Google Professional Cloud Network Engineer Question 649
Select 3Google Cloud PlatformYou are a Professional Cloud Network Engineer tasked with ensuring data confidentiality and integrity between two on-premises sites connected via a Cloud Interconnect. You are required to configure MACsec for this connection. Which of the following steps must you take to properly enable MACsec on this setup?
- A
Ensure that your Cloud Interconnect uses Dedicated Interconnect, as MACsec is not supported on Partner Interconnect.
- B
Configure key exchange using MKA (MACsec Key Agreement) protocol on both ends of the connection.
- C
Enable VLAN tagging on the Cloud Interconnect to support MACsec encryption.
- D
Verify that the Cloud Interconnect attachment (VLAN) is configured for high availability to support MACsec.
- E
Use a supported router or switch that can handle MACsec encryption at both the on-premises and Google Cloud ends.
Show answer and explanation
Correct answers: A, B, E
Explanation
To enable MACsec on a Cloud Interconnect, the connection must use Dedicated Interconnect, which supports MACsec. You must configure the MKA protocol for key exchange and ensure that your on-premises and Google Cloud routers/switches support MACsec encryption. VLAN tagging and high availability, while useful in other contexts, are not required steps for enabling MACsec.
- A. Correct.
Correct: MACsec is only supported on Dedicated Interconnect, not Partner Interconnect. This is a critical prerequisite for enabling MACsec.
- B. Correct.
Correct: The MACsec Key Agreement (MKA) protocol is required for key exchange to establish MACsec encryption between the two endpoints.
- C. Incorrect.
Incorrect: VLAN tagging is not a specific requirement for enabling MACsec. MACsec operates at Layer 2 and is independent of VLAN tagging.
- D. Incorrect.
Incorrect: While high availability is a good practice, it is not directly related to enabling MACsec.
- E. Correct.
Correct: Both endpoints of the connection must use MACsec-capable hardware to encrypt and decrypt the traffic.