Google Professional Cloud Network Engineer Question 645
Select 3Google Cloud PlatformYou are tasked with enabling MACsec (Media Access Control Security) on a Google Cloud network to ensure Layer 2 encryption for traffic between your on-premises network and a Virtual Private Cloud (VPC). Which of the following steps are required to properly set up and enable MACsec for your connection?
- A
Ensure that both on-premises and Google Cloud routers support MACsec and have it enabled.
- B
Configure Cloud Interconnect to use Dedicated Interconnect or Partner Interconnect.
- C
Select the appropriate encryption key length (128-bit or 256-bit) during the configuration process.
- D
Enable MACsec on the VLAN attachments in the Google Cloud Console or via gcloud CLI.
- E
Configure BGP (Border Gateway Protocol) to establish connectivity between on-premises and Google Cloud.
Show answer and explanation
Correct answers: A, B, D
Explanation
To enable MACsec on Google Cloud, you must ensure that the hardware on both ends supports MACsec, configure the appropriate Interconnect type (Dedicated or Partner), and enable MACsec on VLAN attachments. These steps ensure that Layer 2 encryption is applied to the data traffic. While BGP configuration is needed for connectivity, it is unrelated to the MACsec encryption process. Additionally, encryption key lengths are managed automatically by the MACsec implementation in Google Cloud, so no manual selection is required.
- A. Correct.
Correct: MACsec must be supported and enabled on both on-premises and Google Cloud routers for it to function properly.
- B. Correct.
Correct: MACsec can only be enabled on Dedicated Interconnect or Partner Interconnect, as these are the connection types that support MACsec in Google Cloud.
- C. Incorrect.
Incorrect: While key length is important for encryption, MACsec setups on Google Cloud do not require explicit selection of key length during configuration, as the encryption standard is handled automatically.
- D. Correct.
Correct: MACsec must be enabled on VLAN attachments in Google Cloud to ensure Layer 2 encryption is applied to the traffic.
- E. Incorrect.
Incorrect: Configuring BGP is necessary for routing traffic, but it is not a specific requirement for enabling MACsec.