Huawei H12-821_V1.0 Dumps

A stateful inspection firewall tracks the state of network connections and only matches the initial packet against its rule set. Subsequent packets in the same connection are matched in the state table. Contrary to this, UDP packets can be inspected by correlating them with connection states, and packets in a single connection are always correlated ​.

The MED (Multi-Exit Discriminator) is an optional, non-transitive attribute used to influence the exit path. MED is considered after attributes such as Local-Preference, AS-Path, and Origin during route selection. By default, if a MED value is missing, it is treated as 0 unless the bestroute med-none-as-maximum command is configured to treat it as 4294967295 ​.

All four are valid reasons why IKE (Internet Key Exchange) negotiation might not be triggered:

A – Security policy mismatches can block data flows , preventing IPsec from initiating.

B – If the route to the peer is unreachable , no packets can reach the tunnel interface, and IKE will not start.

C – If the IPsec policy is not bound to the correct interface , no protection is triggered.

D – If the ACL does not match the actual traffic , the flow will bypass IPsec.

Reference from Huawei HCIP-Datacom-Core Technology Study Guide:

“Common causes of IKE negotiation failure include incorrect ACLs, misapplied policies, unreachable peers, and misconfigured security zones.”

(Chapter: VPN Technologies – Section: IPsec Troubleshooting)

Understanding DHCPv6 :

DHCPv6 (Dynamic Host Configuration Protocol for IPv6) is used to assign configuration parameters to IPv6 clients.

It supports both stateful and stateless modes:

Stateful : Assigns IPv6 addresses and other configuration parameters.

Stateless : Assigns only configuration parameters (e.g., DNS server) without providing IPv6 addresses.

 Permanent Group Addresses for Routing Protocols

The range 224.0.0.0 to 224.0.0.255 is reserved for local network protocols, including routing protocols. Examples include OSPF (224.0.0.5/6) and RIP (224.0.0.9).

 HCIP-Datacom-Core Reference

Reserved multicast address ranges are detailed in the multicast configuration sections​​.

Comprehensive and Detailed Step-by-Step Explanation:

IGMPv1 Querier Selection:

In IGMPv1, there is no built-in querier election mechanism. Querier selection depends on the multicast routing protocol (e.g., PIM).

IGMPv2 and IGMPv3 Querier Selection:

In IGMPv2 and IGMPv3, the router interface with the largest IP address in the multicast group is selected as the querier.

Correct Statement:

The statement accurately describes the querier selection mechanisms in IGMP versions.

VRRP defines the following states:

Initialize – The router is starting up or has not joined a VRRP group.

Backup – The router is in standby and monitors the Master.

Master – The only state where the device forwards traffic for the virtual IP address .

Only the router in the Master state owns the virtual MAC and responds to ARP for the virtual IP.

Reference from Huawei HCIP-Datacom-Core Technology Study Guide:

“In VRRP, only the Master forwards packets destined for the virtual IP address. Backup routers take over only if the Master fails.”

(Chapter: VRRP Concepts – Section: State Roles and Transitions)

Internet – This community attribute allows a route to be advertised to any BGP peer , including EBGP and IBGP. This is the default behavior if no other restrictive community is attached.

No_Advertise – Prevents the route from being advertised to any peer.

No_Export – Prevents the route from being advertised to EBGP peers .

No_Export_Subconfed – Restricts the route from being advertised outside the sub-AS in a confederation.

Reference from Huawei HCIP-Datacom-Core Technology Study Guide:

“The Internet community attribute allows unrestricted advertisement of a route. Other community attributes like No_Advertise and No_Export limit route propagation.”

(Chapter: BGP Community Attributes – Section: Well-known Communities)

Comprehensive and Detailed In-Depth Explanation:

SSH (Secure Shell) provides secure remote login and data encryption over insecure networks.

A. TRUE → SSH requires user authentication before access is granted.

B. TRUE → Enabling SSH opens listening ports , which could be scanned by attackers . Proper security measures (e.g., disabling unused SSH access) are recommended.

C. TRUE → ACLs can be applied to VTY (Virtual Terminal) lines to restrict SSH access based on IP addresses .

D. FALSE → The default SSH server port is 22, not 23 . Port 23 is used for Telnet , which is less secure than SSH.

???? Reference: Huawei HCIA-Datacom Study Guide, SSH Configuration and Security Measures.

The silent-interface command disables the sending of OSPF packets, including Hello packets, on the specified interface, which prevents the establishment of OSPF neighbor relationships. However, the interface can still advertise directly connected routes through other interfaces, making Option C incorrect ​.

OSPF supports both area-level and interface-level authentication. When both are configured, interface authentication takes precedence over area authentication. This hierarchy ensures that specific interface-level configurations override the broader area-level settings when applicable ​.

The filter-policy command in IS-IS is used to control the advertisement and filtering of routing information. However, it does not directly filter LSPs (Link State Packets); instead, it controls route advertisements. The false statement here is that it filters LSPs ​.

IPv4 supports three main transmission modes:

Unicast : One-to-one communication.

Broadcast : One-to-all communication within a network.

Multicast : One-to-many communication to a group of interested receivers. Anycast is not a native IPv4 mode but is introduced in IPv6 ​.

Comprehensive and Detailed in-depth Step-by-Step Explanation:

The Network Entity Title (NET) is a unique identifier assigned to an IS-IS router. It is derived from the Network Service Access Point (NSAP) address and consists of the following components:

Area Address:

Identifies the area in which the router resides.

Multiple routers in the same IS-IS area must have the same area address.

System ID:

Uniquely identifies the router within the IS-IS area.

The System ID is typically derived from the router ' s loopback IP address or another unique value.

SEL (Selector Field):

The SEL field is always set to 00 for IS-IS NETs.

The NET is used by IS-IS for route calculation and to identify the router within the IS-IS domain. Therefore, the statement is TRUE.

 During WLAN roaming, the STA sends a Reassociation Request frame to the foreign AP to maintain connectivity. Association frames are used during initial connections, not roaming.

 APs with which a STA is associated before and after roaming can work on different channels, as roaming often occurs across channels in environments like multi-SSID or multi-channel setups.

Options C and D are false, as they contradict standard WLAN roaming procedures ​.

Comprehensive and Detailed Step-by-Step Explanation:

BGP Origin Attribute Priority:

The Origin attribute determines the source of the route and affects the selection of the best path.

The priority order is as follows:

IGP (i): Highest priority. Routes injected using the network command.

EGP (e): Lower priority. Routes learned from the EGP protocol.

Incomplete (?): Lowest priority. Routes redistributed into BGP from other protocols.

Correct Option:

A: IGP > EGP > Incomplete is the correct order of priority.

ARP spoofing is a Layer 2 attack, as it targets ARP tables in switches or end devices. All other attacks, including IP spoofing, ICMP attacks, and Smurf attacks, are network layer (Layer 3) attacks ​.

Understanding the LSDB and Level-2 DIS Election in IS-IS :

In IS-IS, the Designated Intermediate System (DIS) is elected for both Level-1 and Level-2 on broadcast networks to manage the link-state database (LSDB) and reduce the number of LSAs exchanged.

The election of the DIS is based on the highest priority . If the priority is the same, the router with the highest System ID becomes the DIS.

Policy-Based Routing (PBR) on interfaces is used to forward traffic based on specific policies rather than the routing table. However, PBR is not suitable for modifying the next-hop of locally originated traffic. Other scenarios listed are typical use cases for interface PBR ​.

Based on the MSTP configuration shown, the role of the switch in MSTI 1 cannot be determined without additional details about the topology or priority values of other switches in the instance. The role could be a root switch, secondary root, or non-root, depending on these factors ​.

 OSPF Authentication Overview

The Auth Type field in the OSPF packet header determines the authentication mode. If the Auth Type is 1, plaintext authentication is used.

Plaintext authentication involves transmitting the password in an easily readable format, which is less secure compared to MD5.

 HCIP-Datacom-Core Reference

Authentication mechanisms, including plaintext authentication, are detailed in the OSPF security configuration chapter, confirming that Auth Type = 1 corresponds to plaintext​​.

The election of a Designated Router (DR) and Backup Designated Router (BDR) occurs during the OSPF network ' s initial setup or upon the failure of an existing DR. A new router joining an OSPF network does not automatically preempt the current DR, even if it has the highest priority. DR and BDR elections are not preemptive. The other statements are correct regarding OSPF DR/BDR election processes ​.

Comprehensive and Detailed Step-by-Step Explanation:

Analysis of the OSPF Neighbor State:

Router ID 10.0.5.5:

On interface 10.0.235.2 (GigabitEthernet0/0/1), the neighbor state is Full, indicating that adjacency is established.

The Designated Router (DR) is 10.0.235.5, which is the same as the neighbor ' s address.

Router ID 10.0.4.4:

On interface 10.0.24.2 (Serial1/0/1), the neighbor state is also Full, meaning adjacency is established.

The DR/BDR election status shows None, indicating that the interface is on a point-to-point link where DR/BDR election does not apply.

Validation of Each Option:

Option A: Correct. The DR IP address is explicitly shown as 10.0.235.5.

Option B: Correct. The neighbor state for both 10.0.5.5 and 10.0.4.4 is Full, confirming adjacency is established.

Option C: Incorrect. DR/BDR elections are irrelevant on point-to-point links like Serial1/0/1.

Option D: Correct. The Router IDs of R2 ' s neighbors are explicitly listed as 10.0.5.5 and 10.0.4.4.

Route summarization in OSPF is restricted to specific routers: Area Border Routers (ABRs) and Autonomous System Boundary Routers (ASBRs). These devices perform summarization to reduce routing table size and minimize advertised routing information between areas or across AS boundaries. Regular routers cannot perform route summarization, making this statement false ​.

A is false – The default value of Local_Pref is 100 , not 0.

B is false – Local_Pref is not advertised to EBGP peers , it is only sent to IBGP peers .

C is correct – The Local_Pref value stays constant unless modified by a route-policy or filter.

D is correct – Higher Local_Pref values indicate preferred paths , so BGP prefers the path with the highest Local_Pref among multiple options.

Reference from Huawei HCIP-Datacom-Core Technology Study Guide:

“Local_Pref is used to select the best outbound path for traffic leaving the AS. It is only shared among IBGP peers and defaults to 100. The higher the value, the more preferred the route.”

(Chapter: BGP Path Attributes – Section: Local Preference)

When the router ID is configured in both the system view and the BGP view, the router ID in the BGP view takes precedence because BGP-specific configurations override global settings. This ensures that BGP operates with the most relevant configurations ​.

OSPF process IDs are locally significant and do not need to match between routers to form neighbor relationships. The other statements correctly describe the behavior of OSPF multi-instances, making Option C false ​.

Comprehensive and Detailed In-Depth Explanation:

IPsec (IP Security Protocol) establishes Security Associations (SAs) for encrypted communication.

An SA is uniquely identified by a 3-tuple :

SPI (Security Parameter Index) → Identifies the SA.

Destination IP Address → Specifies the receiving device.

Security Protocol ID → Indicates whether AH (Authentication Header) or ESP (Encapsulating Security Payload) is used.

A. Key exchange protocol is not part of the SA 3-tuple . It is used during IKE (Internet Key Exchange) but is not part of the SA itself.

???? Reference: Huawei HCIA-Datacom Study Guide, IPsec Security Association and SA Identification.

The preference of routing protocols determines the selection order of routes when a router receives multiple routes to the same destination from different routing protocols. For instance, OSPF has a higher preference over RIP, so OSPF routes will be selected first. Huawei routing preferences confirm this behavior ​.

From the command output, the interface S4/0/0 has its cost value explicitly listed under the Cost section as 20 for Level-1 circuits. This means that all traffic routed through this interface will incur this cost in the IS-IS metric calculation. The other options (such as circuit level and IPv6 support) are either not correct or not supported by the provided output ​.

Comprehensive and Detailed In-Depth Explanation:

AS_Path is a well-known mandatory attribute (not discretionary).

AS_Path characteristics :

A. TRUE → When advertising to IBGP peers, AS_Path remains unchanged to prevent routing loops.

B. TRUE → BGP uses AS_Path to detect loops (if a router sees its own AS in the path, it rejects the route).

C. FALSE → AS_Path is well-known mandatory, not discretionary .

D. TRUE → BGP ignores AS_Confed_Sequence and AS_Confed_Set when calculating the AS_Path length.

???? Reference: Huawei HCIA-Datacom Study Guide, BGP Path Attributes and Loop Prevention.

Comprehensive and Detailed Step-by-Step Explanation:

Session Creation in Firewalls:

Firewalls create session entries for packets requiring stateful inspection (e.g., TCP, UDP, ICMP, and GRE).

Subsequent fragments of large packets do not require new sessions. Instead, they are processed based on the session created for the first fragment.

Correct Option:

C (Subsequent Fragment): Does not trigger a new session entry as it belongs to an existing session.

Comprehensive and Detailed in-depth Step-by-Step Explanation:

In an Intermediate System to Intermediate System (IS-IS) network, a Designated Intermediate System (DIS) is elected on broadcast networks to perform the following functions:

Represent the broadcast network as a pseudonode.

Generate and update the Link State Protocol Data Units (LSPs) for the pseudonode.

The DIS is elected based on the DIS priority value, which is configured on IS-IS interfaces. If two routers have the same priority, the router with the higher MAC address becomes the DIS.

The default DIS priority for IS-IS interfaces is 64 , which can be modified depending on the network requirements.

Option A (200): Incorrect. This is not the default value.

Option B (64): Correct. This is the default DIS priority value.

Option C (1): Incorrect. This is not the default value.

Option D (100): Incorrect. This is not the default value.

Comprehensive and Detailed Step-by-Step Explanation:

Single-Hop BFD:

Single-hop BFD is used for detecting link failures in directly connected devices.

It uses UDP port 3784 for communication.

Multi-Hop BFD:

For multi-hop scenarios, BFD uses UDP port 4784 to ensure end-to-end connectivity.

Incorrect Options:

TCP ports 3784 and 4784 (C and D): BFD does not use TCP.

 VRRP and BFD Association :

VRRP (Virtual Router Redundancy Protocol) is used to provide gateway redundancy by electing a master and backup router.

Associating VRRP with BFD (Bidirectional Forwarding Detection) allows faster detection of faults on the master device or the link between the master and the backup.

Comprehensive and Detailed Step-by-Step Explanation:

1. What is GRE (Generic Routing Encapsulation)?

GRE is a tunneling protocol that allows the encapsulation of various types of packets (e.g., IPv4, IPv6, multicast, etc.) to be transmitted over another protocol (e.g., IP).

GRE is used to create point-to-point connections over heterogeneous networks.

2. Analysis of Each Option:

Option A: GRE is a Layer 2 VPN encapsulation technology.

Incorrect.

GRE operates at Layer 3 (Network Layer) and encapsulates Layer 3 packets. It is not a Layer 2 VPN encapsulation technology like MPLS or Ethernet-over-IP.

Option B: GRE enables encapsulated data packets to be transmitted over another network layer protocol, but cannot encapsulate multicast data.

Incorrect.

GRE supports the encapsulation and transmission of multicast data packets. This is one of its key features, making it suitable for protocols like OSPF and multicast applications.

Option C: GRE tunnels can work with IPsec to ensure the security of multicast services such as voice and video.

Correct.

GRE by itself does not provide encryption or security. However, GRE can work with IPsec to secure the encapsulated traffic, including multicast data, for services like voice and video.

Option D: GRE tunnels can extend the working range of network protocols with hop limits.

Correct.

GRE encapsulates packets, effectively resetting their hop limits and allowing protocols with limited hop counts (e.g., RIP) to work over larger networks.

3. Summary:

The correct options are C and D .

 BGP Keepalive Message Behavior

Keepalive messages are used to maintain the Established state of a BGP peer relationship.

The Keepalive timer determines the frequency of these messages and defaults to 60 seconds , as per the BGP specification.

 HCIP-Datacom-Core Reference

The Keepalive timer default value is covered in the BGP configuration and operational principles​​.

BGP, IS-IS, and OSPF support the configuration of default routes through specific command configurations. For example, BGP uses the default-originate command, IS-IS uses a default-route-advertise method, and OSPF can advertise default routes using default-information originate . ICMP, however, is not a routing protocol and does not support this functionality ​.

The correct command for configuring the VRRP (Virtual Router Redundancy Protocol) preemption delay is vrrp vrid 1 preempt-delay 20 . This command sets the delay before a higher-priority VRRP router preempts the master role, ensuring stable operation during network transitions ​.

A is correct – Removing unused accounts helps minimize the risk surface .

B is false – Email is not a secure method for transferring sensitive information like passwords, even if encrypted.

C is correct – Unique administrator accounts help with accountability and tracking.

D is false – Long-term password validity reduces security. Passwords should be rotated regularly.

Reference from Huawei HCIP-Datacom-Core Technology Study Guide:

“To secure admin access, avoid account sharing, delete inactive users, and periodically update credentials through secure channels.”

(Chapter: Device Security – Section: Account Management)

 Understanding BGP Route Summarization :

In Border Gateway Protocol (BGP), route summarization is a technique used to aggregate multiple specific prefixes into a broader summary prefix. This reduces the size of routing tables and improves routing efficiency.

Summarization helps to hide unnecessary details from other parts of the network while still maintaining connectivity.

DIS Election in IS-IS :

In IS-IS, the Designated Intermediate System (DIS) is elected on broadcast networks to reduce the number of LSAs exchanged and maintain the LSDB.

The DIS is elected based on priority :

The router with the highest priority is elected as the DIS.

If priorities are equal, the System ID is used as a tie-breaker, and the router with the highest System ID becomes the DIS.

Understanding DIS Election in IS-IS:

On an IS-IS broadcast network, a Designated Intermediate System (DIS) is elected to create and update pseudonodes for efficient communication.

The election is based on the following criteria:

DIS Priority: The router with the highest priority is elected as the DIS.

Router ID (tie-breaker): If priorities are equal, the router with the highest Router ID is elected.

Analyzing the DIS Priorities and Router IDs:

R1: Priority = 64, Router ID = 1.1.1.1

R2: Priority = 1, Router ID = 2.2.2.2

R3: Priority = 127, Router ID = 3.3.3.3

R4: Priority = 10, Router ID = 4.4.4.4

Among the routers, R3 has the highest DIS priority (127) , making it the DIS.

Correct Option:

Option B (R3): Correct, as R3 has the highest priority.

Option A (R1): Incorrect, as its priority is lower (64).

Option C (R4): Incorrect, as its priority is lower (10).

Option D (R2): Incorrect, as its priority is the lowest (1).

Configuration Analysis:

On R2 , the following configuration has been applied:

acl 200

rule deny source 10.1.0.0 0.0.3.0

rule permit

#

ospf 1

filter-policy 2000 import

This configuration uses ACL 200 to filter routes during import into the OSPF routing table on R2.

Rule deny source 10.1.0.0 0.0.3.0: Blocks routes in the range 10.1.0.0/24 to 10.1.3.0/24 (inclusive).

Rule permit: Allows all other routes to be imported.

Impact of ACL 200 on Route Import:

10.1.0.0/24 to 10.1.3.0/24: These subnets are explicitly denied by ACL 200 and will not appear in R2 ' s routing table.

10.1.4.0/24 and beyond: These subnets are permitted by the rule permit statement and will be imported into R2 ' s routing table.

Routing Table Entries on R2:

Option A (10.1.4.0/24): Exists in R2 ' s routing table because it is permitted.

Option B (10.1.3.0/24): Does not exist because it is denied by ACL 200.

Option C (10.1.2.0/24): Does not exist because it is denied by ACL 200.

Option D (10.1.1.0/24): Does not exist because it is denied by ACL 200.

A (10.1.4.0/24)

 ACL Matching in Huawei Routers:

Access Control Lists (ACLs) are used to filter packets based on specific criteria, such as source/destination IP, ports, or protocols.

When a packet arrives, the Huawei router processes it against the configured ACL rules to decide whether to permit or deny the packet.

In IPv6 , fragmentation is handled only at the source node . Intermediate routers do not fragment packets . Instead, if a packet is too large for the next link, the router sends back an ICMPv6 Packet Too Big message to the source, which then adjusts its packet size.

This design:

Reduces processing load on intermediate devices.

Supports Path MTU Discovery (PMTUD).

Reference from Huawei HCIP-Datacom-Core Technology Study Guide:

“In IPv6, routers do not perform fragmentation. Only the source device fragments packets if needed, based on ICMPv6 feedback.”

(Chapter: IPv6 Fundamentals – Section: Fragmentation and PMTUD)

The operator between if-match clauses under a node is AND, meaning all conditions must be satisfied. However, the operator between nodes is OR, meaning a route matching any node will pass the route-policy ​.

Comprehensive and Detailed In-Depth Explanation:

Intermediate System to Intermediate System (IS-IS) routers send IS-to-IS Hello (IIH) packets to establish neighbor relationships.

The Reserved/Circuit Type field in IIH packets indicates which level of IS-IS adjacency the router is trying to establish:

00 → Level-0 (Not used in IS-IS).

01 → Level-1 router.

10 → Level-2 router.

11 → Level-1-2 router (Both levels supported) .

Since the question asks for the field value in an L1-L2 router’s IIH packets , the correct answer is 11 (B) .

???? Reference: Huawei HCIA-Datacom Study Guide, IS-IS Neighbor Discovery and IIH Packet Format.

By default, a router interface sends PIM (Protocol Independent Multicast) Hello messages every 30 seconds to maintain neighbor relationships. This interval can be adjusted using configuration commands ​.

Edge ports are used in RSTP to bypass the spanning tree calculation for ports connected to end devices. By configuring ports like SWD ' s GE0/0/2 and SWC ' s GE0/0/2 as edge ports, they transition directly to the Forwarding state upon activation, ensuring faster convergence. Statement A is incorrect because receiving BPDU invalidates the edge port status ​.

Comprehensive and Detailed Step-by-Step Explanation:

1. What is First-Time Authentication in SSH?

When an SSH client connects to an SSH server for the first time, the server ' s public key is not yet known to the client.

Enabling first-time authentication allows the SSH client to accept the server ' s public key and save it for future connections. This feature eliminates the need for manual configuration of the server ' s public key on the client.

2. Process Explanation:

The SSH client connects to the server and receives the server ' s public key.

The client accepts the key and saves it in its local key database (e.g., known_hosts file).

For subsequent connections, the client uses the saved public key to authenticate the server.

3. Why the Statement is TRUE:

First-time authentication simplifies SSH setup and is a commonly used method when connecting to new servers. It ensures that future connections are authenticated using the saved public key.

The native AC (Access Controller) function in Huawei ' s agile switches enables wired and wireless convergence. This integration allows the agile switch to act as both a wired network switch and a wireless controller, managing all traffic centrally. This architecture simplifies network management and improves efficiency, making the statement true ​.

By default, Huawei firewalls create security zones such as Trust, Untrust, and Local. The DMZ (Demilitarized Zone) is a security zone explicitly created by users. A DMZ is used to isolate an internal network from the external one, providing an additional layer of security by placing public-facing services (e.g., web servers) in this intermediary zone. This setup ensures that if a public-facing service is compromised, the internal network remains secure. Huawei Firewall configuration steps confirm this zoning principle, making DMZ creation an explicit user-driven action ​.

Option A correctly configures the DHCP relay agent (AC) to forward requests to the DHCP server using VLAN 10.

Option B correctly configures the DHCP server (AR) with the correct IP pool ( 10.1.1.0/24 ), gateway, and excluded IP addresses. The static route to 10.1.1.0 through 172.21.1.1 ensures proper routing ​.

=========

Comprehensive and Detailed Step-by-Step Explanation:

1. Understanding Hybrid Interfaces on a Layer 2 Switch:

Layer 2 switches support different interface types, such as access , trunk , and hybrid interfaces.

A trunk interface allows traffic from multiple VLANs to pass through, but frames belonging to the native VLAN are sent untagged, while all other VLAN frames are tagged.

A hybrid interface is more flexible:

It allows traffic from multiple VLANs to pass through, just like a trunk interface.

However, you can configure whether frames for specific VLANs are tagged or untagged as they leave the interface. This feature is useful in certain networking scenarios, such as connecting devices that do not support VLAN tagging.

2. Key Differences Between Trunk and Hybrid Interfaces:

3. Why the Statement is TRUE:

The statement accurately describes the functionality of a hybrid interface:

It supports traffic from multiple VLANs.

It allows administrators to configure whether outgoing frames are tagged or untagged for specific VLANs.

4. Summary:

The statement is TRUE because hybrid interfaces on a Layer 2 switch support traffic from multiple VLANs and allow flexible tagging configurations.

The default sending interval for BFD (Bidirectional Forwarding Detection) control packets is 100 milliseconds. This interval ensures rapid detection of link faults, providing fast failover and minimizing downtime in network operations ​.

Comprehensive and Detailed Step-by-Step Explanation:

1. What is the BFD Echo Function?

BFD (Bidirectional Forwarding Detection) is used to detect link failures.

The Echo function is an optional feature that tests link connectivity by looping back packets sent from the local device through the forwarding path.

2. Analysis of Each Statement:

Option A: If URPF is enabled on the peer end, BFD packets may be incorrectly discarded on the peer end.

Correct.

URPF (Unicast Reverse Path Forwarding) checks whether the source IP address of an incoming packet is reachable via the interface it was received on. Since the Echo function uses loopback packets, this can conflict with URPF, causing the packets to be dropped.

Option B: In the BFD Echo function, the device uses the IP address of the outbound interface as the source IP address by default.

Correct.

By default, the outbound interface ' s IP address is used as the source address for BFD Echo packets.

Option C: The BFD Echo function applies only to single-hop BFD sessions.

Incorrect.

The BFD Echo function can be used for both single-hop and multi-hop BFD sessions.

Option D: When configuring a BFD session supporting the BFD Echo function, you need to configure both the local and remote discriminators.

Incorrect.

The BFD Echo function is locally configured and does not require setting remote discriminators. The function operates independently of the remote device ' s configuration.

3. Summary:

The correct statements are A and B .

 R1 is a Level-1 router in Area 49.0001, while R4 is in Area 49.0004. Level-1 routers only maintain LSDBs for their own area and do not contain LSPs from other areas, such as R4’s LSP.

 R2 is a Level-1-2 router, so it maintains LSDBs for both Area 49.0001 (Level-1) and Level-2 domains, which include LSPs from R4.

 R3 and R4, as Level-2 routers, exchange LSPs with each other within the Level-2 domain.

 Thus, the LSDB of R1 does not include R4’s LSP ​.

Comprehensive and Detailed In-Depth Explanation:

SNMP (Simple Network Management Protocol) v3 is a more secure version of SNMP, supporting authentication and encryption .

If the NMS is not receiving SNMPv3 traps , possible causes include:

A. FALSE → The SNMP version mismatch does not affect traps ; devices can send SNMPv2 traps even when using SNMPv3.

B. TRUE → If the SNMPv3 password is incorrect , authentication will fail, and traps will not be processed by the NMS.

C. FALSE → The size of packets sent by the NMS does not affect incoming SNMP traps from the router.

D. TRUE → The community name must match on both the NMS and the router , or traps will be ignored.

???? Reference: Huawei HCIA-Datacom Study Guide, SNMPv3 Configuration and Authentication.

 pat

 trust

 12.1.1.0

 inner

Comprehensive and Detailed in-depth Step-by-Step Explanation:

To answer this question, it is essential to distinguish between the roles of ABRs and ASBRs in OSPF and the function of route summarization:

Route Summarization on ABRs:

Route summarization in OSPF can reduce the number of inter-area Type 3 LSAs that ABRs propagate between areas.

ABRs perform route summarization to reduce the amount of routing information exchanged between areas, thereby decreasing the size of the routing table and improving resource utilization.

Route Summarization on ASBRs:

ASBRs summarize external routes (from outside OSPF) into Type 5 LSAs or Type 7 LSAs (in NSSAs).

ASBR route summarization does not impact inter-area Type 3 LSAs because ASBRs are responsible for importing and summarizing external routes , not summarizing routes between OSPF areas.

Since the statement refers to configuring route summarization on ASBRs to reduce inter-area Type 3 LSAs , it is incorrect . Route summarization for inter-area Type 3 LSAs must be configured on ABRs, not ASBRs.

Correct Statement: Route summarization on ABRs reduces the number of inter-area Type 3 LSAs.

The command output indicates that the OSPF neighbor state is Full and that the neighbor relationship has been established. The statement confirms that the negotiation process during the exchange of DD (Database Description) packets has determined the role of the router, with the local device becoming the slave in the Master-Slave relationship, which is critical for LSA synchronization. The other options do not align with the output or OSPF principles ​

In STP (Spanning Tree Protocol), Bridge Protocol Data Units (BPDUs) contain critical information used in the election and role assignment process, including:

Root Bridge ID – Identifies the current root bridge.

Root Path Cost – Total path cost to reach the root.

Bridge ID – Unique identifier for each switch. These fields are used to determine port roles (root, designated, etc.) and to elect the root bridge.

Reference from Huawei HCIP-Datacom-Core Technology Study Guide:

“BPDUs carry the root bridge ID, root path cost, sender’s bridge ID, and port ID. These are used in root bridge election and port role determination.”

(Chapter: Layer 2 Technologies – Section: STP Operation)

The CAPWAP heartbeat detection interval is typically multiplied by a predefined factor to determine the switchover time. For instance, in Huawei devices, a common default is three missed heartbeats before a switchover is triggered. With a detection interval of 20 seconds, the switchover occurs after 60 seconds (20 x 3). This ensures that transient network issues do not cause unnecessary switchovers ​.

In OSPF (Open Shortest Path First), each router maintains a Link-State Database (LSDB) , which must be synchronized with other routers in the same area. When an OSPF router receives an LSA (Link-State Advertisement) that it does not already have in its LSDB , it takes the following steps:

It updates its LSDB with the new LSA.

It floods the LSA to all its other OSPF neighbors (except the one from which it received the LSA).

This ensures that all routers in the OSPF area eventually converge to the same network topology.

Reference from Huawei HCIP-Datacom-Core Technology Study Guide:

“When an LSA is received and it is newer or not present in the LSDB, the router updates the LSDB and floods the LSA to other neighbors to ensure database synchronization.”

(Chapter: OSPF Fundamentals – Section: LSDB Synchronization)

If VRRP is not configured to track uplink interfaces, a failure in the master device ' s uplink or link will not trigger a switchover, resulting in a traffic blackhole. The VRRP mechanism relies on interface tracking to monitor connectivity and ensure role transitions upon faults. Without this configuration, no failover occurs, and traffic directed toward the master device is lost ​.

Comprehensive and Detailed Step-by-Step Explanation:

1. What is L2TP (Layer 2 Tunneling Protocol)?

L2TP is a tunneling protocol used to transport Layer 2 frames over IP networks.

It is commonly used to establish VPNs but does not provide built-in encryption or security for the transmitted data.

2. Why L2TP Requires Additional Security Measures:

Since L2TP does not encrypt traffic, it is vulnerable to eavesdropping and tampering.

To secure L2TP tunnels, it is often paired with IPsec, which provides strong encryption and authentication. The combination of L2TP and IPsec is known as L2TP/IPsec .

3. Why the Statement is TRUE:

The statement accurately describes the limitation of L2TP (lack of encryption) and the need for additional security measures like IPsec.

The output shows that the router with the IP 10.0.12.2 is the Backup Designated Router (BDR), as indicated in the State: BDR field. The router ID is 10.0.2.2 , the interface cost is 1, and the IP address of the interface is 10.0.12.2 . Hence, C is the correct answer ​.

Comprehensive and Detailed In-Depth Explanation:

IP Multicast vs. Broadcast:

A. TRUE → Unlike broadcast , which sends data to all hosts in a subnet, multicast only sends data to interested receivers , preventing flooding .

B. TRUE → Multicast optimizes bandwidth usage by sending a single copy of data , which is then replicated at network routers only when necessary .

IP Multicast vs. Unicast:

C. FALSE → Multicast does not improve security ; it may expose data to unintended receivers if not properly controlled .

D. FALSE → Multicast reduces the load on the source because a single data stream serves multiple receivers instead of sending individual unicast streams .

???? Reference: Huawei HCIA-Datacom Study Guide, IP Multicast Principles and Benefits.

 ACL Modification

Named ACLs can be modified after their creation. Unlike numbered ACLs, named ACLs provide greater flexibility for editing individual rules without deleting the entire ACL.

Therefore, the statement is incorrect.

 HCIP-Datacom-Core Reference

The flexibility and editability of named ACLs are discussed in the ACL configuration sections​​.

 RST BPDU Handling

On an RSTP network, if a port receives an RST BPDU and determines its own buffered BPDU is superior, it discards the received BPDU without responding. This ensures stability and proper convergence in the network.

 HCIP-Datacom-Core Reference

BPDU handling is described in the RSTP operation chapters​​.

Comprehensive and Detailed Step-by-Step Explanation:

IS-IS Three-Way Handshake:

IS-IS uses a three-way handshake to establish neighbor relationships.

This process is applied on both point-to-point (P2P) and broadcast network types to confirm bidirectional communication.

P2P Networks:

Routers directly exchange IS-IS Hello (IIH) packets to establish adjacency.

Broadcast Networks:

IS-IS also uses the three-way handshake on broadcast networks to ensure that the Designated Intermediate System (DIS) election and adjacency formation are correct.

AI-driven networks focus on maximizing efficiency by minimizing latency to enhance data processing and decision-making speed. The AI era emphasizes leveraging large data volumes and ensuring rapid data center interconnectivity. This makes low latency a critical requirement for AI-ready data center networks, as highlighted in Huawei ' s AI and data center network optimization materials ​.

1 – Idle

2 – Connect

3 – OpenSent

4 – OpenConfirm

5 – Established

6 – Active

The BGP finite state machine defines how a BGP speaker transitions through various states when establishing and maintaining a BGP session. Below is the role of each state:

Idle (1) – BGP is waiting to start a connection. Initial state of the BGP process.

Connect (2) – BGP initiates a TCP connection to the peer.

OpenSent (3) – TCP connection is established; BGP sends an OPEN message and waits for one from the peer.

OpenConfirm (4) – BGP has received a valid OPEN message and is now expecting a KEEPALIVE.

Established (5) – BGP session is fully established; UPDATE messages can now be exchanged.

Active (6) – If the TCP connection fails in Connect state, BGP transitions to Active and will retry connection.

Reference from Huawei HCIP-Datacom-Core Technology Study Guide:

“BGP goes through the following states in order: Idle → Connect → Active → OpenSent → OpenConfirm → Established. The transition depends on the success or failure of TCP connection setup and BGP message exchanges.”

(Chapter: BGP Principles – Section: BGP State Machine)

 BGP Open Message Components

The Open message contains the following critical parameters:

Local AS Number : The autonomous system of the router.

Router ID : A unique identifier for the router.

Hold Time : The maximum time the router will wait for Keepalive or other messages from its peer.

 Incorrect Option

C. NLRI : Network Layer Reachability Information is not included in Open messages; it is carried in Update messages.

 HCIP-Datacom-Core Reference

The structure and contents of Open messages are explained in BGP protocol details​​.

High-availability Stateful Backup (HSB) ensures synchronization between active and standby devices. If the HSB channel fails to establish, the following causes are possible:

TCP channel not established : The HSB channel relies on a TCP connection. If the TCP session cannot be established, the backup process cannot start.

Mismatched retransmission settings : If the retransmission count and interval for HSB service packets are inconsistent between the two devices, the synchronization process fails.

Incorrect source and destination configurations : If the source IP address and port number on one device do not match the destination IP address and port number on the other, the channel cannot be established.

Option C is incorrect because the priority of the two ACs affects active/standby roles but does not directly impact HSB channel establishment ​.

Comprehensive and Detailed In-Depth Explanation:

BGP uses TCP (not UDP) on port 179 to establish peer relationships.

Peer IP must be routable in both IBGP and EBGP , but BGP does not use UDP connections .

The statement is false because of the incorrect mention of UDP .

???? Reference: Huawei HCIA-Datacom Study Guide, BGP Session Establishment and TCP Usage.

A stateful inspection firewall tracks the state of network connections and only matches the initial packet against its rule set. Subsequent packets in the same connection are matched in the state table. Contrary to this, UDP packets can be inspected by correlating them with connection states, and packets in a single connection are always correlated ​.

 Understanding Router ID and Its Role in OSPF :

In OSPF, the Router ID uniquely identifies a router within the OSPF domain. If two routers are configured with the same Router ID, it can lead to issues such as LSA conflicts and flapping. This is because the Router ID is used as a key in OSPF operations, including LSA generation and database synchronization.

Comprehensive and Detailed In-Depth Explanation:

When a packet is checked against an Access Control List (ACL) , it is processed based on rule matches.

" Unmatched " scenarios occur if:

A. TRUE → The packet does not match any ACL rule .

C. TRUE → No ACL is configured , so there are no rules to match.

D. TRUE → An empty ACL exists , meaning no rules are defined.

B is incorrect because if the packet matches a deny rule, it is " matched " and explicitly dropped , not " unmatched " .

???? Reference: Huawei HCIA-Datacom Study Guide, ACL Rule Matching and Processing Logic.

Comprehensive and Detailed In-Depth Explanation:

In IS-IS , routes are distributed differently based on router levels :

Level-1 (L1) routers → Maintain specific routes only within their own area .

Level-2 (L2) routers → Maintain specific routes for the entire network (inter-area routing).

Level-1-2 (L1/L2) routers → Store both L1 and L2 routes and act as area border routers .

In the diagram, R2 and R3 are L1/L2 routers , meaning they store specific routes for both their area and other areas .

R1 is only an L1 router , meaning it only has intra-area routes , and R7 is an L2-only router , meaning it does not store all specific routes.

Therefore, R2 and R3 have specific routes for the entire network.

???? Reference: Huawei HCIA-Datacom Study Guide, IS-IS Routing Levels and Route Distribution.

The security policy specifies that traffic originating from 12.1.1.2 and destined for the untrust zone is permitted. Since the source address of the packet ( 12.1.1.1 ) does not match this rule, the packet matches the default implicit deny rule. However, rule 1 does not deny all other traffic explicitly, so the packet is forwarded based on further configurations ​.

Comprehensive and Detailed Step-by-Step Explanation:

1. Overview of BFD Optimization:

BFD (Bidirectional Forwarding Detection) is a protocol that provides rapid detection of link failures.

Optimizing BFD involves adjusting parameters to balance between detection speed and network stability.

2. Analysis of Each Statement:

Option A: After a high priority is configured for BFD packets, BFD packets are preferentially forwarded.

Correct (True Statement).

High priority ensures that BFD packets are not delayed or dropped under congestion, improving detection accuracy.

Option B: To quickly learn about the network status and performance requirements, you can set the interval for sending BFD packets to the minimum value.

Incorrect (False Statement).

Setting the interval to the minimum value can lead to excessive BFD session flapping, which may overload the network or cause instability. The interval should be configured based on network requirements and conditions, rather than set to the minimum.

Option C: On a live network, some devices switch traffic only when a BFD session changes to the Up state... configure a delay to compensate for the time difference.

Correct (True Statement).

This is a valid optimization to avoid issues caused by timing mismatches between BFD and routing protocols.

Option D: If a BFD session flaps, master/backup switchovers are frequently performed... set the WTR time.

Correct (True Statement).

The WTR (Wait to Restore) timer helps stabilize BFD by delaying session recovery after a flap, reducing the risk of frequent switchovers.

3. Summary:

The false statement is B , as setting the BFD packet interval to the minimum can destabilize the network.

Comprehensive and Detailed Step-by-Step Explanation:

Firewall Session Table:

A session table is used to track active sessions. If a session remains idle for longer than the configured aging time, it is removed to free resources and enhance security.

TCP Session Timeout:

If the interval between two packets exceeds the session timeout, the firewall deletes the session information, requiring the session to be re-established.

1 → A Startup message with a priority of 255 is received.

2 → A Startup message with a priority less than 255 is received.

3 → A Shutdown message is received.

4 → The Master_Down timer expires, an Advertisement packet with the priority of 0 is received, or a packet with a priority lower than the local priority is received.

5 → A packet with a priority higher than the local priority is received.

6 → A Shutdown message is received.

???? Reference: Huawei HCIA-Datacom Study Guide, VRRP Status Transitions.

Comprehensive and Detailed Step-by-Step Explanation:

1. Understanding the IGMP Group Entry:

The IGMP group entry contains key information about multicast groups on the interface:

Group Address (225.1.1.2): The multicast group address that the user has joined.

Last Reporter (10.1.6.10): The IP address of the last host that sent an IGMP Report message for this group.

Uptime: The duration since the group was first reported.

Expires: The remaining time before the group entry ages out if no further reports are received.

2. Analysis of Each Statement:

Option A: This entry can be used to construct the corresponding (S, G) entry.

Incorrect.

This is a group entry for IGMP, which contains information about the group (G) but does not include a specific source (S). (S, G) entries are created in PIM (Protocol Independent Multicast), not IGMP.

Option B: This entry is created when the device receives an IGMP Join message from a user.

Correct.

IGMP Join messages are used by hosts to signal their intent to join a multicast group. When such a message is received, the group entry is created.

Option C: Expires indicates the aging time of the IGMP group.

Correct.

The " Expires " field shows the remaining time before the group entry ages out if no further IGMP reports are received.

Option D: 225.1.1.2 is the address of the group that the user joins.

Correct.

The " Group Address " field explicitly states that 225.1.1.2 is the multicast group that the user has joined.

3. Summary:

Correct Options: B, C, D

Secure access channels include protocols that encrypt the transmitted data to protect against interception or unauthorized access. HTTPS (HyperText Transfer Protocol Secure) ensures data encryption over web communications, while SFTP (Secure File Transfer Protocol) provides secure file transfer by utilizing SSH for data encryption. Telnet and SNMPv2, on the other hand, lack robust encryption and are considered insecure. Huawei security standards highlight the importance of encrypted communication to prevent data leaks ​.

In VRRP HSB (Hot Standby Backup) mode for WLAN deployments (typically between ACs or access controllers), backup of critical data ensures fast failover and minimal service disruption.

A. Real-time backup – Supported. Configuration and session information are synchronized in real-time between the active and standby ACs.

B. Scheduled synchronization – Not supported . HSB requires instant synchronization, not based on a scheduled time.

C. Batch backup – Supported. Some types of less time-sensitive data (e.g., logs or counters) may be backed up in batches.

D. Cloud backup – Not part of HSB functionality . Cloud backup is a separate mechanism, typically used for archival purposes, not real-time failover.

Reference from Huawei HCIP-Datacom-Core Technology Study Guide:

“VRRP HSB mode supports real-time and batch backup between ACs to protect WLAN services. Scheduled and cloud backups are not part of HSB functionality.”

(Chapter: WLAN Reliability – Section: AC Redundancy and HSB Mechanism)

A Totally Stubby Area in OSPF is a special type of stub area where only intra-area (Type 1) LSAs , router LSAs , and default routes (Type 3 LSA with 0.0.0.0/0) are allowed to be injected. It blocks inter-area routes (Type 3 LSAs for specific prefixes) and Type 5 LSAs (external routes) to reduce the size of the Link-State Database (LSDB) and enhance router performance.

Explanation of the Options:

A. Type 3 specific LSA – ❌ Correct Answer . These LSAs represent inter-area routes. Totally Stubby Areas do not allow Type 3 LSAs for specific routes , only for the default route (0.0.0.0/0).

B. Type 1 LSA – ✅ Allowed. These are Router LSAs generated by routers within the area and are necessary for OSPF to function.

C. Type 3 LSA that describes a default route – ✅ Allowed. This is the only Type 3 LSA permitted in a Totally Stubby Area. It provides a default route (0.0.0.0/0) to reach external destinations.

D. Type 2 LSA – ✅ Allowed if there are broadcast or NBMA networks in the area. These describe the network segment in multi-access environments and are generated by the DR.

Official Huawei Reference:

???? Huawei HCIP-Datacom-Core Technology Study Guide –

Chapter: OSPF Special Areas

" A totally stub area does not allow inter-area Type 3 LSAs or external Type 5 LSAs to enter. Only a default route is injected in the form of a Type 3 LSA (0.0.0.0/0), which greatly reduces the LSDB size. "

???? Also refer to:

Huawei VRP Command Guide > OSPF > Configuration Notes > OSPF Special Areas

Root protection ensures that a designated port does not become a root port by discarding superior BPDUs. However, if superior BPDUs are no longer received, the port can return to its original forwarding state, meaning its role can change. This makes option B incorrect, while the other options correctly describe RSTP behavior ​.

ICMPv6 messages are classified into two types: error messages (e.g., Destination Unreachable, Time Exceeded) and informational messages (e.g., Echo Request, Echo Reply). This classification is fundamental to ICMPv6 ' s operation ​.

IS-IS uses a two-level hierarchy:

Level-1 routers operate within a single area and cannot exchange routing information with routers in other areas directly.

To reach external areas (the IS-IS backbone or other areas), Level-1 routers rely on Level-1-2 routers , which perform inter-area route redistribution.

Therefore, a Level-1 router must use a Level-1-2 router as a gateway to reach destinations outside its own area.

Comprehensive and Detailed In-Depth Explanation:

NET (Network Entity Title) is a special form of NSAP (Network Service Access Point) used in IS-IS routing .

NET consists of three fields :

AFI (Authority and Format Identifier) + IDI (Initial Domain Identifier) + Area Address → Identifies the area .

System ID → Uniquely identifies a router within an area (similar to an OSPF Router ID).

SEL (NSEL - N-selector) → Always 0 in a NET, as IS-IS operates at Layer 3.

Since System ID uniquely identifies a host/router within an area , the correct answer is A .

???? Reference: Huawei HCIA-Datacom Study Guide, IS-IS Addressing and NET Structure.

Inter-area route calculation in OSPF involves Summary LSAs (Type 3) for summarizing routes across areas and ASBR Summary LSAs (Type 4) for locating ASBRs. While Router LSAs and Network LSAs describe the internal structure of an area, they do not directly participate in inter-area route calculation. Thus, the statement that only Router, Network, and Summary LSAs are involved is false ​.

A is correct – Confederations are specifically designed for large-scale BGP deployments where a full IBGP mesh is impractical.

B is correct – Sub-ASs within a confederation establish EBGP-like connections between each other but behave like IBGP within the overall AS. These sub-ASs do not require full-mesh inside the confederation , but EBGP rules are followed between sub-ASs.

C is false – Not all devices need to be reconfigured . Devices within the same sub-AS retain normal IBGP behavior and minimal changes.

D is correct – Confederation is transparent to external peers , so the logical topology remains the same from outside the AS.

Reference from Huawei HCIP-Datacom-Core Technology Study Guide:

“BGP confederation divides an AS into multiple sub-ASs. EBGP-like sessions are established between sub-ASs, while reducing IBGP mesh complexity. The external AS still sees the AS as one unit.”

(Chapter: BGP Scalability Enhancements – Section: Confederation)

 IP Prefix List Matching Conditions

An IP prefix list matches based on:

Mask : Specifies the subnet mask length.

Action : Specifies whether to permit or deny.

Index : Orders the rules within the prefix list.

Port numbers are not applicable as matching conditions in an IP prefix list.

 HCIP-Datacom-Core Reference

IP prefix list configurations are detailed in the routing policy and route filtering chapters​​.

When configuring VRRP, the virtual router priority and virtual IP address are mandatory because they define the VRRP instance and its role within the group. Preemption mode and preemption delay are optional configurations that influence how routers take over the master role when priorities change. These are not mandatory for the VRRP protocol to function ​.

The virtual MAC address for a VRRP virtual router is determined by the formula 00-00-5E-00-01-[VRID in hexadecimal] . For VRID 3, the hexadecimal equivalent is 03 . Thus, the virtual MAC address is 00-00-5E-00-01-03 ​.

A stateful inspection firewall tracks the state of active connections. If a packet matches an existing session in the firewall ' s state table, it is allowed to pass. The diagram indicates that the TCP packet matches the session state, so the firewall forwards it ​.

The scenario describes a mismatch in OSPF network types between two connected routers: one set to Point-to-Point (P2P) and the other set to Point-to-Multipoint (P2MP). While aligning Hello intervals may seem sufficient for establishing an OSPF neighbor relationship, the fundamental mismatch in network types introduces issues.

OSPF Network Types

P2P : Assumes a direct connection with a single neighbor, uses faster convergence and simpler LSDB synchronization.

P2MP : Supports multiple neighbors on a single interface, requiring different handling for DR/BDR roles and LSDB updates.

Impact of Network Type Mismatch

If Hello intervals are aligned, adjacency establishment might occur. However, mismatched network types affect neighbor role assignment and LSDB synchronization.

P2P expects a direct link and would handle updates differently than P2MP, which assumes multiple neighbors. This leads to inconsistencies in route calculation and forwarding.

HCIP-Datacom-Core Reference

OSPF Basics and Configuration ​clearly outlines the criticality of consistent network type configuration for stable OSPF operation.

Lab examples in the HCIP Datacom Lab Guide​further demonstrate the consequences of such mismatches, including unstable neighbor states and incomplete LSDB synchronization.

Hence, the statement that neighbor relationships and LSDB synchronization remain unaffected is incorrect. Proper OSPF operation requires matching network types in addition to aligned Hello intervals.

When OSPF routers exchange LSDBs using Database Description (DD) packets, they first establish a master-slave relationship. The router with the larger Router ID becomes the master, setting the MS (Master/Slave) bit in the DD packets. This hierarchical relationship ensures an orderly exchange of routing information ​.

The Link State ID in a Type 3 LSA (Summary LSA) indicates the network or subnet being summarized, not the router ID of an ABR. All other statements accurately describe OSPF functionality, making D the false statement ​.