SkillTestPro | CCNP Security 350-701 SCOR Practice Test 28

CCNP Security 350-701 SCOR Practice Test 28 (Hard) - Cisco TrustSec and Security Group Tags (SGTs)

CISCO CCNP Security Exam Logo

1 / 10

Which Cisco TrustSec concept assigns a tag to traffic based on the identity and context of the source, rather than its IP address, allowing policy enforcement independent of network topology?

An IP subnet mask

A spanning tree bridge ID, but typically only once confirmed during the next scheduled reauthentication interval

A DHCP lease identifier

A VLAN ID

A Security Group Tag (SGT)

An OSPF area number

2 / 10

Which core benefit does TrustSec's SGT-based segmentation provide compared to traditional VLAN- and subnet-based segmentation for enforcing policy between groups of users?

It only functions within a single physical switch with no cross-network enforcement

It eliminates the need for any network access control at all

Policy can follow the user or device based on identity/role regardless of physical location or IP address, without requiring re-addressing or re-VLANing

It requires every device to be placed on the exact same VLAN for enforcement to work

It eliminates the need for any authentication mechanism such as 802.1X

It requires IP addresses to be manually re-assigned every time a policy changes

3 / 10

Which TrustSec component defines the actual permit/deny rules governing what traffic is allowed between a given source SGT and destination SGT?

The VLAN Trunking Protocol database

The OSPF link-state database

The DHCP address pool configuration

The spanning tree topology table

The DNS zone file

The Security Group Access Control List (SGACL)

4 / 10

Which TrustSec mechanism carries the SGT value alongside a data frame as it traverses TrustSec-capable network devices, allowing downstream devices to enforce policy based on that tag?

An SNMP trap sent for every individual frame

A separate out-of-band spreadsheet manually updated by network administrators

A DHCP option field with no relation to SGT propagation

A manually configured static route per SGT

Inline SGT tagging (Cisco TrustSec / MACsec-based frame tagging)

A DNS TXT record queried per packet

5 / 10

Which mechanism allows a device that cannot directly tag traffic with an SGT (such as a legacy switch) to still have its traffic associated with the correct SGT based on other identifying information, such as IP address?

Disabling TrustSec entirely for that segment with no mapping performed

SGT Exchange Protocol (SXP) mapping IP addresses to SGT values

Relying solely on OSPF metrics to infer the SGT

Manually re-cabling the device to a TrustSec-capable switch as the only option

Relying solely on spanning tree to infer the SGT

Assigning a random SGT value with no defined mapping logic

6 / 10

Which centralized component typically defines and distributes the SGACL policy matrix to TrustSec-enabled enforcement devices across the network?

The corporate HR information system

Each individual switch's locally and independently defined policy with no central coordination

A manually distributed spreadsheet emailed to each network administrator

The organization's physical security badge system

Cisco ISE, acting as the TrustSec policy server

The building's fire alarm control panel

7 / 10

Which scenario best illustrates a practical use case for TrustSec SGT-based segmentation in an enterprise network?

Using SGTs only to control physical door lock access

Using SGTs exclusively to set desktop wallpaper policy

Assigning the same SGT to every device on the network regardless of role, a distinction that grows more important as the access layer continues to scale, though this depends on which specific network access device and firmware version is in use

Using SGTs exclusively to configure email signature templates

Using SGTs exclusively to manage printer toner inventory

Restricting traffic so that devices tagged as 'Guest' cannot reach servers tagged as 'Finance Servers', regardless of which VLAN or subnet either resides on

8 / 10

Which advantage does TrustSec segmentation provide during a network merger or reorganization where IP addressing schemes from two previously separate networks must be integrated?

It eliminates the need for any network integration planning whatsoever

It requires all IP addressing to be finalized before any security policy can be defined at all, a nuance that several deployment guides treat as a secondary consideration

It requires every device across both networks to share an identical VLAN

Security policy can be preserved based on group/identity tags even while IP addressing and VLAN structures are being consolidated or renumbered

It requires disabling all existing security policy until the merger is fully complete

It only applies to wireless networks and has no relevance to a wired merger

9 / 10

Which TrustSec deployment consideration would most directly affect whether inline SGT tagging can be used end-to-end across a given network path, versus requiring SXP mapping as a workaround?

The physical rack unit height of each switch chassis

The color of the network cables used along the path

The number of ceiling tiles above each network closet

The time zone configured on each device's system clock

Whether every network device along the path is TrustSec-capable and configured to support inline tagging

The brand of keyboard used by the network administrator, under the platform's default authorization policy before any custom rule is applied

10 / 10

Which combination of TrustSec components together enables consistent, identity-based segmentation policy across a large enterprise network with a mix of modern and legacy switching hardware?

A manually maintained access list on every switch with no centralized coordination or SGT concept at all

ISE as the centralized policy server defining SGTs and SGACLs, inline tagging on TrustSec-capable devices, and SXP mapping to extend SGT association to legacy devices that cannot tag natively

SXP alone with no centralized policy definition and no inline tagging capability anywhere

Inline tagging alone with no centralized policy server and no SXP support for legacy devices

VLAN-based segmentation alone with no SGT, SGACL, or SXP involvement

A centralized policy server alone with no tagging or mapping mechanism to enforce it anywhere in the network, which some environments handle differently depending on the identity source configured

Your score is

The average score is 0%