Exam AWS Certified Advanced Networking - Specialty ANS-C01 topic 1 question 188 discussion

Exam question from Amazon's AWS Certified Advanced Networking - Specialty ANS-C01

Question #: 188
Topic #: 1

[All AWS Certified Advanced Networking - Specialty ANS-C01 Questions]

A network engineer is using AWS Direct Connect connections and MACsec to encrypt data from a corporate data center to the Direct Connect location. The network engineer learns that the MACsec secret key might have been compromised. The network engineer needs to update the connection with an uncompromised secure key.

Which solution will meet this requirement?

A. Create a new MACsec secret key that uses an AWS Key Management Service (AWS KMS) AWS managed key. Associate the new pre-shared key, Connection Key Name (CKN), and Connectivity Association Key (CAK) with the connection.
B. Create a new MACsec secret key that uses an AWS Key Management Service (AWS KMS) customer managed key. Associate the new pre-shared key, Connection Key Name (CKN), and Connectivity Association Key (CAK) with the connection.
C. Modify the existing MACsec secret key. Re-associate the existing pre-shared key, Connection Key Name (CKN), and Connectivity Association Key (CAK) with the connection.
D. Modify the existing MACsec secret key. Associate the new pre-shared key, Connection Key Name (CKN), and Connectivity Association Key (CAK) with the connection.

Show Suggested Answer

Suggested Answer: B 🗳️

by KobDragoon at April 1, 2024, midnight

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

cas_tori

3 months, 4 weeks ago

Selected Answer: B

this is B

upvoted 1 times

...

veyisceylan

6 months ago

MACsec pre-shared CKN/CAK key considerations AWS Direct Connect uses AWS managed CMKs for the pre-shared keys that you associate with connections or LAGs. Secrets Manager stores your pre-shared CKN and CAK pairs as a secret that the Secrets Manager’s root key encrypts. For more information, see AWS managed CMKs in the AWS Key Management Service Developer Guide.

upvoted 1 times

...

KobDragoon

8 months, 3 weeks ago

Selected Answer: B

You cannot modify a MACsec secret key after you associate it with a connection. If you need to modify the key, disassociate the key from the connection, and then associate a new key with the connection. https://docs.aws.amazon.com/directconnect/latest/UserGuide/associate-key-connection.html

upvoted 4 times

[Removed]

8 months, 1 week ago

...moreover modifying a compromised key might be a no no anyway. If compromised better create a new key even if it WAS possible to modify it.

upvoted 2 times

...

Exam AWS Certified Advanced Networking - Specialty ANS-C01 All Questions

View all questions & answers for the AWS Certified Advanced Networking - Specialty ANS-C01 exam