Huawei H19-404_V1.0 - HCSE-Presales-Campus Network Planning and Design V1.0

APs support barcode scanning through the CloudCampus APP, DHCP Option 148–based deployment, and deployment through Huawei’s registration query center. With barcode scanning, the installer scans the AP’s label using the CloudCampus APP. The application obtains information such as the electronic serial number and MAC address, associates the AP with the correct tenant and site, and allows the AP to register with iMaster NCE.

With DHCP Option 148, the DHCP server supplies the AP with its IP configuration and the IP address and port number of iMaster NCE. The AP changes to cloud-management mode and automatically initiates registration. Huawei lists AR routers, switches, and APs as supported devices for this mode.

The registration query center can also provide the controller address after the AP contacts Huawei’s query service. It supports APs together with ARs, firewalls, and switches. Email-based deployment is primarily an SD-WAN CPE or AR-router ZTP method, not an AP deployment mode. Therefore, A, C, and D are correct.

==================

A-FEC, or Adaptive Forward Error Correction, is the correct technology. It protects delay-sensitive traffic by adding calculated redundant packets to the original packet stream. If some original packets are lost during WAN transmission, the receiving edge device can reconstruct them using the surviving original and redundant packets rather than waiting for end-to-end retransmission.

The key distinction between ordinary FEC and A-FEC is adaptation. With A-FEC, the receiving device reports real-time packet-loss and continuous-loss information to the transmitting device through FEC acknowledgement messages. The transmitting edge then dynamically increases or decreases the redundancy ratio according to actual network conditions. This provides stronger recovery during severe loss while avoiding unnecessary bandwidth overhead when link quality improves. Huawei describes this feedback-controlled adjustment as a mechanism that can alleviate or eliminate the impact of packet loss.

IFIT and IPCA are primarily measurement and service-quality analysis technologies; they do not reconstruct lost video packets. Fixed FEC does not adapt its redundancy level as effectively to changing loss conditions. Therefore, the technology intended for smooth video under packet loss of up to 20% is A-FEC.

==================

Huawei SD-WAN allows encryption to be controlled by virtual network and by specific device relationships. When encryption is enabled for a VN, the overlay data channels carrying that VN’s traffic use IPsec protection across the relevant WAN links. This provides consistent isolation and confidentiality for the department or service represented by that VN.

Encryption can also be enabled between selected devices or sites. In that case, secure data channels are established for traffic exchanged between those specified endpoints, while other device relationships can continue using GRE without IPsec according to their policies.

Application-specific encryption, as described in option C, is not the supported control granularity. Application identification can influence intelligent traffic steering, QoS, and security-policy selection, but it does not mean that only the payload of a selected application is independently encrypted inside an otherwise unencrypted SD-WAN tunnel.

A transport network is an underlay WAN such as MPLS or the Internet. Enabling encryption is an overlay tunnel policy rather than a mechanism that encrypts all traffic belonging to an entire TN. Huawei distinguishes TNs as underlay networks and GRE or IPsec VPNs as overlay data channels. Therefore, only A and B are correct.

The statement is true as a WLAN design recommendation. Inter-WAC roaming is supported, but it introduces more control-plane interaction and forwarding complexity than intra-WAC roaming. The Home WAC and Foreign WAC must belong to the same mobility group, synchronize station and AP information, and establish an inter-WAC CAPWAP tunnel for control information and, in some scenarios, service forwarding.

Additional synchronization, tunnel processing, route handling, and failure dependencies can increase roaming delay and complicate troubleshooting. This is especially relevant for delay-sensitive applications such as voice, video, automated guided vehicles, and real-time production systems. A better design places APs between which users frequently move under the same WAC wherever controller capacity and physical topology permit.

Avoiding inter-WAC roaming does not mean disabling the function entirely. Large campuses may require multiple WACs for scale, redundancy, or geographic distribution. Mobility groups should still be configured for unavoidable cross-controller movement. However, buildings, floors, and continuous roaming areas should be assigned carefully so that normal roaming remains intra-WAC. Therefore, the recommendation in the statement is correct, and the answer is True.

==================

All four options represent objectives of a next-generation advanced industrial network. IP-based connections establish a standardized communications foundation, allowing production systems, controllers, sensors, machines, and management platforms to communicate through scalable Ethernet and IP technologies instead of isolated proprietary field networks.

Networked devices extend connectivity across operational technology assets so that equipment status, production data, and control information can be shared across production lines, plants, data centers, and cloud platforms. Network intelligence introduces automated provisioning, telemetry, analytics, fault prediction, policy optimization, and closed-loop operations. These capabilities reduce manual configuration and improve production availability.

Network-security integration is equally essential because greater openness and interconnection increase the potential attack surface. Security must therefore be integrated into access control, segmentation, device identification, encrypted communication, anomaly detection, and policy enforcement rather than added as an isolated external system. Huawei’s broader CloudCampus architecture similarly emphasizes automated provisioning, intelligent O & M, secure interconnection, integrated wired and wireless management, and open network capabilities. The four objectives collectively create an open, connected, intelligent, and secure industrial communications architecture.

==================

Huawei SD-WAN supports full-mesh, hub-spoke, and partial-mesh interconnection models. In a full-mesh topology, every site can communicate directly with the other sites. This model minimizes intermediate forwarding and is appropriate when branches frequently exchange latency-sensitive traffic such as voice, video, or collaborative application data.

In a hub-spoke topology, branch sites communicate with a central headquarters or data-center hub. Branch-to-branch traffic normally traverses that hub. The model is simple, scalable, and suitable for enterprises whose applications and shared resources are concentrated at headquarters.

Partial-mesh is used when most sites can communicate directly but some sites lack direct underlay connectivity or do not require direct tunnels. Those sites can communicate through a redirect or intermediate site. Huawei describes full-mesh, hub-spoke, and partial-mesh as supported topology designs and explains the role of a redirect site in partial-mesh networking.

“Partial-spoke” is not a defined SD-WAN topology model. A spoke is a role within hub-spoke networking rather than an independent partial-spoke topology. Therefore, A, B, and D are correct.

==================

Hardware-based encryption is the unambiguously correct statement. MACsec protects Ethernet frames at Layer 2 using AES-GCM-based authenticated encryption. On enterprise switches and routers, the encryption and integrity operations are commonly implemented in forwarding ASICs or dedicated hardware so that frames can be protected at high throughput with low latency.

Option A is incorrect because complex manual configuration is not an inherent requirement. MACsec can use manually configured connectivity-association keys, but IEEE 802.1X MACsec Key Agreement can automate peer authentication, secure-channel establishment, key distribution, and rekeying. The operational complexity therefore depends on the deployment model and management platform.

Option C is also inaccurate. MACsec is media-independent, meaning it can operate over supported copper or fiber Ethernet; however, it does not eliminate the requirement for appropriate Layer 2 connectivity between participating MACsec entities. Standard hop-by-hop MACsec protects Ethernet links or LAN connectivity between peers and is not a general Layer 3 tunneling mechanism.

MACsec supplies Layer 2 confidentiality, integrity, origin authentication, and replay protection. Its encryption can be performed directly in network-device hardware, enabling substantially better forwarding performance than software-only encryption implementations.

Huawei switches’ unauthorized access prevention function can prevent users from connecting unauthorized hubs and sharing network access through unauthorized Wi-Fi hotspots. An unauthorized hub allows multiple terminals to enter the network through a port intended for a single managed endpoint. This can bypass normal terminal-count limitations, admission controls, and access-policy enforcement.

Unauthorized Wi-Fi hotspot sharing occurs when a user connects an authenticated endpoint to the enterprise network and then enables hotspot or connection-sharing functionality. Other terminals can subsequently access the network through that endpoint without completing the required authentication process. Huawei switches can analyze terminal behavior, MAC-address relationships, packet characteristics, and access patterns to identify and restrict this behavior.

A USB flash drive is a local storage device and does not provide Ethernet network access, so option A is unrelated to switch-based unauthorized network access prevention. An unauthorized router is normally controlled through device identification, NAC, port security, or explicit access policies rather than the specific hub and hotspot-sharing prevention function described by this question.

Huawei intelligent terminal management combines terminal identification, authorization, traffic analysis, and bogus-terminal detection to achieve visualized access and prevent unauthorized connectivity.

==================