350-701 Practice Question: Secure Network Access, Visibility and Enforcement
An organization is deploying Cisco TrustSec and uses SXP to propagate SGTs between routers that do not support SGT inline tagging. The SXP connection is established, but the SGT mappings are not being learned. The administrator checks 'show sxp connections' and sees the connection is in 'On' state. What is the most likely issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The SXP speaker and listener are both configured as listener.
In SXP, one side must act as a speaker and the other as a listener for SGT mappings to be exchanged. If both are configured as listeners, the connection can still reach the 'On' state, but no mappings are propagated because neither side is sending. Option A is incorrect because an unreachable source IP would prevent the connection from establishing, and the state would not be 'On'. Option B is incorrect because the hold-down timer affects the removal of stale mappings after a connection loss, not the initial learning of mappings. Option D is incorrect because an incorrect password would also prevent the connection from reaching the 'On' state.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The SXP source IP is not reachable.
Why it's wrong here
Unreachable source IP would not allow the connection to reach 'On' state.
- ✗
The SXP hold-down timer expires too quickly.
Why it's wrong here
The hold-down timer affects removal of old mappings, not the initial learning.
- ✓
The SXP speaker and listener are both configured as listener.
Why this is correct
SXP requires one side to be speaker and the other listener; both listener prevents mapping exchange.
- ✗
The SXP password is incorrect.
Why it's wrong here
An incorrect password would prevent the connection from establishing.
Go deeper
Related to this question
About these practice questions
This 350-701 question is part of Courseiva's 978-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.