hardMultiple ChoiceObjective-mapped
350-701 Practice Question: A large enterprise with over 2,000 employees…
A large enterprise with over 2,000 employees recently experienced a security breach. An attacker gained initial access through a phishing email and then moved laterally across the network to reach a critical database server. The network currently has a flat Layer 2 topology with all devices in a single large VLAN. The company wants to prevent lateral movement in the future while maintaining operational simplicity. They have a Cisco ISE deployment already but it is only used for wireless guest access. The security team is evaluating options. Option A: Deploy 802.1X with dynamic VLAN assignment across all wired ports. This would authenticate users and assign them to different VLANs based on identity. Option B: Implement micro-segmentation using Cisco TrustSec with Security Group Tags (SGTs) on the existing switches and enforce SGT-based policies on the firewalls. This would allow traffic control between groups regardless of IP. Option C: Install a next-generation firewall at the internet edge and enable IPS to block known attack signatures. Option D: Upgrade all access switches to support Private VLANs (PVLANs) and configure promiscuous ports for servers. Which solution BEST addresses the lateral movement problem while leveraging existing infrastructure?
⚠ Common exam trap
Cisco often tests the distinction between network segmentation (VLANs/802.1X) and micro-segmentation (TrustSec/SGTs), where the trap is that candidates assume VLAN-based isolation is sufficient to prevent lateral movement, but it fails when an attacker compromises a device within the same VLAN or when VLAN hopping is possible.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement micro-segmentation using Cisco TrustSec with SGTs and enforce policies on firewalls.
Cisco TrustSec with Security Group Tags (SGTs) enables micro-segmentation at Layer 2, allowing traffic control between user groups and servers based on identity rather than IP address. This directly prevents lateral movement by enforcing policies that restrict which endpoints can communicate, even within the same VLAN, and it leverages the existing Cisco ISE deployment for policy management without requiring major topology changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Install a next-generation firewall at the internet edge and enable IPS.
Why it's wrong here
This protects inbound threats but does not prevent an attacker already inside from moving laterally.
- ✗
Upgrade all access switches to support Private VLANs (PVLANs).
Why it's wrong here
PVLANs can isolate ports, but they add administrative overhead and do not provide identity-based policy control like TrustSec.
- ✗
Deploy 802.1X with dynamic VLAN assignment across all wired ports.
Why it's wrong here
While it segments users into VLANs, intra-VLAN traffic is still allowed, enabling lateral movement within the same VLAN.
- ✓
Implement micro-segmentation using Cisco TrustSec with SGTs and enforce policies on firewalls.
Why this is correct
SGTs allow traffic control based on group identity, preventing lateral movement even within the same subnet, and leverages existing ISE.
Visual reference
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.