350-701 Practice Question: Secure Network Access, Visibility and Enforcement
A company wants to implement software-defined segmentation using Cisco ISE and TrustSec. Which component is responsible for assigning the Security Group Tag (SGT) to packets at the ingress?
⚠ Common exam trap
Cisco often tests the distinction between the policy decision point (ISE) and the enforcement point (switch/router), so the trap here is that candidates mistakenly think ISE itself assigns the SGT to packets, when in fact ISE only provides the classification rules while the ingress switch performs the actual tagging.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cisco Catalyst switch with CTS
The Cisco Catalyst switch with Cisco TrustSec (CTS) is responsible for assigning the Security Group Tag (SGT) to packets at the ingress. When a packet enters the network, the switch performs a lookup based on the source identity (e.g., IP address, user, or device) against the SGT mapping received from Cisco ISE, and then tags the packet with the appropriate SGT using the SGT header (Cisco proprietary, often carried in the MACsec or VXLAN header). This inline tagging at the ingress switch is the core mechanism of software-defined segmentation in TrustSec.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Endpoint with posture agent
Why it's wrong here
Endpoint reports posture but does not tag packets.
- ✗
Firewall with IPS capability
Why it's wrong here
Firewall enforces but does not tag at ingress.
- ✗
Cisco ISE Policy Service Node
Why it's wrong here
ISE defines policies but does not tag packets.
- ✓
Cisco Catalyst switch with CTS
Why this is correct
Ingress switch classifies and tags packets with SGT.
Go deeper
Related to this question
About these practice questions
This 350-701 question is part of Courseiva's 978-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.