MACsec JN0-352 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A network architect is designing a MACsec deployment for a multi-vendor environment. The architect wants to use MKA to manage keys, but the vendor of one switch does not support MKA. What is the best approach to secure the link?

   • AUse MKA on the Junos switch and static MACsec on the other switch.
   • BUse MKA on both ends, but configure the non-supporting switch with a static SAK.
   • CUse static MACsec with pre-shared keys on both ends.
   • DUse a different encryption protocol, such as IPsec.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   In MACsec terminology, what is the term for a logical point-to-point connection between two peers that carries all secured traffic in one direction?

   • ASecure Association
   • BSecure Channel
   • CSecure Entity
   • DConnectivity Association
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security team is evaluating MACsec to protect traffic between two core switches. The team is concerned about the overhead of encryption on the switches. Which statement correctly describes the performance impact of MACsec?

   • AMACsec only adds overhead when MKA is used.
   • BMACsec encrypts the entire frame, which doubles the frame size.
   • CMACsec has no performance impact because encryption is done in hardware.
   • DMACsec adds a SecTAG and ICV to each frame, increasing frame size and potentially reducing throughput.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which operational characteristic is unique to dynamic MACsec using MKA?

   • AIt automatically detects and removes failed peers
   • BIt requires manual configuration of the same key on both ends
   • CIt does not support encryption, only integrity
   • DIt only works on point-to-point links
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A network architect is designing a MACsec deployment for a campus network. The architect wants to use MKA for automatic key management but also needs to ensure that if the key server fails, the secure channel remains operational. Which approach should be taken?

   • AConfigure multiple key servers with the same CAK.
   • BUse MKA with a pre-shared CAK; the secure channel will continue to operate with the current SAK if the key server fails.
   • CUse static MACsec instead of MKA to avoid key server dependency.
   • DConfigure a static CAK and SAK as a fallback.
   Reveal Solution Discussion Select an answer first