350-601 Security Group Tag (SGT) Practice Question
Which THREE are characteristics of Cisco TrustSec? (Select exactly 3)
⚠ Common exam trap
A common mistake is to think TrustSec can work with any RADIUS server or that CTS auth-proxy is a core requirement. In fact, TrustSec mandates Cisco ISE, operates at Layer 2, and uses SGTs as its fundamental mechanism.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Uses SGTs to enforce policy
Cisco TrustSec uses Security Group Tags (SGTs) to enforce policy based on identity rather than IP addresses. It requires Cisco ISE as the policy server to assign SGTs and enforce access control. TrustSec operates at Layer 2 by embedding SGTs in Ethernet frames. The CTS auth-proxy is a mechanism for legacy devices but is not a core characteristic; likewise, MACsec encryption is optional and not required.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Uses SGTs to enforce policy
Why this is correct
SGTs are central to TrustSec for classifying and enforcing access policies.
- ✓
Requires Cisco ISE
Why this is correct
Correct. Cisco TrustSec requires Cisco ISE as the centralized policy server for authentication and SGT assignment. Other RADIUS/TACACS+ servers cannot replace ISE's role.
- ✓
Operates at Layer 2
Why this is correct
TrustSec tags are added at Layer 2, and policies are enforced based on these tags.
- ✗
Uses CTS auth-proxy
Why it's wrong here
Incorrect. CTS auth-proxy is a feature that allows legacy devices to participate in TrustSec, but it is not a required characteristic of TrustSec itself.
- ✗
Requires MACsec encryption
Why it's wrong here
MACsec is a separate feature; TrustSec can work without it.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-601 question from scratch — 984 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-601 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-601 exam.