Google Professional Cloud Network Engineer Question 647
Select 4Google Cloud PlatformYou are tasked with securing Layer 2 communication between two on-premises data centers connected via an Interconnect through Google Cloud. To ensure data confidentiality and integrity, you decide to enable MACsec. Which of the following steps are required to properly set up and enable MACsec on your Interconnect connection?
- A
Ensure that both endpoints of the Interconnect support MACsec functionality.
- B
Configure the Interconnect VLAN attachments to use the 'High Bandwidth Mode' to support MACsec.
- C
Enable MACsec at the physical interface level on the routers connected to the Interconnect.
- D
Generate and securely exchange Connectivity Association Keys (CAKs) between the endpoints.
- E
Update the Interconnect to a Dedicated Interconnect as MACsec is only supported on Dedicated Interconnect.
Show answer and explanation
Correct answers: A, C, D, E
Explanation
MACsec is a Layer 2 encryption protocol used to secure traffic over Interconnect. To enable MACsec, both endpoints must support it, the feature must be enabled on the physical interfaces, and the appropriate keys (CAKs) must be exchanged securely. Additionally, MACsec is only supported on Dedicated Interconnect connections, so the Interconnect type must be considered during design and implementation.
- A. Correct.
Correct: MACsec functionality must be supported on both endpoints (routers or switches) to enable and configure encryption for Layer 2 traffic.
- B. Incorrect.
Incorrect: There is no specific requirement for 'High Bandwidth Mode' in VLAN attachments to enable MACsec. The mode of the VLAN attachment doesn’t influence MACsec functionality.
- C. Correct.
Correct: MACsec must be explicitly enabled and configured at the physical interface level of the devices connected to the Interconnect.
- D. Correct.
Correct: Connectivity Association Keys (CAKs) are required for establishing secure communication channels with MACsec. They must be securely exchanged and configured on both endpoints.
- E. Correct.
Correct: MACsec is supported only on Dedicated Interconnect, not on Partner Interconnect, so the Interconnect type must be updated if needed.