Huawei VRP AAA Domain Authentication Scheme Overwrite Behavior
Short answer
D The authentication scheme au2 is used for authentication because the last configured scheme overwrites previous bindings in the AAA domain.
Question
[RTA]aaa
[RTA-aaa]domain huawei
[RTA-aaa-domain-huawei]authentication-scheme au1
[RTA-aaa-domain-huawei]authentication-scheme au2
Key Takeaways
The main trap is assuming that multiple authentication schemes can coexist or provide fallback. In reality, each new
authentication-schemecommand replaces the previous binding entirely.
This question examines Huawei VRP AAA domain configuration where multiple authentication schemes are applied sequentially. The correct answer is D, as the last configured scheme (au2) takes precedence and overwrites the previous one (au1).
Common mistake: Option A is the most plausible wrong answer. Candidates may incorrectly assume that deleting the active scheme (`au2`) causes the system to revert to the previously configured scheme (`au1`). However, the previous scheme is completely removed from the domain's active configuration and does not automatically become active again.
Expert Analysis
The configuration snippet shows two sequential commands under the huawei domain view: authentication-scheme au1 followed by authentication-scheme au2. In Huawei VRP, the authentication-scheme command binds a specific authentication scheme to the current domain. When this command is executed multiple times for the same domain, the last configured scheme overwrites previous bindings. Therefore, au2 becomes the active authentication scheme.
Let's evaluate the options based on this behavior:
- Option A suggests
au2is used, and if deleted,au1is used. This is incorrect because deletingau2removes the binding entirely; it does not revert to the previously overwrittenau1. The system does not maintain a stack of schemes. - Option B claims
au1is used. This is incorrect becauseau1was overwritten by the subsequentau2command. - Option C claims
au1is used, with a fallback toau2. This is incorrect for the same reason as B;au1is no longer bound to the domain. - Option D states that
au2is used for authentication. This is correct becauseau2is the last scheme applied and thus the currently active one.
The key insight here is understanding that AAA domain configurations are stateful in terms of the last applied setting. There is no automatic failover or stacking of authentication schemes within a single domain context unless explicitly configured via other mechanisms (like backup schemes, which are not shown here). The question tests the knowledge that later commands take precedence over earlier ones for the same parameter.
Official Reference
- https://support.huawei.com/enterprise/en/doc/EDOC1100064570
- https://info.support.huawei.com/infoweb/change.do?cmd=change&language=en&countryCode=us&productId=11035&docId=EDOC1000092861
These links open the official vendor documentation in a new tab.
Exam Strategy
When reviewing AAA domain configurations, always look for the final instance of a binding command. If you see authentication-scheme, authorization-scheme, or accounting-scheme listed multiple times under the same domain, only the last one matters. Do not assume redundancy or fallback unless explicitly stated. To verify, mentally simulate the CLI execution order: each command updates the current state, discarding the prior value for that specific attribute.
Frequently Asked Questions
Does Huawei VRP support multiple active authentication schemes per domain?
What happens if I delete the active authentication scheme from a domain?
Community Votes
67% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
e9b92a4 👍 1 Answered DD. The authentication scheme au2 is used for authentication. Why: In the AAA domain view, the command authentication-scheme <name> binds one authentication scheme to that domain. Issuing the command again with a different scheme simply overwrites the previous binding—so the second line (authentication-scheme au2) is the one that takes effect. [support.huawei.com], [info.suppo...huawei.com] There’s no automatic fallback to a previously configured scheme if au2 were deleted. Huawei’s docs state that to remove or change the binding you explicitly run undo authentication-scheme in the domain (which restores the default) or reapply another scheme; they do not describe reverting to an earlier scheme automatically.
-
branly 👍 1 Answered ACuando se configuran múltiples esquemas de autenticación en un dominio, el último esquema de autenticación configurado es el que se utiliza por defecto para la autenticación de los usuarios en ese dominio. En este caso, el último esquema de autenticación configurado es "au2". Por lo tanto, la respuesta correcta es: D. y A Si el esquema de autenticación "au2" es eliminado, el dispositivo buscará el siguiente esquema de autenticación configurado, que en este caso sería "au1". Sin embargo, esta información no es necesaria para responder a la pregunta original, que se refiere a cuál es el esquema de autenticación que se utiliza en el dominio "huawei" en el estado actual de la configuración
-
Fmoura17 👍 1 Answered DD. The authentication scheme au2 is used for authentication. Explanation On Huawei's VRP platform, when multiple authentication schemes are configured under a domain, the last one configured takes effect. This is because each new authentication-scheme command overwrites the previous binding for that domain.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.