H12-811_V2.0 HCIA-Datacom V2.0 Question and Answers

The uploaded key includes all four options, but option B is not a valid requirement for normal source NAT and should be removed. Source NAT translates the private source address of outbound traffic into a public address before the packet enters the public network. The public-side router therefore needs reachability to the translated public address for return traffic, not a route to the original private intranet address. By contrast, A can prevent access if NAT is not applied on the proper outbound interface or direction. C can also prevent translation when the configured address pool has no usable address available, depending on the NAT mode and session requirements. D is valid because traffic whose source address does not match the NAT policy or referenced ACL will not be translated; private-source packets then normally cannot traverse the Internet as intended. Routing on the enterprise egress device must of course also be correct, but the specific absence described in B is not inherently a failure when source NAT is working. The verified selections are A, C, and D.

This statement is false because although Area 0 is indeed the backbone area , the statement about the area ID range is incorrect. In OSPF, the area ID is a 32-bit value , which can be represented either in decimal format or in IPv4 address format such as 0.0.0.0. It is not limited to the numeric range 0 to 255 .

For example, an area can be configured as 0, 1, 100, or in dotted-decimal form such as 0.0.0.1 or 0.0.0.10, depending on implementation and configuration style. HCIA-Datacom teaches that OSPF uses hierarchical area design to improve scalability, reduce SPF calculation scope, and optimize LSA flooding. The backbone area , which is Area 0, serves as the transit area connecting all non-backbone areas in a standard OSPF design. Therefore, the second part of the statement is correct, but the first part is wrong, making the entire statement false. This question tests whether the learner understands both the function of Area 0 and the actual format of OSPF area identifiers.

VTY interfaces provide remote terminal sessions to the device. The command protocol inbound all allows the interactive remote-login protocols supported by that VTY implementation, notably Telnet and SSH/STelnet. FTP is not a VTY terminal-login protocol. FTP is a file-transfer service that uses its own server/client process, TCP sessions, authentication, and file system permissions; enabling FTP service does not make an FTP user consume a VTY terminal line in the same manner as a Telnet or SSH CLI session. Therefore, even though the word all broadens the VTY ' s permitted terminal access protocols, it does not mean that FTP users log in through those five VTY interfaces. Huawei troubleshooting documentation specifically treats protocol inbound all as satisfying Telnet and SSH access requirements. The statement incorrectly groups FTP with the VTY login protocols and claims that all three types of users can use the five VTY interfaces. That conclusion is false. The verified answer is B.

RADIUS and HWTACACS are AAA protocols that support accounting functions in addition to authentication and authorization. Accounting records can be used to track login sessions, service usage, command activity, or other information required by the deployment. LDAP and Microsoft Active Directory, by contrast, are directory-based identity technologies. Huawei documentation describes LDAP/AD integration primarily for authentication and authorization by querying directory information and validating user credentials. They are not used as the native AAA accounting protocol between a Huawei AAA client and an AAA server in the same way as RADIUS or HWTACACS. Therefore, when the question asks which listed protocols cannot be used for accounting between the AAA client and AAA server, AD and LDAP are the appropriate selections. RADIUS explicitly carries accounting messages, and HWTACACS also separates and supports authentication, authorization, and accounting functions. The source file leaves the answer blank, but the Datacom AAA model supports a verified answer of B and D.

Several upper-layer management and file transfer protocols use SSH as their secure transport foundation. SFTP is the SSH File Transfer Protocol and operates over SSH, making option C correct. STelnet is secure Telnet implemented over SSH, so option D is also correct. NETCONF commonly uses SSH as its transport protocol for secure configuration management and device orchestration, making option B correct as well.

Option A, DNS, does not use SSH as its normal transport protocol. Traditional DNS operates over UDP or TCP port 53, depending on the query or transfer type. Although DNS security extensions and encrypted DNS variants exist, they are not based on SSH. HCIA-Datacom emphasizes the role of SSH in secure network management because it replaces insecure plaintext protocols and provides confidentiality, integrity, and authentication. In practical Huawei enterprise deployments, SSH-based protocols are widely used for interactive device login, automated configuration delivery, and secure file operations. This question tests recognition of management protocols that inherit SSH’s secure channel rather than protocols that operate independently at the application layer.

IPv6 text representation permits zero compression to make long addresses easier to read and write. One or more consecutive 16-bit groups containing only zeros can be replaced by a double colon, subject to the rule that the double-colon compression is used only once in a single IPv6 address; otherwise the number of omitted groups would be ambiguous. In the address 2001:DBFF:130F:0:0:0:0:130B, four consecutive zero groups appear between 130F and 130B. Replacing that run with :: produces 2001:DBFF:130F::130B, which expands back unambiguously to the original eight groups. Leading zeros within an individual 16-bit group can also be omitted, but that is a separate abbreviation rule. The example in the question follows valid IPv6 notation and does not alter the numeric address. Consequently, the statement that the address can be compressed in the manner shown is TRUE. The correct answer is A. The compression changes only the written representation of the IPv6 address; it does not change the underlying 128-bit address value itself in any way.

An ARP Request is carried in an Ethernet broadcast frame whose destination MAC address is FF-FF-FF-FF-FF-FF. When SW1 receives the ARP Request from PC2, it does not look up a single destination MAC entry and send the frame only toward PC3. Instead, the switch floods the broadcast frame through all other eligible ports in the same VLAN, excluding the ingress port. The 300-second MAC aging time reinforces why the earlier PC1 entry is not relevant after 30 minutes: a dynamic entry that is not refreshed will age out long before PC2 is connected. PC4 ' s continued communication with PC3 may refresh MAC entries associated with that traffic, but it does not transform PC2 ' s ARP Request into a known unicast frame. ARP relies on broadcast precisely because the sender does not yet know the target ' s Layer 2 address. Therefore, the claim that SW1 forwards the request only through GE1/0/3 is incorrect. The verified answer is FALSE, option B.

Comprehensive and Detailed 150 to 200 words of Explanation From Datacom knowledge:

The false statement is B . From the AAA configuration output, the value of Remote-admin-user block time is clearly shown as 5 Min(s) , which means the account lockout duration is 5 minutes , not 30 minutes.

Option A is true because Remote-admin-user block retry-time : 3 indicates that after 3 consecutive authentication failures , the account will be blocked. Option C is also true because the displayed Domain Name Delimiter is @ , which is the separator used in usernames such as user@huawei.com. Option D is true as well because the output shows Local-user : total: 512 used: 2 , meaning that the device supports a maximum of 512 local users , and currently 2 local users have been created.

This question checks the ability to correctly read AAA configuration output on Huawei devices. In HCIA-Datacom knowledge, it is important to distinguish between retry interval , retry count , and block time , because these values represent different security control parameters and are often confused during troubleshooting or configuration review.

OSPF defines five protocol packet types: Hello, Database Description (DD), Link State Request (LSR), Link State Update (LSU), and Link State Acknowledgment (LSAck). A Link State Advertisement, or LSA, is not itself an OSPF packet type. LSAs are data structures that describe topology or routing information and are carried inside OSPF packets, especially LSU packets. For example, an LSU packet may transport one or more LSAs to a neighbor, and an LSAck packet acknowledges receipt of LSAs. Hello packets discover and maintain neighbor relationships, DD packets summarize LSDB contents during synchronization, and LSR packets request specific missing LSAs. The distinction between an LSA and an LSU is important in Huawei Datacom study material because they operate at different conceptual levels: an LSA is routing information, whereas an LSU is the OSPF protocol packet that transports that information. Therefore, among the choices, LSA is the item that is not one of the five OSPF packet types. The correct answer is B.

For an Eth-Trunk operating in manual load-balancing mode , the logical Eth-Trunk interface can remain Up as long as at least one member link is operational and properly added to the trunk. Therefore, if GE1/0/1 is Up and GE1/0/2 is Down, Eth-Trunk 1 can still stay Up, making option A correct.

Option B is incorrect because member interfaces in a manual Eth-Trunk do not need to be in identical physical states for the trunk itself to remain operational. Option C is also incorrect because there is no inherent rule here that two-member trunks must have both links active unless a separate minimum-links mechanism has been explicitly configured. No such condition is stated in the question. Option D is false because one of the key purposes of Eth-Trunk is redundancy; requiring all member interfaces to be Up would defeat that design advantage. HCIA-Datacom teaches that Eth-Trunk enhances link reliability by allowing continued forwarding when part of the bundle fails, provided the trunk still has an active forwarding member.

The root path cost (RPC) of a switch is the total path cost from that switch to the root bridge along the selected spanning-tree path. Since SW1 is given as the root bridge, its RPC is 0. Each link in the topology has a path cost of 20 . To determine SW4’s RPC, you identify the shortest active STP path from SW4 to SW1.

Based on the topology used in the question, SW4 reaches SW1 through a path containing two links . Therefore, the total root path cost is 20 + 20 = 40 , which makes option B correct. This is a standard STP calculation. HCIA-Datacom uses RPC as one of the main comparison parameters in root-port election on non-root switches. A lower RPC means a better path toward the root bridge. If multiple candidate ports have the same RPC, the switch then compares the sender’s bridge ID and port ID. This question checks whether the learner understands that RPC is cumulative across the spanning-tree forwarding path and is not simply the cost of a single directly connected link unless the switch is directly attached to the root bridge.

STelnet is Huawei ' s secure terminal service based on SSH and uses a client/server model. The device being remotely managed operates as the STelnet server, and the administrator ' s terminal acts as the client. A user who must modify device configuration also requires an adequate command privilege level; a level intended only for monitoring is insufficient. The false statement is A because the SSH/STelnet listening port cannot be set to literally any port number. Huawei VRP permits the default SSH server port 22 and, on common platforms and releases, configurable high-numbered ports within the documented allowed range. Port 1026 is a valid example of a non-default server port, but the wording " any port " is technically incorrect because reserved or disallowed values cannot be selected. Changing the listening port can reduce exposure to routine scans, but it does not remove the requirement for SSH authentication and access controls. Therefore the source answer A is valid when the complete wording of the option is considered.

The IEEE 802.11 channel plan for the 2.4 GHz ISM band defines channels numbered 1 through 14, with adjacent channel center frequencies separated by 5 MHz. Because a traditional 20 MHz Wi-Fi channel occupies substantially more spectrum than the 5 MHz center-frequency spacing, neighboring channels overlap. This is why WLAN planning normally uses a limited set of non-overlapping or minimally overlapping channels, such as 1, 6, and 11 in many regulatory domains. The fact that fourteen channel numbers exist in the standard does not mean that every country permits operation on every one of them. Regulatory domains restrict the usable subset; for example, channel 14 is not generally available worldwide and has historically been associated with specific Japanese operation. Huawei APs apply the configured regulatory domain to determine which channels may actually be selected. The statement concerns the standard channelization itself rather than regional permission to use every channel. On that basis, the statement is TRUE and option A is correct.

After STP convergence, only ports in the forwarding state participate in active traffic forwarding, while redundant ports may be placed into the blocking or discarding state to eliminate loops. According to the topology and STP role election shown in the question, the valid forwarding path from SW1 to SW4 is SW1 → SW3 → SW4, so option B is correct.

This means that the direct alternative path or the path through SW2 is not the active spanning-tree forwarding path after election and state transition. STP selects paths based on the root bridge, path cost, bridge ID, and port ID. Once the root bridge and port roles are determined, some links remain active and others are blocked to ensure a loop-free Layer 2 topology. HCIA-Datacom emphasizes that the resulting forwarding topology is a tree, not a mesh, even if the physical topology contains redundant links. Understanding the actual forwarding path after STP convergence is important for troubleshooting connectivity, predicting traffic behavior, and verifying whether bridge priority and path-cost settings have produced the intended design outcome in campus switching networks.

Before PC1 is moved, PC2 successfully communicates with it, so SW1 learns PC1 ' s MAC address on GE1/0/1. The dynamic MAC aging time is 300 seconds, and the cable move is performed immediately. Therefore, when PC2 sends the next frame to PC1, SW1 can still have the old destination MAC entry pointing to GE1/0/1. The question then states that GE1/0/1 is connected to another switch, so the port remains physically usable. SW1 follows the existing MAC table entry and forwards the frame out GE1/0/1 toward that new connection; it does not simply discard the frame. If PC1 subsequently transmits from GE1/0/2, SW1 can relearn the same source MAC on the new interface and update the entry, restoring correct forwarding. The core point is that dynamic MAC entries do not immediately disappear merely because the end station is physically moved when the original interface remains Up. Accordingly, the statement that SW1 discards the frame is FALSE, option B.

This statement is false . In classic STP, when a non-root switch detects a topology change, it does not continuously send configuration BPDUs upstream to notify the root bridge. Instead, it sends a Topology Change Notification (TCN) BPDU toward the root bridge through its root port. Each upstream switch acknowledges the TCN and forwards it further until it reaches the root bridge.

After the root bridge receives the topology change notification, the root bridge sets the Topology Change (TC) flag in its configuration BPDUs, and those configuration BPDUs are then propagated throughout the network. Therefore, topology-change notification and normal configuration BPDU transmission are different functions. The statement is wrong because it confuses TCN BPDUs with configuration BPDUs , and also inaccurately describes the notification behavior. HCIA-Datacom requires learners to distinguish between these BPDU types and understand how STP reacts to topology changes by accelerating MAC address aging and informing the network through the root bridge. This process helps the Layer 2 topology converge and reduces long-lasting forwarding inconsistencies after a link or port-state change.

The IPv6 basic header has a fixed length of 40 bytes and contains eight fields: Version, Traffic Class, Flow Label, Payload Length, Next Header, Hop Limit, Source Address, and Destination Address. The Source IPv6 Address is therefore part of the IPv6 header. Hop Limit is also present and serves a function comparable to the IPv4 TTL field by limiting how many Layer 3 forwarding hops a packet can traverse. Next Header identifies the type of extension header or upper-layer protocol that follows the IPv6 basic header. A source MAC address is not part of the IPv6 header. MAC addresses belong to the data-link-layer frame header, such as an Ethernet header, and are relevant only to the current Layer 2 segment. As an IPv6 packet is routed, Ethernet source and destination MAC addresses can change from hop to hop while the IPv6 source and destination addresses normally remain unchanged end to end. Therefore A, B, and C are IPv6 header fields, while D is not. The correct answer is A, B, and C.

PC1 and PC3 are members of VLAN 2, while PC2 and PC4 are members of VLAN 3. SW1 receives the frame from PC1 on access interface GE1/0/1 and associates it with VLAN 2. Because all switch MAC address tables are initially empty, PC3 ' s destination MAC address is unknown to SW1. The switch therefore floods this unknown unicast frame only through other interfaces that can carry VLAN 2. GE1/0/3 connects to PC3 in VLAN 2, so it is a valid flood port. GE1/0/4 is a trunk that permits VLAN 2 and VLAN 3, so it is also eligible to carry the VLAN 2 frame. SW1 does not send the frame back through GE1/0/1, the ingress interface, and it does not send it through GE1/0/2 because that access port belongs to VLAN 3. Therefore, the interfaces through which SW1 does not send the frame are GE1/0/2 and GE1/0/1, corresponding to A and D.

During modulation, the transmitter maps digital information onto certain physical characteristics of a carrier signal so that the information can be transmitted over the air. The three classic carrier parameters that can be modified are amplitude , frequency , and phase . Therefore, options A , B , and D are correct.

Amplitude modulation changes the strength of the carrier wave. Frequency modulation changes the oscillation rate of the carrier. Phase modulation changes the phase angle of the carrier relative to a reference. Modern wireless communication systems often combine these parameters, especially amplitude and phase, in complex digital modulation schemes such as QPSK, 16-QAM, 64-QAM, or higher-order QAM used in WLAN standards. Option C , channel, is not a carrier parameter modified during modulation. A channel refers to a frequency resource or spectrum allocation used for communication, not a physical waveform characteristic being directly altered to encode bits. HCIA-Datacom introduces these basic wireless concepts to help learners understand how WLAN signals are transmitted, how data rate improvements are achieved, and why different modulation methods have different requirements for signal quality and interference resistance.

Huawei ' s Wi-Fi 7 documentation describes several technologies introduced or enhanced relative to Wi-Fi 6 to increase throughput, spectrum efficiency, and reduce latency. 4096-QAM raises modulation density from the 1024-QAM maximum associated with Wi-Fi 6, allowing more bits to be carried per modulation symbol under suitable radio conditions. Multi-RU allows one user to be assigned multiple resource units, improving spectrum scheduling flexibility compared with the Wi-Fi 6 restriction of a user operating within its assigned RU. Multi-link operation allows a station to establish and use links across multiple bands or radios as a coordinated connection. Wi-Fi 7 also enhances MU-MIMO capabilities, increasing the ability to serve multiple users and exploit additional spatial resources. Huawei product documentation commonly lists 4096-QAM, multi-RU, MLO/multi-link, and enhanced MU-MIMO among Wi-Fi 7 improvements built on Wi-Fi 6. Therefore, each technology listed in the question contributes to Wi-Fi 7 performance improvement, and the verified selection is A, B, C, and D.

On a Huawei WAC, the VAP profile is the profile that brings together the service attributes required to instantiate a wireless service on an AP radio. The service VLAN is configured in this VAP profile using the service-vlan command. The VAP profile can also reference an SSID profile and a security profile and can define the data forwarding mode, allowing the wireless service to map associated STA traffic into the correct wired VLAN. The SSID profile primarily defines the WLAN name and related SSID behavior. The security profile defines authentication and encryption policies such as WPA/WPA2/WPA3 parameters. The regulatory domain profile controls radio regulatory settings such as country-specific channel and transmit-power constraints. None of those profiles is the location in which the service VLAN itself is defined. Huawei configuration examples explicitly show the administrator entering the VAP profile view and then applying service-vlan vlan-id or a VLAN pool. Therefore, the correct choice is C, VAP profile.

All four statements are correct. The code uses the Paramiko library to automate SSH login to a network device. import paramiko and import time load the Python modules required for SSH communication and delay control, so option C is correct. The statement ssh = paramiko.SSHClient() creates an SSH client object, and ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy()) allows the client to accept an unknown host key automatically in this example scenario.

The command ssh.connect( ' 192.168.1.254 ' , username= ' python ' , password= ' Huawei@123 ' ) establishes an SSH connection to the target device, so option B is correct. Then channel = ssh.invoke_shell() opens an interactive shell channel , which is commonly used to send CLI commands and receive output just as an administrator would in a terminal session, making option D correct. The command channel.send( ' screen-length 0 temporary\n ' ) disables page-by-page output for the current session, which is useful in network automation. Finally, ssh.close() closes the SSH session and releases the connection, so option A is correct. HCIA-Datacom automation knowledge often uses Paramiko examples to demonstrate basic Python-based device O & M.

ARP resolves an IPv4 address to a Layer 2 MAC address only within the local broadcast domain. When Host A determines, from its IP address and subnet mask, that Host B is on a different subnet, Host A does not broadcast an ARP request for Host B ' s MAC address. Instead, it forwards the packet to its default gateway. If the gateway ' s MAC address is not already cached, Host A broadcasts an ARP request for the gateway interface ' s IPv4 address. The gateway replies with its own MAC address, and Host A uses that MAC address as the Ethernet destination while retaining Host B ' s IP address as the IP destination. The router then forwards the packet toward Host B and may perform ARP on the destination subnet to learn Host B ' s MAC address. Therefore, the statement incorrectly describes cross-subnet forwarding as direct ARP resolution between the two hosts. The correct answer is FALSE, option B.

The destination address FF-FF-FF-FF-FF-FF is the Ethernet broadcast address. A switch floods a broadcast frame through the other eligible ports in the same VLAN, so both Host B and Host C can receive the frame. Option C, 53-80-C2-00-00-01, is a multicast MAC address because the individual/group bit, which is the least significant bit of the first octet, is 1. The first octet 0x53 has a binary least significant bit of 1, identifying a group address. Multicast frames may therefore be delivered to multiple receivers in the same Layer 2 domain, depending on multicast handling and membership behavior. By contrast, the first octets in options B and D, 0x98 and 0x34, have a least significant bit of 0 and are unicast addresses. A unicast frame is intended for a single MAC destination and is not normally delivered simultaneously to both hosts. Therefore A and C are the correct choices. This classification is fundamental when predicting whether a switched Ethernet frame is delivered to one station or replicated to multiple receivers simultaneously.

On Huawei switches, a physical Ethernet interface usually works as a Layer 2 switch port by default. A Layer 2 interface cannot be assigned an IP address directly. If an administrator wants to configure an IP address on such an interface, the interface must first be converted into a Layer 3 interface . The command used for this is undo portswitch , so option B is correct.

After this command is executed, the interface no longer behaves as a Layer 2 switching port and can then support Layer 3 features such as direct IP address configuration. Options A , C , and D are all Layer 2 port-type commands used to configure the interface as a trunk, access, or hybrid port. These commands do not solve the problem because they keep the interface operating at Layer 2. HCIA-Datacom emphasizes the difference between Layer 2 switching interfaces and Layer 3 routed interfaces on switches. Understanding when to use undo portswitch is important in campus network deployment, especially when configuring routed uplinks, management interfaces, or inter-device Layer 3 links on switches.

When a switch receives an untagged frame from a user host on an access interface , it associates that frame with the VLAN configured on the interface. In this scenario, PC1 and PC2 are in VLAN 10, and GE1/0/2 is an access interface in VLAN 10. After SW1 receives the frame from PC1, it internally associates the frame with VLAN 10 , so option A is correct in the practical VLAN-processing sense used in HCIA-Datacom questions.

When the frame is forwarded out an access interface toward PC2, the switch sends it without a VLAN tag , because end hosts normally do not process 802.1Q tags. Therefore, option D is correct. Option B is incorrect because both hosts are in the same VLAN and can communicate normally; SW1 does not discard the return traffic for that reason. Option C is not correct in the standard VLAN switching model used by Huawei training, because the switch performs forwarding based on VLAN membership and internally processes the frame as belonging to VLAN 10. This question mainly checks understanding of access/trunk behavior and tag handling on ingress and egress.

The authentication-mode radius local configuration defines an authentication sequence in which RADIUS is attempted first and local authentication is used as a fallback under the conditions defined by Huawei AAA processing. A critical distinction exists between a RADIUS service being unavailable and a RADIUS server explicitly rejecting the credentials. If the RADIUS server is unreachable, times out, or otherwise cannot perform the authentication service, local authentication may be used as the backup method. However, when the device successfully contacts the RADIUS server and receives an explicit authentication failure or Access-Reject response, that is a definitive authentication result rather than a server-unavailable condition. The device does not simply bypass the rejection and retry the same user against the local database, because doing so would undermine centralized authentication policy. The question explicitly states that R1 is properly connected to the RADIUS server and that the server sends an authentication failure message. Therefore, the claimed fallback to local authentication does not occur in this situation. The statement is FALSE and option B is correct.