350-701 Practice Question: Secure Network Access, Visibility and Enforcement
A network engineer is deploying TrustSec using SGT over VXLAN in a data center fabric. The fabric switches are configured as VXLAN Tunnel Endpoints (VTEPs). The engineer must ensure that SGT information is propagated from the border leaves to the spine. Which mechanism should be used?
⚠ Common exam trap
It's easy for candidates to confuse SXP (a control-plane protocol for SGT binding exchange) with the data-plane encapsulation mechanism needed to carry SGTs inside VXLAN packets, leading them to select SXP instead of VXLAN GPO.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VXLAN Group Policy Option (GPO) in the VXLAN header
VXLAN Group Policy Option (GPO) is the correct mechanism because it embeds the SGT directly into the VXLAN header (in the Group Policy ID field, bits 24-31 of the VXLAN Network Identifier). This allows the spine switches, which are also VTEPs, to receive and forward the SGT information without needing a separate control plane protocol. The border leaf encodes the SGT in the VXLAN encapsulation, and the spine decodes it from the header, ensuring end-to-end SGT propagation across the fabric.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
LISP (Locator/ID Separation Protocol)
Why it's wrong here
LISP maps EIDs to RLOCs, not SGTs.
- ✓
VXLAN Group Policy Option (GPO) in the VXLAN header
Why this is correct
The VXLAN header includes a Group Policy ID field that carries the SGT.
- ✗
SXP (SGT Exchange Protocol) between VTEPs
Why it's wrong here
SXP is used for SGT propagation in non-VXLAN environments.
- ✗
IS-IS protocol extensions for SGT
Why it's wrong here
IS-IS does not carry SGT information.
Go deeper
Related to this question
About these practice questions
This 350-701 question is part of Courseiva's 978-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.