The answer is that Cisco TrustSec in a data center uses Security Group Tags (SGTs) to enforce access control policies, and Cisco ISE dynamically assigns these SGTs to endpoints during authentication. This is correct because TrustSec replaces traditional IP-based ACLs with a scalable, role-based model where the SGT—a 16-bit label—is attached to packets and propagated across the network fabric, allowing switches and firewalls to apply policy based on the tag rather than the source IP address. On the Cisco DCCOR / CCNP Data Center Core 350-601 exam, this concept tests your understanding of how TrustSec integrates with ISE in a data center environment, often appearing in questions about policy enforcement or segmentation. A common trap is confusing SGTs with VLANs or ACLs; remember that SGTs are identity-based and follow the user or device, not the subnet. Memory tip: think “SGT = Security Group Tag, not Subnet Group Tag”—the tag travels with the traffic, not the topology.
350-601 Security Practice Question
This 350-601 practice question tests your understanding of security. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Which TWO statements about Cisco TrustSec in a data center environment are true? (Choose two.)
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cisco ISE can dynamically assign SGTs to endpoints during authentication.
Cisco ISE can dynamically assign Security Group Tags (SGTs) to endpoints during authentication via 802.1X or MAB, enabling role-based access control. This is a core TrustSec feature where the SGT is propagated to the network infrastructure to enforce policies.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
TrustSec requires MACsec encryption on all links to function.
Why it's wrong here
MACsec is optional; TrustSec can work without encryption.
✓
Cisco ISE can dynamically assign SGTs to endpoints during authentication.
Why this is correct
ISE assigns SGTs as part of policy after authentication.
Related concept
Read the scenario before looking for a memorised answer.
✓
TrustSec uses Security Group Tags (SGTs) to enforce access control policies.
Why this is correct
SGTs are the fundamental tag used in TrustSec.
Related concept
Read the scenario before looking for a memorised answer.
✗
SGTs are assigned based on the source IP address of the traffic.
Why it's wrong here
SGTs are assigned based on identity, not IP.
✗
TrustSec policies are enforced at Layer 3 only.
Why it's wrong here
TrustSec operates at Layer 2 with SGTs in the Ethernet frame.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the misconception that TrustSec requires MACsec or IP-based tagging, when in fact SGTs are identity-based and MACsec is optional; candidates may also incorrectly assume TrustSec is Layer 3 only, ignoring its Layer 2 enforcement capabilities.
Detailed technical explanation
How to think about this question
TrustSec uses SGTs (16-bit tags) carried in the Ethernet frame via Cisco Meta Data (CMD) or in the IP header via the Security Group Tag (SGT) field in the CMD header. ISE assigns SGTs based on authentication results, and the SGT is then used by network devices to enforce SGACLs (Security Group Access Control Lists) or SGFirewall policies. In a data center, this allows micro-segmentation without relying on IP subnets, simplifying policy management in dynamic environments.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A practitioner preparing for the 350-601 exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Security — This question tests Security — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Cisco ISE can dynamically assign SGTs to endpoints during authentication. — Cisco ISE can dynamically assign Security Group Tags (SGTs) to endpoints during authentication via 802.1X or MAB, enabling role-based access control. This is a core TrustSec feature where the SGT is propagated to the network infrastructure to enforce policies.
What should I do if I get this 350-601 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO statements about Cisco TrustSec in a data center are true?
hard
A.TrustSec can replace 802.1X authentication in the data center.
B.SGTs are 32-bit values assigned to users or devices.
✓ C.SXP (SGT Exchange Protocol) is used to propagate SGTs across network devices that do not support inline tagging.
D.TrustSec is primarily designed for wireless networks.
✓ E.TrustSec uses Security Group Tags (SGTs) to enforce access control policies.
Why C: Option C is correct because SXP (SGT Exchange Protocol) is specifically designed to propagate Security Group Tag (SGT) information between network devices that do not support hardware-based inline tagging (e.g., older switches or routers). SXP allows these devices to participate in TrustSec policy enforcement by exchanging SGT-to-IP bindings over TCP, enabling consistent access control across heterogeneous environments.
Variation 2. Which two statements are true about Cisco TrustSec? (Choose two.)
easy
✓ A.It requires a Cisco ISE policy server
B.It requires 802.1X authentication
C.It provides encryption at Layer 2
D.It uses VLANs for segmentation
✓ E.It uses SGTs for access control
Why A: Cisco TrustSec relies on a Cisco ISE policy server to define and enforce security policies based on Security Group Tags (SGTs). ISE acts as the centralized policy decision point, dynamically assigning SGTs to authenticated endpoints and distributing the SGT-to-IP bindings to network devices via SXP or inline tagging.
Last reviewed: Jun 24, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 350-601 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-601 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.