Home » Cisco » 300-208 » What protecs MacSec Frame?
What protecs MacSec Frame?
A. ICV
B. MKA
C. DNS
D. dot1x
Correct Answer: B
Explanation/Reference:
Link: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/15-0_1_se/configuration/guide/3750xcg/swmacsec.pdf
A is correct Answer
It’s A !!!
“MACsec frames are encrypted and protected with an integrity check value
(ICV). ”
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/15-0_1_se/configuration/guide/3750xcg/swmacsec.pdf
Correct answer is ICV not MKA as Macsec frames are encrypted and protected with an integrity check value
MKA utilizes ICV to encrypt frames. So MKA does the actual encryption.
MKA protects the payload
ICV protects the frame.
Since the question is about frame protection, I would guess that the correct answer is A
Answer i s B
https://pasteboard.co/IbHFqSt.png
Answer i s B
MACsec is the IEEE 802.1AE standard for authenticating and encrypting packets between two MACsec-capable devices. Cisco switches support 802.1AE encryption with MKA on downlink ports for encryption between the switch and host devices. The switches also support MACsec link layer switch-to-switch security by using Cisco TrustSec NDAC and the SAP key exchange. Link layer security can include both packet authentication between switches and MACsec encryption between switches (encryption is optional).
The 802.1AE standard requires supporting protocols for key management, authentication, and authorization. To meet this need, the IEEE proposed an additional standard, 802.1af MAC Key Agreement (802.1X-2010/MKA), an extension of 802.1X that manages short-lived session keys that are used to encode and decode messages. 802.1X-2010/MKA supports per-device security associations in shared media environments, for example, with PCs connected to Cisco IP phones. 802.1AE must be supported on the platform and the respective modules.
ayer 2 Encryption (802.1AE)
Downlink MACsec:
Industry Standard Extension to 802.1X
Uses MKA
Enabled by Cisco AnyConnect supplicant
Supports per-device security associations (for example PC and IP phone)
Switch-to-switch MACsec:
NDAC
SAP
I agree:
MACsec frames are encrypted and protected with an integrity check value
ICV
and
MKA Protocol manages the encryption keys used by the underlying MACsec protocol
The correct answer is A.
The link explains: page 2 : Line 8 –> under the topic “Understanding Media Access Control Security and MACsec Key
Agreement”
ICV is only for integrity check not to “protect the MacSec frame”