H12-891_V1.0 Exam Dumps - Huawei HCIE-Datacom Questions and Answers

Comprehensive and Detailed In-Depth Explanation:

MACsec (Media Access Control Security)is a security protocol that provides securecommunication over Ethernet links. It operates at the MAC layer (Layer 2) and offers the following key security services:

Integrity Check (B):Ensures that data has not been tampered with during transmission.

User Data Encryption (C):Protects data confidentiality by encrypting the payload.

Data Source Authenticity Verification (D):Confirms that the data originates from a legitimate source by using security associations.

Controllability Check (A)is not a service provided by MACsec. The term "controllability" typically relates to network management and configuration control rather than data security. MACsec primarily focuses on protecting data integrity, confidentiality, and authenticity, rather than controlling network elements or configurations.

In OSPF:

AnNSSA (Not-So-Stubby Area)allowsexternal route injectionviaType 7 LSAs.

These Type 7 LSAs aregenerated by ASBRs inside the NSSA(R4 in this case) when external or direct routes are imported.

ABRs(such as R2) between the NSSA and backbonetranslate Type 7 LSAs into Type 5 LSAsfor flooding into other areas.

Clarification of options:

A: Incorrect — default route is not involved here; it's a specific route (10.1.4.4/32).

B: Correct — R2 translates Type 7 LSAs into Type 5.

C: Incorrect — default route is not being advertised.

D: Correct — R4 imports a direct route and generates Type 7 LSAs for it.

Correct answers: B, D

SSH Public Key Authentication

Inpublic key authentication mode, the SSH client must generate akey pair (public and private keys)before connecting to an SSH server.

✅C. ssh-keygen -t dsa (Correct Answer)

DSA (Digital Signature Algorithm) key generationfor SSH authentication.

Generates aprivate key (id_dsa)and apublic key (id_dsa.pub).

Understanding BFD (Bidirectional Forwarding Detection)

BFDis ahigh-speed fault detection protocolused to monitor link failures inmilliseconds.

It operates atLayer 2 (Data Link Layer) and Layer 3 (Network Layer)to providefast convergence.

Why Can BFD Detect Failures in Milliseconds?

Useslightweight control packetsthat are exchanged between routers.

Works withOSPF, IS-IS, BGP, and MPLSto trigger fast convergence.

Detection time = (Transmit Interval) × (Detect Multiplier)

Example: If the interval is3msand the multiplier is3, failure detection takes9ms.

Why is the Answer TRUE?

✅BFD achieves millisecond-level detectionby sending rapid probe packets.

✅Used in high-availability networkswhere link failures must be detected inreal-time.

Real-World Application

Service Provider Networks:BFD improves network resilience by detecting link failuresfaster than traditional routing timers.

Enterprise WANs:Used inSD-WANsto switch paths dynamically.

MPLS Fast Reroute (FRR):Works withMPLS Traffic Engineeringfor near-instantaneous failover.

✅Reference:Huawei HCIE-Datacom Guide – BFD for Fast Link Failure Detection

ForSRv6 (Segment Routing over IPv6)deployment on abearer WAN, the following are essential:

IGP (OSPFv3 or IS-IS): Required for SID advertisement and SRv6 route computation →✅

BGP: Required when deployinginter-domain SRv6or for control plane distribution of VPN/service routes →✅

Not required:

MPLS: SRv6 replaces MPLS labels withIPv6-based SIDs→❌

BGP-LU: Used inMPLS-based inter-AS scenarios,not applicableto SRv6 →❌

Correct answers: B, C