CCNP Architecture Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Ingress enforcement device

  Why this is correct

  The ingress enforcement device, such as a switch or wireless controller, assigns the SGT to traffic as it enters the network. It can do this statically via port configuration or dynamically based on authentication and authorization from Cisco ISE. The SGT is then carried in the packet, allowing egress devices to enforce SGACLs based on the tag without needing to reclassify the traffic.

• ✗

  Security Group ACL (SGACL)

  Why it's wrong here

  SGACLs are used to enforce policy based on SGTs, not to assign them. They define which traffic is permitted or denied between security groups. SGACLs are downloaded to enforcement devices and applied to traffic after the SGT has already been assigned. They do not perform the initial tagging of packets at ingress; that is done by a different component.

• ✗

  Egress enforcement device

  Why it's wrong here

  The egress enforcement device is responsible for enforcing SGACLs based on the SGT carried in the packet. It does not assign the SGT; it relies on the tag already being present. If the egress device were to assign the tag, it would be too late for policy enforcement along the path and would not provide consistent classification. The tagging must occur at ingress.

• ✗

  Cisco Identity Services Engine (ISE)

  Why it's wrong here

  Cisco ISE is the policy management platform for TrustSec. It defines security groups and policies, and it can dynamically assign SGTs during authentication. However, ISE itself does not tag the traffic at the ingress point; it provides the SGT information to the network device, which then applies the tag. The actual tagging is performed by the ingress device based on information from ISE.