Administrator:

– Defining a Security Group

– Defining a Policy Control Matrix

iMaster NCE-Campus:

– Delivering IP-Group Entries

– Delivering a Policy Control Matrix

In Huawei’s free mobility solution, responsibilities are clearly divided betweenadministratorsandiMaster NCE-Campusto achieve centralized control with automated policy delivery. Administrators are responsible forpolicy and security intent definition, while iMaster NCE-Campus handlesautomatic distribution and enforcement coordination.

Administrators firstdefine security groups, which represent logical user or terminal categories such as employees, guests, or IoT devices. These security groups form the basis of identity-based access control in the campus network. Administrators alsodefine the policy control matrix, which specifies communication permissions between different security groups, such as allow, deny, or redirect. This step represents business intent and security requirements and must be manually planned and configured.

Once these definitions are complete,iMaster NCE-Campus takes over the execution phase. It automaticallydelivers the policy control matrixto authentication points and policy enforcement points, translating high-level policies into device-level configurations. This ensures consistent policy enforcement across the entire campus network.

In addition, iMaster NCE-Campus automaticallydelivers IP-group entries, which bind user IP addresses to security groups. These entries are dynamically generated based on authentication results and are distributed to relevant devices so that traffic can be correctly identified and controlled as users move.

This division of labor aligns with HCIP Datacom Campus Network design principles, enabling simplified administration, reduced manual configuration, and truly seamless free mobility across the campus network.

In campus network architecture, theegress zoneplays a critical role as the boundary between the internal campus network and external networks such as the Internet, WAN, or cloud services. According to HCIP Datacom Campus Network design principles, the egress zone must meet multiple functional and security requirements to ensure stable, secure, and flexible network operation.

First,network connectivityis a fundamental requirement. The egress zone must reliably connect the campus intranet to external networks, ensuring uninterrupted access to external resources and services. High availability and redundancy are often considered in this aspect to avoid single points of failure.

Second,network secure ensuranceis essential. As the main security boundary, the egress zone must protect the campus network from external threats. This typically involves deploying security mechanisms such as firewalls, intrusion prevention, traffic filtering, and attack defense to ensure data and service security.

Third, the egress zone must provide strongservice control capability. This includes traffic identification, policy-based forwarding, bandwidth management, and application control. These capabilities allow administrators to optimize service quality, prioritize critical applications, and manage user access to external services.

Finally,various and flexible access modesare required to support different external connection scenarios, such as Internet access, MPLS WAN access, VPN connections, and cloud interconnection. This flexibility enables the campus network to adapt to evolving business and service requirements.

Therefore, all listed options are essential requirements for proper egress zone design, makingA, B, C, and Dthe correct answers.

Position 1 → Before authenticationBefore users are authenticated, they are placed in thepre-authentication domain. At this stage, access is strictly limited to basic network services such as theAdmission server,DHCP server, andDNS server. This allows users to obtain IP addresses and reach authentication-related services only.

Position 2 → Upon authentication failuresIf user authentication fails or security posture checks (such as antivirus or patch verification) do not pass, users are redirected to theisolation domain. In this domain, access is restricted to remediation resources likevirus signature database serversandpatch servers, preventing users from accessing business services while allowing problem resolution.

Position 3 → After successful authenticationAfter authentication succeeds, users enter thepost-authentication domain. At this stage, full or role-based access is granted to enterprise resources such asoffice data,R&D data,marketing systems, as well asintranet or Internet services, based on assigned policies.

This mapping reflects Huawei’s standardNAC domain-based access control model, ensuring secure, staged network access.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

CloudCampus virtualized campus networks support multiplefabric egress modesto connect VXLAN fabrics to external networks. These modes determine how traffic exits the fabric and whether egress resources are shared among multiple virtual networks.

Layer 3 shared egressallows multiple VNs to share the same Layer 3 egress interface, improving resource utilization and simplifying external connectivity.Layer 3 exclusive egressdedicates an independent Layer 3 interface to a specific VN, providing stronger isolation and higher security.

Layer 2 shared egressenables multiple VNs to access an external Layer 2 network through a shared interface. This mode is commonly used when the external network does not support Layer 3 integration.

Layer 2 exclusive egressis not supported in the CloudCampus solution because Layer 2 resources are typically designed to be shared to optimize scalability and simplify deployment.

Therefore, the correct answers are A, C, and D.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

Huawei iMaster NCE-Campus supports multiplelicense business modelsto meet different customer deployment and commercial requirements.

TheGlobal perpetual license (N1 mode)is a traditional licensing model where licenses are purchased once and permanently authorized. It is commonly used in on-premises controller deployments and is therefore a supported model, makingoption A correct.

TheTenant Subscription license (SaaS mode)is designed for cloud-based deployments, especially in MSP or enterprise scenarios using Huawei Cloud services. In this model, tenants subscribe to services on a periodic basis, aligning with the SaaS delivery approach. This is a valid and supported licensing model, makingoption B correct.

TheGlobal perpetual license (a-la-carte mode)allows customers to flexibly purchase specific functional modules according to their needs rather than buying a bundled license. This model is also supported by iMaster NCE-Campus and is widely used for customized deployments, makingoption C correct.

TheGlobal subscription license (IaaS mode)is not a defined licensing business model for iMaster NCE-Campus. IaaS refers to infrastructure-level cloud services rather than application-level controller licensing. Therefore,option D is incorrect.

Hence, the correct answers are A, B, and C.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In astatic VXLAN tunneldeployment, Huawei devices use anNVE (Network Virtualization Edge) interfaceas the logical tunnel interface for VXLAN encapsulation and decapsulation. The NVE interface represents the VTEP and does not have a one-to-one relationship with Bridge Domains (BDs) or VXLAN tunnels.

AnNVE interface can be associated with multiple VNIs, each corresponding to a different BD. Therefore, when multiple BDs exist on a VTEP,only one NVE interface is required, makingstatement B correctandstatement A incorrect.

In static VXLAN, thedestination VTEP addressesare specified usingingress replication listsunder each VNI. This allows a single NVE interface to establishmultiple VXLAN tunnelsto different remote VTEPs. As a result, there is no requirement to create a separate NVE interface for each tunnel, makingstatement D correctandstatement C incorrect.

According to HCIP Datacom Campus Network VXLAN configuration principles, the correct practice is to createone NVE interface per VTEP, associate multiple VNIs with it, and define remote peers through ingress replication. Therefore, the correct answers areB and D.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

In Huawei campus access authentication designs, network access is divided intopre-authentication,isolation, andpost-authenticationdomains to control user access at different stages of authentication.

Thepre-authentication domainprovides users with only the most basic network services required to initiate authentication. These services typically includeDHCPandDNS. DHCP allows unauthenticated terminals to obtain IP addresses and basic network parameters, while DNS enables domain name resolution so that users can reach authentication portals or admission servers. Therefore,DHCP and DNS servers are essential components of the pre-authentication domain, making optionsC and D correct.

AnFTP serveris a general-purpose file transfer service and is not required for user authentication. Anantivirus serverbelongs to theisolation domain, where users are redirected if authentication fails or if their devices do not meet security posture requirements, such as outdated virus signatures. These servers provide remediation resources but are not part of the pre-authentication process.

According to HCIP Datacom Campus Network documentation, limiting the pre-authentication domain to only essential services reduces security risks while ensuring successful user onboarding.

Comprehensive and Detailed 200 to 250 words of Explanation From HCIP Datacom Campus Network documents knowledge without any URL or Links:

NQA on Huawei devices is designed to actively measure network performance by simulating service traffic and monitoring protocol behavior. It supports commonconnectivity and routing-related protocolsto detect delay, jitter, packet loss, and reachability.

NQA supportsICMP, which is widely used to test network connectivity and latency, makingoption D correct. It also supportsrouting protocol detection, including OSPF, enabling administrators to monitor routing convergence and path availability, validatingoption A.

DHCP and SNMP are management and configuration protocols rather than traffic or routing performance protocols. NQA does not actively simulate or monitor DHCP address allocation behavior or SNMP management communication, makingoptions B and C incorrect.

Thus, NQA focuses on traffic forwarding and routing health rather than control-plane management protocols.

The command output shows an EVPNRoute Type 2 (MAC Advertisement Route), which is used in VXLAN BGP EVPN fabrics to advertise host reachability information. The route clearly carries both aMAC address(b0d5-9dc7-3c41/48) and ahost IP address(172.16.1.173/32). In HCIP Datacom Campus Network VXLAN design, when a Type 2 route includes both MAC and IP information, it is classified as anIRB (Integrated Routing and Bridging) Type 2 route, enabling distributed gateways to perform Layer 2 forwarding and Layer 3 routing based on the same control-plane information. Therefore, statement A is correct.

Statement B is incorrect because ARP-related learning is not represented as a separate “ARP Type 2” EVPN route. EVPN uses MAC/IP Advertisement routes to distribute host reachability, not ARP-only route types.

Statement C is correct. The route containsRoute Target extended communities RT 0:2 and RT 0:3, which control EVPN route import. Any VPN instance configured with an import RT of 0:2 or 0:3 can successfully import this route and learn the corresponding host MAC and IP information.

Statement D is also correct. The output explicitly showsRT extended communitiesand theEVPN Router’s MACextended community. These attributes are essential for VXLAN tunnel identification, split-horizon forwarding, and correct EVPN operation in a campus fabric.

Hence, the correct answers are A, C, and D.