A game studio must encrypt Ethernet frames on specific leaf-to-spine links so a tap on those fibers cannot read them. The traffic is bridged and routed beyond that single link. Which control encrypts the frames on the link itself?
Select an answer to reveal the explanation.
Short Explanation
MACsec is a locked door on one hallway, not a sealed package for the whole building. You encrypt the frames on the fiber you are worried about, and the next hop can decrypt them to keep forwarding. A contract or a routing key does not scramble those frames.
Full Explanation
MACsec, defined by 802.1AE, encrypts Ethernet frames on a single link. MKA agrees the keys. Each switch decrypts on ingress, makes a forwarding decision, and can encrypt again on the next protected link. That is the control that stops a tap on the studio's leaf-to-spine fiber from reading the frames, without pretending the encryption survives every later hop by itself. An ACI contract filter permits or denies traffic between EPGs. It does not encrypt the frame on the wire, and a tap would still see cleartext on an unprotected link. An OSPF key chain authenticates routing protocol messages so a neighbor can prove it holds the key. It does not encrypt the tenant data frames crossing the link. A TACACS+ method list authenticates and authorizes administrative logins. It protects the management session to the AAA server, not the user traffic on a leaf-to-spine fiber. Caveat: both ends and the optics or line card have to support MACsec, and a key mismatch brings the protected link down rather than passing cleartext. Operational check: confirm both ends show the MACsec session secured, then verify a capture on that fiber no longer shows readable application payloads.