MACsec JN0-352 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   A network administrator notices that MACsec is not working between two switches. Which log or command output would most likely reveal a pre-shared key mismatch?

   • Ashow log messages | match macsec
   • Bshow route table
   • Cshow arp
   • Dshow interfaces terse
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A network administrator is configuring MACsec with MKA on a Junos switch. The administrator wants to ensure that only authorized devices can participate in the secure channel. What is the correct way to achieve this?

   • AConfigure a static SAK on both ends.
   • BUse a null cipher to prevent unauthorized access.
   • CEnable MACsec on the interface without any key configuration.
   • DConfigure a pre-shared CAK on both ends.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A network administrator is configuring MACsec with MKA on a Junos device. The administrator wants to ensure that the secure association keys are updated periodically. What is the correct way to achieve this?

   • AConfigure a static SAK and set a timer for rekeying.
   • BUse a different CAK for each secure association to force rekeying.
   • CManually update the SAK on both ends at regular intervals.
   • DEnable MKA and configure the CAK; the SAK is derived and refreshed automatically by the key server.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary difference between static and dynamic MACsec operation modes?

   • AStatic mode uses MKA for key exchange, while dynamic mode uses pre-shared keys
   • BStatic mode is more secure than dynamic mode
   • CStatic mode provides encryption, while dynamic mode only provides integrity
   • DStatic mode uses pre-shared keys, while dynamic mode uses MKA for key management
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   A company requires encryption of traffic between two data center switches to protect against passive eavesdropping on the physical link. Which benefit of MACsec makes it the most appropriate choice for this scenario?

   • AIt authenticates users before they can access the network
   • BIt filters traffic based on MAC addresses
   • CIt encrypts IP payloads end-to-end across the internet
   • DIt provides hop-by-hop encryption of Ethernet frames on the link
   Reveal Solution Discussion Select an answer first