{"id":21111,"date":"2026-09-24T10:51:33","date_gmt":"2026-09-24T10:51:33","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=21111"},"modified":"2026-09-24T10:51:33","modified_gmt":"2026-09-24T10:51:33","slug":"huawei-h12-821-practice-test-questions-and-exam-dumps-part9-q161-180","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/huawei-h12-821-practice-test-questions-and-exam-dumps-part9-q161-180\/","title":{"rendered":"Huawei H12-821 Practice Test Questions and Exam Dumps Part9 Q161-180"},"content":{"rendered":"<p><b>View Full <\/b><a href=\"https:\/\/www.examlabs.com\/h12-821-exam-dumps\"><b>Huawei H12-821 Exam Dumps<\/b><\/a><b> and Practice Test Dumps.<\/b><\/p>\n<p><b><br \/>\n<\/b><b>Question 161. What is the PRIMARY purpose of enabling authentication for OSPF packets between neighboring routers?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> To increase the OSPF interface cost automatically<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> To encrypt all user data forwarded by OSPF routers<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> To help prevent unauthorized devices from successfully exchanging trusted OSPF routing information<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> To convert OSPF into a path-vector protocol<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 3. To help prevent unauthorized devices from successfully exchanging trusted OSPF routing information<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">OSPF authentication helps protect the routing domain by requiring participating devices to use matching authentication parameters before routing information is accepted as trusted. Without authentication, an unauthorized device that gains access to the routing segment could potentially attempt to inject false OSPF information. Huawei supports multiple OSPF authentication mechanisms, including simple authentication, MD5, HMAC-MD5, HMAC-SHA256, and keychain-based authentication on supported platforms. Huawei recommends stronger mechanisms such as HMAC-SHA256 rather than weaker MD5-based options. Authentication protects routing-protocol exchanges; it does not encrypt ordinary user traffic passing through the router.<\/span><\/p>\n<p><b>Question 162. Which OSPF authentication algorithm does Huawei recommend over MD5 and HMAC-MD5 where supported?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> HMAC-SHA256<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> DES<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> CRC32<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> PAP<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 1. HMAC-SHA256<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Huawei recommends HMAC-SHA256 for OSPF packet authentication because it provides stronger security than legacy MD5 and HMAC-MD5 options. OSPF authentication helps ensure that routing packets are accepted only when the participating devices use compatible authentication settings and credentials. MD5-based algorithms are considered weak by modern security standards and may require explicit enabling of weak-algorithm support on some Huawei software versions. For new deployments, administrators should therefore prefer supported stronger cryptographic authentication rather than deploying legacy algorithms merely for compatibility.<\/span><\/p>\n<p><b>Question 163. If OSPF authentication is configured both at the area level and directly on an interface, which configuration normally takes precedence on Huawei devices?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> The area authentication always overrides the interface<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Both configurations are ignored<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> The configuration with the lowest key ID<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> The interface authentication configuration<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 4. The interface authentication configuration<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Huawei documentation states that when authentication is configured both for an OSPF area and for a specific interface, the interface-level authentication configuration takes precedence. Area authentication provides a convenient way to apply common settings across interfaces participating in an area, while interface authentication allows more specific control where necessary. This behavior is important during troubleshooting because administrators may inspect the area configuration and incorrectly assume it is the active authentication policy. The actual interface-level configuration must also be checked whenever an OSPF neighbor fails to establish because of authentication mismatches.<\/span><\/p>\n<p><b>Question 164. Two directly connected OSPF routers use HMAC-SHA256 authentication, but their authentication keys do not match. What is the expected result?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> They automatically fall back to no authentication<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> The OSPF neighbor relationship fails to establish normally<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> OSPF changes the area to a stub area<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> The routers establish a BGP session instead<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 2. The OSPF neighbor relationship fails to establish normally<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">OSPF neighbors using cryptographic authentication must have compatible authentication settings, including the appropriate authentication mode, key identifier, and secret. Huawei explicitly states that interfaces on the same network segment need consistent authentication configuration. If one side uses a different key or incompatible authentication method, packets fail authentication and the routers cannot form a normal OSPF adjacency. This is a common troubleshooting scenario after key changes. Administrators should verify that both endpoints were updated consistently and that interface-level configuration is not overriding expected area authentication settings.<\/span><\/p>\n<p><b>Question 165. In IS-IS, what does area authentication primarily protect?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> BGP Update packets<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Ethernet data frames<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Only DHCP messages<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Level-1 LSPs and SNPs within the IS-IS area<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 4. Level-1 LSPs and SNPs within the IS-IS area<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Huawei IS-IS area authentication is applied to Level-1 routing information. It authenticates Level-1 Link State PDUs and Sequence Number PDUs using the configured authentication method and password. This helps prevent unauthorized or modified Level-1 link-state information from being accepted into the routing domain. Huawei recommends enabling IS-IS authentication and using stronger algorithms such as HMAC-SHA256 where supported. Area authentication is different from IS-IS domain authentication, which applies to Level-2 LSPs and SNPs.<\/span><\/p>\n<p><b>Question 166. Which IS-IS authentication mechanism is used to authenticate Level-2 LSPs and SNPs across the routing domain?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Domain authentication<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> OSPF area authentication<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> DHCP snooping<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> VRRP authentication only<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 1. Domain authentication<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">IS-IS domain authentication protects Level-2 link-state information. Huawei&#8217;s <\/span><span style=\"font-weight: 400;\">domain-authentication-mode<\/span><span style=\"font-weight: 400;\"> functionality allows Level-2 and Level-1-2 routers to authenticate received Level-2 LSPs and SNPs and to add authentication information to outgoing Level-2 packets. Packets that fail authentication can be rejected, helping protect the Level-2 backbone from unauthorized routing updates. By comparison, IS-IS area authentication is associated with Level-1 LSPs and SNPs. Huawei recommends HMAC-SHA256 rather than weak MD5 algorithms where the platform supports it.<\/span><\/p>\n<p><b>Question 167. What does interface-level IS-IS authentication primarily authenticate on a broadcast or point-to-point interface?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> BGP OPEN messages<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> OSPF LSAs<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> IS-IS Hello packets<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> SNMP traps<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 3. IS-IS Hello packets<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Huawei supports IS-IS interface authentication for both broadcast and point-to-point interfaces. This mechanism authenticates the IS-IS Hello packets exchanged on the link. Hello packets are fundamental to IS-IS neighbor discovery and adjacency formation, so protecting them helps prevent unauthorized devices from participating normally in the local IS-IS relationship. This function is distinct from area and domain authentication, which focus primarily on LSPs and SNPs at Level 1 and Level 2 respectively. Huawei recommends HMAC-SHA256 for stronger authentication where supported.<\/span><\/p>\n<p><b>Question 168. Why is cryptographic authentication valuable in a link-state routing protocol such as IS-IS?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> It increases interface bandwidth<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> It helps prevent unauthorized or altered routing information from being accepted<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> It automatically creates backup routes<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> It replaces SPF calculations<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 2. It helps prevent unauthorized or altered routing information from being accepted<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Link-state routing depends on routers trusting topology information exchanged by other devices. If an attacker successfully injects false link-state information, traffic may be redirected, black-holed, or sent through unintended paths. Authentication helps establish trust by requiring routing packets to contain valid authentication data before they are accepted. Huawei specifically recommends IS-IS authentication to improve routing security and prevent route information from being modified by unauthorized users. Authentication does not replace SPF, routing metrics, or redundancy; it protects the integrity and legitimacy of the protocol exchanges on which those functions depend.<\/span><\/p>\n<p><b>Question 169. What is the PRIMARY purpose of configuring a password between two BGP peers?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> To authenticate the TCP connection used by the BGP peers and reduce the risk of unauthorized session establishment<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> To encrypt every packet forwarded by the routers<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> To change the peer&#8217;s AS number dynamically<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> To create an MPLS VPN automatically<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 1. To authenticate the TCP connection used for the BGP peers and reduce the risk of unauthorized session establishment<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">BGP uses TCP for peer communication. Huawei supports configuring authentication parameters for the TCP relationship used by BGP peers. This makes it more difficult for an unauthorized system to establish a valid BGP session by impersonating a configured peer. Huawei documentation for BGP MD5 authentication explains that the authentication occurs at the TCP connection level; if authentication fails, the TCP connection required by BGP is not successfully established. Such authentication strengthens session security but does not encrypt ordinary user traffic passing through the router.<\/span><\/p>\n<p><b>Question 170. Two BGP routers are configured as peers and have IP connectivity, but they use different configured BGP authentication passwords. What is the likely result?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> The routers exchange routes but mark them invalid<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> The routers automatically negotiate a shared password<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> BGP changes from TCP to UDP<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> The required authenticated TCP connection does not establish successfully**<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 4. The required authenticated TCP connection does not establish successfully<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">BGP relies on TCP to establish the transport session over which OPEN, UPDATE, KEEPALIVE, and NOTIFICATION messages are exchanged. When TCP authentication is configured for the BGP peer relationship, both endpoints must use compatible credentials. Huawei documentation states that if authentication fails, the TCP connection is not established. Therefore, a password mismatch can prevent the BGP session from progressing even though basic IP reachability between the peer addresses works correctly. Troubleshooting should include checking peer addresses, AS configuration, TCP reachability, and matching authentication credentials.<\/span><\/p>\n<p><b>Question 171. Why should an administrator avoid storing BGP authentication secrets in clear text when a ciphertext option is available?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Cleartext storage improves routing convergence<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Cleartext passwords are easier for unauthorized users to obtain from configuration data<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Ciphertext passwords disable BGP<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Cleartext passwords are required for EBGP<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 2. Cleartext passwords are easier for unauthorized users to obtain from configuration data<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">A password stored in readable form inside device configuration creates unnecessary exposure. Anyone who gains permission to view or copy the configuration may be able to recover the secret directly. Huawei therefore recommends using ciphertext storage when configuring authentication passwords where that option is available. This principle applies broadly to routing-protocol and management credentials. Ciphertext storage does not make a weak algorithm inherently strong, but it reduces the risk of straightforward credential disclosure from configuration files, backups, or administrative output.<\/span><\/p>\n<p><b>Question 172. What is the PRIMARY security function of IPv6 ND snooping on an access network?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> To create BGP routes<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> To translate IPv6 addresses to IPv4<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> To monitor Neighbor Discovery behavior and help prevent unauthorized IPv6 control messages such as rogue Router Advertisements<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> To replace IPv6 routing<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 3. To monitor Neighbor Discovery behavior and help prevent unauthorized IPv6 control messages such as rogue Router Advertisements<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">IPv6 Neighbor Discovery carries critical local-link information, including Router Advertisements that can tell hosts which routers and prefixes to use. An attacker sending rogue RAs could attempt to redirect hosts through an unauthorized gateway. Huawei ND snooping distinguishes trusted and untrusted interfaces. Interfaces connected to trusted IPv6 infrastructure can be configured as trusted, while RAs arriving from untrusted interfaces can be discarded. ND snooping can also create prefix-management information from legitimate RA packets, giving administrators better control over IPv6 access-layer behavior.<\/span><\/p>\n<p><b>Question 173. By default, how does Huawei ND snooping classify interfaces before trust is explicitly configured?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Every interface is trusted<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Only trunk interfaces are trusted<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Only routed interfaces are trusted<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Interfaces are untrusted by default**<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 4. Interfaces are untrusted by default<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Huawei documentation states that ND snooping interfaces are untrusted by default. Administrators explicitly configure interfaces connected to trusted IPv6 nodes, such as legitimate router infrastructure, as trusted. This secure-default behavior helps prevent Router Advertisements and other sensitive ND behavior arriving through ordinary user-facing ports from being accepted automatically. Correct trust placement is essential: an uplink toward an authorized router may need to be trusted, while endpoint-facing ports normally remain untrusted. Incorrectly trusting user access ports can weaken protection against rogue IPv6 control messages.<\/span><\/p>\n<p><b>Question 174. What happens to Router Advertisement packets received on an untrusted ND snooping interface according to Huawei&#8217;s described behavior?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> They are discarded to help prevent RA attacks<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> They are automatically converted into DHCPv6 messages<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> They are always flooded to every VLAN<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> They are used to establish OSPFv3 neighbors<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 1. They are discarded to help prevent RA attacks<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Huawei ND snooping treats Router Advertisements from untrusted interfaces as potentially dangerous because a rogue RA can cause hosts to select an unauthorized router or accept malicious IPv6 prefix information. Huawei therefore documents that RA packets received through untrusted ND snooping interfaces are discarded. Trusted interfaces should be configured only toward legitimate IPv6 infrastructure from which RA messages are expected. This protection is particularly important on enterprise access switches because endpoint-facing ports should not normally be sources of authoritative router advertisements.<\/span><\/p>\n<p><b>Question 175. Which SNMP version provides standardized support for both authentication and encryption of management traffic?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> SNMPv1 only<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> SNMPv3<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> SNMPv2c only<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> RMON1<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 2. SNMPv3<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">SNMPv3 adds significant security capabilities compared with SNMPv1 and SNMPv2c. Huawei supports SNMPv3 modes that can authenticate packets and also provide privacy through encryption. Authentication helps verify message integrity and validity, while privacy protects management data against disclosure. SNMPv1 and SNMPv2c are primarily based on community strings and do not provide the same standardized user-based authentication and encryption capabilities. For security-sensitive network management, SNMPv3 should therefore generally be preferred when all participating systems support it.<\/span><\/p>\n<p><b>Question 176. In SNMPv3, what does the privacy function provide?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Only device discovery<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Routing-table synchronization<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Authentication plus encryption to protect SNMP packet data<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> OSPF authentication<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 3. Authentication plus encryption to protect SNMP packet data<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Huawei describes the SNMPv3 privacy option as providing authentication together with encryption. Authentication validates the integrity and legitimacy of SNMP packets, while encryption protects management information from being read if network traffic is intercepted. This is especially important because network-management communications may contain sensitive device information and administrative data. Huawei platforms support several encryption methods depending on software and hardware capabilities, with stronger AES-based methods preferred over older DES-based encryption where supported.<\/span><\/p>\n<p><b>Question 177. Why is SNMPv3 generally preferable to SNMPv2c for managing security-sensitive network devices?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> It supports stronger user-based authentication and encrypted management communication<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> It automatically configures every device<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> It replaces SSH<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> It eliminates the need for access control<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 1. It supports stronger user-based authentication and encrypted management communication<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">SNMPv2c uses community strings, which provide comparatively limited security. SNMPv3 adds a user-based security model with authentication and privacy capabilities, allowing management messages to be validated and encrypted. This significantly reduces the risks of credential exposure, message tampering, and passive interception. Huawei documentation distinguishes SNMPv3 authentication mode from privacy mode, with privacy adding encryption in addition to authentication. SNMPv3 does not replace sound access-control policies, management-plane filtering, or secure administrative protocols, but it provides a much stronger SNMP security foundation.<\/span><\/p>\n<p><b>Question 178. Which transport protocol is used by NETCONF on Huawei devices in the documented secure management setup?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Telnet only<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> TFTP<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> HTTP without encryption only<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> SSH**<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 4. SSH<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Huawei documentation states that NETCONF requires SSH as its transport-layer protocol in the documented device-management setup. SSH provides an authenticated and encrypted channel over which NETCONF operations can be performed. Before NETCONF management is used, administrators configure appropriate SSH server parameters, keys, and user authentication. NETCONF itself provides structured network-configuration and management operations, while SSH protects the transport session carrying those operations. This is preferable to unencrypted remote-management mechanisms because configuration commands and management credentials may otherwise be exposed to interception.<\/span><\/p>\n<p><b>Question 179. Why is NETCONF well suited to network automation compared with manually entering CLI commands on every device?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> NETCONF disables configuration validation<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> NETCONF works only for monitoring<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> NETCONF provides a structured programmatic interface that automation systems can use to retrieve and modify configuration data<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> NETCONF eliminates the need for device authentication<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 3. NETCONF provides a structured programmatic interface that automation systems can use to retrieve and modify configuration data<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">NETCONF is designed for structured, machine-driven network management. Automation platforms can use it to retrieve configuration or operational data and make controlled configuration changes without depending entirely on screen-oriented CLI interaction. On Huawei equipment, NETCONF can operate over SSH, combining structured management with secure transport. This makes NETCONF useful in environments where large numbers of devices need consistent automated configuration. Authentication and authorization remain essential because a programmatic management interface can make large-scale changes very quickly if an automation account is misconfigured or compromised.<\/span><\/p>\n<p><b>Question 180. An enterprise wants stronger routing-protocol security, protection against rogue IPv6 Router Advertisements, encrypted network monitoring, and secure automated device configuration. Which design BEST satisfies the requirement?<\/b><\/p>\n<ol>\n<li><b><\/b><span style=\"font-weight: 400;\"> Use unauthenticated OSPF and IS-IS, SNMPv2c, and Telnet<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Use strong OSPF\/IS-IS authentication, ND snooping with trusted infrastructure interfaces, SNMPv3 with privacy, and NETCONF over SSH<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Disable IPv6 security and use static passwords everywhere<\/span><\/li>\n<li><b><\/b><span style=\"font-weight: 400;\"> Use only ACLs and no management protocols<\/span><\/li>\n<\/ol>\n<p><b>Correct Answer: 2. Use strong OSPF\/IS-IS authentication, ND snooping with trusted infrastructure interfaces, SNMPv3 with privacy, and NETCONF over SSH<\/b><\/p>\n<p><b>Explanation:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Each requirement is addressed by a dedicated security control. Strong OSPF and IS-IS authentication helps prevent unauthorized routing information from being accepted. ND snooping allows trusted IPv6 router-facing interfaces to be distinguished from untrusted endpoint interfaces and can block rogue Router Advertisements. SNMPv3 privacy provides authenticated and encrypted network-management traffic. NETCONF over SSH provides a secure programmatic configuration channel for automation systems. Together, these controls protect the routing plane, IPv6 access layer, monitoring plane, and configuration-management plane instead of relying on one mechanism to secure all network functions.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>View Full Huawei H12-821 Exam Dumps and Practice Test Dumps. Question 161. What is the PRIMARY purpose of enabling authentication for OSPF packets between neighboring routers? To increase the OSPF interface cost automatically To encrypt all user data forwarded by OSPF routers To help prevent unauthorized devices from successfully exchanging trusted OSPF routing information To [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/21111"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=21111"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/21111\/revisions"}],"predecessor-version":[{"id":21112,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/21111\/revisions\/21112"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=21111"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=21111"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=21111"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}