The canal authority has ExpressRoute Direct and a regulator who wants Layer-2 encryption on the physical ports toward Microsoft. What should the security engineer enable?
Select an answer to reveal the explanation.
Short Explanation
Layer-2 on the Direct ports means MACsec—ExpressRoute Direct only, keys in Key Vault. Provider-managed circuits don’t get that physical MACsec switch.
Full Explanation
MACsec provides link-layer encryption on ExpressRoute Direct physical ports and can use customer-managed key material stored in Key Vault. For a canal authority with ExpressRoute Direct and a regulator who wants Layer-2 encryption on the physical ports toward Microsoft, enable MACsec on those Direct ports with CMK in Key Vault.
Toggling MACsec on a provider-managed ExpressRoute circuit the same way as Direct fails—MACsec for ExpressRoute is tied to Direct port scenarios, not a generic FastPath checkbox on every circuit. Claiming storage-account infrastructure encryption covers ExpressRoute physical links fails by concept. Treating a custom IPsec policy on a VPN gateway as Layer-2 MACsec on Direct ports confuses network layers and products.
Exam caveat: MACsec on ExpressRoute Direct is the Layer-2 answer; VPN overlay is Layer-3 encryption for other designs. Operational check: enable MACsec on Direct ports, configure keys via Key Vault per guidance, verify link encryption status, and record key rotation owners. In municipal Azure estates, document the decision in the change record, validate with a nonproduction rehearsal, and confirm monitoring still pages the on-call operator when the control fails closed during an incident drill.