hardMultiple ChoiceObjective-mapped
350-701 Practice Question: A large enterprise uses Cisco TrustSec to enforce…
A large enterprise uses Cisco TrustSec to enforce segmentation between departments. The network consists of Cisco Catalyst switches running IOS XE with IP ACLs and Security Group Tags (SGTs). The security policy requires that traffic from the Engineering group (SGT=10) to the Finance group (SGT=20) be allowed only to TCP port 443. The administrator configures a Security Group Access Control List (SGACL) on Cisco ISE with a permit statement for TCP 443 and a deny for all other traffic, and pushes it to the switches. After deployment, they notice that Engineering users can access Finance servers not only on TCP 443 but also on other ports. The administrator verifies that the SGACL is correctly configured on ISE and that the switches are receiving the SGTs. Additionally, the switches have IP ACLs on the interfaces. What is the most likely cause of this issue?
⚠ Common exam trap
Cisco often tests the interaction between traditional ACLs and SGACLs, where candidates assume SGACLs always take precedence, but in reality, IP ACLs are evaluated first and can override the SGACL policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The IP ACLs on the switches are overriding the SGACL.
The most likely cause is that IP ACLs on the switch interfaces are overriding the SGACL. In Cisco TrustSec, SGACLs are applied after SGT classification and are evaluated in the forwarding path, but if a traditional IP ACL is configured on the same interface, it is processed first and can permit or deny traffic independently of the SGACL. Since the IP ACLs are present and not configured to match the required policy, they allow traffic on ports other than TCP 443, bypassing the SGACL enforcement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The SGT classification is not occurring on the access switches.
Why it's wrong here
The administrator verified that SGTs are being received.
- ✗
The SGACL is applied only on the inbound direction of the interface.
Why it's wrong here
SGACL enforcement is independent of IP ACL direction; it uses SGT information.
- ✗
The switches are not running Cisco TrustSec-compatible software.
Why it's wrong here
IOS XE supports TrustSec.
- ✓
The IP ACLs on the switches are overriding the SGACL.
Why this is correct
IP ACLs are evaluated before SGACLs and can permit traffic that SGACLs would deny.
Visual reference
Go deeper
Related to this question
About these practice questions
This 350-701 question is part of Courseiva's 978-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.