Free Access to Huawei.H12-891_V1.0.v2026-06-05.q295 with Valid Practice Test (Page 55)

Question 266

With an existing network running OSPF, what types of LSAs cause ISPF operations?

A.3 ?LSA
B.5 ?LSA
C.4 ?LSA
D.2 ?LSA
E.1 ?LSA

Question 267

This figure shows an SRv6 (Segment Routing over IPv6) packet. If the Destination Address field in the IPv6 basic header is FC04::4, the value of the SL (Segment Left) field in the SRv6 header should be ____. (Enter only digits.)

Question 268

The Huawei SD-WAN solution has three types of channels. Drag the channel names to their corresponding callouts.

Question 269

To allow only authorized users (users who obtain IP addresses through authorized DHCP servers or use specified static IP addresses) to access the network shown in the figure, which of the following solutions can be used?

A.DAI + Port Security
B.DHCP Snooping + IPSG
C.DHCP Snooping + DAI
D.DAI + IPSG

Correct Answer: B

Understanding Network Security for Authorized User Access
# Problem Scenario:
Only authorized users should be allowed network access.
Users can obtain IP addresses either via DHCP or a predefined static IP list.
Unauthorized users (e.g., attackers using rogue DHCP servers or spoofed IPs) must be blocked.
# Required Technologies for Securing Access:
1##DHCP Snooping- Protects againstrogue DHCP serversand builds abinding table of legitimate DHCP clients.
2##IP Source Guard (IPSG)- Ensures that onlyauthorized IP-MAC bindingscan send traffic.
Analysis of the Answer Choices:
#A. DAI + Port Security (Incorrect)
DAI (Dynamic ARP Inspection)prevents ARP spoofingbut doesnot validate IP-MAC-DHCP bindings.
Port Securityonlylimits MAC addresses per portbut doesnot verify IP addresses.
Does NOT protect against unauthorized static IP users.
#B. DHCP Snooping + IPSG (Correct)
DHCP Snooping:
Preventsrogue DHCP servers from assigning unauthorized IPs.
Builds aDHCP binding table(IP-MAC-Port).
IP Source Guard (IPSG):
Blocks trafficfrom IPs not listed in the DHCP snooping binding table.
Can be configured to allow manually specified static IP addresses.
Best choice to allow only authorized users (both DHCP and static IP users).
#C. DHCP Snooping + DAI (Incorrect)
DAI (Dynamic ARP Inspection) prevents ARP spoofingbutdoes not block unauthorized static IP users.
Lacks IP-level access controlneeded to enforce static IP policies.
#D. DAI + IPSG (Incorrect)
IPSG (IP Source Guard) needs DHCP Snooping to build the binding table.
Without DHCP Snooping, IPSG cannot function properly.
DAI does not provide complete protection against unauthorized users.
Why is the Answer B (DHCP Snooping + IPSG)?
#Ensures only users assigned a DHCP IP (or authorized static IPs) can send traffic.
#Blocks rogue DHCP servers and unauthorized static IP users.
Real-World Application:
Enterprise Networks:Prevents unauthorizedstatic IP users or attackers from accessing VLANs.
Public Wi-Fi Security:Ensures onlyauthorized users receive IPs and can send traffic.
#Reference:Huawei HCIE-Datacom Guide - DHCP Snooping and IPSG Security Mechanisms

Question 270

What is wrong with the following statement about digital certificates?

A.Digital certificates contain public key information.
B.Even if two PRI entities are not in the same CA system, authentication can be completed as long as both parties can recognize each other's CA.
C.Authentication fails when the peer certificate is received within the validity period, but the device itself is in the wrong time if it is not within the validity period of the certificate.
D.Digital signatures guarantee the integrity of digital certificates.

Question 266

Question 267

Question 268

Question 269

Question 270

Download PDF File