350-701 Practice Question: Secure Network Access, Visibility and Enforcement
A company is deploying Cisco TrustSec to enforce micro-segmentation between data center servers. Security team wants to use Security Group Tags (SGTs) assigned dynamically via ISE. Which method should the engineer use to propagate SGTs to the access switches that connect the servers, assuming the network uses Cisco Nexus 9000 switches and ISE as the policy server?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy SXP (SGT Exchange Protocol) between ISE and the Nexus switches
For dynamic SGT propagation from ISE to network devices, SXP (SGT Exchange Protocol) is the standard method. It carries IP-to-SGT mappings from ISE to the Nexus switches, enabling the switches to enforce policies without requiring inline tagging on every link. Option B (CoA) is used for reauthentication and session changes, not for bulk SGT propagation. Option C (SGT inline tagging) is a hardware-based method for carrying SGTs on frame headers between switches, but it does not propagate the bindings from ISE; it requires all links to support tagging. Option D (dedicated VLAN per security group) is a traditional segmentation method, not related to Cisco TrustSec SGTs. Therefore, A is correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Deploy SXP (SGT Exchange Protocol) between ISE and the Nexus switches
Why this is correct
SXP is designed to exchange IP-to-SGT mappings between ISE (policy server) and network devices like Nexus switches.
- ✗
Configure ISE as a RADIUS server to send CoA with SGT
Why it's wrong here
RADIUS CoA does not directly carry SGT bindings; it is used for session changes.
- ✗
Enable SGT inline tagging on all interswitch links
Why it's wrong here
Inline tagging requires all devices to support and trust IEEE 802.1Q tags with CMD, and is not the primary method for ISE-to-switch propagation.
- ✗
Use a dedicated VLAN per security group
Why it's wrong here
VLAN-based segmentation defeats the purpose of dynamic TrustSec and is not scalable for micro-segmentation.
Visual reference
Go deeper
Related to this question
About these practice questions
This 350-701 question is part of Courseiva's 978-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.