CCNP Security Practice Question
A security architect is evaluating MACsec on a Cisco Catalyst switch uplink between two buildings. The requirement is to encrypt all Layer 2 traffic on the link with minimal configuration and use a standards-based key agreement. Which statement correctly describes how MACsec should be deployed on this link?
⚠ Common exam trap
The trap here is believing MACsec always requires 802.1X, when a static pre-shared CAK/CKN with MKA is a valid and common deployment for switch-to-switch links.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
MACsec must be configured with a pre-shared CAK/CKN pair on both switches, and MKA uses this pair to derive session keys.
MACsec secures point-to-point Ethernet links using MKA to negotiate encryption keys. A static CAK and CKN configured on both ends lets MKA derive the SAK that encrypts each frame, requiring no external authentication server. This is the standard, minimal-configuration approach for a switch uplink, and MACsec encrypts the full Ethernet frame, not just IP payloads.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
MACsec must be configured with a pre-shared CAK/CKN pair on both switches, and MKA uses this pair to derive session keys.
Why this is correct
MACsec uses the MACsec Key Agreement (MKA) protocol, which relies on a Connectivity Association Key (CAK) and its name (CKN). When configured with a static pre-shared CAK/CKN, MKA derives the Secure Association Key (SAK) used to encrypt traffic. This is the standard, low-configuration deployment for a point-to-point uplink and meets the requirement for standards-based key agreement.
- ✗
MACsec can be enabled only on routed ports and is incompatible with switch-to-switch trunk links carrying multiple VLANs.
Why it's wrong here
MACsec is a Layer 2 hop-by-hop encryption technology designed for point-to-point Ethernet links, including trunk links carrying multiple VLANs. It is commonly deployed on switch-to-switch uplinks. Claiming it works only on routed ports is incorrect because MACsec is inherently a Layer 2 feature and does not require IP routing on the link.
- ✗
MACsec encrypts only the payload of IP packets, leaving the Ethernet header visible for switching.
Why it's wrong here
MACsec operates at Layer 2 and encrypts the entire original Ethernet frame, including the source and destination MAC addresses and the EtherType, then encapsulates it in a new SecTAG and ICV. It is not limited to IP payloads. Describing it as IP-payload-only encryption mischaracterizes MACsec as an IPsec-like Layer 3 mechanism.
- ✗
MACsec requires 802.1X EAP-TLS authentication of both switches before any frame encryption can occur.
Why it's wrong here
MACsec can use 802.1X to distribute keys dynamically, but it is not mandatory. For a simple switch-to-switch uplink, a static CAK/CKN is sufficient and far less complex. Requiring full EAP-TLS supplicant and authenticator roles on both switches adds configuration and an authentication server dependency that the scenario does not need.
About these practice questions
One of 1,923 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.