AWS Certified Advanced Networking – Specialty (ANS-C01) — Question 252

A company is migrating its internet VPN connections to dedicated AWS Direct Connect connections. The company needs to set up the Direct Connect connections so that all network communications are encrypted in transit.

Which combination of steps will meet this requirement? (Choose three.)

Answer options

• A. Create new Direct Connect connections while requesting MACsec ports.
• B. Create a MACsec Connectivity Association Key Name (CKN) and Connectivity Association Key (CAK) pair. Associate the pair with each new connection.
• C. Update the on-premises routers to use MACsec and the shared Connectivity Association Key Name (CKN) and Connectivity Association Key (CAK) pair.
• D. Create a shared key for an IPsec connection.
• E. Configure a new Direct Connect gateway. Associate the shared key with the new Direct Connect gateway.
• F. Set up IPsec on the on-premises router. Associate the shared key with the IPsec configuration.

Correct answer: A, B, C

Explanation

Options A, B, and C are correct as they directly involve the necessary steps to establish MACsec encryption for Direct Connect connections. Options D, E, and F, while related to encryption, do not address the specific requirement of using MACsec for Direct Connect connections.