Encrypting 10 Gbps Dedicated Interconnect with MACsec
Short answer
C Configure MACsec on each of the two 10 Gbps Dedicated Interconnect connections to encrypt all on-premises-to-VPC traffic at line rate with redundancy.
Question
What should you do?
Key Takeaways
The question tests which Google Cloud encryption mechanism runs directly on the Dedicated Interconnect path at 10 Gbps; the trap is choosing HA VPN tunnel scaling over the purpose-built MACsec option.
For a 10 Gbps Dedicated Interconnect that must carry encrypted traffic, MACsec configured on each interconnect connection provides line-rate end-to-end encryption plus redundancy, making C the correct answer.
Common mistake: Option A (four HA VPN gateways per connection) is wrong because it optimizes tunnel count for throughput rather than providing the required line-rate encryption on the interconnect itself, and it needlessly duplicates redundancy already supplied by two connections.
Expert Analysis
Where the encryption must occur The traffic path here is: on-premises CPE router → the two provisioned 10 Gbps Dedicated Interconnect links → Google's edge routers → the VLAN attachments into the VPC. The mandate is end-to-end encryption at 10 Gbps, so the encryption mechanism must sit directly on that physical path and run at line rate — anything that tunnels over the public internet changes the path itself.
Why MACsec fits Google Cloud supports MACsec on Dedicated Interconnect between your customer edge router and Google's edge router, encrypting every frame traversing the interconnect at line rate (10 Gbps per attachment, no throughput haircut). Configuring MACsec on each of the two already-provisioned 10 Gbps connections (option C) therefore satisfies both the bandwidth requirement and the encryption requirement, and because MACsec is applied per connection, the second encrypted interconnect provides the redundancy. This is the vendor-recommended mechanism specifically for encrypting Dedicated Interconnect traffic.
Why the HA VPN options fail Options A and B describe HA VPN gateways riding on top of the interconnect (HA VPN over Cloud Interconnect). A community comment argues that a 10 Gbps attachment needs four tunnels for active traffic and concludes option A, but tunnel-count scaling answers capacity, not the encryption mandate at 10 Gbps: HA VPN tunnels cap out around a few Gbps each, so you would need multiple gateways and tunnels per attachment just to reach line rate, dramatically increasing configuration complexity while still not being the purpose-built encryption for the interconnect. Note also that the question already provides redundancy through two physical connections, so multiplying gateways adds nothing to fault tolerance.
Why D fails Option D sends backup traffic over an internet HA VPN, which neither encrypts the primary interconnect traffic nor preserves the 10 Gbps end-to-end path, and it exposes traffic to the public internet.
Verdict: option C — apply MACsec on each Dedicated Interconnect connection.
Official Reference
https://cloud.google.com/interconnect/docs/how-to/dedicated-interconnect/using-macsec
This link opens the official vendor documentation in a new tab.
Exam Strategy
When a question names a specific interconnect type plus a hard bandwidth and encryption mandate, look for the Google Cloud encryption feature built for that media — MACsec for Dedicated Interconnect, IPSec for VPN links. Ignore options that merely add tunnel or gateway count unless the question is explicitly about scaling throughput, and treat existing dual links as the redundancy so you do not over-provision.
Frequently Asked Questions
Why not use HA VPN over Dedicated Interconnect for encryption?
Does MACsec on two Dedicated Interconnects provide redundancy?
Does MACsec encrypt traffic end-to-end into the VPC?
Community Votes
82% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
Rob80205 👍 2 Answered ATunnel and Gateway Scaling: To fully utilize a 10 Gbps Dedicated Interconnect line with proper capacity matching, you need 4 tunnels per VLAN attachment (as detailed in Google Cloud's official capacity scaling guides: a 10 Gbps attachment requires 4 tunnels for active traffic, while a 5 Gbps attachment requires 2 tunnels).
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All PCNE Questions
Access 80 questions with complete answers and detailed explanations.
View Full PCNE Practice Test →