Pass the Huawei HCIA-Cloud Service H13-811_V3.5 Questions and answers with CertsForce

The statement is TRUE. Huawei Cloud OBS provides several resource-based authorization mechanisms, including bucket policies and object policies. Their principal distinction is the scope of resources to which they apply.

Huawei's official OBS Permission Configuration Guide explicitly states that an object policy applies to only one object in a bucket, whereas a bucket policy applies to multiple objects or all objects within the bucket. This enables administrators to select the authorization mechanism that best matches the required granularity.

An object policy is useful when permissions must be configured specifically for an individual object, such as granting another principal read or write permissions to one particular resource without broadening access to the rest of the bucket.

A bucket policy supports broader authorization scenarios. Its policy statements can define principals, actions, resources, effects, and conditions to grant or restrict access to selected objects, prefixes, or the entire bucket. Typical uses include allowing another Huawei Cloud account to access specified OBS resources or granting IAM identities access to defined bucket content.

The question therefore correctly distinguishes object-level policy scope from bucket-level multi-object policy scope.

Reference topics: OBS Permission Management; Object Policies; Bucket Policies; Resource-Based Authorization.

===============

Statement C is incorrect because container images do not require a private registry. Huawei Cloud container services can consume images from multiple sources, including Huawei Cloud SoftWare Repository for Container (SWR), public repositories, shared repositories, and supported third-party image repositories. Huawei Cloud CCI documentation explicitly states that containers can pull both SWR images and third-party images .

A container image is a standardized, executable package containing the files and configuration required for a containerized application. Huawei describes it as containing the application and required supporting components such as environments, libraries, configuration files, and file systems. This supports option A.

Option B is consistent with the container-image concept because images can contain a base operating-system environment or filesystem together with application dependencies and configuration required by the application.

Option D is also valid. An image acts as an immutable deployment template: once constructed, the same image can be instantiated repeatedly as containers, enabling applications to run with a consistent packaged environment rather than requiring the software stack to be manually reconfigured for every deployment.

A private registry is useful for controlling proprietary enterprise images, but it is an architectural choice—not a mandatory requirement. Therefore, C is the incorrect statement.

Reference topics: Container Images; SWR; Container Registries; CCI Image Sources; Containerized Application Deployment.

===============

Statements B and C are correct . Huawei Cloud Eye supports batch creation of monitoring alarms. Huawei's documented quota specifically states that up to 50 monitored objects can be selected when creating an alarm rule and that up to 1,000 alarm rules can be created at one time . Huawei even provides the exact example used here: 50 monitored objects multiplied by 20 metrics produces 1,000 alarm rules. Therefore, B is directly supported.

Statement C is also valid. Cloud Eye alarm rules can provide monitoring triggers used with Auto Scaling. An alarm-based AS policy references a Cloud Eye alarm rule; when monitored metrics meet the configured threshold condition, the corresponding scaling action can be initiated.

Statement A is false because Cloud Eye server monitoring is not limited to OS-level resource metrics. With the Agent installed, Huawei Cloud Eye also provides process monitoring , including process CPU usage, memory usage, opened files, and customized process-monitoring tasks.

Statement D is false because alarm templates and batch alarm creation eliminate the requirement to create every alarm rule individually.

Reference topics: Cloud Eye Server Monitoring; Process Monitoring; Alarm Rules; Alarm Templates; Auto Scaling Integration.

===============

The statement is false . Huawei Cloud ECS supports multiple billing models, and cost optimization is not exclusive to pay-per-use billing. The principal modes include yearly/monthly, pay-per-use, and spot pricing , with each optimized for different workload characteristics.

Pay-per-use is useful for workloads with uncertain or fluctuating demand because resources are billed according to actual usage and can be released when no longer required. However, yearly/monthly billing can provide a lower effective price for stable, long-running workloads because Huawei Cloud applies subscription discounts; the longer the committed subscription period, the greater the potential discount. Therefore, for predictable production workloads running continuously, yearly/monthly billing can be substantially more economical than pay-per-use.

Spot pricing is another cost-saving mechanism. Spot instances use market-based pricing and can provide compute resources at a lower price where workload interruption characteristics permit their use. Consequently, several ECS billing models can reduce expenditure when aligned to an appropriate workload.

The incorrect portion of the statement is therefore the assertion that only pay-per-use can reduce costs .

Reference topics: Elastic Cloud Server; ECS Billing Modes; Yearly/Monthly; Pay-per-Use; Spot Pricing.

===============

Statements B and D are correct. Huawei Cloud CBR architecture consists fundamentally of backups, vaults, and policies. A vault is the storage container used by CBR for backup data. Huawei documentation explicitly states that CBR stores backups in vaults and that different resource categories are associated with appropriate vault types, such as server backup vaults and disk backup vaults.

Statement B is also directly supported. Huawei categorizes CBR policies into backup policies and replication policies. A backup policy automatically runs backup operations according to configured schedules and retention parameters, while a replication policy periodically replicates eligible backup data to another vault or region.

Statement A is incorrect because CBR is specifically designed to automate protection through policies; regular backups do not normally need to depend on repeated manual execution. Huawei advises using backup policies for scheduled protection.

Statement C is too absolute. CBR substantially improves recoverability against accidental deletion, malware, software failures, and hardware faults, but no backup architecture legitimately guarantees that data can never be lost under every conceivable condition.

Therefore, B and D are the verified statements.

Reference topics: CBR Architecture; Vault Management; Backup Policies; Replication Policies.

===============

All four categories form part of Huawei Cloud's layered security architecture. Network security includes controls and services designed to protect network boundaries and traffic, such as Anti-DDoS, Advanced Anti-DDoS, VPC security controls, firewalls, and network isolation. Huawei Cloud describes network security as a core component of its full-stack cloud defense model.

Application security protects web applications and application-layer traffic. Representative Huawei Cloud services include Web Application Firewall, which detects and blocks HTTP/HTTPS attacks, and application vulnerability/security capabilities.

Computing security covers server and workload protection. Host Security Service protects ECS and other server workloads through vulnerability management, intrusion detection, account-security controls, malware detection, and web tamper protection. Security-management capabilities such as Cloud Bastion Host and centralized security operations provide access management, authentication, authorization, auditing, and operational control.

Finally, data security encompasses encryption, database protection, identity/access control, sensitive-data protection, and lifecycle safeguards. Huawei's security architecture explicitly identifies protection of confidentiality, integrity, availability, durability, and traceability as data-security objectives.

Therefore, A, B, C, and D are all included .

Reference topics: Huawei Cloud Security Architecture; Network Security; Application Security; Compute Security; Security Management; Data Security.

===============

The statement is TRUE, with an important implementation distinction. Huawei Cloud extended network interfaces provide flexible networking independently of the ECS primary network interface. An extended network interface can be associated with security groups that differ from those associated with the ECS's other interfaces. Huawei Cloud explicitly states that an extended network interface created through the console can be attached to an instance in the same VPC while using different security groups.

Huawei documentation additionally specifies that when an extended network interface is created through the appropriate API, it can be attached to an instance residing in a different VPC. Therefore, the broader proposition in the question—that an ECS and an extended interface can belong to different VPCs or security groups—is technically supported by Huawei Cloud.

For conventional console-based deployments, the normal architecture places the ECS's primary and extended interfaces in different subnets of the same VPC, with security rules independently assignable to individual interfaces. This provides traffic separation for service, management, internal, and external networks. The API capability extends this flexibility further.

Consequently, because Huawei officially supports both differentiated security-group association and cross-VPC attachment under the documented API scenario, the correct answer is TRUE.

Reference topics: Elastic Network Interfaces; Extension NICs; VPC Networking; Security Group Association.

===============

Option A is not a main WAF function . Huawei Cloud Web Application Firewall is an application-layer web protection service . It analyzes HTTP and HTTPS traffic and protects websites against threats such as SQL injection, cross-site scripting, command injection, malicious bots, scanners, CC attacks, and other web exploits.

Huawei explicitly lists information leakage prevention , web tamper protection , and anti-crawler protection among WAF's protection functions. Information leakage prevention can mask or block sensitive information such as ID numbers, phone numbers, and email addresses. Web tamper protection prevents unauthorized modification of protected static website pages. Anti-crawler protection identifies and mitigates malicious automated crawler behavior.

Brute-force attacks against ECS operating-system or application accounts , however, fall primarily under Host Security Service (HSS) . Huawei documents HSS detection and blocking capabilities for brute-force attacks involving services such as SSH, RDP, MySQL, SQL Server, and FTP.

WAF can mitigate certain web-based authentication abuse using web rules and rate controls, but generic ECS account brute-force protection is not the WAF function described here.

Therefore, the required answer is A .

Reference topics: Web Application Firewall; Information Leakage Prevention; Web Tamper Protection; Anti-Crawler; Host Security Service.

===============

The statement is FALSE because the management tracker used for general cloud-resource auditing does not need to be created manually when CTS is first enabled. Huawei Cloud explicitly states that when CTS is enabled for the first time, a management tracker named system is created automatically.

The management tracker identifies and associates with the cloud services used by the account and records management operations, including resource creation, modification, query, login-related actions, and deletion. Therefore, the portion of the statement saying that the user must manually create the tracker is technically incorrect.

Huawei does allow users to create additional data trackers manually. These trackers are specifically designed to record operations performed on data in OBS buckets, such as uploads and downloads. That is different from the automatically created management tracker.

Huawei's official getting-started workflow is explicit: open CTS, choose Enable CTS , and the system automatically creates the management tracker named system. Configuration such as OBS or LTS trace transfer can then be added if long-term retention is required.

Therefore, enabling CTS is necessary, but manually creating its primary management tracker is not.

Reference topics: Cloud Trace Service; Management Tracker; Data Tracker; Enabling CTS.

===============

The major CTS functions represented by the options are trace recording, trace query, and trace transfer , making A, B, and D correct.

Trace recording captures operations performed through the Huawei Cloud management console, through APIs, and operations initiated by supported cloud services. These records provide an audit trail containing information such as the operator, operation time, resource, operation result, and associated request data.

Trace query allows administrators and auditors to search recent operational records on the CTS console using criteria such as trace source, resource type, operator, trace status, and operation type. This is essential for security auditing, compliance investigation, and troubleshooting.

Trace transfer provides longer-term retention and centralized analysis. CTS can package operation records into trace files and transfer them to supported destinations such as OBS or LTS for preservation and subsequent processing.

Option C, OS monitoring , does not belong to CTS. Operating-system performance monitoring is primarily a Cloud Eye/server-monitoring capability rather than an audit-trace function.

Huawei's official CTS documentation expressly identifies recording, querying, and transfer among its core service functions.

Reference topics: Cloud Trace Service; Trace Recording; Trace Query; Trace Transfer; Cloud Auditing.

===============