CCNP Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  MACsec encrypts traffic end to end from the originating host to the final destination host across all intermediate routers.

  Why it's wrong here

  MACsec is a link-layer technology that protects frames only between directly connected devices. Each intermediate router or switch decrypts and re-encrypts the frame, so it is not end-to-end encryption. For host-to-host protection across a routed path, technologies such as IPsec or TLS are required instead of MACsec.

• ✓

  MACsec requires an MKA session and a connectivity association key to establish secure associations between peers.

  Why this is correct

  The MACsec Key Agreement protocol negotiates session keys between peers using a connectivity association key, which can be provided statically or derived through 802.1X. Without a successful MKA session, the link will not pass protected traffic. This key management layer distinguishes MACsec from simple link encryption and ensures both ends agree on cipher suites and key material.

• ✗

  MACsec replaces 802.1X and removes the need for any authentication server in the network.

  Why it's wrong here

  MACsec and 802.1X are complementary, not mutually exclusive. 802.1X can authenticate endpoints and derive keys used by MKA, while MACsec protects the link. Deployments often use Cisco ISE as the authentication server to distribute keys, so MACsec does not eliminate the need for an authentication framework or server in managed environments.

• ✓

  MACsec provides hop-by-hop encryption and integrity for Ethernet frames using the 802.1AE standard.

  Why this is correct

  MACsec, defined by IEEE 802.1AE, secures the Layer 2 link by encrypting and authenticating each frame between directly connected devices. It operates per physical link, so each hop must support and negotiate MACsec independently. This hop-by-hop model protects traffic on the wire between switches while leaving the frames decrypted inside each device for normal forwarding decisions.

• ✗

  MACsec can be deployed only on routed ports and is incompatible with switch access ports.

  Why it's wrong here

  MACsec is commonly deployed on switch-to-switch links and can also protect host-facing access ports when the endpoint supports it. It is not limited to routed ports. In fact, many campus designs use MACsec on trunk or access switch links, and some Catalyst platforms support MACsec on uplinks and downlinks depending on hardware and licensing.