MACsec JN0-637 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A network architect is planning to deploy MACsec across a data center fabric. The fabric uses link aggregation groups (LAGs) between switches. What is a key consideration when enabling MACsec on LAG interfaces?

   • AMACsec on LAGs requires a separate key for each member link.
   • BMACsec must be configured on each member link of the LAG individually.
   • CMACsec cannot be used on LAG interfaces.
   • DMACsec is automatically enabled on all LAG members when configured on the LAG interface.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A network engineer is configuring MACsec on a Juniper MX router. The interface is already configured with an IP address and is part of a routing instance. What additional configuration is required to enable MACsec on this interface?

   • AEnable MACsec globally and reboot the router.
   • BApply a MACsec policy to the interface and configure a pre-shared key.
   • CCreate a new routing instance for MACsec traffic.
   • DConfigure a tunnel interface and route traffic through it.
   Reveal Solution Discussion Select an answer first
4. 3application · easy

   A security auditor is reviewing the network and asks how MACsec protects against man-in-the-middle attacks on the LAN. What is the correct explanation to give?

   • AMACsec provides encryption and integrity, preventing unauthorized devices from reading or modifying traffic.
   • BMACsec hides the IP addresses of devices on the LAN.
   • CMACsec authenticates users before they can access the network.
   • DMACsec filters malicious packets using firewall rules.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A network engineer is troubleshooting a MACsec link between two Juniper devices. The 'show security macsec associations' output shows 'Status: Up' but 'Secure: No'. The physical link is up, and both devices have the same pre-shared key. What is the most likely cause?

   • AMKA is disabled on both devices.
   • BThe pre-shared key is incorrect on one device.
   • CThe interface MTU is too large for MACsec frames.
   • DThe MACsec policy is set to 'should-secure', allowing the link to come up without encryption.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A network administrator is configuring MACsec on a pair of Juniper switches. They want to use a pre-shared key but are concerned about key distribution. What is the best practice for distributing the pre-shared key?

   • AUse a simple, easy-to-remember key for convenience.
   • BConfigure the key over the same link that will be secured.
   • CEmail the key to the other administrator.
   • DUse a secure out-of-band method, such as SSH or a secure file transfer, to share the key.
   Reveal Solution Discussion Select an answer first