CCNP Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Replace the phone with a MACsec-capable model or use a different encryption method such as IPsec for the traffic.

  Why this is correct

  Since the phone does not support MACsec, link-layer encryption cannot be established. The engineer must either upgrade to a MACsec-capable phone or use a higher-layer encryption method like IPsec, which can encrypt traffic end-to-end regardless of link-layer capabilities. This is the only viable way to secure the traffic.

• ✗

  Use a MACsec-capable switch port and enable `macsec` with `fallback` to allow unencrypted traffic if the phone does not support it.

  Why it's wrong here

  The `macsec` command with fallback is not a valid Cisco IOS configuration for allowing unencrypted traffic. MACsec either negotiates encryption or the link fails. There is no fallback to clear text in standard MACsec configuration. This option is technically incorrect and would not secure the link.

• ✗

  Configure the switch port to use MACsec for the PC traffic and leave the phone traffic unencrypted.

  Why it's wrong here

  MACsec operates at the link layer and encrypts all traffic on the physical link. It cannot selectively encrypt traffic for one device (the PC) and leave another device (the phone) unencrypted on the same port. This option misunderstands how MACsec works and is not feasible.

• ✗

  Enable MACsec on the switch port with `macsec` and configure the phone to use 802.1X with MAB.

  Why it's wrong here

  The phone does not support MACsec, so enabling MACsec on the switch port would cause the link to fail or fall back to unencrypted mode. Configuring 802.1X with MAB does not provide encryption. The phone's lack of MACsec support means link encryption cannot be established between the switch and the phone.