easyMultiple ChoiceObjective-mapped
350-701 Practice Question: Needs to implement a security solution that…
A network engineer needs to implement a security solution that provides encryption, integrity, and authentication at Layer 2 between two switches. Which technology should be used?
⚠ Common exam trap
Cisco often tests the distinction between Layer 2 encryption (MACsec) and Layer 3 encryption (IPsec), and the trap here is that candidates confuse 'encryption between switches' with IPsec because IPsec is the most commonly known encryption protocol, but it operates at a higher layer and requires IP routing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
MACsec
MACsec (IEEE 802.1AE) provides hop-by-hop encryption, integrity, and authentication at Layer 2 (the data link layer) directly on Ethernet frames. It uses GCM-AES-128 or GCM-AES-256 to encrypt the entire payload and authenticate the frame, ensuring confidentiality and integrity between directly connected switches without requiring IP-layer processing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SSL/TLS
Why it's wrong here
SSL/TLS operates at the Transport layer (Layer 4) and is used for securing application traffic.
- ✗
IPsec
Why it's wrong here
IPsec operates at Layer 3 (Network layer), not Layer 2.
- ✗
802.1X
Why it's wrong here
802.1X is a port-based authentication protocol and does not provide encryption or integrity.
- ✓
MACsec
Why this is correct
MACsec provides Layer 2 encryption, integrity, and authentication.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
One of 978 original 350-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.