A hybrid environment uses a 10 Gbps Direct Connect dedicated connection with multiple private VIFs terminating in multiple VPCs. Regulations require encrypting all WAN traffic regardless of transport. The company needs encryption that does not reduce available bandwidth. Which option meets this requirement?

MACsec (Media Access Control Security) provides line-rate encryption at Layer 2, meaning it encrypts data before it leaves the Direct Connect location and decrypts it upon arrival, without impacting throughput. To use MACsec, the Direct Connect connection itself must support it. Therefore, provisioning a new MACsec-capable Direct Connect connection and associating existing VIFs with it is the correct approach. Creating a public VIF and using a Site-to-Site VPN would encrypt traffic, but VPNs operate at Layer 3 and introduce overhead, reducing the effective bandwidth below the 10 Gbps Direct Connect capacity. Configuring MACsec on an existing port is not possible if the port hardware doesn't support it; a new connection is typically required. A private IP VPN over Direct Connect would also incur performance overhead.