JNCIS-ENT Layer 2 Security Practice Question
An engineer deploys MACsec across an untrusted Metro Ethernet Layer 2 transport circuit. After enabling MACsec, packets larger than 1500 bytes fail to pass through the link. What is the most likely cause of this issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The MACsec ICV and header overhead exceed the standard 1500-byte MTU, requiring an increased MTU along the path.
MACsec encapsulation adds overhead (ICV and security headers) to the Ethernet frame, increasing its size. If the transport provider network or physical interface MTU is not increased to accommodate this overhead, frames are dropped.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The MKA key exchange failed due to MTU handshake validation timeouts.
Why it's wrong here
MKA uses control packets that fit within standard MTUs; the issue is data frame size after encryption.
- ✗
Dynamic ARP Inspection is dropping fragmented Ethernet frames.
Why it's wrong here
DAI inspects ARP packets, not standard data frames.
- ✓
The MACsec ICV and header overhead exceed the standard 1500-byte MTU, requiring an increased MTU along the path.
Why this is correct
MACsec adds encryption overhead to frames, requiring MTU to be adjusted upwards (e.g., to 1532 or higher) across the transit path.
- ✗
The cipher suite GCM-AES-256 compresses frames beyond the minimum frame size limit.
Why it's wrong here
MACsec encrypts and adds headers; it does not compress frames.
About these practice questions
Courseiva writes every JNCIS-ENT question from scratch — 506 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Juniper Networks exam blueprint
This JNCIS-ENT practice question is part of Courseiva's free Juniper Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the JNCIS-ENT exam.