H13-811_V3.5 HCIA-Cloud Service V3.5 Question and Answers

Option C cannot be the cause because the password used to log in to the ECS operating system has no requirement to match the database credential used by an RDS instance. ECS authentication and RDS database authentication are separate security domains. An application running on an ECS connects to RDS using the database endpoint, port, database username, and corresponding database password.

Option A can cause the failure. Huawei's RDS troubleshooting guidance requires appropriate security-group rules so that traffic to the database port is permitted.

Option B can also prevent communication. Huawei Cloud states that when an ECS and RDS DB instance are deployed in different VPCs, network connectivity must be established—for example through an appropriate VPC peering connection —or the resources must be placed in a mutually reachable network.

Option D can likewise cause connection failure. Huawei's official RDS troubleshooting process specifically instructs administrators to validate the connection address and port configuration and test connectivity to the RDS listening port. Examples include port 3306 for RDS for MySQL and 5432 for PostgreSQL.

The ECS's own login password is unrelated to these connectivity requirements; therefore C is correct.

Reference topics: RDS Database Connectivity; ECS-to-RDS Communication; Security Groups; VPC Peering; Database Ports.

===============

KooSearch is the Huawei Cloud service specifically designed to provide enterprise-grade search capabilities with an out-of-the-box service model. Huawei Cloud describes KooSearch as a one-stop intelligent enterprise search solution built on Cloud Search Service (CSS). It enables organizations to construct enterprise search, knowledge retrieval, AI search, and document Q & A applications without having to independently build the underlying search infrastructure. The service integrates enterprise knowledge sources, search models, vector search capabilities, and other components required for enterprise information retrieval.

This directly corresponds to the question's description of an out-of-the-box search service designed for enterprise digitalization . Huawei's current KooSearch documentation explicitly emphasizes its ready-to-use enterprise search and RAG capabilities. KooPhone is associated with cloud-phone capabilities, KooMessage concerns enterprise messaging and communication, and KooMap provides map-related services; none is the dedicated enterprise search offering.

Therefore, KooSearch is the only technically valid choice . This aligns with the HCIA-Cloud Service domain covering Huawei Cloud platform and other value-added cloud services.

Reference topics: KooSearch Service Overview; Cloud Search Service; Huawei Cloud PaaS/aPaaS Services.

===============

Option A is not a main WAF function . Huawei Cloud Web Application Firewall is an application-layer web protection service . It analyzes HTTP and HTTPS traffic and protects websites against threats such as SQL injection, cross-site scripting, command injection, malicious bots, scanners, CC attacks, and other web exploits.

Huawei explicitly lists information leakage prevention , web tamper protection , and anti-crawler protection among WAF's protection functions. Information leakage prevention can mask or block sensitive information such as ID numbers, phone numbers, and email addresses. Web tamper protection prevents unauthorized modification of protected static website pages. Anti-crawler protection identifies and mitigates malicious automated crawler behavior.

Brute-force attacks against ECS operating-system or application accounts , however, fall primarily under Host Security Service (HSS) . Huawei documents HSS detection and blocking capabilities for brute-force attacks involving services such as SSH, RDP, MySQL, SQL Server, and FTP.

WAF can mitigate certain web-based authentication abuse using web rules and rate controls, but generic ECS account brute-force protection is not the WAF function described here.

Therefore, the required answer is A .

Reference topics: Web Application Firewall; Information Leakage Prevention; Web Tamper Protection; Anti-Crawler; Host Security Service.

===============

The statement is FALSE because directly binding an EIP to an ECS is only one of several Huawei Cloud mechanisms for providing Internet access. An ECS with its own EIP can communicate directly with the public network, but ECSs can also access the Internet without having an EIP individually bound to each server .

The principal alternative is a public NAT Gateway using an SNAT rule . Huawei Cloud states that servers in a VPC subnet can share an EIP through a public NAT gateway. The NAT gateway translates their private source addresses into the configured public EIP, enabling outbound Internet connectivity while avoiding the need to expose or allocate an individual public IP address to every ECS.

Huawei's ECS documentation also explicitly describes “Internet connectivity for an ECS without an EIP bound” and recommends NAT Gateway as the standard solution. A proxy/SNAT ECS can also provide an Internet access path in suitable architectures.

Therefore, binding an EIP directly to the ECS is a valid method, but it is not the only method , making the statement false.

Reference topics: Elastic IP; Public NAT Gateway; SNAT; ECS Internet Connectivity; VPC Networking.

Statements B and C are false . Huawei Cloud distinguishes alarm-based, scheduled, and periodic Auto Scaling policies. An alarm policy triggers a scaling operation in response to monitored metrics such as CPU utilization. Scaling “every three hours” is time-interval behavior and therefore belongs to a periodic policy , not an alarm policy. This makes B incorrect.

Statement C is also incorrect. The expected number of instances is the desired number of ECS instances that should currently run within an AS group. Huawei specifies that this value must remain between the configured minimum and maximum instance counts. It can be modified manually or changed through scheduled, periodic, or alarm-based policies. It is not synonymous with the minimum instance count during peak hours.

Statement A is valid because an AS configuration can use a Huawei Cloud public image; Huawei's AS configuration parameters explicitly support public, private, and shared images.

Statement D is also valid. Huawei specifies that when an existing ECS is manually added to an AS group, the ECS must not already be a member of another AS group .

Consequently, the two false statements are B and C .

Reference topics: Auto Scaling Configurations; AS Policies; Expected Instances; AS Groups.

===============

Statements B and D are correct. Huawei Cloud CBR architecture consists fundamentally of backups, vaults, and policies. A vault is the storage container used by CBR for backup data. Huawei documentation explicitly states that CBR stores backups in vaults and that different resource categories are associated with appropriate vault types, such as server backup vaults and disk backup vaults.

Statement B is also directly supported. Huawei categorizes CBR policies into backup policies and replication policies. A backup policy automatically runs backup operations according to configured schedules and retention parameters, while a replication policy periodically replicates eligible backup data to another vault or region.

Statement A is incorrect because CBR is specifically designed to automate protection through policies; regular backups do not normally need to depend on repeated manual execution. Huawei advises using backup policies for scheduled protection.

Statement C is too absolute. CBR substantially improves recoverability against accidental deletion, malware, software failures, and hardware faults, but no backup architecture legitimately guarantees that data can never be lost under every conceivable condition.

Therefore, B and D are the verified statements.

Reference topics: CBR Architecture; Vault Management; Backup Policies; Replication Policies.

===============

The correct mechanisms are security groups and network ACLs . A security group contains inbound and outbound access-control rules governing traffic to and from ECS instances associated with the group. Inbound rules regulate traffic entering an ECS, while outbound rules regulate traffic leaving it. Security groups therefore provide the instance-oriented access-control layer within a Huawei Cloud VPC.

Network ACLs operate at the subnet level . A network ACL is associated with one or more subnets and controls traffic entering and leaving those subnets. In the HCIA V3.5 networking architecture, network ACLs complement security groups and provide an additional layer of network protection. Huawei's VPC documentation explicitly presents security groups and network ACLs as complementary controls for comprehensive access management.

IPsec VPN does not serve this role. Its purpose is to establish encrypted network connectivity—for example, between VPCs or between Huawei Cloud and an external network. Fingerprint authentication is likewise not a VPC packet-filtering mechanism.

Therefore, only A and D directly provide inbound/outbound traffic-control functionality for ECS workloads.

Reference topics: VPC Access Control; Security Groups; Network ACLs; ECS Network Security.

===============

Option A is the only sequence that respects the essential dependency chain for Huawei Cloud Log Tank Service host-log collection. A log group must exist before its log stream can be created , because a log stream is a subordinate storage and management unit within a log group. Huawei explicitly describes log groups and streams as the basic units used to manage logs and requires creation of the group before creation of its contained stream.

ICAgent is the host-side log collection component. It must be installed on the ECS before LTS can collect host log files according to configured paths and rules. After ICAgent is operational and the destination log stream exists, the administrator configures the relevant collection paths, parsing/collection rules, and ingestion configuration. ICAgent then packages and reports matching log records into the selected log stream.

Only after ingestion has been configured can the administrator reliably access LTS and view the collected logs for searching, analysis, monitoring, troubleshooting, or O & M.

The other alternatives violate basic dependencies by attempting to create a stream before its parent group, configuring collection before the required destination/agent exists, or installing ICAgent after collection configuration.

Reference topics: Log Tank Service; Log Groups; Log Streams; ICAgent; ECS Log Collection.

===============

The statement is false . Huawei Cloud ECS supports multiple billing models, and cost optimization is not exclusive to pay-per-use billing. The principal modes include yearly/monthly, pay-per-use, and spot pricing , with each optimized for different workload characteristics.

Pay-per-use is useful for workloads with uncertain or fluctuating demand because resources are billed according to actual usage and can be released when no longer required. However, yearly/monthly billing can provide a lower effective price for stable, long-running workloads because Huawei Cloud applies subscription discounts; the longer the committed subscription period, the greater the potential discount. Therefore, for predictable production workloads running continuously, yearly/monthly billing can be substantially more economical than pay-per-use.

Spot pricing is another cost-saving mechanism. Spot instances use market-based pricing and can provide compute resources at a lower price where workload interruption characteristics permit their use. Consequently, several ECS billing models can reduce expenditure when aligned to an appropriate workload.

The incorrect portion of the statement is therefore the assertion that only pay-per-use can reduce costs .

Reference topics: Elastic Cloud Server; ECS Billing Modes; Yearly/Monthly; Pay-per-Use; Spot Pricing.

===============

The correct advantages are B, C, and D. Huawei Cloud EVS provides a range of disk specifications and performance classes so customers can select storage appropriate for different workloads and budgets. Huawei's EVS overview explicitly lists various disk types and high security/reliability among its principal benefits.

EVS is also easier to manage than traditional physical storage. Huawei documentation comparing EVS with traditional hard disks states that EVS disks provide higher reliability and I/O throughput and are easier to use. Cloud-based provisioning eliminates much of the physical installation, replacement, cabling, and capacity-management work associated with conventional disks.

Option A is incorrect. EVS is block storage intended for cloud servers and cannot be used independently. Huawei explicitly states that EVS disks must first be attached to a supported server and then initialized, partitioned, and formatted before applications can persist data on them.

High reliability derives from distributed storage and data-protection mechanisms, while the range of available disk classes enables workload-specific performance selection.

Therefore, various disk types, ease of use, and high reliability are advantages; independent use is not.

Reference topics: EVS Advantages; Block Storage; EVS Reliability; EVS Disk Types.

===============

Statements B and C are correct . Huawei Cloud Eye supports batch creation of monitoring alarms. Huawei's documented quota specifically states that up to 50 monitored objects can be selected when creating an alarm rule and that up to 1,000 alarm rules can be created at one time . Huawei even provides the exact example used here: 50 monitored objects multiplied by 20 metrics produces 1,000 alarm rules. Therefore, B is directly supported.

Statement C is also valid. Cloud Eye alarm rules can provide monitoring triggers used with Auto Scaling. An alarm-based AS policy references a Cloud Eye alarm rule; when monitored metrics meet the configured threshold condition, the corresponding scaling action can be initiated.

Statement A is false because Cloud Eye server monitoring is not limited to OS-level resource metrics. With the Agent installed, Huawei Cloud Eye also provides process monitoring , including process CPU usage, memory usage, opened files, and customized process-monitoring tasks.

Statement D is false because alarm templates and batch alarm creation eliminate the requirement to create every alarm rule individually.

Reference topics: Cloud Eye Server Monitoring; Process Monitoring; Alarm Rules; Alarm Templates; Auto Scaling Integration.

===============

Options B, C, and D identify problems that CDN architecture is designed to mitigate. Huawei defines CDN as an intelligent virtual network built on Internet infrastructure that caches origin content on geographically distributed points of presence close to users. This substantially shortens the network path between users and frequently requested resources.

Consequently, CDN improves download speed because users can retrieve cached files from a nearby edge PoP rather than repeatedly crossing long-distance networks to the origin server. It also addresses slow website access by accelerating static content delivery, reducing latency, and improving site response and availability. Huawei specifically states that CDN breaks through bottlenecks associated with limited bandwidth, high access traffic, and uneven network-node distribution.

Caching popular content at edge nodes also reduces repeated traffic flowing through core and backbone networks. This alleviates bandwidth pressure on both the origin infrastructure and long-distance network paths.

Option A is not a CDN problem statement. CDN commonly reduces origin-server load , meaning utilization of origin resources may decrease rather than fixing a problem described as “low server utilization.” Its purpose is acceleration and traffic offloading, not increasing server utilization.

Therefore, B, C, and D are correct.

Reference topics: Content Delivery Network; Edge Caching; Website Acceleration; Download Acceleration; Origin Traffic Reduction.

===============

For the HCIA-Cloud Service V3.5 curriculum version , statements A, B, and C are correct . An ECS must be associated with a security group so that inbound and outbound network access can be controlled. If an account has no custom group, Huawei Cloud provides a default security group, and users can either use that default group or create and select another security group that matches the workload's security requirements.

The V3.5-era Huawei Cloud VPC documentation distinguishes security groups from network ACLs by stating that security groups provide allow rules , whereas network ACLs provide both allow and deny rules. This distinction is important because it appears repeatedly in the HCIA V3.5 networking curriculum.

Statement D is false. Huawei Cloud specifically permits administrators to modify existing rules or add rules to the default security group . The default group itself cannot normally be deleted, but that restriction does not make its inbound or outbound rules immutable. Huawei's default-security-group documentation explicitly distinguishes group deletion restrictions from rule modification permissions.

Reference topics: VPC Security Groups; ECS Network Configuration; Default Security Group; Security Group Rules.

===============

Option A specifically describes Huawei Cloud's dynamic resource adjustment mode . In Huawei Auto Scaling, dynamic scaling uses an alarm policy that evaluates real-time monitoring metrics such as CPU utilization. When the configured alarm condition is reached, AS automatically performs a scaling action to increase or decrease resources so that capacity follows unpredictable workload changes.

Option B is incorrect because triggering an AS policy does not automatically redefine the configured maximum number of instances . The maximum is an upper boundary for the AS group. A scaling policy changes the expected number of instances, adds or removes instances, or sets the instance count to a configured value while remaining within the minimum and maximum boundaries.

Option C correctly describes planned scaling , but the question specifically asks about dynamic resource scaling. Huawei classifies scheduled and periodic policies as planned adjustment mechanisms suitable for workloads that change predictably according to a schedule.

Option D is incorrect because alarm-triggered scaling is subject to a cooldown period . During that period, Huawei Cloud rejects additional scaling requests generated by alarm policies to prevent repeated unnecessary scaling operations.

Therefore, for dynamic resource scaling, A is the correct answer .

Reference topics: Auto Scaling; Dynamic Resource Adjustment; Alarm Policies; Planned Scaling; Cooldown Period.

The statement is TRUE because Huawei Cloud NAT Gateway includes both public NAT Gateway and private NAT Gateway functionality. These two service types cover the two network-translation scenarios described.

A public NAT Gateway performs translation between a private VPC network and the Internet. Through SNAT, servers with private IP addresses can share Elastic IP addresses to access public networks. Through DNAT, internal servers can provide externally accessible services using public addresses.

A private NAT Gateway performs address translation between private networks. Huawei Cloud describes private NAT gateways as enabling servers in a VPC to communicate with on-premises data centers or other VPCs while translating private addresses to transit IP addresses. This is particularly valuable during network migration, address-overlap resolution, and hybrid-cloud integration.

Huawei's official NAT Gateway comparison therefore states that a public NAT Gateway connects a private network to the Internet, whereas a private NAT Gateway connects private networks.

The statement deliberately describes the NAT Gateway service family rather than only public NAT. Since Huawei Cloud provides translation in both private-to-private and private-to-public architectures, the proposition is correct.

Reference topics: NAT Gateway; Public NAT Gateway; Private NAT Gateway; SNAT; DNAT.

===============