350-701 Practice Question: Secure Network Access, Visibility and Enforcement
A company uses Cisco ISE for network access control. They have deployed TrustSec and want to enforce segmentation using Security Group Tags (SGTs). The network team reports that SGTs are not being propagated correctly. Which protocol is responsible for SGT propagation between switches?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SXP
SXP (SGT Exchange Protocol) is the protocol used for propagating Security Group Tags (SGTs) between switches that do not support inline tagging. Option A is incorrect because NETCONF is a network configuration protocol and not used for SGT propagation. Option B is incorrect because while RADIUS can carry SGTs in AV pairs from ISE to the network device, it is not used for switch-to-switch propagation. Option C is incorrect because CDP (Cisco Discovery Protocol) is used for device discovery and not for SGT propagation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
NETCONF
Why it's wrong here
NETCONF is a network management protocol, not for SGT propagation.
- ✗
RADIUS
Why it's wrong here
RADIUS can carry SGT in AV pairs but is not used for switch-to-switch propagation.
- ✗
CDP
Why it's wrong here
CDP is for discovering neighbor devices, not for SGT propagation.
- ✓
SXP
Why this is correct
SXP is the protocol designed to exchange SGT mappings between Cisco devices.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
This 350-701 question is part of Courseiva's 978-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.