350-601 Security Practice Question
Exhibit
crypto macsec policy MACSEC security-policy must-secure cipher-suite GCM-AES-128 ! interface Ethernet1/1 macsec connect ckn 1234567890 cak 1234567890
Refer to the exhibit. Two Nexus switches are connected via Ethernet1/1. MKA does not initiate. What is the issue?
⚠ Common exam trap
Cisco often tests the distinction between defining a MACsec policy globally and applying it to an interface, knowing that candidates may assume a defined policy is automatically active on all interfaces.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The policy is not applied to the interface
The exhibit shows that the MACsec policy is defined but not applied to interface Ethernet1/1. Without applying the policy using the `macsec policy` command under the interface configuration, MKA (MACsec Key Agreement) cannot initiate because the switch does not know which security policy to enforce on that link.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The interface is not administratively up
Why it's wrong here
The exhibit does not indicate the interface is down; the link is up.
- ✓
The policy is not applied to the interface
Why this is correct
The interface must have 'macsec policy MACSEC' to associate the policy.
- ✗
The cipher-suite is not supported
Why it's wrong here
GCM-AES-128 is a common and supported cipher suite.
- ✗
The MACsec key chain is missing
Why it's wrong here
The key chain is not needed if connecting via CKN/CAK directly, but the MKA parameters are present.
Go deeper
Related to this question
About these practice questions
One of 984 original 350-601 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-601 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-601 exam.