350-401 Question 299
Select 2A network engineer is tasked with implementing a secure communication strategy for a Cisco campus network. The organization requires protection for Layer 2 traffic against eavesdropping and tampering, as well as a policy-based access control mechanism to segment traffic between departments. Which combination of technologies should the engineer implement to meet both requirements?
- A
Cisco TrustSec for policy-based access control and segmentation
- B
MACsec to encrypt Layer 2 traffic
- C
802.1X for endpoint authentication
- D
IPsec for securing Layer 3 traffic
- E
GRE tunneling for traffic segmentation
Show answer and explanation
Correct answers: A, B
Explanation
To meet the scenario's requirements, Cisco TrustSec and MACsec work in tandem. TrustSec provides policy-based access control and segmentation using security group tags, while MACsec encrypts Layer 2 traffic to ensure secure communication. Other technologies like 802.1X, IPsec, and GRE tunneling either do not address the stated requirements or are used for different purposes.
- A. Correct.
Cisco TrustSec provides policy-based access control and traffic segmentation by using security group tags (SGTs). This meets the requirement for traffic segmentation between departments.
- B. Correct.
MACsec (Media Access Control Security) encrypts traffic at Layer 2, protecting against eavesdropping and tampering. This satisfies the requirement for securing Layer 2 traffic.
- C. Incorrect.
802.1X is used for endpoint authentication and is not a traffic encryption or segmentation technology. While it complements TrustSec and MACsec, it does not directly fulfill the stated requirements.
- D. Incorrect.
IPsec secures traffic at Layer 3, not Layer 2, and is typically used for WAN or VPN connectivity. It does not meet the requirement for protecting Layer 2 traffic or policy-based segmentation.
- E. Incorrect.
GRE tunneling is used for creating virtual point-to-point connections, but it does not provide encryption or policy-based segmentation. It is not relevant to the scenario's requirements.