Answer-first summary for fast verification
Answer: Create a new MACsec secret key that uses an AWS Key Management Service (AWS KMS) AWS managed key. Associate the new pre-shared key, Connection Key Name (CKN), and Connectivity Association Key (CAK) with the connection., Create a new MACsec secret key that uses an AWS Key Management Service (AWS KMS) customer managed key. Associate the new pre-shared key, Connection Key Name (CKN), and Connectivity Association Key (CAK) with the connection.
When a MACsec secret key is compromised, the best practice is to create a new key rather than modifying the existing one to ensure the security of the connection. AWS Direct Connect supports the use of MACsec to encrypt data in transit between your network and AWS. To update the connection with an uncompromised secure key, you should create a new MACsec secret key. This key can be managed either by AWS KMS using an AWS managed key or a customer managed key. The key difference between options A and B is the type of key management: AWS managed key vs. customer managed key. Both options are valid for creating a new MACsec secret key, but the choice between them depends on the organization's preference for key management. Options C and D suggest modifying the existing MACsec secret key, which is not recommended when the key has been compromised. Therefore, the correct actions involve creating a new MACsec secret key and associating it with the connection, making options A and B the correct choices.
Author: LeetQuiz Editorial Team
Ultimate access to all questions.
No comments yet.
A network engineer is utilizing AWS Direct Connect connections with MACsec to encrypt data between a corporate data center and the Direct Connect location. Upon discovering that the MACsec secret key may have been compromised, the engineer must update the connection with a new, secure key.
What solution will fulfill this requirement?
A
Create a new MACsec secret key that uses an AWS Key Management Service (AWS KMS) AWS managed key. Associate the new pre-shared key, Connection Key Name (CKN), and Connectivity Association Key (CAK) with the connection.
B
Create a new MACsec secret key that uses an AWS Key Management Service (AWS KMS) customer managed key. Associate the new pre-shared key, Connection Key Name (CKN), and Connectivity Association Key (CAK) with the connection.
C
Modify the existing MACsec secret key. Re-associate the existing pre-shared key, Connection Key Name (CKN), and Connectivity Association Key (CAK) with the connection.
D
Modify the existing MACsec secret key. Associate the new pre-shared key, Connection Key Name (CKN), and Connectivity Association Key (CAK) with the connection.