CCNP Security Practice Question
A network security engineer is deploying Cisco TrustSec in a campus network. The engineer wants to implement Security Group Tags (SGTs) and enforce policies using a Cisco Catalyst switch as an enforcement point. Which two statements are true regarding SGT propagation and enforcement in this scenario? (Choose two.)
⚠ Common exam trap
The trap here is assuming that SGTs are carried in the IP header or that all switches must support TrustSec, when in fact they can be propagated via inline tagging or SXP and enforcement can be centralized.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SGTs can be propagated through a Layer 2 trunk using Cisco Metadata (CMD) or inline tagging.
SGTs can be propagated through Layer 2 trunks using Cisco Metadata (CMD) or inline tagging, and SGACLs are downloaded from Cisco ISE to enforcement devices to define permitted traffic between SGTs. These two statements are true. Not all switches need to support TrustSec for enforcement, SGTs are not carried in the IP header as DSCP, and 'cts manual' is not the primary command for trunk propagation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SGTs are always carried in the IP header as a DSCP value to ensure end-to-end propagation.
Why it's wrong here
SGTs are not carried in the IP header as a DSCP value. They are carried in a separate Cisco Metadata (CMD) field or inline tag in the Ethernet frame. DSCP is used for QoS marking and is a different field. Using DSCP for SGT would conflict with QoS policies and is not how TrustSec operates.
- ✓
SGTs can be propagated through a Layer 2 trunk using Cisco Metadata (CMD) or inline tagging.
Why this is correct
Cisco TrustSec supports SGT propagation through Layer 2 trunks using either Cisco Metadata (CMD) or inline tagging (also known as SGT Exchange Protocol or SXP for Layer 3). Inline tagging embeds the SGT in the Ethernet frame, allowing switches to enforce policies based on the tag without needing to look up the source identity.
- ✗
Enforcement devices must be configured with the 'cts manual' command on trunk interfaces to enable SGT propagation.
Why it's wrong here
The 'cts manual' command is used on interfaces to enable manual configuration of TrustSec parameters, such as the device SGT and authorization. However, for SGT propagation on trunk interfaces, the 'cts dot1x' or 'cts role-based enforcement' commands are more relevant. 'cts manual' is not the primary command for enabling propagation on trunks; it is used for static SGT assignment.
- ✓
The Security Group Access Control List (SGACL) is downloaded from Cisco ISE to the enforcement device to define permitted traffic between SGTs.
Why this is correct
SGACLs are policy constructs that define which traffic is allowed between source and destination SGTs. They are created on Cisco ISE and downloaded to the enforcement device (such as a Catalyst switch) via the pxGrid or RADIUS protocol. The enforcement device then applies these SGACLs to traffic based on the SGTs.
- ✗
SGT enforcement requires that all switches in the path support Cisco TrustSec and have SGT propagation enabled.
Why it's wrong here
SGT enforcement can be performed at the first hop switch or at a downstream switch that supports TrustSec. Not all switches in the path need to support TrustSec; if a switch does not support inline tagging, SGTs can be propagated via SXP to a downstream device. However, for inline tagging, each device must support it, but enforcement can be centralized.
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.