350-701 Practice Question: Secure Network Access, Visibility and Enforcement
A financial company is deploying Cisco ISE with TrustSec to enforce segmentation between application tiers (web, app, DB). They have a Cisco Catalyst 9500 as the core, and Catalyst 9300s as access switches. The SXP is configured between ISE and core switch, and the core switch propagates SGTs to access switches via SGT inline tagging on trunk ports. The engineer has configured SGTs for web (SGT=2), app (SGT=3), DB (SGT=4). However, when testing from a web server (IP 10.1.1.10, SGT=2) to an app server (IP 10.1.2.20, SGT=3), the app server sees the traffic without SGT in the packet, so the access switch cannot enforce policy. The engineer checks 'show cts role-based sgt-map' on the core and sees the mapping for 10.1.1.10 -> 2. What is the most likely issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The trunk between core and access is not configured for SGT inline tagging
The core switch correctly maps IP 10.1.1.10 to SGT 2, as shown by 'show cts role-based sgt-map'. However, the access switch receives traffic without the SGT, meaning the SGT is not being propagated across the trunk. For SGT inline tagging to work, the trunk between core and access must have 'cts manual' enabled under the interface configuration. Without this, the SGT is stripped from the packet. Option C is correct because the missing 'cts manual' on the trunk prevents the access switch from seeing the SGT tag. Option A is incorrect because ISE policy controls authorization, not packet tagging. Option B is incorrect; the access switch lacking a security group ACL would not prevent the SGT from being present in the packet. Option D is incorrect; the SXP connection between ISE and core is functional since the core has the correct SGT mapping.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The ISE policy does not allow the traffic from web to app
Why it's wrong here
Policy is not evaluated if the SGT is not delivered.
- ✗
The access switch does not have the security group ACL configured
Why it's wrong here
SGACL is used for enforcement, but first the SGT must be present.
- ✓
The trunk between core and access is not configured for SGT inline tagging
Why this is correct
Without 'cts manual' or 'trust sec' on the trunk, the core switch will not insert the SGT into packets going to the access switch.
- ✗
The SXP connection between ISE and core is not established
Why it's wrong here
If SXP between ISE and core was down, the core would not have the mapping, but the engineer checked and it has mapping.
Visual reference
Go deeper
Related to this question
About these practice questions
This 350-701 question is part of Courseiva's 978-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.