Option B is false because it reverses the encapsulation behavior. In IPsec transport mode, the IPsec security header is inserted after the existing IP header; a new outer IP header is not normally added. In tunnel mode, the complete original IP packet is encapsulated and a new outer IP header is added. Tunnel mode therefore generally introduces greater overhead and produces a longer packet than transport mode, not the reverse.

The remaining statements are correct. IPsec supports both transport and tunnel modes. GRE over IPsec performs GRE encapsulation first, allowing GRE to transport the original payload, and then applies IPsec protection to the resulting GRE packet. The IPsec security association is established between the GRE tunnel endpoints, protecting the GRE-encapsulated traffic as it traverses an untrusted transport network.

Huawei SD-WAN data channels can use either GRE or GRE over IPsec. GRE provides flexible overlay encapsulation, while IPsec adds confidentiality, integrity, origin authentication, and anti-replay protection for site-to-site traffic. Huawei specifically identifies IPsec encryption as the mechanism securing site-to-site SD-WAN services.

==================

Hardware-based encryption is the unambiguously correct statement. MACsec protects Ethernet frames at Layer 2 using AES-GCM-based authenticated encryption. On enterprise switches and routers, the encryption and integrity operations are commonly implemented in forwarding ASICs or dedicated hardware so that frames can be protected at high throughput with low latency.

Option A is incorrect because complex manual configuration is not an inherent requirement. MACsec can use manually configured connectivity-association keys, but IEEE 802.1X MACsec Key Agreement can automate peer authentication, secure-channel establishment, key distribution, and rekeying. The operational complexity therefore depends on the deployment model and management platform.

Option C is also inaccurate. MACsec is media-independent, meaning it can operate over supported copper or fiber Ethernet; however, it does not eliminate the requirement for appropriate Layer 2 connectivity between participating MACsec entities. Standard hop-by-hop MACsec protects Ethernet links or LAN connectivity between peers and is not a general Layer 3 tunneling mechanism.

MACsec supplies Layer 2 confidentiality, integrity, origin authentication, and replay protection. Its encryption can be performed directly in network-device hardware, enabling substantially better forwarding performance than software-only encryption implementations.

Option C is false. The digital-map energy-saving function provides network-wide energy visibility, identifies periods of low wireless demand, and recommends appropriate energy-saving time windows. During an approved energy-saving period, selected wireless APs or radio resources can be placed into an energy-saving state after the system evaluates coverage, traffic, and capacity requirements.

Automatically powering off switches is not the intended function. Campus switches may carry essential wired services, provide uplinks for other network devices, and supply PoE power to APs, cameras, phones, sensors, and access-control systems. Automatically shutting down a complete switch could therefore interrupt many unrelated services and potentially disconnect downstream network segments.

Huawei identifies low-carbon and energy-saving operation as a characteristic of cloud campus networks and combines this objective with AI-based intelligent O & M and proactive optimization. Its intelligent O & M architecture analyzes AP load trends and performs predictive wireless-network optimization, providing the analytical foundation for selecting safe energy-saving periods and resources.

Therefore, A, B, and D describe supported digital-map energy-saving capabilities. Automatic switch power-off is the false statement, making C correct.

Option B is false because a station retains its original IP address during Layer 3 roaming. Preserving the IP address is essential for maintaining active application sessions when the station moves between APs associated with different service VLANs, Layer 2 domains, and gateways. Huawei’s training diagram shows the same station IP address before and after roaming, while the service VLAN changes.

When the STA initially accesses the WLAN, a Home AP or HAP is selected for it. After the STA roams to a Foreign AP, the new AP obtains the station information and establishes the required forwarding relationship with the HAP. In direct-forwarding implementations, the STA’s traffic is encapsulated and forwarded to the HAP, which preserves access through the original network and gateway.

Therefore, A and C accurately describe HAP-based Layer 3 roaming. Option D is also correct: the APs use the same SSID and authentication mode but different service VLANs. The station’s IP address does not change, so B is the false statement.

==================

Huawei firewalls provide four commonly predefined security zones: Local, Trust, DMZ, and Untrust. The Local zone represents the firewall itself, including traffic generated by or destined for the device, and has the highest default security priority of 100. The Trust zone normally represents an organization’s protected internal network and has a default priority of 85, not 95. Therefore, option C is false.

The DMZ typically hosts public-facing or semi-trusted resources, such as web, email, and application servers. Its default priority is 50, placing it between the trusted internal network and the external untrusted network. The Untrust zone normally represents the Internet or another uncontrolled network and has the lowest predefined priority of 5.

Zone priority expresses the relative security level used to classify inbound and outbound traffic direction; it does not independently permit traffic. Security policies still determine whether matched traffic is allowed or denied. Huawei’s SD-WAN design uses Trust and Untrust zones on CPEs, and iMaster NCE can orchestrate the corresponding zones and firewall policies for Internet-access protection.

==================

The statement is false. An MPLS label stack is an ordered sequence of label-stack entries, with the top label processed first and the bottom identified by the Bottom-of-Stack bit. However, the MPLS architecture does not define a universal maximum of three nested labels. An MPLS forwarding operation may replace the top label, remove it, or push one or more additional labels onto the stack.

Practical label depth is constrained by device implementation, forwarding ASIC capabilities, packet size, and the number of network functions being encoded. A conventional MPLS VPN may use two labels: a transport label and a VPN label. More advanced deployments can add labels for traffic engineering, segment routing, entropy, service chaining, or hierarchical transport. This can produce stacks deeper than three entries.

Therefore, “three layers” may describe a limitation of a particular platform, software version, or deployment design, but it is not an MPLS protocol maximum. RFC 3032 defines the stack as a sequence of four-byte entries and explicitly allows one or more entries to be pushed without specifying a three-label ceiling.

==================

An industrial RedBox can provide all four listed interconnection modes. In HSR-SAN mode, it connects a singly attached node that does not natively support High-availability Seamless Redundancy to an HSR network. The RedBox duplicates frames entering the HSR domain and removes duplicate frames before delivering traffic to the SAN.

HSR-PRP mode interconnects an HSR ring with a Parallel Redundancy Protocol network while preserving seamless redundancy. PRP-PRP mode couples two PRP network domains, while HSR-HSR mode connects separate HSR rings. Depending on the implementation, the HSR-HSR interconnection function may also be described as a QuadBox function because four HSR-facing ports can be involved.

The essential RedBox responsibilities are frame conversion, duplication, duplicate elimination, sequence-number handling, and prevention of unintended forwarding loops between redundancy domains. HSR and PRP use compatible duplicate-identification principles, enabling controlled interconnection between these network types without introducing a single point of failure. RedBoxes also provide redundant connectivity for devices that have only one ordinary Ethernet interface.

==================

A-FEC, or Adaptive Forward Error Correction, is the correct technology. It protects delay-sensitive traffic by adding calculated redundant packets to the original packet stream. If some original packets are lost during WAN transmission, the receiving edge device can reconstruct them using the surviving original and redundant packets rather than waiting for end-to-end retransmission.

The key distinction between ordinary FEC and A-FEC is adaptation. With A-FEC, the receiving device reports real-time packet-loss and continuous-loss information to the transmitting device through FEC acknowledgement messages. The transmitting edge then dynamically increases or decreases the redundancy ratio according to actual network conditions. This provides stronger recovery during severe loss while avoiding unnecessary bandwidth overhead when link quality improves. Huawei describes this feedback-controlled adjustment as a mechanism that can alleviate or eliminate the impact of packet loss.

IFIT and IPCA are primarily measurement and service-quality analysis technologies; they do not reconstruct lost video packets. Fixed FEC does not adapt its redundancy level as effectively to changing loss conditions. Therefore, the technology intended for smooth video under packet loss of up to 20% is A-FEC.

==================