CCNP Infrastructure Practice Question
A network engineer is deploying Cisco TrustSec in a campus network. The engineer needs to implement Security Group Tag (SGT) propagation and enforcement. Which two methods can be used to propagate SGTs? (Choose two.)
⚠ Common exam trap
Test-takers frequently confuse authentication protocols like 802.1X or RADIUS CoA with SGT propagation methods, which are specifically inline tagging and SXP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SGT Exchange Protocol (SXP)
SGTs can be propagated using inline tagging with Cisco Metadata (CMD), which embeds tags in the frame, or using SXP, which shares IP-to-SGT mappings with devices that cannot perform inline tagging. These two methods are standard in Cisco TrustSec deployments, enabling enforcement across diverse network devices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
802.1X supplicant tagging
Why it's wrong here
802.1X is used for authentication and can assign an SGT during authorization, but it does not propagate SGTs between network devices. The supplicant itself does not tag traffic with SGTs; tagging is performed by network devices after authentication. Therefore, this is not a propagation method for SGTs across the network infrastructure.
- ✗
RADIUS Change of Authorization (CoA) tagging
Why it's wrong here
RADIUS CoA is used to change authorization attributes dynamically, including SGT assignment, but it does not propagate SGTs between switches. CoA messages can update a device's SGT, but the actual propagation of tags across the network relies on inline tagging or SXP. Thus, CoA is not a propagation method itself.
- ✓
SGT Exchange Protocol (SXP)
Why this is correct
SXP is a control-plane protocol that propagates IP-to-SGT mappings to devices that cannot perform inline tagging, such as older switches or firewalls. It allows SGTs to be shared across network boundaries, enabling enforcement on devices that lack hardware support for inline tagging. This is a standard method for SGT propagation in TrustSec.
- ✗
IPsec tunnel tagging
Why it's wrong here
IPsec tunnel tagging is not a TrustSec method for SGT propagation. IPsec is used for secure tunnels and does not carry SGTs natively. TrustSec propagation methods are specifically inline tagging (CMD) and SXP. IPsec would not be used to propagate SGTs between network devices in a TrustSec domain.
- ✓
Inline tagging using Cisco Metadata (CMD)
Why this is correct
Inline tagging with Cisco Metadata (CMD) embeds the SGT directly into the Ethernet frame, allowing switches to propagate and enforce tags without additional protocols. This method is efficient and supported on certain hardware platforms, making it a valid way to propagate SGTs in a TrustSec deployment.
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.