and encapsulation overhead, resulting in higher forwarding efficiency (B). However, when a user roams between APs connected to different edge switches, their network entry point changes, which can necessitate re-authentication and IP address reallocation, thus degrading the roaming experience (D).

All the provided options are correct statements describing the attributes of tunnel and direct forwarding modes within a fabric wireless network.

1. Huawei CloudCampus Solution 3.1.T Solution Description, Section: "WLAN Service Basics" -> "Forwarding Mode". This document details the two forwarding modes. It explicitly states that tunnel forwarding "facilitates centralized user management and security control" (supports A) but "all service traffic is forwarded through the WAC, which imposes high-performance requirements on the WAC" (supports C). It also describes direct forwarding as having "high forwarding efficiency" (supports B) but notes that for inter-AC or inter-group roaming, "the user IP address needs to be re-obtained, affecting user experience" (supports D).

2. Huawei iMaster NCE-Campus V300R021C00 Product Documentation, Section: "WLAN Service Configuration" -> "Forwarding Mode". The documentation explains that in direct forwarding, "service data packets are not encapsulated by CAPWAP tunnels and forwarded by the WAC. Instead, they are directly forwarded by the access device," which improves efficiency (supports B). Conversely, it describes tunnel forwarding as a model where the WAC "centrally forwards service data packets of all APs," which facilitates centralized control but increases WAC pressure (supports A and C). The implications for roaming in direct mode are also discussed as a key consideration (supports D).

WAPI (WLAN Authentication and Privacy Infrastructure) is a Chinese national standard for securing wireless networks. It consists of two main parts: WLAN Authentication Infrastructure (WAI) for identity authentication and WLAN Privacy Infrastructure (WPI) for data protection. The WPI protocol is responsible for data encryption and integrity. It explicitly mandates the use of the SM4 block cipher (formerly known as SMS4), a 128-bit block cipher that is also a Chinese national standard, for ensuring data confidentiality over the wireless link.

A. Web (WEP): WEP (Wired Equivalent Privacy) is an obsolete and insecure IEEE 802.11 security protocol, entirely separate from the WAPI standard.

C. TKIP: The Temporal Key Integrity Protocol (TKIP) is the encryption method used in the WPA (Wi-Fi Protected Access) standard, not in WAPI.

D. CCMP: The Counter Mode Cipher Block Chaining Message Authentication Code Protocol (CCMP) is the mandatory encryption standard for WPA2 and is also used in WPA3, not WAPI.

1. Huawei Enterprise Support Documentation, WLAN Security Feature Guide. In sections detailing the configuration of WAPI security policies, the documentation specifies that the WPI protocol uses the SM4 algorithm for data encryption. (e.g., in documentation for Huawei ACs and APs under WLAN Service Configuration > Security Profile Configuration).

2. Chinese National Standard GB 15629.11-2003, "Information technology... Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) specifications," Amendment XG1-2006. This standard, which defines WAPI, specifies the SMS4 (later renamed SM4) algorithm for the WPI component.

3. Zhang, Y., & Zheng, J. (2005). Security of the WAPI protocol. In Cryptology and Network Security, 4th International Conference, CANS 2005, Xiamen, China, December 14-16, 2005, Proceedings (Vol. 3810, p. 158). Springer. The paper states, "The encryption algorithm used in WPI is a block cipher with 128-bit key and 128-bit block size, called SMS4." (Section 2.2 WPI). DOI: https://doi.org/10.1007/1159937112

For a large-scale network with 15,000 wireless terminals, a three-layer hierarchical network architecture is the most appropriate and recommended solution. This model consists of a core layer, an aggregation layer, and an access layer. It provides the highest levels of scalability, performance, resilience, and manageability required for such a large user base. The aggregation layer is critical for summarizing traffic, enforcing policies, and distributing the load before it reaches the network core. A native WAC, integrated into a core or aggregation switch, simplifies the network architecture and centralizes management, which is highly beneficial in large deployments.

B. Combining aggregation and access layers is a design for medium-sized networks and would likely create performance bottlenecks and management complexity with 15,000 users.

C. This is a collapsed core design suitable only for very small networks. It is not scalable for the number of access points required to support 15,000 terminals.

D. A two-layer architecture (core and access) is suitable for medium-sized networks but lacks the scalability and policy enforcement capabilities of a dedicated aggregation layer for a large-scale deployment.

1. Huawei Enterprise Support Documentation: In the Huawei CloudCampus Solution Design Guide, the standard networking model for a large campus network (typically defined as supporting thousands of users) is the three-layer architecture of core, aggregation, and access switches. This design ensures high reliability and allows for future expansion. The guide also details the deployment of native WAC functionality on core or aggregation switches for centralized WLAN management. (Refer to: Huawei CloudCampus Solution Design Guide, Section: "Network Design > Campus Network Architecture Design > Large and Medium-Sized Campus Network Architecture").

2. University Courseware: Network design principles taught in advanced networking courses advocate for a hierarchical model for scalability. For instance, Stanford's CS144 (Introduction to Computer Networking) course materials explain that large enterprise networks are built hierarchically (Core, Distribution/Aggregation, Access) to manage complexity, provide scalability, and isolate failures. This principle directly applies to designing a network for 15,000 users. (Reference: General principles covered in curricula like Stanford CS144 or MIT 6.829).

3. Official Vendor Documentation: Huawei's documentation for its CloudEngine series switches, which often serve as core and aggregation devices with native WAC capabilities, consistently presents the three-layer architecture as the best practice for large campus networks. This ensures that performance, forwarding capacity, and port density requirements are met efficiently. (Refer to: CloudEngine S12700E Series Switches Documentation, Section: "Typical Applications > Large-Scale Campus Network").

Huawei's cloud-managed campus network solution, known as CloudCampus, is specifically designed for scenarios with geographically distributed branches, limited local IT personnel, and a need for simplified, centralized network management. All the listed options represent typical use cases. Micro stores, shopping malls, and supermarkets (Retail), hotels (Hospitality), and schools (Education) benefit from features like zero-touch provisioning, unified cloud-based O&M, and standardized network policies. This approach significantly reduces operational complexity and costs for such organizations, making them ideal application scenarios for this solution.

All the provided options are correct and represent primary target scenarios for Huawei's CloudCampus solution.

1. Huawei. (2023). Huawei CloudCampus Solution for Small- and Medium-Sized Campus Networks. Solution Overview. This document details the application scenarios, explicitly mentioning "SME offices, economy hotels, primary and secondary schools, and commercial stores" as key targets for the cloud management solution.

2. Huawei Enterprise. (n.d.). Huawei CloudCampus Solution. Retrieved from Huawei's official enterprise website. The solution's industry application section highlights its suitability for Education, Retail, and Hospitality sectors, which directly correspond to the options provided in the question. For example, the "Retail" section covers scenarios like chain stores and shopping malls, while "Hospitality" covers hotels.

The DHCP snooping binding table is a database created and maintained by a switch to record information about legitimate DHCP clients. When a trusted DHCP server sends a DHCPACK packet to a client, the switch intercepts this packet and records the client's MAC address, the assigned IP address, the VLAN the client belongs to, and the interface it is connected through. This comprehensive entry allows the switch to validate subsequent data packets from the client, ensuring they originate from the correct source IP and MAC address on the expected port and VLAN, thereby preventing spoofing attacks.

All the provided options are correct components of a DHCP snooping binding table. There are no incorrect options in this list.

1. Huawei CloudEngine S5732-H Series Switches Command Reference - display dhcp snooping user-bind: The official command reference for Huawei switches details the output of the command used to view the DHCP snooping binding table. The output fields explicitly include MAC Address, Ip Address, VLAN, and Interface. (Refer to the command description for display dhcp snooping user-bind in the relevant product documentation).

2. Huawei S Series Campus Switches Configuration Guide - Security - Configuring DHCP Snooping: This guide explains the mechanism of DHCP snooping. In the section "DHCP Snooping Principles," it states, "A DHCP snooping binding table is generated based on DHCP ACK messages. The table records the mapping between the MAC address, IP address, lease, binding type, VLAN ID, and interface number of each client." This confirms all four options are integral parts of the binding table. (Refer to the chapter on "DHCP Snooping" in the Security Configuration Guide for S Series Switches).