H13-527_V5.0 Exam Dumps - HCIP-Cloud Computing V5.0

The correct answer is PKI. In OpenStack Keystone, PKI (Public Key Infrastructure) tokens are cryptographically signed and specifically rely on a public/private key pair. Official OpenStack Keystone documentation states that PKI tokens are signed documents and that the Identity service uses public/private key pairs and certificates to create and validate them. It also explains that PKI and PKIZ tokens can be verified offline using Keystone’s public signing key, which directly matches the wording in the question about signing and verification.

By contrast, UUID tokens are simple persisted identifiers and do not inherently depend on public/private key signing. Fernet tokens are also a Keystone token format, but they are based on symmetric cryptography and shared key repositories rather than a public/private key pair. OpenStack documentation explicitly distinguishes Fernet and UUID from the deprecated PKI token mechanism. Therefore, among the listed options, the authentication method that uses a pair of private and public keys is clearly PKI. This aligns with standard OpenStack identity-service architecture and is consistent with Huawei Cloud Stack training topics that build on Keystone authentication concepts.

The statement is TRUE . In OpenStack Neutron, VXLAN uses a VNI (VXLAN Network Identifier) as the segmentation identifier for overlay networks. Official OpenStack Neutron configuration references describe vni_ranges as the range of VXLAN VNI IDs available for tenant network allocation , which confirms that the VNI is the central identifier used for VXLAN-based Neutron networks.

OpenStack networking documentation also explains that Neutron supports project networks and allows different projects to use overlapping IP spaces while remaining logically separated. In VXLAN/GRE tunnel realizations, OpenStack documents refer to a logical switch identifier being used to differentiate tenant traffic on inter-hypervisor tunnels , which is the practical mechanism for tenant isolation.

So, in Huawei Cloud Stack or any OpenStack-based multi-tenant cloud, the VNI functions as the unique overlay-network identifier that keeps one tenant’s VXLAN traffic separate from another tenant’s traffic. That is why the statement is correct and the verified answer is A (TRUE) .

========

The correct fill-in answer is VPN gateway . In Huawei Cloud Stack networking, an EIP can be associated not only with an individual ECS, but also with shared-access components that serve multiple backend resources. Huawei documentation clearly states that when multiple cloud servers in a subnet need outbound Internet access, they can use a NAT gateway and share an EIP . Huawei’s ELB documentation also reflects the model where a load balancer exposes services externally on behalf of multiple backend ECSs.

In the same family of network services, a VPN gateway is another gateway-type object that uses public-facing connectivity to provide secure access for multiple private-side resources. That is why the exam sentence groups it with load balancer and NAT gateway . The logic is that these service gateways allow multiple ECSs or private resources to make use of a single public-facing IP resource instead of requiring one EIP per server. Huawei’s VPN service documentation also shows VPN as the gateway-based service for secure site-to-cloud communication.

The correct answer is B. Managing the services or resources of branches across regions . In HUAWEI CLOUD Stack, resource sets are primarily used as an internal organizational and authorization tool within a tenant or VDC . They are well suited for grouping resources by department , project , or environment , such as production versus test resources. This means options A , C , and D are all typical and appropriate use cases because they involve structuring and controlling resources inside the same logical management domain. ( )

By contrast, managing services or resources of branches across regions is broader than the normal scope of a resource set. Cross-region branch management usually involves higher-level multi-region organizational constructs, regional administration, or broader tenant/VDC design rather than simply creating a resource set. Resource sets help refine governance inside an established tenant structure; they are not the main mechanism for organizing geographically distributed branch operations across regions.

So after correcting the wording, the scenario that is not suitable for resource sets is B , because it describes a cross-region management requirement that typically belongs to a higher-level cloud planning and governance model rather than a resource-set grouping function. Therefore, the verified answer is B .

The correct answer is C. Glance Store . OpenStack’s official Glance architecture documentation states that all image data operations are performed using the glance_store library, and that this library is responsible for interaction with external storage back ends and/or local file systems . The same documentation explains that glance_store provides a uniform interface to access backend stores, which is exactly the function described in the question.

The other options do not match this role. The REST API exposes image service operations to clients, but it does not directly serve as the backend storage interaction layer. The database stores metadata about images, while the actual image binary data is handled through the storage interface. “ Glance Domain Controller ” is not a standard Glance core component in official OpenStack architecture. In Huawei Cloud Stack and OpenStack-based image management, the distinction between image metadata management and image data storage interaction is important, and the storage-facing part is handled by Glance Store . Therefore, the fully verified answer is C .

========

The correct answer is B (FALSE). Huawei documentation confirms that a dummy external network exists and may appear as an option when creating services such as VPC-related resources. Huawei’s Elastic IP and related network-service guidance gives examples such as selecting the dummy external network in one group and then selecting an actual Internet external network in another group for service use. This shows that the dummy external network is mainly a default placeholder or structural network object, not the real tenant-bound network required for service traffic.

Because of that, the second part of the statement is inaccurate. The proper requirement is not simply to “bind the dummy external network to tenants” so VPCs can be created properly. Instead, tenants and services need the correct actual external network resources and related mappings or selections. The Huawei examples make it clear that the dummy external network is not the operational external network used for normal connectivity. Therefore, although the first part about default creation is consistent with Huawei practice, the conclusion about binding it to tenants is not correct. For that reason, the full statement is FALSE.

========

The correct answers are B and C . Huawei documentation states that a security group is a collection of access control rules used to protect cloud servers or instances added to that group. Huawei also describes a network ACL as a security service for VPCs or subnets , which means it protects traffic at the subnet level rather than directly protecting individual instances. That makes C correct.

Huawei’s comparison guidance also distinguishes the way rules are processed. Security groups are stateful and their rules work together as a combined access-control set, while network ACLs are processed according to rule priority , which makes B correct. The official Huawei comparison page explicitly frames network ACLs as an additional security layer on top of security groups.

Option A is incorrect because network ACLs are not mandatory by default in the same way security-group association is standard for instances. Option D is not supported by the Huawei VPC/network ACL documentation cited here; the docs emphasize instance-vs-subnet scope and rule handling, not that exact 5-tuple versus 3-tuple split for these two features. Therefore, the best verified answer is B, C .

========

The correct answer is B. ML2 Plugin . In OpenStack Neutron, ML2 stands for Modular Layer 2 and is the main core networking plugin framework used to support different network types and mechanism drivers. Official OpenStack documentation describes ML2 as a plug-in with components for network types and mechanisms, not as a service plugin .

Service plugins in Neutron are different. They add higher-level networking services beyond basic Layer 2 connectivity. OpenStack deployment documentation shows optional service areas such as load balancing and virtual private network services, and Neutron’s router-related functionality is commonly associated with the L3 service plugin . These are examples of service plugins layered on top of the core networking plugin model.

So the key distinction is this: ML2 is the core plugin architecture , while L3, VPN, and load balancing belong to the service-plugin category. In Huawei Cloud Stack networking topic coverage, this separation between the core Neutron plugin and optional service plugins is also fundamental. Therefore, the option that is not a service plugin is B. ML2 Plugin .

========