H13-811_V3.5 HCIA-Cloud Service V3.5 Questions and Answers

The correct mechanisms are security groups and network ACLs . A security group contains inbound and outbound access-control rules governing traffic to and from ECS instances associated with the group. Inbound rules regulate traffic entering an ECS, while outbound rules regulate traffic leaving it. Security groups therefore provide the instance-oriented access-control layer within a Huawei Cloud VPC.

Network ACLs operate at the subnet level . A network ACL is associated with one or more subnets and controls traffic entering and leaving those subnets. In the HCIA V3.5 networking architecture, network ACLs complement security groups and provide an additional layer of network protection. Huawei's VPC documentation explicitly presents security groups and network ACLs as complementary controls for comprehensive access management.

IPsec VPN does not serve this role. Its purpose is to establish encrypted network connectivity—for example, between VPCs or between Huawei Cloud and an external network. Fingerprint authentication is likewise not a VPC packet-filtering mechanism.

Therefore, only A and D directly provide inbound/outbound traffic-control functionality for ECS workloads.

Reference topics: VPC Access Control; Security Groups; Network ACLs; ECS Network Security.

===============

The statement is FALSE . Although an ECS group does logically organize ECS instances, its placement behavior is the opposite of what the second sentence states. Huawei Cloud ECS groups support the anti-affinity policy , which is designed to place ECS instances belonging to the same group on different physical hosts .

Anti-affinity is an availability and fault-isolation mechanism. If multiple application instances were placed on one physical server, failure of that host could simultaneously disrupt every application instance. Distributing the ECSs across different hosts reduces this correlated-failure risk and improves service reliability, high availability, and disaster tolerance.

Huawei's ECS documentation explicitly states that ECS groups support the anti-affinity policy and that ECSs in an anti-affinity group are deployed on different hosts. When an existing ECS is added to such a group, Huawei Cloud may even reallocate its host so that the placement requirement can be maintained.

Therefore, the first proposition—an ECS group logically groups ECSs—is valid. However, the assertion that ECSs in that group are created on the same physical server by default contradicts the anti-affinity design. Since the overall statement contains this incorrect condition, the correct answer is FALSE .

Reference topics: ECS Groups; Anti-Affinity Policy; Host Placement; High Availability.

===============

The statement is TRUE because Huawei Cloud NAT Gateway includes both public NAT Gateway and private NAT Gateway functionality. These two service types cover the two network-translation scenarios described.

A public NAT Gateway performs translation between a private VPC network and the Internet. Through SNAT, servers with private IP addresses can share Elastic IP addresses to access public networks. Through DNAT, internal servers can provide externally accessible services using public addresses.

A private NAT Gateway performs address translation between private networks. Huawei Cloud describes private NAT gateways as enabling servers in a VPC to communicate with on-premises data centers or other VPCs while translating private addresses to transit IP addresses. This is particularly valuable during network migration, address-overlap resolution, and hybrid-cloud integration.

Huawei's official NAT Gateway comparison therefore states that a public NAT Gateway connects a private network to the Internet, whereas a private NAT Gateway connects private networks.

The statement deliberately describes the NAT Gateway service family rather than only public NAT. Since Huawei Cloud provides translation in both private-to-private and private-to-public architectures, the proposition is correct.

Reference topics: NAT Gateway; Public NAT Gateway; Private NAT Gateway; SNAT; DNAT.

===============

Options B and C are incorrect because they reverse the isolation characteristics of IAM projects and enterprise projects . Huawei Cloud defines enterprise projects as a mechanism for grouping and managing resources across regions. Resources assigned to different enterprise projects are logically isolated , and a single enterprise project can contain resources residing in multiple regions. Supported resources can also be added to, removed from, or transferred between enterprise projects. Consequently, statements A and D correctly describe Enterprise Project Management.

IAM projects operate differently. Huawei Cloud documentation states that IAM projects are region-oriented and are used to group and physically isolate resources within a region . A project corresponds to a region, and an IAM project does not provide the cross-region logical grouping model associated with enterprise projects.

Therefore, B is wrong because it attributes physical, same-region isolation to enterprise projects, while C is wrong because it attributes logical isolation to IAM projects. The two concepts are intentionally distinguished in Huawei Cloud architecture: IAM project = regional/physical isolation; enterprise project = cross-region/logical resource organization .

Reference topics: IAM Projects; Enterprise Projects; Resource Isolation; Enterprise Management.

===============

For the HCIA-Cloud Service V3.5 curriculum version , statements A, B, and C are correct . An ECS must be associated with a security group so that inbound and outbound network access can be controlled. If an account has no custom group, Huawei Cloud provides a default security group, and users can either use that default group or create and select another security group that matches the workload's security requirements.

The V3.5-era Huawei Cloud VPC documentation distinguishes security groups from network ACLs by stating that security groups provide allow rules , whereas network ACLs provide both allow and deny rules. This distinction is important because it appears repeatedly in the HCIA V3.5 networking curriculum.

Statement D is false. Huawei Cloud specifically permits administrators to modify existing rules or add rules to the default security group . The default group itself cannot normally be deleted, but that restriction does not make its inbound or outbound rules immutable. Huawei's default-security-group documentation explicitly distinguishes group deletion restrictions from rule modification permissions.

Reference topics: VPC Security Groups; ECS Network Configuration; Default Security Group; Security Group Rules.

===============

All four operations are supported management actions for Huawei Cloud RDS instances, subject to the applicable database engine, instance type, current status, and other service constraints.

Changing the failover priority is supported for primary/standby RDS deployments. Huawei allows administrators to prioritize either Reliability , which emphasizes data consistency, or Availability , which emphasizes service continuity during failover.

Deleting a DB instance is a standard lifecycle-management operation available to appropriately authorized users. Huawei's RDS permission model includes the rds:instance:delete action for this purpose.

Scaling up storage space is likewise an established RDS modification operation. Administrators can increase allocated storage when database capacity requirements grow, and supported database engines can also provide storage autoscaling options.

Finally, rebooting a DB instance is a supported administrative action used when configuration changes, troubleshooting, or other operational circumstances require an instance restart. Huawei's CTS integration explicitly identifies both scaling storage and restarting an instance as auditable RDS operations.

Huawei's RDS API catalog lists deleting, scaling storage, rebooting, and changing failover priority as supported instance-management operations.

Reference topics: RDS Instance Management; Failover Priority; Storage Scaling; DB Instance Reboot; DB Instance Deletion.

Option C is incorrect under the HCIA-Cloud Service V3.5 networking model . Huawei Cloud's V3.5-era VPC documentation differentiates the two access-control mechanisms by their scope and rule behavior: security groups protect cloud server instances and use allow rules, whereas network ACLs protect subnets and support both allow and deny rules . Therefore, the statement that both mechanisms support both rule actions is inconsistent with the curriculum version used by this examination.

Option A is correct because a network ACL is associated with one or more subnets and controls traffic entering or leaving those subnets. Option D is also correct because security groups provide instance-level access control for resources such as ECSs. Huawei describes a security group as a collection of traffic-control rules applied to instances sharing common security requirements.

Option B is technically correct because these mechanisms can be layered. A security group provides access control around ECS instances, while a network ACL adds another security-control boundary around the subnet. Huawei specifically recommends using them together where comprehensive or fine-grained network protection is required.

Reference topics: Security Groups; Network ACLs; VPC Access Control; Defense-in-Depth.

===============

Options B, C, and D identify problems that CDN architecture is designed to mitigate. Huawei defines CDN as an intelligent virtual network built on Internet infrastructure that caches origin content on geographically distributed points of presence close to users. This substantially shortens the network path between users and frequently requested resources.

Consequently, CDN improves download speed because users can retrieve cached files from a nearby edge PoP rather than repeatedly crossing long-distance networks to the origin server. It also addresses slow website access by accelerating static content delivery, reducing latency, and improving site response and availability. Huawei specifically states that CDN breaks through bottlenecks associated with limited bandwidth, high access traffic, and uneven network-node distribution.

Caching popular content at edge nodes also reduces repeated traffic flowing through core and backbone networks. This alleviates bandwidth pressure on both the origin infrastructure and long-distance network paths.

Option A is not a CDN problem statement. CDN commonly reduces origin-server load , meaning utilization of origin resources may decrease rather than fixing a problem described as “low server utilization.” Its purpose is acceleration and traffic offloading, not increasing server utilization.

Therefore, B, C, and D are correct.

Reference topics: Content Delivery Network; Edge Caching; Website Acceleration; Download Acceleration; Origin Traffic Reduction.

===============

The correct answer is D. Available. Huawei Cloud uses Cloud Backup and Recovery to create backups of EVS disks, and the source disk must be in an operational state that permits a consistent backup operation. Huawei's official CBR and EVS documentation states that EVS disk backups can be created when disks are in the Available or In-use state.

Of the states listed in this question, only Available qualifies. A disk in the Creating state has not completed provisioning. A disk in the Deleting state is being removed and cannot serve as a stable backup source. “Deletion failed” represents an exception condition requiring remediation rather than a valid backup state. Huawei's disk-status guidance instructs administrators to troubleshoot a disk in the Deletion failed state rather than perform normal storage operations on it.

An Available disk has completed creation, is not currently attached for active I/O, and is accessible for supported management operations. Huawei Cloud can therefore associate it with a disk backup vault and create a CBR backup.

Although In-use would also be supported if included among the options, it is absent here. Consequently, Available is the only valid selection.

Reference topics: EVS Disk States; CBR Cloud Disk Backup; Backup Prerequisites.

===============

The statement is TRUE . Huawei Cloud Image Management Service supports creating private images from external image files, with OBS serving as the staging storage location for those files. The documented workflow is to prepare the source image, upload the image file to an appropriate OBS bucket, and then register or import that file through IMS as a private image.

Huawei's IMS documentation explicitly describes the scenario as registering an image file that has been uploaded to an OBS bucket as a private image . During image creation, the administrator selects Import Image or Image File as the source, selects the OBS bucket containing the prepared file, and then selects the required file.

Supported formats and detailed constraints depend on the image type and import method. For example, standard system-disk image imports and optimized fast-import workflows have specific requirements concerning image formats, file size, operating system, and bucket storage class. However, these restrictions do not change the fundamental integration represented in the question.

OBS therefore provides object storage for the source image file, while IMS performs image registration and lifecycle management. The resulting private image can subsequently be used to provision identically configured ECS instances.

Reference topics: Image Management Service; Creating Private Images; Importing Image Files; OBS and IMS Integration.

===============

Option A is the only sequence that respects the essential dependency chain for Huawei Cloud Log Tank Service host-log collection. A log group must exist before its log stream can be created , because a log stream is a subordinate storage and management unit within a log group. Huawei explicitly describes log groups and streams as the basic units used to manage logs and requires creation of the group before creation of its contained stream.

ICAgent is the host-side log collection component. It must be installed on the ECS before LTS can collect host log files according to configured paths and rules. After ICAgent is operational and the destination log stream exists, the administrator configures the relevant collection paths, parsing/collection rules, and ingestion configuration. ICAgent then packages and reports matching log records into the selected log stream.

Only after ingestion has been configured can the administrator reliably access LTS and view the collected logs for searching, analysis, monitoring, troubleshooting, or O & M.

The other alternatives violate basic dependencies by attempting to create a stream before its parent group, configuring collection before the required destination/agent exists, or installing ICAgent after collection configuration.

Reference topics: Log Tank Service; Log Groups; Log Streams; ICAgent; ECS Log Collection.

===============

Statement C is false because it gives the definition of a shared image rather than a private image. Huawei Cloud defines a private image as an image available to the user who created it. Such an image can contain an operating system, pre-installed public applications, service data, and the user's own applications. It is commonly used to rapidly create identically configured ECS instances.

A shared image , conversely, is a private image that another Huawei Cloud user has explicitly shared with the recipient. Therefore, saying that “a private image is shared by other users” reverses these concepts.

Option A is correct. Huawei describes Marketplace images as third-party images containing an operating system, application environment, and software already installed, allowing rapid deployment of application environments.

Option B is also correct: public images are standardized system images provided by the cloud platform and made available broadly to customers.

Option D conforms to Huawei IMS sharing restrictions. Huawei Cloud specifies that encrypted images cannot be directly shared with other tenants; an encrypted image must first be replicated as an unencrypted image if sharing is required.

Thus, C is the single incorrect statement .

Reference topics: Image Management Service; Public Images; Private Images; Shared Images; Marketplace Images; Image Encryption.

===============

All four options are valid Huawei Cloud CTS functions. Trace recording provides the fundamental audit capability: CTS records system-triggered operations as well as operations performed through the console or APIs. These records enable accountability, troubleshooting, security investigation, and compliance auditing.

Trace query allows users to retrieve and filter recent operation records directly on the CTS console according to attributes such as resource type, operator, trace source, operation status, and time.

Trace transfer supports longer-term preservation. CTS compresses recorded traces into trace files and periodically transfers them to configured storage or logging destinations, including OBS or LTS depending on tracker configuration.

Trace file encryption is also explicitly supported. Huawei's current CTS documentation states that trace files can be encrypted using keys provided through Data Encryption Workshop during the transfer process. This protects audit information at rest and provides stronger security for retained operation records.

This question differs slightly from asking only for the three foundational audit-processing functions; it asks broadly which options are functions of CTS , and Huawei's official function list includes encryption in addition to recording, querying, transfer, and key event notification.

Therefore, A, B, C, and D are all correct .

Reference topics: Cloud Trace Service Functions; Trace File Encryption; Trace Recording; Trace Transfer; Trace Query.

1 → No configuration is required

2 → Configure a VPC peering connection

3 → Create a VPN

The mappings follow Huawei Cloud's VPC connectivity rules. ECS-C and ECS-D are deployed in the same VPC , so their private network traffic can use the VPC's internal routing directly. Provided the applicable security-group rules allow the traffic, no additional VPC interconnection mechanism is required.

ECS-A and ECS-B are in different VPCs but in the same CN North-Beijing4 region. Huawei Cloud VPC peering is specifically designed to connect two VPCs in the same region using private IP addresses. Huawei documentation states that VPC peering is region-scoped and enables resources in the two peered VPCs to communicate after the required routes are configured.

ECS-A and ECS-C are located in different regions. The HCIA V3.5 networking design uses VPN for this scenario. Huawei's official VPN documentation specifically describes establishing VPN gateways and VPN connections between two VPCs in different regions, providing an encrypted communication channel across the Internet.

Therefore, the required sequence is same VPC → no additional configuration; same-region different VPCs → peering; cross-region VPCs → VPN .

Reference topics: VPC Communication; VPC Peering; VPN; Intra-VPC Networking.

===============

The statement is FALSE because directly binding an EIP to an ECS is only one of several Huawei Cloud mechanisms for providing Internet access. An ECS with its own EIP can communicate directly with the public network, but ECSs can also access the Internet without having an EIP individually bound to each server .

The principal alternative is a public NAT Gateway using an SNAT rule . Huawei Cloud states that servers in a VPC subnet can share an EIP through a public NAT gateway. The NAT gateway translates their private source addresses into the configured public EIP, enabling outbound Internet connectivity while avoiding the need to expose or allocate an individual public IP address to every ECS.

Huawei's ECS documentation also explicitly describes “Internet connectivity for an ECS without an EIP bound” and recommends NAT Gateway as the standard solution. A proxy/SNAT ECS can also provide an Internet access path in suitable architectures.

Therefore, binding an EIP directly to the ECS is a valid method, but it is not the only method , making the statement false.

Reference topics: Elastic IP; Public NAT Gateway; SNAT; ECS Internet Connectivity; VPC Networking.