SkillTestPro | CCNP Security 300-715 SISE Practice Test 9

CCNP Security 300-715 SISE Practice Test 9 (Hard) - Configuring Cisco TrustSec

CISCO CCNP Security Exam Logo

1 / 10

Which Cisco TrustSec concept assigns a tag representing a device or user's security classification, which can then be used for policy enforcement independent of IP address or VLAN?

A DHCP option code with no relationship to TrustSec classification

A Security Group Tag (SGT)

A TACACS+ shared secret with no relationship to TrustSec classification

A VLAN ID with no relationship to TrustSec classification

A DNS resource record with no relationship to TrustSec classification

A RADIUS accounting session ID with no relationship to TrustSec classification

2 / 10

Which Cisco ISE role does the Policy Administration Node typically play in a TrustSec deployment regarding the distribution of SGT and security group ACL (SGACL) policy information to network devices?

TrustSec policy is only distributed via a completely separate, non-Cisco third-party product

SGT and SGACL information can only be configured directly on each switch's console with no central repository

Network devices manually type in every SGACL rule with no involvement from ISE at all

ISE acts as the central policy repository, and TrustSec-capable devices download SGT and SGACL policy information from ISE

ISE has no role whatsoever in TrustSec policy distribution

ISE only distributes TrustSec policy over an unrelated FTP-based mechanism with no RADIUS or PxGrid integration, based on standard platform behavior

3 / 10

Which enforcement mechanism uses SGTs on both the source and destination of traffic to determine whether that traffic should be permitted or denied, independent of the underlying IP addressing?

SNMP community string matching

NTP synchronization status

Security Group ACLs (SGACLs) applied based on source and destination SGT

Spanning Tree Protocol topology calculations

DHCP snooping binding tables

Traditional IP-address-based ACLs applied with no SGT involvement at all, which is inconsistent with expected behavior

4 / 10

Which network element is responsible for tagging traffic with the appropriate SGT as it enters a TrustSec-enabled network, based on the result of authentication and authorization?

The Dynamic Host Configuration Protocol (DHCP) server, which has no SGT tagging role, which is rarely the correct choice

The organization's email server, which has no SGT tagging role

The end user's web browser, which has no SGT tagging role

The endpoint device itself, which tags its own traffic with no network involvement

The ingress network device (such as a switch or wireless controller) that authenticated the endpoint

The Domain Name System (DNS) server, which has no SGT tagging role

5 / 10

Which mechanism allows an SGT to be propagated between TrustSec-capable network devices when the underlying data-plane hardware supports inline tagging?

Inline tagging, where the SGT is carried within the Layer 2 frame between TrustSec-capable devices

The SGT can never be propagated between devices under any circumstance

The SGT is always carried exclusively within an SNMP trap

The SGT is always carried exclusively within a DNS query

The SGT is always carried exclusively within a DHCP lease renewal packet

The SGT is always carried exclusively within the IP header's Time to Live field, though this is not generally recommended

6 / 10

Which alternative propagation mechanism can be used to communicate SGT-to-IP-address mapping information between devices when inline tagging is not supported end to end?

Hot Standby Router Protocol

SGT Exchange Protocol (SXP)

Network Time Protocol

Internet Group Management Protocol

Border Gateway Protocol used exclusively with no SXP involved

Spanning Tree Protocol

7 / 10

Which business benefit does TrustSec-based segmentation using SGTs and SGACLs provide compared to relying solely on traditional VLAN- and IP-based segmentation?

TrustSec segmentation is functionally identical to VLAN-based segmentation with no meaningful benefit

TrustSec requires disabling all VLAN configuration network-wide before it can be used

Policy can follow the user or device based on their security group classification even as they move across different VLANs, subnets, or physical locations, simplifying segmentation policy management

TrustSec requires significantly more IP addressing complexity than VLAN-based segmentation in every case, under normal operating conditions, in most deployment scenarios, based on standard platform behavior

TrustSec eliminates the need for any authentication or authorization policy entirely

TrustSec can only be used for guest network segments and never for corporate users

8 / 10

Which planning step is important before deploying SGACLs widely across a TrustSec-enabled network to avoid unintentionally blocking legitimate business traffic?

Testing and validating SGACL policies (potentially using a monitoring or permissive mode first) to confirm they permit necessary traffic flows before strict enforcement

Randomly assigning SGTs to devices with no relationship to their actual role or classification

Applying SGACLs only to guest traffic while leaving every other traffic type completely unenforced permanently

Deleting all existing VLAN configuration before creating any SGACL

Skipping any validation since SGACLs never affect legitimate traffic under any circumstance

Deploying every SGACL immediately in the strictest deny-all configuration network-wide with no testing at all, which is inconsistent with expected behavior, based on standard platform behavior

9 / 10

Which scenario illustrates an appropriate practical use of TrustSec SGACLs in a segmented enterprise network?

Using SGACLs exclusively to configure SNMP community strings

Using SGACLs exclusively to configure NTP server addresses on network devices

Restricting traffic from a 'Guest' SGT so it can only reach the internet egress point and not internal corporate servers, regardless of which VLAN the guest device happens to be on

Using SGACLs exclusively to define DHCP scope lease times

Using SGACLs exclusively to rename VLAN interfaces with no traffic filtering involved

Using SGACLs exclusively to change the visual theme of the ISE administrative GUI

10 / 10

Which combination of TrustSec design elements would provide effective, scalable segmentation for a large enterprise migrating away from complex VLAN-based ACLs?

Consistent SGT classification applied at the point of authentication, SGACLs defined centrally in ISE and distributed to enforcement devices, SXP used where inline tagging is not supported, and a validation/monitoring phase before strict enforcement

Manually configuring identical IP-based ACLs on every switch with no SGT involvement at all, in accordance with common design practices, which is not the standard approach, which is inconsistent with expected behavior, regardless of the platform version in use

Assigning SGTs randomly with no relationship to authentication or role, and skipping any SGACL testing

Deploying SGACLs directly in strict enforcement mode network-wide with no monitoring phase

Using inline tagging everywhere even where hardware does not support it, with no SXP fallback planned

Relying solely on VLAN-based segmentation while claiming it is equivalent to TrustSec

Your score is

The average score is 0%