Passed Exam Today H19-404_V1.0

The statement is false. In Parallel Redundancy Protocol, LAN A and LAN B must remain two separate, failure-independent networks. A PRP RedBox connects a singly attached node or conventional network to both parallel LANs and behaves toward the PRP network like a doubly attached node. It duplicates outgoing frames and transmits one copy through each PRP port. For incoming traffic, it accepts the first valid copy and discards the later duplicate before forwarding the frame through its interlink port.

The RedBox must not operate as a normal bridge that directly forwards frames from its LAN A port to its LAN B port. Doing so would connect the two redundant LANs, potentially creating loops, duplicate propagation, broadcast amplification, and a common failure path. That would defeat the fundamental PRP requirement that failure or disruption in one LAN must not affect the other.

The original video contains the typing error “PPR RedBox”; the correct term is PRP RedBox , meaning Parallel Redundancy Protocol Redundancy Box. PRP topology requires two separate networks with no direct links between them, while the RedBox provides controlled redundant attachment for non-PRP devices.

==================

Huawei SD-WAN supports full-mesh, hub-spoke, and partial-mesh interconnection models. In a full-mesh topology, every site can communicate directly with the other sites. This model minimizes intermediate forwarding and is appropriate when branches frequently exchange latency-sensitive traffic such as voice, video, or collaborative application data.

In a hub-spoke topology, branch sites communicate with a central headquarters or data-center hub. Branch-to-branch traffic normally traverses that hub. The model is simple, scalable, and suitable for enterprises whose applications and shared resources are concentrated at headquarters.

Partial-mesh is used when most sites can communicate directly but some sites lack direct underlay connectivity or do not require direct tunnels. Those sites can communicate through a redirect or intermediate site. Huawei describes full-mesh, hub-spoke, and partial-mesh as supported topology designs and explains the role of a redirect site in partial-mesh networking.

“Partial-spoke” is not a defined SD-WAN topology model. A spoke is a role within hub-spoke networking rather than an independent partial-spoke topology. Therefore, A, B, and D are correct.

==================

After identifying a terminal, iMaster NCE-Campus can use the identification result for security monitoring, visibility, and policy automation. Spoofing detection is supported because the platform can compare a terminal’s current type and traffic behavior with its previously identified characteristics. For example, if a device originally identified as an IP phone suddenly behaves like a PC, the system can generate a spoofing alarm or apply an isolation policy.

Terminal identification also supports statistics and reporting by vendor, operating system, device category, access port, and policy status. Huawei explicitly describes terminal-type statistics, report export, and visibility of access policies.

In addition, iMaster NCE-Campus can automatically deliver VLAN, security-group, QoS, authentication, and access-permission policies according to the identified terminal type. Option B is incorrect because wired authentication is an admission process, not a service produced after terminal identification. Therefore, A, C, and D are correct.

==================

Authentication points should generally be placed on access devices close to the terminals. For wireless users, the AP or WLAN access device is the natural admission point because it directly controls the station’s wireless association and service access. For wired users, the access switch directly connects the endpoint and can enforce 802.1X, MAC-address authentication, VLAN authorization, ACLs, and security-group policies.

Huawei recommends access devices as authentication points for employees and specifically recommends access switches as authentication points for wired dumb terminals using MAC-address authentication. Deploying enforcement close to endpoints prevents unauthenticated or unauthorized traffic from traversing deeper into the campus network. It also improves fault isolation, policy granularity, and scalability because admission processing is distributed across access devices.

Option A is incorrect. A centralized authentication point can simplify configuration and policy management, but it does not inherently provide higher performance. It can create concentrated processing pressure, enlarge the Layer 2 scope, and allow unauthenticated traffic to travel farther before being evaluated. Therefore, the recommended principles are represented by B, C, and D.

==================