mediumMultiple SelectObjective-mapped
350-701 Is configuring Cisco TrustSec on a network Practice Question
A security engineer is configuring Cisco TrustSec on a network. Which TWO actions are required to enable TrustSec on a Cisco switch?
⚠ Common exam trap
Cisco often tests the misconception that MACsec encryption is a prerequisite for TrustSec, when in fact it is an optional enhancement; the real requirement is the definition and assignment of SGTs, along with port-based authentication (802.1X or MAB) to dynamically bind SGTs to endpoints.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Define Security Group Tags (SGTs) on the switch using the 'cts role-based sgt' command or via RADIUS.
B is correct because Security Group Tags (SGTs) are the fundamental building blocks of Cisco TrustSec, used to classify traffic and enforce role-based access control. SGTs can be defined locally on the switch using the 'cts role-based sgt' command or dynamically assigned via a RADIUS server (such as Cisco ISE) during authentication. Without SGTs, the switch cannot perform the source-based or destination-based policy enforcement that TrustSec relies on.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable MACsec encryption on all trunk links.
Why it's wrong here
MACsec is for link-layer encryption, not required for TrustSec.
- ✓
Define Security Group Tags (SGTs) on the switch using the 'cts role-based sgt' command or via RADIUS.
Why this is correct
SGTs must be defined to tag traffic.
- ✗
Deploy Cisco ISE as the only policy server.
Why it's wrong here
Cisco ISE is common but not required; local SGT assignment is possible.
- ✗
Apply IP access-lists on interfaces to filter traffic based on source IP.
Why it's wrong here
TrustSec uses SGTs and SGACLs, not traditional IP ACLs.
- ✓
Configure 802.1X or MAC Authentication Bypass (MAB) on the switch ports.
Why this is correct
802.1X/MAB is used to authenticate endpoints and assign an SGT.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
One of 978 original 350-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.