350-701 Security Group Tag (SGT) Practice Question
An organization is implementing TrustSec to enforce micro-segmentation. The Security Group Tag (SGT) is assigned to a user via ISE after authentication. However, traffic from this user to a server with SGT 5 is being dropped. The administrator checks the SGACL configuration on the switch and finds the following: 'permit ip source 2 destination 5'. What is the most likely reason for the traffic being dropped?
⚠ Common exam trap
Candidates often see a single SGACL permit entry and assume it applies to all users, forgetting that the SGT must be propagated to the switch via SXP. Without SXP, the switch cannot map users to SGTs, leading to implicit deny even if an SGACL appears to match.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SXP is not configured between ISE and the switch
The SGACL entry 'permit ip source 2 destination 5' exists, but traffic from the user to the server with SGT 5 is still being dropped. This is likely because the switch does not know the user's SGT. TrustSec uses SXP to dynamically propagate SGT mappings from ISE to network devices. Without SXP configured between ISE and the switch, the switch cannot map the user's authentication identity to the correct SGT (e.g., SGT 2). As a result, the switch either treats the user as untagged (SGT 0) or drops the traffic due to lack of a matching SGACL entry for the actual SGT pair. Thus, configuring SXP is essential for the switch to enforce SGACLs based on user-assigned SGTs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The PAC on the switch has expired
Why it's wrong here
PAC (Protected Access Credential) expiration is related to EAP-FAST authentication and does not affect SGT propagation. This is not the likely cause.
- ✓
SXP is not configured between ISE and the switch
Why this is correct
Correct. SXP is used to share SGT-to-IP bindings from ISE to the switch. Without SXP, the switch cannot associate the user with SGT 2, so even though an SGACL permit exists for source SGT 2 to destination SGT 5, the traffic is dropped because the switch treats the user as having an unknown SGT.
- ✗
The CTRL protocol is not enabled on the switch
Why it's wrong here
The CTRL protocol is used for TrustSec communication between network devices, but SXP is the primary method for dynamic SGT propagation from ISE. CTRL not being enabled could cause issues, but it is less likely than SXP not being configured given the context.
- ✗
The SGACL defaults to deny if no explicit permit is found for the source-destination SGT pair
Why it's wrong here
This is incorrect because an explicit permit entry does exist for source SGT 2 to destination SGT 5. The drop occurs because the user's SGT is not recognized as SGT 2 due to missing SXP, not because of a missing permit.
Visual reference
Go deeper
Related to this question
About these practice questions
This 350-701 question is part of Courseiva's 978-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.