A network engineer is using AWS Direct Connect connections and MACsec to encrypt data from a corporate data center to the Direct Connect location. The network engineer learns that the MACsec secret…

Question

Options

• ACreate a new MACsec secret key that uses an AWS Key Management Service (AWS KMS) AWS
• BCreate a new MACsec secret key that uses an AWS Key Management Service (AWS KMS)
• CModify the existing MACsec secret key. Re-associate the existing pre-shared key, Connection
• DModify the existing MACsec secret key. Associate the new pre-shared key, Connection Key

• A
  2% (1)
• B
  84% (42)
• C
  4% (2)
• D
  10% (5)

Explanation

Explanation

Option B is correct because when a MACsec secret key is compromised, the proper remediation is to create an entirely new MACsec secret key stored in AWS KMS and associate it with the Direct Connect connection - AWS does not allow modification of existing MACsec keys, so a fresh key must be generated and linked to replace the compromised one.

Option A appears nearly identical to B but is likely incomplete or truncated, missing the critical step of associating the new key with the Direct Connect connection, making it an insufficient solution. Option C is incorrect because you cannot modify an existing MACsec secret key in AWS; re-associating a potentially compromised pre-shared key would not resolve the security concern. Option D is also incorrect because while it mentions associating a new pre-shared key, it still references "modifying" the existing secret, which is not a supported operation in AWS Direct Connect MACsec configuration.

Memory Tip: Think "Compromise = Create, Never Modify" - in AWS MACsec, keys are immutable. Just like rotating a compromised password means creating a new one (not editing the old one), a compromised MACsec key requires creating a new KMS-backed secret and associating it fresh with your Direct Connect connection.

No community discussion yet for this question.