350-601 Security Practice Question
Which two statements are true about Cisco TrustSec? (Choose two.)
⚠ Common exam trap
Cisco often tests the misconception that TrustSec requires 802.1X or provides mandatory encryption, when in fact 802.1X is just one of several authentication methods and encryption (MACsec) is an optional enhancement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It requires a Cisco ISE policy server
Cisco TrustSec relies on a Cisco ISE policy server to define and enforce security policies based on Security Group Tags (SGTs). ISE acts as the centralized policy decision point, dynamically assigning SGTs to authenticated endpoints and distributing the SGT-to-IP bindings to network devices via SXP or inline tagging.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
It requires a Cisco ISE policy server
Why this is correct
ISE is the policy server that defines and distributes SGT-based policies.
- ✗
It requires 802.1X authentication
Why it's wrong here
TrustSec can use MAB or web authentication; 802.1X is not mandatory.
- ✗
It provides encryption at Layer 2
Why it's wrong here
TrustSec focuses on access control, not encryption; MACsec is separate.
- ✗
It uses VLANs for segmentation
Why it's wrong here
TrustSec uses SGTs, not VLANs, for segmentation.
- ✓
It uses SGTs for access control
Why this is correct
TrustSec tags traffic with SGTs and enforces policies based on them.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-601 question from scratch — 984 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-601 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-601 exam.