Incorrect Statement on User Access Authentication Configuration
Short answer
C Configuring RADIUS/HWTACACS interconnection parameters like IP and keys belongs in dedicated server templates, not directly inside the AAA scheme.
Question
Key Takeaways
The main trap is confusing the AAA scheme container with the server template; the scheme references the template but does not hold the IP/key config itself.
This question identifies the false statement regarding Huawei user access authentication, highlighting that server connection details belong in templates, not AAA schemes.
Common mistake: Candidates often choose Option A or D thinking the binding order is complex, missing the simpler factual error in Option C about where server IPs are configured.
Expert Analysis
AAA Scheme vs. Server Template Separation The core of this question tests the architectural separation between AAA schemes and server configurations in Huawei network devices (specifically within the context of H12-891). In Huawei's VRP (Versatile Routing Platform), authentication parameters are not configured directly inside the AAA scheme block. Instead, the AAA scheme references dedicated server templates (RADIUS or HWTACACS) which contain the actual interconnection details like IP addresses, ports, and shared keys. Therefore, Option C is incorrect because it suggests configuring these interconnection parameters directly within the AAA scheme.
Analysis of Other Options
- Option A is correct. To control user access, the system must identify the user's domain to select the appropriate AAA scheme. This is a fundamental requirement for policy-based access control.
- Option B is correct. The device supports various access profiles (802.1X, MAC, Portal, multi-mode) that can be selected based on specific security and convenience requirements for different user groups.
- Option D is correct. The logical flow for enabling network access control involves binding an access profile (which defines how the user authenticates, e.g., via Portal) to an authentication profile (which defines who authenticates them, i.e., the AAA scheme/server reference), and then applying this combined profile to the interface where users connect.
The question asks for the incorrect statement. Since Options A, B, and D accurately describe standard configuration procedures and dependencies, Option C is the outlier due to its misplacement of server-specific configuration data.
Exam Strategy
When answering 'incorrect' questions about configuration hierarchy, always check if a parameter belongs to a higher-level policy object (like AAA scheme) or a lower-level reference object (like Server Template). Memorize the boundary: AAA schemes define the method (local/RADIUS), while Server Templates define the connectivity (IP/Port/Key). If an option says 'configure X in AAA scheme' and X is a physical link parameter, it is likely the wrong statement.
Frequently Asked Questions
Where should RADIUS server IP and shared key be configured?
What is the relationship between access profile and authentication profile?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
Toyyib 👍 1 Answered CC is incorrect because parameters for interconnection with a RADIUS or HWTACACS server (such as server IP addresses, shared keys, and port numbers) are configured in dedicated RADIUS or HWTACACS server templates, rather than directly inside the AAA scheme. The AAA scheme defines the authentication, authorization, and accounting modes or references these templates.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.