View Full Huawei H12-821 Exam Dumps and Practice Test Dumps.

Question 161. What is the PRIMARY purpose of enabling authentication for OSPF packets between neighboring routers?

1. To increase the OSPF interface cost automatically
2. To encrypt all user data forwarded by OSPF routers
3. To help prevent unauthorized devices from successfully exchanging trusted OSPF routing information
4. To convert OSPF into a path-vector protocol

Correct Answer: 3. To help prevent unauthorized devices from successfully exchanging trusted OSPF routing information

Explanation:

OSPF authentication helps protect the routing domain by requiring participating devices to use matching authentication parameters before routing information is accepted as trusted. Without authentication, an unauthorized device that gains access to the routing segment could potentially attempt to inject false OSPF information. Huawei supports multiple OSPF authentication mechanisms, including simple authentication, MD5, HMAC-MD5, HMAC-SHA256, and keychain-based authentication on supported platforms. Huawei recommends stronger mechanisms such as HMAC-SHA256 rather than weaker MD5-based options. Authentication protects routing-protocol exchanges; it does not encrypt ordinary user traffic passing through the router.

Question 162. Which OSPF authentication algorithm does Huawei recommend over MD5 and HMAC-MD5 where supported?

1. HMAC-SHA256
2. DES
3. CRC32
4. PAP

Correct Answer: 1. HMAC-SHA256

Explanation:

Huawei recommends HMAC-SHA256 for OSPF packet authentication because it provides stronger security than legacy MD5 and HMAC-MD5 options. OSPF authentication helps ensure that routing packets are accepted only when the participating devices use compatible authentication settings and credentials. MD5-based algorithms are considered weak by modern security standards and may require explicit enabling of weak-algorithm support on some Huawei software versions. For new deployments, administrators should therefore prefer supported stronger cryptographic authentication rather than deploying legacy algorithms merely for compatibility.

Question 163. If OSPF authentication is configured both at the area level and directly on an interface, which configuration normally takes precedence on Huawei devices?

1. The area authentication always overrides the interface
2. Both configurations are ignored
3. The configuration with the lowest key ID
4. The interface authentication configuration

Correct Answer: 4. The interface authentication configuration

Explanation:

Huawei documentation states that when authentication is configured both for an OSPF area and for a specific interface, the interface-level authentication configuration takes precedence. Area authentication provides a convenient way to apply common settings across interfaces participating in an area, while interface authentication allows more specific control where necessary. This behavior is important during troubleshooting because administrators may inspect the area configuration and incorrectly assume it is the active authentication policy. The actual interface-level configuration must also be checked whenever an OSPF neighbor fails to establish because of authentication mismatches.

Question 164. Two directly connected OSPF routers use HMAC-SHA256 authentication, but their authentication keys do not match. What is the expected result?

1. They automatically fall back to no authentication
2. The OSPF neighbor relationship fails to establish normally
3. OSPF changes the area to a stub area
4. The routers establish a BGP session instead

Correct Answer: 2. The OSPF neighbor relationship fails to establish normally

Explanation:

OSPF neighbors using cryptographic authentication must have compatible authentication settings, including the appropriate authentication mode, key identifier, and secret. Huawei explicitly states that interfaces on the same network segment need consistent authentication configuration. If one side uses a different key or incompatible authentication method, packets fail authentication and the routers cannot form a normal OSPF adjacency. This is a common troubleshooting scenario after key changes. Administrators should verify that both endpoints were updated consistently and that interface-level configuration is not overriding expected area authentication settings.

Question 165. In IS-IS, what does area authentication primarily protect?

1. BGP Update packets
2. Ethernet data frames
3. Only DHCP messages
4. Level-1 LSPs and SNPs within the IS-IS area

Correct Answer: 4. Level-1 LSPs and SNPs within the IS-IS area

Explanation:

Huawei IS-IS area authentication is applied to Level-1 routing information. It authenticates Level-1 Link State PDUs and Sequence Number PDUs using the configured authentication method and password. This helps prevent unauthorized or modified Level-1 link-state information from being accepted into the routing domain. Huawei recommends enabling IS-IS authentication and using stronger algorithms such as HMAC-SHA256 where supported. Area authentication is different from IS-IS domain authentication, which applies to Level-2 LSPs and SNPs.

Question 166. Which IS-IS authentication mechanism is used to authenticate Level-2 LSPs and SNPs across the routing domain?

1. Domain authentication
2. OSPF area authentication
3. DHCP snooping
4. VRRP authentication only

Correct Answer: 1. Domain authentication

Explanation:

IS-IS domain authentication protects Level-2 link-state information. Huawei’s domain-authentication-mode functionality allows Level-2 and Level-1-2 routers to authenticate received Level-2 LSPs and SNPs and to add authentication information to outgoing Level-2 packets. Packets that fail authentication can be rejected, helping protect the Level-2 backbone from unauthorized routing updates. By comparison, IS-IS area authentication is associated with Level-1 LSPs and SNPs. Huawei recommends HMAC-SHA256 rather than weak MD5 algorithms where the platform supports it.

Question 167. What does interface-level IS-IS authentication primarily authenticate on a broadcast or point-to-point interface?

1. BGP OPEN messages
2. OSPF LSAs
3. IS-IS Hello packets
4. SNMP traps

Correct Answer: 3. IS-IS Hello packets

Explanation:

Huawei supports IS-IS interface authentication for both broadcast and point-to-point interfaces. This mechanism authenticates the IS-IS Hello packets exchanged on the link. Hello packets are fundamental to IS-IS neighbor discovery and adjacency formation, so protecting them helps prevent unauthorized devices from participating normally in the local IS-IS relationship. This function is distinct from area and domain authentication, which focus primarily on LSPs and SNPs at Level 1 and Level 2 respectively. Huawei recommends HMAC-SHA256 for stronger authentication where supported.

Question 168. Why is cryptographic authentication valuable in a link-state routing protocol such as IS-IS?

1. It increases interface bandwidth
2. It helps prevent unauthorized or altered routing information from being accepted
3. It automatically creates backup routes
4. It replaces SPF calculations

Correct Answer: 2. It helps prevent unauthorized or altered routing information from being accepted

Explanation:

Link-state routing depends on routers trusting topology information exchanged by other devices. If an attacker successfully injects false link-state information, traffic may be redirected, black-holed, or sent through unintended paths. Authentication helps establish trust by requiring routing packets to contain valid authentication data before they are accepted. Huawei specifically recommends IS-IS authentication to improve routing security and prevent route information from being modified by unauthorized users. Authentication does not replace SPF, routing metrics, or redundancy; it protects the integrity and legitimacy of the protocol exchanges on which those functions depend.

Question 169. What is the PRIMARY purpose of configuring a password between two BGP peers?

1. To authenticate the TCP connection used by the BGP peers and reduce the risk of unauthorized session establishment
2. To encrypt every packet forwarded by the routers
3. To change the peer’s AS number dynamically
4. To create an MPLS VPN automatically

Correct Answer: 1. To authenticate the TCP connection used for the BGP peers and reduce the risk of unauthorized session establishment

Explanation:

BGP uses TCP for peer communication. Huawei supports configuring authentication parameters for the TCP relationship used by BGP peers. This makes it more difficult for an unauthorized system to establish a valid BGP session by impersonating a configured peer. Huawei documentation for BGP MD5 authentication explains that the authentication occurs at the TCP connection level; if authentication fails, the TCP connection required by BGP is not successfully established. Such authentication strengthens session security but does not encrypt ordinary user traffic passing through the router.

Question 170. Two BGP routers are configured as peers and have IP connectivity, but they use different configured BGP authentication passwords. What is the likely result?

1. The routers exchange routes but mark them invalid
2. The routers automatically negotiate a shared password
3. BGP changes from TCP to UDP
4. The required authenticated TCP connection does not establish successfully**

Correct Answer: 4. The required authenticated TCP connection does not establish successfully

Explanation:

BGP relies on TCP to establish the transport session over which OPEN, UPDATE, KEEPALIVE, and NOTIFICATION messages are exchanged. When TCP authentication is configured for the BGP peer relationship, both endpoints must use compatible credentials. Huawei documentation states that if authentication fails, the TCP connection is not established. Therefore, a password mismatch can prevent the BGP session from progressing even though basic IP reachability between the peer addresses works correctly. Troubleshooting should include checking peer addresses, AS configuration, TCP reachability, and matching authentication credentials.

Question 171. Why should an administrator avoid storing BGP authentication secrets in clear text when a ciphertext option is available?

1. Cleartext storage improves routing convergence
2. Cleartext passwords are easier for unauthorized users to obtain from configuration data
3. Ciphertext passwords disable BGP
4. Cleartext passwords are required for EBGP

Correct Answer: 2. Cleartext passwords are easier for unauthorized users to obtain from configuration data

Explanation:

A password stored in readable form inside device configuration creates unnecessary exposure. Anyone who gains permission to view or copy the configuration may be able to recover the secret directly. Huawei therefore recommends using ciphertext storage when configuring authentication passwords where that option is available. This principle applies broadly to routing-protocol and management credentials. Ciphertext storage does not make a weak algorithm inherently strong, but it reduces the risk of straightforward credential disclosure from configuration files, backups, or administrative output.

Question 172. What is the PRIMARY security function of IPv6 ND snooping on an access network?

1. To create BGP routes
2. To translate IPv6 addresses to IPv4
3. To monitor Neighbor Discovery behavior and help prevent unauthorized IPv6 control messages such as rogue Router Advertisements
4. To replace IPv6 routing

Correct Answer: 3. To monitor Neighbor Discovery behavior and help prevent unauthorized IPv6 control messages such as rogue Router Advertisements

Explanation:

IPv6 Neighbor Discovery carries critical local-link information, including Router Advertisements that can tell hosts which routers and prefixes to use. An attacker sending rogue RAs could attempt to redirect hosts through an unauthorized gateway. Huawei ND snooping distinguishes trusted and untrusted interfaces. Interfaces connected to trusted IPv6 infrastructure can be configured as trusted, while RAs arriving from untrusted interfaces can be discarded. ND snooping can also create prefix-management information from legitimate RA packets, giving administrators better control over IPv6 access-layer behavior.

Question 173. By default, how does Huawei ND snooping classify interfaces before trust is explicitly configured?

1. Every interface is trusted
2. Only trunk interfaces are trusted
3. Only routed interfaces are trusted
4. Interfaces are untrusted by default**

Correct Answer: 4. Interfaces are untrusted by default

Explanation:

Huawei documentation states that ND snooping interfaces are untrusted by default. Administrators explicitly configure interfaces connected to trusted IPv6 nodes, such as legitimate router infrastructure, as trusted. This secure-default behavior helps prevent Router Advertisements and other sensitive ND behavior arriving through ordinary user-facing ports from being accepted automatically. Correct trust placement is essential: an uplink toward an authorized router may need to be trusted, while endpoint-facing ports normally remain untrusted. Incorrectly trusting user access ports can weaken protection against rogue IPv6 control messages.

Question 174. What happens to Router Advertisement packets received on an untrusted ND snooping interface according to Huawei’s described behavior?

1. They are discarded to help prevent RA attacks
2. They are automatically converted into DHCPv6 messages
3. They are always flooded to every VLAN
4. They are used to establish OSPFv3 neighbors

Correct Answer: 1. They are discarded to help prevent RA attacks

Explanation:

Huawei ND snooping treats Router Advertisements from untrusted interfaces as potentially dangerous because a rogue RA can cause hosts to select an unauthorized router or accept malicious IPv6 prefix information. Huawei therefore documents that RA packets received through untrusted ND snooping interfaces are discarded. Trusted interfaces should be configured only toward legitimate IPv6 infrastructure from which RA messages are expected. This protection is particularly important on enterprise access switches because endpoint-facing ports should not normally be sources of authoritative router advertisements.

Question 175. Which SNMP version provides standardized support for both authentication and encryption of management traffic?

1. SNMPv1 only
2. SNMPv3
3. SNMPv2c only
4. RMON1

Correct Answer: 2. SNMPv3

Explanation:

SNMPv3 adds significant security capabilities compared with SNMPv1 and SNMPv2c. Huawei supports SNMPv3 modes that can authenticate packets and also provide privacy through encryption. Authentication helps verify message integrity and validity, while privacy protects management data against disclosure. SNMPv1 and SNMPv2c are primarily based on community strings and do not provide the same standardized user-based authentication and encryption capabilities. For security-sensitive network management, SNMPv3 should therefore generally be preferred when all participating systems support it.

Question 176. In SNMPv3, what does the privacy function provide?

1. Only device discovery
2. Routing-table synchronization
3. Authentication plus encryption to protect SNMP packet data
4. OSPF authentication

Correct Answer: 3. Authentication plus encryption to protect SNMP packet data

Explanation:

Huawei describes the SNMPv3 privacy option as providing authentication together with encryption. Authentication validates the integrity and legitimacy of SNMP packets, while encryption protects management information from being read if network traffic is intercepted. This is especially important because network-management communications may contain sensitive device information and administrative data. Huawei platforms support several encryption methods depending on software and hardware capabilities, with stronger AES-based methods preferred over older DES-based encryption where supported.

Question 177. Why is SNMPv3 generally preferable to SNMPv2c for managing security-sensitive network devices?

1. It supports stronger user-based authentication and encrypted management communication
2. It automatically configures every device
3. It replaces SSH
4. It eliminates the need for access control

Correct Answer: 1. It supports stronger user-based authentication and encrypted management communication

Explanation:

SNMPv2c uses community strings, which provide comparatively limited security. SNMPv3 adds a user-based security model with authentication and privacy capabilities, allowing management messages to be validated and encrypted. This significantly reduces the risks of credential exposure, message tampering, and passive interception. Huawei documentation distinguishes SNMPv3 authentication mode from privacy mode, with privacy adding encryption in addition to authentication. SNMPv3 does not replace sound access-control policies, management-plane filtering, or secure administrative protocols, but it provides a much stronger SNMP security foundation.

Question 178. Which transport protocol is used by NETCONF on Huawei devices in the documented secure management setup?

1. Telnet only
2. TFTP
3. HTTP without encryption only
4. SSH**

Correct Answer: 4. SSH

Explanation:

Huawei documentation states that NETCONF requires SSH as its transport-layer protocol in the documented device-management setup. SSH provides an authenticated and encrypted channel over which NETCONF operations can be performed. Before NETCONF management is used, administrators configure appropriate SSH server parameters, keys, and user authentication. NETCONF itself provides structured network-configuration and management operations, while SSH protects the transport session carrying those operations. This is preferable to unencrypted remote-management mechanisms because configuration commands and management credentials may otherwise be exposed to interception.

Question 179. Why is NETCONF well suited to network automation compared with manually entering CLI commands on every device?

1. NETCONF disables configuration validation
2. NETCONF works only for monitoring
3. NETCONF provides a structured programmatic interface that automation systems can use to retrieve and modify configuration data
4. NETCONF eliminates the need for device authentication

Correct Answer: 3. NETCONF provides a structured programmatic interface that automation systems can use to retrieve and modify configuration data

Explanation:

NETCONF is designed for structured, machine-driven network management. Automation platforms can use it to retrieve configuration or operational data and make controlled configuration changes without depending entirely on screen-oriented CLI interaction. On Huawei equipment, NETCONF can operate over SSH, combining structured management with secure transport. This makes NETCONF useful in environments where large numbers of devices need consistent automated configuration. Authentication and authorization remain essential because a programmatic management interface can make large-scale changes very quickly if an automation account is misconfigured or compromised.

Question 180. An enterprise wants stronger routing-protocol security, protection against rogue IPv6 Router Advertisements, encrypted network monitoring, and secure automated device configuration. Which design BEST satisfies the requirement?

1. Use unauthenticated OSPF and IS-IS, SNMPv2c, and Telnet
2. Use strong OSPF/IS-IS authentication, ND snooping with trusted infrastructure interfaces, SNMPv3 with privacy, and NETCONF over SSH
3. Disable IPv6 security and use static passwords everywhere
4. Use only ACLs and no management protocols

Correct Answer: 2. Use strong OSPF/IS-IS authentication, ND snooping with trusted infrastructure interfaces, SNMPv3 with privacy, and NETCONF over SSH

Explanation:

Each requirement is addressed by a dedicated security control. Strong OSPF and IS-IS authentication helps prevent unauthorized routing information from being accepted. ND snooping allows trusted IPv6 router-facing interfaces to be distinguished from untrusted endpoint interfaces and can block rogue Router Advertisements. SNMPv3 privacy provides authenticated and encrypted network-management traffic. NETCONF over SSH provides a secure programmatic configuration channel for automation systems. Together, these controls protect the routing plane, IPv6 access layer, monitoring plane, and configuration-management plane instead of relying on one mechanism to secure all network functions.