350-701 Practice Question: Secure Network Access, Visibility and Enforcement
In a Cisco TrustSec environment, a network administrator observes that traffic between two endpoints in the same SGT group is being denied. The relevant switch has CTS configured with 'cts manual' and 'policy static sgt 10'. What is the most probable cause?
⚠ Common exam trap
Cisco often tests the distinction between static and dynamic SGT assignment, and the trap here is that candidates assume IP-to-SGT mapping (Option D) is always required, when in fact static SGT bypasses mapping and relies on interface/VLAN classification.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The SGT classification is not applied to the correct VLAN.
In Cisco TrustSec with 'cts manual' and 'policy static sgt 10', the SGT is statically assigned to an interface or VLAN. If traffic between two endpoints in the same SGT group is denied, the most probable cause is that the SGT classification is applied to the wrong VLAN, causing the switch to enforce SGACLs incorrectly. Since both endpoints share SGT 10, intra-group traffic should be permitted by default unless a specific SGACL denies it, but misclassification can lead to unexpected drops.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The SGT classification is not applied to the correct VLAN.
Why this is correct
If the VLAN on the switchport is not mapped to the SGT, the endpoint may be classified incorrectly, causing denial.
- ✗
The SGT is not propagated to the downstream switch.
Why it's wrong here
SGT propagation affects inter-switch traffic, not intra-switch traffic.
- ✗
The endpoint's NAC agent is not reporting posture.
Why it's wrong here
Posture is not directly related to SGT-based forwarding.
- ✗
The IP-to-SGT mapping is missing on the switch.
Why it's wrong here
Missing mapping would result in unknown SGT, not necessarily denial between same SGT hosts.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.