Huawei H12-891 Exam Dumps & Practice Test Questions
Question 1
In Huawei’s SD-WAN solution, what is the maximum number of Customer Premises Equipment (CPE) devices that can be deployed at a single site?
A. 1
B. 2
C. 3
D. 4
Correct Answer: D
Explanation:
In Huawei’s SD-WAN architecture, Customer Premises Equipment (CPE) devices are used at branch sites to provide secure, optimized, and policy-driven connectivity to the enterprise WAN. The flexibility and scalability of Huawei's SD-WAN solution allow enterprises to deploy multiple CPEs at a single site to ensure high availability, load balancing, and fault tolerance.
According to Huawei’s official SD-WAN documentation and best practices, a site can support up to 4 CPEs. These can be configured in either active-active, active-standby, or hybrid configurations, depending on the enterprise's redundancy and traffic requirements.
Let’s analyze each option:
A. 1: While a single CPE can serve a small branch with simple requirements, this setup lacks redundancy. Most enterprises seek a minimum of high availability, especially in critical sites, which makes one CPE insufficient for maximum supported deployment.
B. 2: Two CPEs are common in high availability (HA) setups, where one acts as a backup to the other. However, this is not the maximum supported configuration; it is just one common deployment model.
C. 3: Three CPEs could be used in more complex deployments, potentially involving a mix of active and standby nodes or specific routing scenarios, but it still does not represent the maximum limit.
D. 4: This is the correct answer. Huawei SD-WAN supports up to four CPEs per site. This configuration is particularly beneficial for large branches or headquarters requiring load balancing, multiple uplinks, and seamless failover between CPEs.
With four CPEs, organizations can fully leverage Huawei SD-WAN's link redundancy, path optimization, and policy-based traffic engineering, offering both robustness and flexibility. This approach also enables granular traffic distribution across WAN links and ensures service continuity even in the event of multiple CPE or link failures.
Thus, D is the correct answer because Huawei's SD-WAN supports a maximum of 4 CPEs per site, optimizing performance and reliability in distributed enterprise environments.
Question 2
Which type of Internet access mode is best suited for implementing centralized security policies and controlling Internet-bound traffic in Huawei’s SD-WAN solution?
A. Local Internet access
B. Centralized Internet access
C. Hybrid Internet access
D. Priority-based Internet access
Correct Answer: B
Explanation:
In Huawei’s SD-WAN solution, traffic management and security enforcement are critical elements that can be tailored based on an organization’s policy preferences and network architecture. One of the key decisions is selecting the Internet access mode, which determines how traffic is routed to and from the Internet.
There are several access modes, each with different implications for security, latency, bandwidth, and policy enforcement:
A. Local Internet access: In this mode, each branch connects directly to the Internet via its local CPE. While this reduces latency for services like SaaS or cloud applications, it decentralizes traffic flows and makes centralized security enforcement difficult. Every site would need its own security appliances, such as firewalls and intrusion prevention systems (IPS), which can be costly and harder to manage consistently across branches.
B. Centralized Internet access: This mode routes all Internet-bound traffic from branches through a central hub, typically located in the data center or headquarters, before forwarding it to the Internet. This centralized path allows the enterprise to enforce uniform security policies, monitor traffic, and use centralized firewalls and security inspection systems. As such, this is the ideal configuration when the primary goal is centralized security control over Internet access traffic.
C. Hybrid Internet access: This is a combination of local and centralized access. Traffic can be dynamically directed based on application type, criticality, or policy. While this offers flexibility and optimization, it splits security enforcement between central and local entities, which dilutes centralized control.
D. Priority-based Internet access: This is not a standard Huawei SD-WAN access mode. It might refer to traffic prioritization based on Quality of Service (QoS), but it doesn't directly address Internet access routing or centralized security.
In summary, centralized Internet access is the best choice for organizations prioritizing centralized policy enforcement, visibility, and control over Internet-bound traffic. All traffic is funneled through a secured central location, where enterprise-grade security tools can be uniformly applied.
Therefore, the correct answer is B.
Question 3
Which VPN solution provides the most secure and dependable method for transferring data between a company's headquarters and its branch offices over the public Internet?
A. SSL VPN
B. IPsec VPN
C. L2TP VPN
D. MPLS VPN
Correct Answer: B
Explanation:
When considering secure and reliable connectivity between a corporate headquarters and multiple branch offices across the Internet, the most widely accepted and robust technology is the IPsec VPN (Internet Protocol Security Virtual Private Network).
IPsec VPN is a suite of protocols that encrypt and authenticate packets at the IP layer, ensuring that all traffic between remote locations is both secure and verifiable. This approach is ideal for site-to-site VPNs, where static or dynamic tunnels are created between gateways (e.g., routers or firewalls) at each office location. Once the tunnel is established, all traffic between those sites travels over the encrypted channel, protecting the data from eavesdropping or tampering.
One of the main advantages of IPsec VPN is its interoperability, as it is a standards-based protocol supported by most enterprise-grade network devices and operating systems. It also supports robust encryption algorithms (such as AES) and authentication mechanisms (like digital certificates or pre-shared keys), offering high levels of confidentiality, integrity, and data origin authentication.
Let’s consider why the other options are less ideal:
A (SSL VPN) is commonly used for remote access VPNs, where individual users connect to corporate resources using a browser or a lightweight client. While SSL VPNs are secure, they are not optimized for full-site connectivity like IPsec VPNs are. Their usage typically revolves around access to web applications or small-scale remote operations rather than sustained site-to-site traffic.
C (L2TP VPN) combines Layer 2 Tunneling Protocol with IPsec for encryption. However, L2TP on its own does not provide encryption, and even when paired with IPsec, it tends to be less efficient and more complex to set up than native IPsec VPNs.
D (MPLS VPN) is a high-performance, private network service offered by telecom providers. Although MPLS VPNs offer reliable connectivity, they do not run over the public Internet and typically require costly dedicated links. Also, they lack end-to-end encryption unless combined with additional technologies like IPsec.
For companies looking to leverage the public Internet as a transport medium while still ensuring security and performance, IPsec VPN strikes the best balance between cost-efficiency, security, and site-to-site scalability, making it the best choice for this use case.
Question 4
In the process of configuring virtual networks on iMaster NCE-Campus, which step is not necessary after user accounts have already been created for handling authentication and authorization?
A. Authentication rule
B. Authentication result
C. Authorization result
D. Authorization rule
Correct Answer: B
Explanation:
In Huawei iMaster NCE-Campus, creating virtual networks (VN) involves configuring a variety of components that manage how users are authenticated and what resources they can access. The system distinguishes between authentication (validating who the user is) and authorization (defining what the user is allowed to do).
After user accounts are created, the system needs:
Authentication rules, which define conditions under which users are authenticated. These rules determine how the authentication process occurs (e.g., by username/password, certificate, MAC address, etc.).
Authorization rules, which map specific user attributes (e.g., role, department) to policies or resource access levels.
Authorization results, which are the outcomes or permissions granted to the user (such as assigning them to a VLAN, applying QoS policies, or granting access to specific applications or network zones).
However, authentication results are not mandatory in all setups, especially when the system uses a default behavior or when policies are driven more by authorization outcomes than by complex authentication result mappings. Authentication results are typically used when more granular control over the network behavior is required immediately after user authentication, but many standard setups can operate without explicitly configuring them.
Let’s briefly clarify the other components:
A (Authentication rule) is essential for triggering the authentication mechanism, so it must be configured.
C (Authorization result) is vital because it defines what network access is given post-authentication.
D (Authorization rule) links the user or user group with specific authorization results, so it’s also required.
In contrast, B (Authentication result) is not always required, particularly if default policies are in place or if access decisions are entirely driven by the authorization phase. It is therefore the correct answer to the question of what does not necessarily need to be configured after user accounts are set up.
Question 5
In a VXLAN-based network, which identifier serves a role similar to the VLAN ID in traditional Ethernet networks by defining individual VXLAN segments?
A. VRF
B. VNI
C. BD
D. VTEP
Correct Answer: B
Explanation:
In traditional Layer 2 Ethernet networks, segmentation is achieved using VLAN IDs, which are 12-bit identifiers allowing for a maximum of 4,096 separate broadcast domains. However, modern data centers and cloud-based environments often require greater scalability and flexibility than VLANs can offer. This led to the adoption of VXLAN (Virtual Extensible LAN), a network virtualization technology that extends Layer 2 segments over Layer 3 networks.
One of the core components of VXLAN is the VXLAN Network Identifier (VNI), which acts as a segment ID, just like a VLAN ID does in traditional networks. Each VXLAN segment is identified by a unique 24-bit VNI, which allows for over 16 million (2^24) isolated network segments—far surpassing VLAN's 4,096 limit.
Let’s evaluate each option:
A. VRF (Virtual Routing and Forwarding) is used to create multiple routing tables within a router or Layer 3 switch. While VRFs help isolate routing domains, they do not identify VXLAN segments. VRFs and VNIs can work together in a VXLAN environment, but the VRF is not analogous to a VLAN ID.
B. VNI (VXLAN Network Identifier) is the correct answer. It uniquely identifies each VXLAN segment and ensures that traffic from one segment does not bleed into another, much like a VLAN ID ensures isolation in traditional networks.
C. BD (Bridge Domain) is a Layer 2 concept used primarily in data center fabric technologies like Huawei’s CloudFabric or Cisco ACI. While a BD can be mapped to a VNI in VXLAN configurations, it is not the direct analog to a VLAN ID. The VNI performs the actual identification function in VXLAN.
D. VTEP (VXLAN Tunnel Endpoint) is responsible for encapsulating and decapsulating VXLAN traffic at the network edge. While VTEPs use VNIs to identify which virtual network traffic belongs to, the VTEP itself is a functional component, not a segment identifier.
Thus, B is correct because the VNI serves the same role as a VLAN ID by providing logical separation and segment identification in a VXLAN-enabled network.
Question 6
In a VXLAN network, which component facilitates inter-subnet communication and enables connectivity to networks that do not support VXLAN?
A. VLAN IF interface
B. NVE interface
C. Layer 2 VXLAN gateway
D. Layer 3 VXLAN gateway
Correct Answer: D
Explanation:
VXLAN networks are typically deployed in data center environments to enable Layer 2 adjacency over Layer 3 infrastructure. In VXLAN, communication within the same subnet and across different subnets requires specialized mechanisms. Particularly for inter-subnet communication and connectivity to external or legacy non-VXLAN networks, a Layer 3 VXLAN gateway is essential.
Here's a breakdown of the options:
A. VLAN IF interface: This refers to a Layer 3 interface created on a VLAN (commonly called an SVIs—Switched Virtual Interface). While this interface can provide routing functionality on traditional networks, it does not understand VXLAN encapsulation and cannot handle VXLAN-specific inter-subnet routing or external connectivity.
B. NVE interface (Network Virtualization Edge): This interface exists on devices that act as VXLAN Tunnel Endpoints (VTEPs). It facilitates VXLAN encapsulation and decapsulation but does not, by itself, perform routing between VXLAN segments or enable access to external networks. It's a transport mechanism rather than a routing function.
C. Layer 2 VXLAN gateway: This gateway type is used for extending VLANs into VXLAN segments, enabling communication between a traditional VLAN and a VXLAN segment at Layer 2 only. It does not route between different subnets, and thus cannot handle inter-subnet communication or access to external Layer 3 networks.
D. Layer 3 VXLAN gateway: This is the correct answer. A Layer 3 VXLAN gateway performs routing between different VXLAN segments (which may correspond to different IP subnets). It also enables communication between VXLAN and non-VXLAN networks, acting as a bridge between the overlay (VXLAN) and underlay (traditional IP routing). This is critical for enterprise environments that need centralized policy enforcement, routing, and connectivity to external services like firewalls, DNS, or the Internet.
In summary, when a VXLAN network must support inter-subnet routing and provide access to external non-VXLAN environments, the Layer 3 VXLAN gateway is the component responsible for this functionality. Therefore, the correct answer is D.
Question 7
Which of the following statements is incorrect when setting up fabric access management on iMaster NCE-Campus?
A. Create a server template and then an authentication template.
B. Only one authentication mode can be specified in an authentication template.
C. iMaster NCE-Campus can act as both a RADIUS server and a Portal server.
D. Authentication templates need to be applied to wired and wireless access points.
Correct Answer: B
Explanation:
Fabric access management in iMaster NCE-Campus enables centralized control over user access to both wired and wireless networks through unified authentication and authorization mechanisms. This process involves setting up templates and policies that define how users are authenticated and what network resources they can access.
A key part of the configuration includes:
Server templates, which define external or built-in servers like RADIUS, LDAP, or Portal servers.
Authentication templates, which specify the authentication mechanisms, policies, and link to server templates.
Let’s evaluate each of the options:
A (Create a server template and then an authentication template): This is a correct statement. In iMaster NCE-Campus, administrators must first define server templates—like RADIUS or Portal servers—before these can be referenced in authentication templates. Authentication templates link the type of authentication (e.g., 802.1X, MAC, or Portal) to these servers.
B (Only one authentication mode can be specified in an authentication template): This is the incorrect statement and therefore the correct answer to the question. In iMaster NCE-Campus, an authentication template can support multiple authentication modes. For example, a single template can include 802.1X, MAC authentication, and Portal authentication, either as fallback methods or for different device types. This flexibility is particularly important in campus environments where various types of devices (IoT, personal laptops, printers, etc.) require different authentication mechanisms.
C (iMaster NCE-Campus can act as both a RADIUS server and a Portal server): This is correct. Huawei’s iMaster NCE-Campus supports built-in RADIUS and Portal server functionalities, enabling simplified deployment without the need for external authentication servers in smaller networks or branch scenarios.
D (Authentication templates need to be applied to wired and wireless access points): This is also correct. Authentication templates must be bound to access nodes such as wired switches and wireless access points. This ensures that user traffic is intercepted and forwarded to the authentication server based on the policy defined.
Thus, B is the only incorrect statement among the options, as it incorrectly limits the flexibility of authentication template configuration.
Question 8
In a VXLAN deployment using BGP EVPN, which BGP EVPN route type is responsible for distributing MAC addresses, ARP entries, and integrated routing and bridging (IRB) routes?
A. Type 1
B. Type 2
C. Type 3
D. Type 4
Correct Answer: B
Explanation:
In BGP EVPN-based VXLAN deployments, several different route types are defined to carry specific control-plane information across the fabric. These route types enable VXLAN to support advanced features like distributed gateway, host mobility, and optimized Layer 2/Layer 3 forwarding.
Let’s examine what each type of route represents:
Type 1 (Ethernet Auto-Discovery Route): This route is used for auto-discovery of Ethernet segments, enabling features like multi-homing and split-horizon for redundancy and loop prevention. It does not carry MAC or ARP entries.
Type 2 (MAC/IP Advertisement Route): This is the correct answer. Type 2 routes carry MAC address information and optional IP address information (such as ARP entries and IRB routes). These are used to advertise hosts or endpoints that are learned on a VXLAN-enabled device (such as a Leaf switch). This type of route enables the control plane to replace traditional flooding for MAC learning and ARP resolution, making the fabric more scalable and efficient.
Type 3 (Inclusive Multicast Ethernet Tag Route): This route is used to signal VXLAN multicast group membership. It allows the setup of multicast trees for broadcast, unknown unicast, and multicast (BUM) traffic across VXLAN tunnels. It doesn't carry MAC or IP address entries.
Type 4 (Ethernet Segment Route): This route provides information about Ethernet Segment Identifiers (ESIs) for multi-homed connections, such as in EVPN multi-homing scenarios, but it is not used for advertising host reachability.
Therefore, when distributing MAC addresses, ARP entries, and IRB routes in a BGP EVPN-based VXLAN deployment, the appropriate BGP route type is Type 2, also known as the MAC/IP Advertisement Route.
Thus, the correct answer is B.
Question 9
When an NVE (Network Virtualization Edge) encapsulates a data frame into a VXLAN packet, which protocol’s header is inserted between the outer IP header and the VXLAN header?
A. TCP
B. UDP
C. IP
D. Ethernet
Correct Answer: B
Explanation:
VXLAN (Virtual Extensible LAN) is a network virtualization technology designed to solve the limitations of traditional VLANs, particularly their scalability in large-scale data center environments. VXLAN encapsulates Layer 2 Ethernet frames within Layer 3 packets, allowing Layer 2 segments to be extended across Layer 3 boundaries.
The encapsulation process involves several protocol headers that are stacked to carry the original Ethernet frame across an IP network. Here's the encapsulation structure from the innermost to the outermost:
Original Ethernet Frame – This is the actual Layer 2 frame that needs to be transmitted over the VXLAN network.
VXLAN Header – Contains the VXLAN Network Identifier (VNI) and other fields to identify the VXLAN segment.
UDP Header – VXLAN uses UDP (User Datagram Protocol) as its transport mechanism. Specifically, VXLAN packets are encapsulated using UDP port 4789.
Outer IP Header – Identifies the source and destination IP addresses of the VTEPs (VXLAN Tunnel Endpoints), which are responsible for encapsulating and decapsulating VXLAN packets.
Outer Ethernet Header – Required for physical transmission over the actual network.
So, the UDP header sits between the VXLAN header and the outer IP header. This design allows for stateless transmission, easy handling by intermediate routers, and compatibility with ECMP (Equal-Cost Multi-Path) routing thanks to UDP’s inclusion of source and destination ports, which help with hash-based load balancing.
Let’s review the options:
A. TCP: TCP is a connection-oriented protocol, not used for VXLAN encapsulation due to its overhead and complexity. It doesn't allow for efficient transport in high-performance environments like data centers.
B. UDP: Correct. UDP provides a lightweight and connectionless transport layer suitable for the high-throughput, low-latency demands of VXLAN.
C. IP: While IP is part of the encapsulation, it exists outside the UDP header in the encapsulation hierarchy.
D. Ethernet: The Ethernet header is used at both the inner and outermost parts of the encapsulated frame but does not exist between the outer IP and VXLAN headers.
Thus, the correct answer is B, as the UDP header is the protocol header inserted between the outer IP header and the VXLAN header in VXLAN packet encapsulation.
Question 10
Which technology is widely adopted in data centers to enable network virtualization and extend Layer 2 networks over Layer 3 infrastructure?
A. MPLS
B. VXLAN
C. OSPF
D. BGP
Correct Answer: B
Explanation:
Modern data centers demand scalable, flexible, and efficient networking architectures. Traditional VLAN-based Layer 2 networks are limited by the 12-bit VLAN ID, which supports only 4,096 unique IDs—insufficient for large-scale cloud environments with multi-tenant architectures. To overcome this limitation, technologies that allow network virtualization and Layer 2 extension over Layer 3 have emerged, with VXLAN (Virtual Extensible LAN) being the most widely adopted.
VXLAN provides the following key capabilities:
Network Virtualization: By encapsulating Layer 2 frames within Layer 3 packets, VXLAN allows multiple isolated tenant networks to coexist over a shared infrastructure.
Scalability: VXLAN uses a 24-bit VXLAN Network Identifier (VNI), supporting up to 16 million logical networks, far more than VLAN.
L2 over L3 Overlay: VXLAN enables Layer 2 adjacency across a Layer 3 underlay, which is essential for deploying distributed applications and virtual machines across data centers.
Cloud and SDN Integration: VXLAN is foundational in Software-Defined Networking (SDN) and cloud platforms like VMware NSX and OpenStack Neutron.
Let’s analyze the other options:
A. MPLS (Multiprotocol Label Switching): MPLS is widely used in WAN and service provider networks. While it can provide Layer 2 VPNs (like VPLS), it is not typically used for Layer 2 extension in data center environments due to complexity and hardware dependency.
B. VXLAN: Correct. VXLAN is specifically designed for data center environments and is the standard for overlay networks enabling Layer 2 extension across Layer 3 infrastructure.
C. OSPF (Open Shortest Path First): OSPF is a Layer 3 routing protocol, not a virtualization or overlay technology. It is used for routing underlay networks but does not extend Layer 2 domains.
D. BGP (Border Gateway Protocol): BGP is also a routing protocol and is used in EVPN (Ethernet VPN) as a control plane for VXLAN overlays, but by itself, BGP does not virtualize networks or extend Layer 2 domains.
Therefore, the best answer is B, because VXLAN is the de facto standard for enabling network virtualization and Layer 2 extension over Layer 3 in modern data centers.
