Which benefit does MACsec provide in a multilayer LAN design?

MACsec (Media Access Control Security), defined by IEEE 802.1AE, operates at Layer 2 of the OSI model. Its primary function is to provide hop-by-hop encryption and authentication for Ethernet frames, securing the data plane on point-to-point links. Therefore, it is ideal for securing Layer 2 trunk links between switches within a LAN, preventing eavesdropping, tampering, and replay attacks. While MACsec encrypts data, it does so at Layer 2, not for end-to-end application flows which typically require higher-layer encryption like TLS/SSL. MACsec complements, rather than replaces, 802.1X, which handles port-based network access control. MACsec secures Layer 2 links, not Layer 3 links, which are typically secured by protocols like IPsec.