AWS Certified Advanced Networking - Specialty ANS-C01 — Topic 1 Question 115

Question

A company is moving its record-keeping application to the AWS Cloud. All traffic between the company's on-premises data center and AWS must be encrypted at all times and at every transit device during the migration. The application will reside across multiple Availability Zones in a single AWS Region. The application will use existing 10 Gbps AWS Direct Connect dedicated connections with a MACsec capable port. A network engineer must ensure that the Direct Connect connection is secured accordingly at every transit device. The network engineer creates a Connection Key Name and Connectivity Association Key (CKN/CAK) pair for the MACsec secret key. Which combination of additional steps should the network engineer take to meet the requirements? (Choose two.)

Accepted Answer

Correct answer: A, D. The correct answer is A, D. Option A: Configure the on-premises router with the MACsec secret key. Option D: Associate the CKN/CAK pair with the connection. Then update the connection's MACsec encryption mode to must_encrypt. AWS Config tracks resource configuration changes and evaluates compliance. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

AWS Certified Advanced Networking - Specialty ANS-C01 — Question 115