The two IPsec encapsulation modes are transport mode and tunnel mode. In transport mode, IPsec protects the upper-layer payload of the original IP packet while retaining the original IP header as the packet’s outer header. It is commonly associated with end-to-end host communication, although it can also protect a GRE packet between tunnel endpoints.

In tunnel mode, IPsec protects the complete original IP packet and adds a new outer IP header containing the addresses of the IPsec peers. This mode is commonly used between security gateways, routers, or site-to-site VPN endpoints because the original source and destination information can be protected within the encrypted inner packet. RFC 4301 formally defines transport and tunnel as the two IPsec security-association modes.

AH and ESP are not encapsulation modes. They are IPsec security protocols. Authentication Header provides integrity and source authentication but not encryption. Encapsulating Security Payload can provide encryption, integrity, authentication, and anti-replay protection. Either protocol can conceptually operate in transport or tunnel mode, although ESP is overwhelmingly used for encrypted enterprise VPN and SD-WAN data channels.

==================

SM4 is the supported SM-series cryptographic algorithm intended by this question. SM4 is a standardized symmetric block cipher that uses a 128-bit block size and a 128-bit key. It is suitable for high-volume data encryption because symmetric cryptography can process service traffic efficiently compared with public-key algorithms.

Within an SD-WAN or IPsec context, the bulk traffic carried through secure data channels requires a symmetric encryption algorithm. SM4 can therefore be used as the encryption component of an approved cryptographic suite where compliance with Chinese commercial cryptography requirements is necessary.

SM2 is an asymmetric public-key cryptographic suite used for functions such as digital signatures, key exchange, and public-key encryption. It is not the bulk data-encryption algorithm requested in this item. SM1 is a restricted proprietary algorithm whose implementation details are not publicly standardized in the same manner, while SM5 is not the supported option represented by the Huawei course question.

Huawei’s SD-WAN architecture uses IPsec to protect site-to-site services and supports secure GRE-over-IPsec data channels between edge devices. In the SM-series selection presented here, the correct supported traffic-encryption algorithm is SM4.

==================

WAPI, or WLAN Authentication and Privacy Infrastructure, is the wireless LAN security standard proposed by China. It provides wireless link authentication and data-protection mechanisms and was developed as an alternative security framework for WLAN environments. Huawei’s training material explicitly identifies WAPI as a WLAN security standard proposed in China and states that it provides stronger protection than legacy WEP and WPA mechanisms.

WPA, WPA2, and WPA3 belong to the Wi-Fi Protected Access family maintained through Wi-Fi industry certification. WPA was introduced as an interim improvement over WEP. WPA2 adopted stronger IEEE 802.11i security mechanisms, including AES-based CCMP. WPA3 later introduced stronger password-authentication and enterprise-security options.

WAPI incorporates authentication and encryption as part of an integrated wireless security architecture. Its deployment depends on regional requirements, terminal compatibility, AP support, and the organization’s regulatory or cryptographic-policy obligations. The question asks which standard originated as a Chinese wireless security standard, not which standard is most widely deployed internationally. Therefore, WAPI is the only correct choice, making option B the verified answer.

==================

The statement is true. iMaster NCE-Campus supports multiple on-premises deployment combinations rather than being restricted exclusively to Huawei-branded physical servers and Huawei virtualization platforms. The training material explicitly lists physical-server deployment using SUSE Linux and a third-party server, as well as virtual-machine deployment using VMware.

The platform can also be deployed using Huawei server and virtualization combinations, including Huawei 2288X servers, EulerOS, FusionCompute, and TaiShan-based environments. The availability of several combinations enables customers to select an architecture consistent with their existing data-center standards, procurement strategy, virtualization environment, and operational requirements.

Huawei nevertheless identifies a recommended platform combination in the training material. A recommendation does not mean that the other listed combinations are unsupported; it identifies the preferred configuration for standardized deployment and support. The material displays third-party server plus SUSE Linux and VMware-based virtual-machine deployment as valid alternatives while recommending Huawei 2288X V5 plus EulerOS.

The deployment must still satisfy the specified CPU, memory, storage, network-interface, software-version, and compatibility requirements. Therefore, the statement is True.

==================

GRE is a multiprotocol encapsulation mechanism and can carry all the listed packet types. It inserts a GRE header around the original payload and then places the resulting GRE packet inside a delivery-protocol packet. Because the GRE header contains a Protocol Type field identifying the encapsulated payload, GRE is not restricted to ordinary IPv4 unicast traffic.

IPv6 packets can be transported as GRE payloads when supported by the tunnel endpoints. IP unicast traffic is the most common use case. GRE can also carry IP multicast and broadcast packets, which is one of its major advantages over basic IPsec tunnel selectors that traditionally focus on IP unicast traffic. This enables routing protocols, multicast applications, discovery traffic, and other non-unicast services to operate across a logical point-to-point tunnel.

RFC 2784 defines GRE as a general mechanism for encapsulating an arbitrary network-layer protocol over another network-layer protocol. It also defines the Protocol Type field used to identify the carried payload. Huawei uses GRE as an SD-WAN overlay data-channel option and can additionally secure it using IPsec when confidentiality and integrity are required.

==================

A central switch in the relevant passive Ethernet network architecture supports a maximum of 48 access units. The architecture replaces a conventional multi-layer access design with a centralized switch and distributed remote or access units. The access units function as extensions of the central switch’s ports, simplifying device management, configuration, and topology maintenance.

Huawei’s CloudEngine S5731-H fixed central-switch specification provides models with 24 or 48 hybrid optical-electrical downlink ports. The 48-port model can therefore directly manage up to 48 associated access or remote units under the design limits represented by this question. The same hybrid links can provide data transmission and remote PoE power, enabling access units to be installed closer to terminals without requiring conventional active aggregation equipment at every location.

The central switch automatically discovers the topology, while remote units behave as extended ports rather than independently managed switches. This reduces management nodes and simplifies a traditional three-layer network into a two-layer architecture. The larger values of 64, 72, and 96 exceed the supported maximum for the specified central-switch implementation. Therefore, option C is correct.

==================

The statement is false. In Parallel Redundancy Protocol, LAN A and LAN B must remain two separate, failure-independent networks. A PRP RedBox connects a singly attached node or conventional network to both parallel LANs and behaves toward the PRP network like a doubly attached node. It duplicates outgoing frames and transmits one copy through each PRP port. For incoming traffic, it accepts the first valid copy and discards the later duplicate before forwarding the frame through its interlink port.

The RedBox must not operate as a normal bridge that directly forwards frames from its LAN A port to its LAN B port. Doing so would connect the two redundant LANs, potentially creating loops, duplicate propagation, broadcast amplification, and a common failure path. That would defeat the fundamental PRP requirement that failure or disruption in one LAN must not affect the other.

The original video contains the typing error “PPR RedBox”; the correct term is PRP RedBox , meaning Parallel Redundancy Protocol Redundancy Box. PRP topology requires two separate networks with no direct links between them, while the RedBox provides controlled redundant attachment for non-PRP devices.

==================

The statement is true as a WLAN design recommendation. Inter-WAC roaming is supported, but it introduces more control-plane interaction and forwarding complexity than intra-WAC roaming. The Home WAC and Foreign WAC must belong to the same mobility group, synchronize station and AP information, and establish an inter-WAC CAPWAP tunnel for control information and, in some scenarios, service forwarding.

Additional synchronization, tunnel processing, route handling, and failure dependencies can increase roaming delay and complicate troubleshooting. This is especially relevant for delay-sensitive applications such as voice, video, automated guided vehicles, and real-time production systems. A better design places APs between which users frequently move under the same WAC wherever controller capacity and physical topology permit.

Avoiding inter-WAC roaming does not mean disabling the function entirely. Large campuses may require multiple WACs for scale, redundancy, or geographic distribution. Mobility groups should still be configured for unavoidable cross-controller movement. However, buildings, floors, and continuous roaming areas should be assigned carefully so that normal roaming remains intra-WAC. Therefore, the recommendation in the statement is correct, and the answer is True.

==================

The AR5710-S8T1XWE-NRGL supports all four listed 5G-Advanced capabilities. Support for 3GPP Release 16 enables enhanced 5G New Radio functions and provides the standards foundation for improved mobile-WAN capacity, reliability, and service performance.

Carrier aggregation combines multiple component carriers to increase available throughput. Downlink 3CC allows three component carriers to be aggregated for received traffic, while uplink 2CC combines two carriers for transmitted traffic. This is valuable for high-bandwidth branch access, video backhaul, and mobile private-network scenarios.

Support for eight APNs permits multiple logically separated mobile services or provider profiles to be configured. Different APNs can represent enterprise services, management traffic, production systems, backup connectivity, or isolated customer networks. Global-frequency-band support improves deployment flexibility across countries and carrier networks, subject to local spectrum regulation and the supported modem variant.

Huawei SD-WAN can use 5G as a primary, secondary, or bypass link and supports combinations such as dual 5G and 5G plus wired connectivity for service assurance. Therefore, NR Release 16, carrier aggregation, eight APNs, and global frequency bands are all supported.

==================

The statement is false because Huawei SD-WAN supports both priority-based link selection and load balancing. Multiple Internet or WAN links do not have to be treated equally. An administrator can define a preferred or primary link and designate another link as secondary or backup according to application requirements, link quality, cost, bandwidth, or operational policy.

For delay- and packet-loss-sensitive services such as voice and video, a higher-quality link can be configured as the primary path and another link as the backup. If the primary link no longer satisfies the configured SLA thresholds, traffic can be dynamically switched to a better path. Huawei’s material explicitly describes primary and secondary link selection based on SLA and also presents load-balancing-based steering as a separate option.

Load balancing is useful when an enterprise wants to utilize the bandwidth of multiple links concurrently. Priority-based active/standby forwarding is preferable when one provider offers better quality or when one circuit should be reserved for critical services. Intelligent traffic steering can additionally consider application priority and current bandwidth utilization. Therefore, multiple links can be prioritized, load-balanced, or used in a policy-controlled combination, making option B correct.

==================