H13-527_V5.0 HCIP-Cloud Computing V5.0 Questions and Answers

The best verified answer is A, B, and D . Huawei networking documentation shows that Internet access troubleshooting for cloud resources commonly involves checking whether an EIP is bound or whether a NAT gateway is configured , which supports A . Huawei guidance also explicitly refers to selecting or checking an appropriate EIP bandwidth , which supports D as a normal troubleshooting item.

Huawei documentation also shows that network ACL rules are part of VPC access control and can affect connectivity. Because network ACLs are stateless and traffic validation depends on rule direction, checking ACL rules is a reasonable O & M troubleshooting operation. In your option wording, inbound rules are still part of that validation scope, so B is acceptable.

By contrast, checking route configurations on core switches is not the standard first-line troubleshooting action for tenant-side VPC Internet access in Huawei Cloud Stack service O & M. The cloud service boundary is usually diagnosed first through NAT, ACL, and EIP-related configuration. Therefore, the verified answer is A, B, and D .

The correct answer is D. Virtual Private Network (VPN) . Huawei’s official HUAWEI CLOUD Stack VPN documentation states that a VPN connection is an encrypted communications channel established between the VPN gateway in a VPC and the gateway in an external or local data center. Huawei also describes VPN as a way to connect a local data center to cloud resources through a secure and reliable encrypted tunnel over the Internet . This directly matches the requirement in the question for encrypting connections between cloud resources and local data centers.

By contrast, Direct Connect provides a dedicated, high-speed, low-latency connection, but the cited Huawei description emphasizes dedicated connectivity and stability rather than the VPN-style encrypted tunnel itself. EIP is only a public IP addressing service, and VPCEP is used for private access to services, not site-to-cloud encrypted interconnection. For small- and medium-sized enterprises that want a practical, secure, and relatively simple hybrid-cloud connection, Huawei documentation supports VPN as the best fit. Therefore, the verified answer is D .

In OpenStack, Keystone is the Identity service responsible for authentication and authorization. A core Keystone concept is that permissions are not usually granted directly to a user; instead, users are assigned one or more roles, and those roles are associated with a project, domain, or system scope. OpenStack’s official Keystone documentation states that the Identity service assigns roles to users, and a user can have different roles in different projects. It also explains that default roles such as admin, member, and reader are used to control what actions a user can perform. This means the statement is correct: Keystone users are assigned roles, and those roles determine their permissions.

This is also consistent with Huawei Cloud’s identity and permission model, where permissions are controlled through assigned authorization policies and identities use tokens containing identity and permission information when accessing services. In practical Huawei Cloud Stack and OpenStack-based environments, role-based access control is the standard method for defining what a user is allowed to do. Therefore, the correct answer is TRUE .

AS group → A set of instances with the same application scenario

AS policy → Specify the conditions for triggering an AS action

AS configuration → Define the specifications of the instance to be added

AS action → Its purpose is to keep the number of instances in the application system the same as expected

Comprehensive and Detailed 150 to 200 words of Explanation From HUAWEI CLOUD Computing Topics:

This matching is consistent with Huawei’s official Auto Scaling concept definitions. Huawei states that an AS group consists of a collection of instances that apply to the same application scenario , so that description belongs to AS group . Huawei also explains that an AS policy specifies the conditions for triggering a scaling action , which makes the second match straightforward.

Huawei’s Auto Scaling documentation further distinguishes AS configuration from policy and action. The configuration defines the template or specifications for the instances that will be added during scaling, so define the specifications of the instance to be added correctly matches AS configuration . Finally, Huawei defines a scaling action as adding or removing ECS instances from an AS group, and states that its purpose is to keep the number of instances in the application system at the expected level. That directly matches the final description.

So the verified drag-and-drop mapping is: group = instance set , policy = trigger condition , configuration = instance specification , and action = maintain expected instance count .

The best verified answer is A and D . Huawei’s official EVS documentation states that the major disk performance metrics include IOPS, throughput, and latency . Among the options given in your question, throughput is therefore definitely one of the major EVS disk metrics. ( ; )

In addition, Huawei EVS usage materials consistently treat capacity as a core disk attribute when defining EVS disks and their sizing. Although capacity is not a performance metric like throughput, exam questions of this type often use “major metrics” more broadly to mean the key measurable characteristics users pay attention to when selecting disks. By contrast, maximum snapshots is a feature limit rather than a primary disk metric, and endurance is not listed by Huawei as one of the standard major EVS disk metrics in the product guidance cited above.

So based on Huawei documentation and the exam-style wording, the most defensible answer is A and D : Throughput and Capacity . ( )

========

The correct fill-in answer is FTP. Huawei documentation for image registration on Service OM shows that images can be uploaded using different modes, including local upload, FTP, and NFS. The guidance indicates that for larger image files, administrators should use a network-based upload mode rather than simple local browser upload. In the Huawei document snippet, the upload options explicitly include NFS, and the paired option used in this context is FTP, which matches the exam sentence structure: “select ____ or NFS.”

This makes sense operationally in HUAWEI CLOUD Stack because large image files are more reliably transferred through shared file or server-based methods, especially in enterprise O & M scenarios. Local browser-based uploads are less suitable for very large images due to session stability, browser limits, and transfer reliability. Using FTP or NFS improves image registration efficiency and reduces the chance of interrupted uploads during image onboarding. Therefore, after correcting the sentence, the blank should be filled with FTP.

========

The correct answers are B, C, and D. Huawei’s official resource-analysis documentation states that bottleneck resources can be identified and analyzed globally and by VDC, resource pool, and application. This directly matches options B, C, and D in your question.

Although Huawei also has resource-pool analysis views that can monitor resources from multiple dimensions such as region, resource pool, and AZ, the specific wording for bottleneck analysis in the cited Huawei documentation highlights application, VDC, and resource pool as the relevant factors used for bottleneck identification and analysis. That is why AZs should not be selected for this particular question.

So, after correcting the sentence structure, the supported dimensions for bottleneck-related analysis by O & M administrators are applications, VDCs, and resource pools. Therefore, the verified answer is B, C, D.

========

Developers → Users can only log in to the ECS using VNC. They cannot change the ECS specifications.

O & M personnel → An ECS can be restarted, but the system or software version cannot be upgraded.

Financial personnel → Users can only view cost reports. They cannot perform operations on resources.

This matching follows the least-privilege principle used in HUAWEI CLOUD Stack permission design. Huawei documentation emphasizes separating user responsibilities and assigning permissions based on operational roles, so users receive only the minimum capabilities required for their work. Huawei also describes resource grouping and user-group-based authorization as a standard way to control who can apply for or manage resources.

Based on that model, financial personnel should have the narrowest access, limited to viewing cost reports without operating resources. Developers usually need access to instances for testing or development work, but under minimum-permission security they should not be allowed to alter infrastructure specifications, so VNC-only login without ECS specification changes is the best match. O & M personnel need more operational control than developers, such as basic restart capability, but under minimum permissions they still should not perform higher-risk actions like upgrading the system or software version unless explicitly authorized. This division reduces accidental changes, lowers operational risk, and aligns with Huawei Cloud Stack’s role-based access and tenant/resource governance approach.

The correct answer is C. show . Official OpenStack command-line documentation explicitly lists the command openstack server show < server > and explains that it is used to show server details . The same documentation states that the < server > argument represents the server name or ID , which matches the wording in your question exactly.

The other options are not correct in this context. openstack server list displays a list of servers rather than the details of one specific instance. query and conf are not valid standard subcommands for this OpenStack server-detail operation. Since HUAWEI CLOUD Stack operations in this area follow OpenStack command syntax for instance inspection and lifecycle management, the proper command for viewing one instance’s details is openstack server show < server > .

Therefore, after correcting the sentence format, the blank should be filled with show , and the full verified command is openstack server show < server > . That makes the correct answer C .

========

The correct fill-in answer is PB level . Huawei’s official HUAWEI CLOUD Stack SFS documentation states that the maximum capacity of a single file is 240 TB , and it further explains that the file system capacity can be scaled to the PB level . This is the exact Huawei wording used to describe the upper expansion capability of SFS.

This reflects the design goal of SFS in Huawei Cloud Stack: to provide managed, shared file storage for applications that require large-scale file-system growth over time. In other words, the size of one individual file and the total expandable capacity of the file system are two different things. A single file has a stated upper limit, but the whole file system can continue to grow far beyond that limit, reaching petabyte-scale capacity

Therefore, after correcting the sentence structure, the blank should be filled with PB level , which is the official Huawei description of the scalable upper capacity for the file system.

========

Domain → A top-level container that is globally unique in Keystone

Role → Permission set

Endpoint → External access address of a single service

Group → User set

These matches are consistent with official OpenStack Keystone identity concepts. OpenStack documentation defines a group as a collection of users , so “user set” is the correct description for Group . It also explains that a role is used in Keystone’s RBAC model to represent a set of permissions that can be assigned to users or groups, so Role → Permission set is correct.

For Endpoint , OpenStack service configuration documentation describes endpoints as the network-accessible API addresses used to access a service, which matches external access address of a single service .

For Domain , Keystone identity documentation explains that domains are top-level containers used to organize projects, users, and groups. In practice, a domain is a globally unique administrative boundary in Keystone, which matches the description a top-level container that is globally unique in Keystone .

So the final verified mapping is: Domain → top-level container , Role → permission set , Endpoint → service access address , and Group → user set .

The correct answer is B. BMS . For a typical web application architecture on HUAWEI CLOUD Stack, ECS provides the compute instances, IMS provides reusable images for quick deployment, AS enables elastic scale-out and scale-in based on demand, and ELB distributes traffic and improves availability. Huawei’s ECS and IMS documentation explicitly notes that ECS images can be used with Auto Scaling for dynamic expansion to meet peak demand, which directly supports quick deployment and elasticity.

BMS is a dedicated bare-metal service intended for scenarios needing direct physical hardware access, stronger isolation, or reduced virtualization overhead. It is useful for special workloads, but it is not required for the classic goals listed in the question, especially high cost-effectiveness and fast elastic web scaling. Those goals are more naturally achieved with ECS-based architectures plus ELB and AS. Huawei’s BMS positioning emphasizes physical-server management and performance advantages, not being a necessary part of a standard web application elasticity stack. Therefore, among the listed services, the one that is not required is BMS , making B the verified answer.

========

The correct answer is B. L3 Agent . Official OpenStack Neutron documentation states that routers provide virtual Layer 3 services such as routing and NAT , and that the Networking service uses a layer-3 agent to manage routers. OpenStack also explicitly says that the neutron-l3-agent uses the Linux IP stack and iptables to perform L3 forwarding and NAT . This directly matches the wording of the question.

The other options do not fit. The L2 agent handles local virtual switch configuration and Layer 2 networking behavior, not routing and NAT. The DHCP agent provides DHCP services to tenant networks. “ NAT Agent ” is not the standard Neutron component name used in official OpenStack architecture. OpenStack documentation consistently identifies the L3 agent as the component responsible for router namespace management, forwarding, floating IP behavior, and source NAT functions.

This is also consistent with Huawei Cloud Stack networking architecture topics, where routing and NAT functions are tied to Neutron Layer 3 services. Therefore, the fully verified answer is B. L3 Agent .

The correct answer is B. ML2 Plugin . In OpenStack Neutron, ML2 stands for Modular Layer 2 and is the main core networking plugin framework used to support different network types and mechanism drivers. Official OpenStack documentation describes ML2 as a plug-in with components for network types and mechanisms, not as a service plugin .

Service plugins in Neutron are different. They add higher-level networking services beyond basic Layer 2 connectivity. OpenStack deployment documentation shows optional service areas such as load balancing and virtual private network services, and Neutron’s router-related functionality is commonly associated with the L3 service plugin . These are examples of service plugins layered on top of the core networking plugin model.

So the key distinction is this: ML2 is the core plugin architecture , while L3, VPN, and load balancing belong to the service-plugin category. In Huawei Cloud Stack networking topic coverage, this separation between the core Neutron plugin and optional service plugins is also fundamental. Therefore, the option that is not a service plugin is B. ML2 Plugin .

========

The correct answers are B and C . Huawei documentation states that a security group is a collection of access control rules used to protect cloud servers or instances added to that group. Huawei also describes a network ACL as a security service for VPCs or subnets , which means it protects traffic at the subnet level rather than directly protecting individual instances. That makes C correct.

Huawei’s comparison guidance also distinguishes the way rules are processed. Security groups are stateful and their rules work together as a combined access-control set, while network ACLs are processed according to rule priority , which makes B correct. The official Huawei comparison page explicitly frames network ACLs as an additional security layer on top of security groups.

Option A is incorrect because network ACLs are not mandatory by default in the same way security-group association is standard for instances. Option D is not supported by the Huawei VPC/network ACL documentation cited here; the docs emphasize instance-vs-subnet scope and rule handling, not that exact 5-tuple versus 3-tuple split for these two features. Therefore, the best verified answer is B, C .

========