Huawei Updated H12-891_V1.0 Exam Questions and Answers by rumaysa

Understanding User Authentication Points in a Network

Authentication pointscan be deployed at different network layersbased on security and scalability needs:

✅Access Layer Authentication:

Ensureshigh security & granular control(user-level authentication).

Preferred inhigh-security enterprise networks.

✅Aggregation or Core Layer Authentication:

Reduces authentication overheadbutprovides less granular control.

Suitable forlarge-scale networkswhere authentication load needs to be balanced.

Analysis of the Answer Choices:

✅A. Deploying user authentication points at the access layer achieves granular permission management and high network security.

Correct:Providesfine-grained control per userand prevents unauthorized access.

✅B. Moving user authentication points from the access layer to the aggregation or core layer greatly reduces the number of user authentication points, thereby effectively mitigating the pressure on the AAA server.

Correct:Fewer authentication points meanless load on the AAA server.

✅C. Deploying user authentication points at the access layer has both advantages and disadvantages when compared to doing so at the aggregation or core layer. Policy association can be applied if user authentication points are deployed at the access layer.

Correct:Policy-based authentication isbest applied at the access layerforgranular control.

❌D. When user authentication points are moved from the access layer to the aggregation layer, MAC address authentication for users may fail.

Incorrect:MAC authentication worksat both layers, butpolicy adjustmentsmay be needed.

✅Reference:Huawei HCIE-Datacom Guide – User Authentication Strategies in Enterprise Networks

Dynamic VLAN Authorization in Huawei CloudCampus

Dynamic VLAN assignmentallows users to be placed into specific VLANsbased on authentication methods, ensuring security and network segmentation.

Correct Explanations:

✅A. Wired users using 802.1X authentication receive VLAN assignments dynamically.

After authentication,the access control system (e.g., iMaster NCE-Campus)assigns VLANs dynamically.

✅C. Wireless users using 802.1X authentication also receive VLAN assignments.

Similar to wired users,wireless 802.1X authentication allows dynamic VLAN assignmentvia the RADIUS server.

✅D. Wired users using MAC authentication can receive VLAN assignments.

If a userdoes not support 802.1X, MAC authentication can still be used to assign VLANs dynamically.

Incorrect Statement Explanation:

❌B. When wireless users pass Portal authentication, they join the authorization VLANs delivered to edge nodes.

Wrong!InPortal authentication, VLAN assignmentis not dynamically deliveredbecausePortal authentication typically applies access policies, not VLAN changes.

Dynamic VLAN assignment is mainly used with 802.1X or MAC authentication.

Reference from Huawei HCIE-Datacom Documentation:

Huawei CloudCampus Configuration Guide – Dynamic VLAN Assignment and Authentication

HCIE-Datacom Training Material – VLAN Authorization in Virtualized Campus Networks

In Huawei'sSRv6 instruction namingsystem, each letter keyword represents a specific forwarding behavior:

X (Cross): Forwards packets viaspecified Layer 3 interfaces→✅

M (MAC): SearchesLayer 2 forwarding tableforbroadcast/multicast,not unicast→❌

V (VPN): Searches theVPN routing table (VRF)for forwarding →✅

T (Table): Searches aspecific routing table (e.g., user-defined)→✅

Correct answers: A, C, D