The canal authority has ExpressRoute Direct and a regulator who wants Layer-2 encryption on the physical ports toward Microsoft. What should the security engineer enable?
Select an answer to reveal the explanation.
Short Explanation
Layer-2 on the Direct ports means MACsec—ExpressRoute Direct only, keys in Key Vault. Provider-managed circuits don’t get that physical MACsec switch.
Full Explanation
MACsec provides link-layer encryption on ExpressRoute Direct physical ports and commonly uses customer-managed keys stored in Azure Key Vault. MACsec is not available on ordinary provider-managed ExpressRoute circuits. Storage infrastructure encryption and VPN IPsec policies address different layers and do not configure MACsec on Direct ports.