Huawei HCSP-Presales-Datacom (New) (H25-521) Certification Sample Questions

01. A regional bank is consolidating its branch applications into a virtualized data center. Its security team proposes keeping the existing design: a firewall pair at the data center border inspects all traffic, and everything inside the border is treated as trusted. The presales engineer notes that most of the new application traffic will flow between web, application and database virtual machines inside the data center.
Why does this observation weaken the border-only design?
a) East-west traffic between internal servers never crosses the border firewall
b) Border firewalls cannot inspect encrypted sessions originating from branch offices
c) North-south traffic will grow faster than the border links can carry
d) VM live migration needs internal traffic to be treated as trusted

02. A healthcare group with a main hospital and several clinics reviews the four-layer architecture of the Xinghe Intelligent Campus Solution. Its main requirement is LAN-WAN convergence between the hospital and the clinics, with end-to-end assurance for video consultations and for senior clinicians treated as VIP users.
In which architecture layer, and with what, does the solution meet this requirement?
a) The access layer, with wireless access for office and branch scenarios
b) The application layer, with digital-map-based intelligent O&M
c) The WAN layer, with SD-WAN converging the hospital and clinic LANs
d) The LAN layer, with VLAN-based routing between clinic sites

03. A university IT director explains that the existing campus was built wired-first, with Wi-Fi added later as a supplement and teaching applications hosted in an on-site data center. Today most students connect over Wi-Fi and the learning platforms run as cloud services. The director asks how Huawei frames this change when positioning the Xinghe Intelligent Campus Solution.
Which framing does Huawei use?
a) From an experience-centric era to a security-centric era
b) From a connectivity-centric era to an experience-centric era
c) From a cloud-centric era back to an on-premises-centric era
d) From a bandwidth-centric era to a cost-centric era

04. A bank's security team has relied for years on signature-based intrusion prevention. Its new situational awareness program adds big data analytics, anomaly detection and machine learning so that the team can flag attack behavior matching no existing signature.
Which of the transformations driven by situational awareness does this change represent?
a) The security goal moving from compliance to defense and deterrence
b) Response moving from manual handling to automatic closed-loop handling
c) Protection moving from the network border to endpoint agents
d) Detection moving from known to unknown threats

05. A manufacturer's data center team is reviewing a microsegmentation proposal. It defines endpoint groups for production MES servers and for office application servers, and it must state which traffic is permitted within and between those groups.
In microsegmentation, which element defines that permitted traffic?
a) A group-based policy (GBP)
b) An endpoint group (EPG)
c) A VXLAN network identifier (VNI)
d) Border firewall security zones

06. A university's security operations team uses its situational awareness platform in three ways: dashboards list the alerts currently active, analysts correlate those alerts to judge which ones belong to one coordinated campaign, and a planning view estimates which faculty servers the campaign is likely to target next.
In Endsley's situational awareness model, which level does the planning view represent?
a) Comprehension (level 2)
b) Projection (level 3)
c) Perception (level 1)
d) Decision and action (level 4)

07. A regional retail chain's operations manager says the current tools show device alarms but never what shoppers or store staff actually experienced. The presales engineer describes the network digital map of iMaster NCE-Campus as giving full visibility at four levels.
Which four levels does the digital map cover?
a) Buildings, floors, rooms and access points
b) Access, aggregation, core, egress
c) Controllers, interfaces, connections and subnets
d) Networks, terminals, users and applications

08. A hotel chain's managed WAN provider polls interface counters on thousands of routers with SNMP every few minutes. Device CPU rises during each poll and short congestion events are missed. The new O&M design must deliver subsecond performance data for long-term trending, and collection must resume on its own after a collector link outage.
Which two design choices meet these requirements?
(Choose two.)
a) SNMP polling at a shorter interval from more collectors
b) SNMP traps for every counter defined in the device MIBs
c) Static telemetry subscriptions configured on the devices
d) Dynamic telemetry subscriptions created by the collector
e) Push-mode telemetry with data organized by YANG models

09. A presales engineer is walking a regional hospital's IT board through the parts of a modern data center. The board wants to know where its patient-records and billing applications would actually run once they move into the new facility.
On which part of the data center are user services such as these deployed directly?
a) General-purpose computing modules
b) High-performance computing modules
c) Storage nodes and their disk arrays
d) The data center network switches

10. At a manufacturing plant, HiSec Insight correlates events on one engineering workstation. The workstation first opened a malicious attachment, then began beaconing to an external server on a regular schedule. The newest alerts show it logging in to several production-line servers with stolen administrator credentials.
Which kill-chain stage do the newest alerts indicate?
a) Command and control (C&C)
b) External penetration
c) Internal diffusion
d) Data sending (exfiltration)