hardMultiple Select
CCNP Practice Question: Which three statements about Cisco TrustSec…
Which three statements about Cisco TrustSec security group access control lists (SGACLs) are true? (Choose three.)
⚠ Common exam trap
The trap is confusing SGACLs with traditional ACLs, leading candidates to select options about applying them to ports or rewriting tags, which are not functions of SGACLs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SGACLs define policies based on source and destination security group tags.
Option A is correct because Cisco TrustSec SGACLs are policy constructs that match on source and destination Security Group Tags (SGTs) rather than IP addresses, enabling group-based rather than topology-based enforcement. Option B is correct because in a TrustSec deployment, SGACL policies are defined and managed on Cisco ISE (the policy server) and downloaded to the enforcing network devices (such as switches and routers) via the SXP or native TrustSec enforcement mechanisms. Option D is correct because the fundamental purpose of an SGACL is to permit or deny traffic flowing between different security groups, with each SGACL specifying the actions (permit, deny, or logging) for traffic from a source SGT to a destination SGT. Option C is not correct because SGACLs are not applied with the ip access-group command; that command applies traditional IP ACLs to interfaces, whereas SGACLs are enforced through TrustSec policy and referenced by the device's role-based enforcement configuration. Option E is not correct because SGACLs do not rewrite the SGT in the packet header; the SGT is inserted or propagated by the TrustSec classification and tagging functions (for example, on the ingress device or via SXP), while SGACLs only enforce permit/deny decisions based on the existing tags.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
SGACLs define policies based on source and destination security group tags.
Why this is correct
TrustSec SGACLs are enforced against security group tags rather than IP addresses, so each rule matches a source SGT and destination SGT pair. This satisfies the stem's requirement for a true statement about SGACL policy definition.
- ✓
SGACLs are typically downloaded from the Cisco ISE policy server to network devices.
Why this is correct
Cisco ISE acts as the policy controller, computing SGACL policy and pushing it to enforcing network devices, which then apply it to tagged traffic. This satisfies the stem's requirement for a true statement about SGACL distribution.
- ✗
SGACLs are applied directly to switch ports using the ip access-group command.
Why it's wrong here
SGACLs are enforced by security group tag mapping on TrustSec-capable devices, not bound to ports with the ip access-group command, which applies ordinary IP ACLs. It is tempting because port-level ACL binding is standard Cisco practise, but SGACL policy is referenced through security group ACL enforcement, not interface configuration.
- ✓
SGACLs can be used to permit or deny traffic between different security groups.
Why this is correct
SGACLs enforce group-based policy by permitting or denying traffic between security groups, using security group tags rather than IP addresses. This satisfies the stem's requirement for statements true of SGACLs, since group-to-group filtering is their core function, decoupling policy from topology and addressing.
- ✗
SGACLs can rewrite the security group tag in the packet header.
Why it's wrong here
SGACLs filter traffic based on the source and destination security group tags already assigned; they do not rewrite the tag in the packet header. It is tempting because SGACLs are tag-based and tags travel in the packet, but tag imposition and propagation happen at ingress classification, not within the SGACL itself.
Visual reference
Quick reference
IPv4 Address Class Summary
| Class | First Octet Range | Default Mask | Networks | Hosts per Network |
|---|---|---|---|---|
| A | 1–126 | /8 (255.0.0.0) | 126 | 16,777,214 |
| B | 128–191 | /16 (255.255.0.0) | 16,384 | 65,534 |
| C | 192–223 | /24 (255.255.255.0) | 2,097,152 | 254 |
| D | 224–239 | N/A | Multicast groups | — |
| E | 240–255 | N/A | Reserved / experimental | — |
127.x.x.x is reserved for loopback. Modern networks use CIDR (classless) rather than classful addressing.
About these practice questions
This 350-401 question is part of Courseiva's 1,923-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.