Free Huawei H13-811_V3.5 Practice Exam with Questions & Answers | Set: 2

The correct advantages are B, C, and D. Huawei Cloud EVS provides a range of disk specifications and performance classes so customers can select storage appropriate for different workloads and budgets. Huawei's EVS overview explicitly lists various disk types and high security/reliability among its principal benefits.

EVS is also easier to manage than traditional physical storage. Huawei documentation comparing EVS with traditional hard disks states that EVS disks provide higher reliability and I/O throughput and are easier to use. Cloud-based provisioning eliminates much of the physical installation, replacement, cabling, and capacity-management work associated with conventional disks.

Option A is incorrect. EVS is block storage intended for cloud servers and cannot be used independently. Huawei explicitly states that EVS disks must first be attached to a supported server and then initialized, partitioned, and formatted before applications can persist data on them.

High reliability derives from distributed storage and data-protection mechanisms, while the range of available disk classes enables workload-specific performance selection.

Therefore, various disk types, ease of use, and high reliability are advantages; independent use is not.

Reference topics: EVS Advantages; Block Storage; EVS Reliability; EVS Disk Types.

===============

Option A is correct . Huawei Cloud Elastic Load Balance provides several traffic-distribution algorithms, including weighted round robin, weighted least connections, and source IP hash for shared load balancers. When backend servers have equal weights under weighted round robin, they receive an equal proportion of requests, providing the even traffic distribution described in the question.

Auto Scaling and ELB are explicitly integrated. When an AS group is associated with a load balancer, Huawei Cloud automatically associates newly added ECS instances with the load balancer and removes the association when instances leave the AS group. Therefore, option C is false; administrators do not need to manually register each dynamically created instance one by one.

Option B is incorrect in this context because the load balancer and its AS resources operate within the applicable regional/VPC deployment architecture; a standard shared ELB is not a mechanism for arbitrary cross-region backend distribution. Option D is also false because detecting unhealthy instances depends upon an enabled health-check mechanism. Disabling health checking removes the basis for making that health determination.

Reference topics: Elastic Load Balance; Auto Scaling and ELB Integration; Backend Servers; Load Balancing Algorithms.

===============

Option A is not a main WAF function . Huawei Cloud Web Application Firewall is an application-layer web protection service . It analyzes HTTP and HTTPS traffic and protects websites against threats such as SQL injection, cross-site scripting, command injection, malicious bots, scanners, CC attacks, and other web exploits.

Huawei explicitly lists information leakage prevention , web tamper protection , and anti-crawler protection among WAF's protection functions. Information leakage prevention can mask or block sensitive information such as ID numbers, phone numbers, and email addresses. Web tamper protection prevents unauthorized modification of protected static website pages. Anti-crawler protection identifies and mitigates malicious automated crawler behavior.

Brute-force attacks against ECS operating-system or application accounts , however, fall primarily under Host Security Service (HSS) . Huawei documents HSS detection and blocking capabilities for brute-force attacks involving services such as SSH, RDP, MySQL, SQL Server, and FTP.

WAF can mitigate certain web-based authentication abuse using web rules and rate controls, but generic ECS account brute-force protection is not the WAF function described here.

Therefore, the required answer is A .

Reference topics: Web Application Firewall; Information Leakage Prevention; Web Tamper Protection; Anti-Crawler; Host Security Service.

===============

Option A is incorrect because it confuses full-access permissions with a read-only role. In Huawei Cloud IAM, a permission whose name contains FullAccess normally represents full or administrator-level permissions for the corresponding service. For example, IAMFullAccess provides full permissions for IAM operations rather than read-only access.

Huawei Cloud separately defines Tenant Guest as providing read-only permissions for cloud services other than IAM. This distinction is important in HCIA IAM authorization concepts: FullAccess and ReadOnlyAccess represent materially different privilege levels.

The remaining statements correctly describe Huawei Cloud authorization. IAM supports roles and policies as authorization mechanisms, with policies providing more fine-grained control. User groups provide an efficient way to authorize multiple IAM users: an administrator assigns permissions to a group and then places users in that group, after which the users inherit the group's permissions. Finally, an IAM user can perform only the cloud-service operations allowed by the permissions granted to that identity.

Thus, option A incorrectly assigns the behavior of a read-only permission model to FullAccess and is the required answer.

Reference topics: IAM Permissions; Roles and Policies; User Groups; FullAccess; Tenant Guest.

===============

The statement is FALSE . Huawei Cloud explicitly supports using VPN to establish communication between VPCs deployed in different regions . The Huawei Cloud VPC FAQ describes this architecture directly: VPCs in the same region can be connected by VPC peering, while VPCs in different regions can establish connectivity through VPN. In the VPN design, each VPC uses a VPN gateway, and the two gateways establish an encrypted connection over the Internet. The VPC CIDR blocks are configured as the local and remote subnets.

This distinction is central to the HCIA V3.5 networking domain. VPC peering is region-scoped : two VPCs connected through a peering connection must reside in the same region. VPN, by contrast, can establish encrypted connectivity between geographically separated VPC networks. Huawei's VPN documentation specifies creating a VPN gateway for each VPC, creating VPN connections, configuring the peer gateway EIP, defining peer subnets, and applying matching cryptographic parameters.

Consequently, saying that Huawei Cloud VPN “does not support” cross-region VPC communications directly contradicts the supported VPN deployment model.

Reference topics: Virtual Private Network; Cross-Region VPC Connectivity; VPC Peering; VPN Gateways.

===============

Statements B and C are false . Huawei Cloud distinguishes alarm-based, scheduled, and periodic Auto Scaling policies. An alarm policy triggers a scaling operation in response to monitored metrics such as CPU utilization. Scaling “every three hours” is time-interval behavior and therefore belongs to a periodic policy , not an alarm policy. This makes B incorrect.

Statement C is also incorrect. The expected number of instances is the desired number of ECS instances that should currently run within an AS group. Huawei specifies that this value must remain between the configured minimum and maximum instance counts. It can be modified manually or changed through scheduled, periodic, or alarm-based policies. It is not synonymous with the minimum instance count during peak hours.

Statement A is valid because an AS configuration can use a Huawei Cloud public image; Huawei's AS configuration parameters explicitly support public, private, and shared images.

Statement D is also valid. Huawei specifies that when an existing ECS is manually added to an AS group, the ECS must not already be a member of another AS group .

Consequently, the two false statements are B and C .

Reference topics: Auto Scaling Configurations; AS Policies; Expected Instances; AS Groups.

===============

1 → B

2 → C

3 → A

The mappings follow Huawei Cloud's LTS architecture exactly. A log group is the fundamental management unit used by LTS to organize logs. Huawei defines a log group as the basic unit for managing logs; it can contain multiple log streams and is primarily an organizational container rather than the location from which individual log records are read or written.

A log stream is the basic unit for reading and writing log data. Different categories of logs can be stored in separate streams within the same group, which improves log classification, searching, analysis, and O & M management.

ICAgent is the collection component. Huawei explicitly describes ICAgent as a log collection tool for LTS that runs on hosts from which logs need to be collected, including ECSs and physical servers. LTS distributes collection configurations to ICAgent, and ICAgent detects matching log files and reports the records to the specified log stream.

Therefore, the correct relationship is Log stream → read/write; ICAgent → collection; Log group → management .

Reference topics: Log Tank Service; Log Groups; Log Streams; ICAgent; Host Log Collection.

===============

The correct mechanisms are security groups and network ACLs . A security group contains inbound and outbound access-control rules governing traffic to and from ECS instances associated with the group. Inbound rules regulate traffic entering an ECS, while outbound rules regulate traffic leaving it. Security groups therefore provide the instance-oriented access-control layer within a Huawei Cloud VPC.

Network ACLs operate at the subnet level . A network ACL is associated with one or more subnets and controls traffic entering and leaving those subnets. In the HCIA V3.5 networking architecture, network ACLs complement security groups and provide an additional layer of network protection. Huawei's VPC documentation explicitly presents security groups and network ACLs as complementary controls for comprehensive access management.

IPsec VPN does not serve this role. Its purpose is to establish encrypted network connectivity—for example, between VPCs or between Huawei Cloud and an external network. Fingerprint authentication is likewise not a VPC packet-filtering mechanism.

Therefore, only A and D directly provide inbound/outbound traffic-control functionality for ECS workloads.

Reference topics: VPC Access Control; Security Groups; Network ACLs; ECS Network Security.

===============