View Full Huawei H12-821 Exam Dumps and Practice Test Dumps.

Question 81. What does AAA stand for in network access control?

1. Access, Addressing, and Accounting
2. Authentication, Access, and Addressing
3. Authentication, Authorization, and Accounting
4. Authorization, Allocation, and Authentication

Correct Answer: 3. Authentication, Authorization, and Accounting

Explanation:

AAA stands for Authentication, Authorization, and Accounting. Authentication determines whether a user’s identity is valid. Authorization determines which resources or services that authenticated user is allowed to access. Accounting records information about user activity, such as login time, logout time, service usage, or traffic statistics. Huawei devices can act as AAA clients and communicate with centralized RADIUS or HWTACACS servers. Centralized AAA helps organizations apply consistent identity and access policies across multiple routers, switches, wireless systems, and other access devices rather than configuring every user independently on each device.

Question 82. In a centralized AAA architecture, what is the role of the Network Access Server (NAS)?

1. It acts as the AAA client that receives the user’s access request and communicates with the AAA server
2. It functions only as the accounting database
3. It always generates user passwords locally
4. It replaces the authentication server

Correct Answer: 1. It acts as the AAA client that receives the user’s access request and communicates with the AAA server

Explanation:

In a centralized AAA architecture, a router, switch, wireless controller, or similar device can operate as the AAA client or Network Access Server. The user first attempts to access the network through this device. The NAS then sends the user’s authentication information to the configured AAA server and receives an authentication and authorization result. Based on that response, the NAS decides whether to permit the user’s network access. The AAA server remains responsible for centralized user information and authentication policy; the NAS is the enforcement point between the user and the protected network.

Question 83. Which statement BEST describes a key difference between RADIUS and HWTACACS?

1. RADIUS uses TCP while HWTACACS uses UDP
2. RADIUS does not support accounting
3. HWTACACS cannot perform authorization
4. HWTACACS uses TCP and separates authentication from authorization, while RADIUS commonly combines them**

Correct Answer: 4. HWTACACS uses TCP and separates authentication from authorization, while RADIUS commonly combines them

Explanation:

Huawei documents several differences between RADIUS and HWTACACS. HWTACACS uses TCP, giving it reliable transport, while RADIUS traditionally uses UDP. HWTACACS also separates authentication, authorization, and accounting more clearly. RADIUS combines authentication and authorization within its access process, which can make it less obvious whether a denial resulted from invalid credentials or insufficient authorization. Both protocols support centralized AAA and use client/server architectures, but HWTACACS is often attractive for device-administration scenarios where granular authorization and reliable transport are important.

Question 84. Why is HWTACACS often suitable for centralized administrator access to network devices?

1. It requires no authentication server
2. It provides separate authentication, authorization, and accounting functions with reliable TCP transport
3. It disables command authorization
4. It uses only local switch accounts

Correct Answer: 2. It provides separate authentication, authorization, and accounting functions with reliable TCP transport

Explanation:

HWTACACS is well suited to network-device administration because it separates authentication, authorization, and accounting and uses TCP for reliable communication. This allows an organization to authenticate a network administrator centrally and then apply detailed authorization rules governing what that administrator is allowed to do. Accounting records can also capture administrative activity. RADIUS is widely used and appropriate for many user-access scenarios, but HWTACACS’s separation of the AAA functions makes it particularly useful where fine-grained administrative authorization and accountability are required.

Question 85. What is the PRIMARY purpose of IEEE 802.1X?

1. To provide port-based network access control based on user or device authentication
2. To elect an STP root bridge
3. To advertise BGP routes
4. To perform MPLS label distribution

Correct Answer: 1. To provide port-based network access control based on user or device authentication

Explanation:

802.1X is a port-based network access control protocol. It controls whether a user or endpoint connected to a switch port is allowed to send normal service traffic. Before authentication succeeds, the controlled port remains unauthorized and regular service traffic is blocked. Authentication traffic, such as EAP over LAN, is still permitted through the uncontrolled logical port so the endpoint can complete the authentication process. 802.1X is widely used in enterprise wired and wireless networks where organizations need user-level access control before allowing endpoints onto the production network.

Question 86. Which protocol is used between an 802.1X client and the access device to carry EAP messages on the LAN?

1. BGP
2. LDP
3. EAPoL
4. VRRP

Correct Answer: 3. EAPoL

Explanation:

In an 802.1X environment, the endpoint and the access device exchange Extensible Authentication Protocol messages using EAP over LAN (EAPoL). This works directly at Layer 2, meaning the endpoint does not need an IP address before authentication can begin. The access device then communicates with the authentication server, commonly a RADIUS server, using either EAP relay or EAP termination behavior. This architecture lets the switch control whether the user-facing port becomes authorized for normal traffic based on the result returned by the authentication infrastructure.

Question 87. What happens to normal user service traffic on an 802.1X controlled port before authentication succeeds?

1. It is always forwarded normally
2. It is blocked while authentication traffic remains permitted
3. It is converted into multicast traffic
4. It is redirected to BGP

Correct Answer: 2. It is blocked while authentication traffic remains permitted

Explanation:

802.1X logically divides an access interface into a controlled and uncontrolled port. Before successful authentication, the controlled port remains unauthorized, so normal service packets from the client are not permitted. The uncontrolled port remains available for EAPoL authentication traffic so the endpoint can authenticate. After the authentication server returns a successful result, the access device changes the controlled port to the authorized state and permits normal traffic. This design prevents unauthenticated endpoints from using the production network while still giving them enough connectivity to complete authentication.

Question 88. Which access authentication method is generally more appropriate than 802.1X for public environments with highly diverse users and terminals that may not have 802.1X client software?

1. IS-IS authentication
2. BGP authentication
3. MPLS authentication
4. Portal authentication

Correct Answer: 4. Portal authentication

Explanation:

Huawei notes that 802.1X is especially suitable for enterprise networks with strong security requirements and managed endpoints. Public environments such as airports or business centers often contain many different terminal types and users who do not have dedicated 802.1X client software installed. In such environments, Portal authentication can be more practical because users can authenticate through a web-based process. Dumb terminals that cannot enter usernames and passwords, such as printers, may instead use MAC address authentication. Selecting the right access method depends on endpoint capabilities, user mobility, and security requirements.

Question 89. What is the PRIMARY purpose of IKE in an IPsec VPN?

1. To carry user payload traffic directly
2. To assign VLAN tags
3. To negotiate Security Associations and manage cryptographic keys
4. To elect the VRRP master

Correct Answer: 3. To negotiate Security Associations and manage cryptographic keys

Explanation:

Internet Key Exchange (IKE) is used to negotiate Security Associations and establish the cryptographic parameters required for IPsec communication. It handles functions such as identity authentication, key generation, and negotiation of encryption and integrity algorithms. Huawei documents IKE as a UDP-based protocol, with UDP port 500 normally used for negotiation. IPsec data protection is then provided by AH or ESP according to the negotiated settings. Separating key management from data protection allows IPsec peers to establish and refresh secure cryptographic state dynamically rather than manually configuring every session key.

Question 90. Which IPsec protocol can provide encryption in addition to integrity and source authentication?

1. ESP
2. AH
3. VRRP
4. GRE only

Correct Answer: 1. ESP

Explanation:

Encapsulating Security Payload (ESP) can provide confidentiality through encryption and can also provide authentication and integrity protection. Authentication Header (AH) provides authentication and integrity protection but does not encrypt the payload. This makes ESP the more common choice when data confidentiality is required. Huawei documents ESP as adding its own header and trailer around protected packet content and notes that AH and ESP can be used independently or together. The exact combination depends on the security requirements and negotiated IPsec configuration.

Question 91. Which statement about IPsec AH is correct?

1. AH encrypts the entire IP payload
2. AH provides source authentication and integrity but does not provide encryption
3. AH uses TCP port 443
4. AH replaces IKE

Correct Answer: 4. AH provides source authentication and integrity but does not provide encryption

Explanation:

Authentication Header (AH) protects packet integrity and verifies the authenticity of the packet source, but it does not provide confidentiality because it does not encrypt the payload. Huawei also notes that AH checks packet integrity more broadly than ESP transport mode, including IP header fields that are appropriate for integrity protection. If encryption is required, ESP is typically used. AH and ESP are IP-layer protocols rather than TCP or UDP services, and IKE remains responsible for negotiating Security Associations and cryptographic keys.

Question 92. Which UDP port is normally used by IKE for initial IPsec negotiation?

1. UDP 53
2. UDP 500
3. UDP 179
4. UDP 520

Correct Answer: 2. UDP 500

Explanation:

Huawei documents UDP port 500 as the standard port used for IKE negotiation. When two IPsec peers establish a VPN, their initial IKE exchanges use this port to negotiate authentication, cryptographic algorithms, and Security Associations. If an intermediate security device blocks UDP 500, the IPsec tunnel may fail before protected data traffic can begin. In NAT traversal scenarios, UDP 4500 is additionally important. AH and ESP themselves do not use TCP or UDP ports because they are IP protocols with protocol numbers 51 and 50 respectively.

Question 93. Which port must normally be allowed for IPsec NAT Traversal?

1. UDP 4500
2. TCP 179
3. UDP 67
4. TCP 22

Correct Answer: 1. UDP 4500

Explanation:

When IPsec traffic must traverse a NAT device, NAT Traversal (NAT-T) typically encapsulates the protected traffic in UDP using port 4500. Huawei documents that security policies must allow UDP 4500 in NAT traversal scenarios. This allows IPsec to work through devices that translate IP addresses and ports, which can otherwise interfere with normal IPsec packet handling. Initial IKE negotiation still commonly uses UDP 500 before peers detect NAT and switch to NAT-T operation. Administrators troubleshooting IPsec through a NAT boundary should therefore verify both UDP 500 and UDP 4500 reachability.

Question 94. In VRRP, which router normally becomes Master when participating devices have different priorities?

1. The router with the lowest priority
2. The router with the lowest IP address
3. The router with the highest priority
4. The router that booted first regardless of priority

Correct Answer: 4. The router with the highest priority

Explanation:

VRRP elects a Master based primarily on priority, with the higher priority preferred. The Master assumes forwarding responsibility for the virtual router and periodically sends VRRP Advertisement packets to the Backup routers. If the Master fails, the remaining backups elect a new Master, again using priority. Huawei also documents a special case for the IP address owner, which has priority 255 and immediately becomes Master when appropriate. Predictable VRRP operation therefore depends on intentional priority configuration rather than simply accepting default values on all devices.

Question 95. What does a VRRP Backup router normally do while the Master is operating correctly?

1. It forwards all traffic for the virtual IP simultaneously with the Master
2. It remains in Backup state and monitors VRRP Advertisement packets from the Master
3. It sends BGP updates on behalf of the Master
4. It disables its interface

Correct Answer: 2. It remains in Backup state and monitors VRRP Advertisement packets from the Master

Explanation:

A VRRP Backup does not normally perform the forwarding duties of the virtual router while the Master is healthy. Instead, it listens for periodic VRRP Advertisement packets from the Master to determine whether the Master continues to operate. If the Master stops advertising and failure is detected, eligible backup routers perform an election and one becomes the new Master. This active/backup behavior provides gateway redundancy to hosts that continue using the same virtual IP address as their default gateway.

Question 96. What is the effect of VRRP preemption when a recovered Backup has a higher priority than the current Master?

1. The higher-priority Backup may take over the Master role according to the configured preemption behavior
2. Priorities are ignored permanently
3. Both devices become Master simultaneously
4. VRRP is automatically disabled

Correct Answer: 3. The higher-priority Backup may take over the Master role according to the configured preemption behavior

Explanation:

Huawei documents that when a Backup device has a higher priority than the current Master, whether it takes over depends on whether preemption is enabled. In preemption mode, the higher-priority router can reclaim or assume the Master role, possibly after a configured delay. In non-preemption mode, the current Master can continue forwarding even though another device has a higher priority. This gives administrators control over whether the preferred gateway should automatically resume Master status after recovery or whether unnecessary role changes should be avoided.

Question 97. Why would a VRRP group track the status of the current Master’s uplink interface?

1. To change the VLAN ID automatically
2. To reduce the Master’s VRRP priority if its upstream path fails, allowing a healthier Backup to become Master
3. To generate IPsec keys
4. To disable gratuitous ARP

Correct Answer: 2. To reduce the Master’s VRRP priority if its upstream path fails, allowing a healthier Backup to become Master

Explanation:

A router can remain operational on its LAN-facing interface even when its upstream link has failed. Without tracking, that router could remain VRRP Master and continue receiving host traffic that it can no longer forward successfully. Huawei supports association between VRRP and an uplink interface or route. When the tracked object fails, the Master’s effective priority can be reduced. If that priority becomes lower than a Backup’s priority, the Backup becomes Master and forwards traffic through its healthy upstream path. This improves gateway reliability beyond simple device-failure detection.

Question 98. What is the purpose of the gratuitous ARP sent by a newly elected VRRP Master after a switchover?

1. To refresh connected devices’ MAC information so traffic for the virtual gateway is directed to the new Master
2. To authenticate users with RADIUS
3. To establish an IPsec SA
4. To advertise an OSPF external route

Correct Answer: 4. To refresh connected devices’ MAC information so traffic for the virtual gateway is directed to the new Master

Explanation:

After a VRRP master/backup switchover, the new Master sends gratuitous ARP containing the virtual IP and virtual MAC information. Connected switches and hosts can then update their MAC or ARP-related forwarding information so packets destined for the virtual gateway reach the new Master quickly. This helps make the failover transparent to users because their configured default gateway address does not change. The gratuitous ARP supports rapid traffic redirection following the VRRP role change and is unrelated to user authentication or IPsec negotiation.

Question 99. Which authentication method is MOST appropriate for a network-connected printer that cannot run an 802.1X client or prompt a user for credentials?

1. BGP MD5 authentication
2. Portal authentication
3. MAC address authentication
4. IPsec certificate authentication

Correct Answer: 3. MAC address authentication

Explanation:

Huawei notes that some dumb terminals, such as printers and fax machines, cannot install 802.1X client software or accept a username and password from an interactive user. For these devices, MAC address authentication can be more appropriate. The access device uses the terminal’s MAC address as part of the identity process and consults the authentication infrastructure according to the configured policy. This is not generally as strong as certificate-based 802.1X for managed endpoints, so organizations should apply suitable authorization and network segmentation to such devices.

Question 100. An enterprise wants centralized administrator AAA, authenticated employee access at the switch edge, secure encrypted site-to-site connectivity, and redundant default gateways that react to uplink failures. Which design BEST meets the requirement?

1. Use local passwords on every switch, no access authentication, GRE only, and a single gateway
2. Use RADIUS only for every requirement
3. Use HWTACACS or RADIUS for centralized AAA, 802.1X for employee edge authentication, IPsec/IKE for encrypted site connectivity, and VRRP with uplink tracking for gateway redundancy
4. Use only STP and DHCP

Correct Answer: 1. Use HWTACACS or RADIUS for centralized AAA, 802.1X for employee edge authentication, IPsec/IKE for encrypted site connectivity, and VRRP with uplink tracking for gateway redundancy

Explanation:

The scenario requires several different technologies. HWTACACS or RADIUS can centralize authentication, authorization, and accounting for administrators and network users. 802.1X provides port-based access authentication for managed enterprise endpoints. IPsec protects site-to-site traffic using IKE-negotiated Security Associations and ESP or AH security services. VRRP provides a stable virtual default gateway, while uplink or route tracking helps trigger failover when the current Master loses upstream reachability even though the device itself remains online. Combining specialized technologies according to their intended functions provides stronger security and availability than relying on one protocol for unrelated requirements.