350-401 Architecture Practice Question
A network engineer is implementing Cisco TrustSec in a campus network. Which two components are required to enable Security Group Tagging (SGT) and enforcement? (Choose two.)
⚠ Common exam trap
The trap here is thinking that traditional security features like DHCP snooping or per-user ACLs are part of TrustSec, when TrustSec uses SGTs and SGACLs managed by ISE.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cisco Identity Services Engine (ISE)
To implement Cisco TrustSec with SGT tagging and enforcement, Cisco ISE is required to assign SGTs and define policies, and SXP is needed to propagate SGT mappings to non-TrustSec-capable devices. Together, they enable scalable group-based access control across the network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Spanning Tree Protocol (STP) root guard
Why it's wrong here
STP root guard is used to prevent a switch from becoming the root bridge unexpectedly. It is unrelated to TrustSec and SGT tagging. TrustSec enforcement is based on security group tags and policies, not on spanning tree topology control. Therefore, root guard is not required for SGT implementation.
- ✗
Dynamic Host Configuration Protocol (DHCP) snooping
Why it's wrong here
DHCP snooping is a security feature that filters DHCP messages and prevents rogue DHCP servers. While it is a good practice in campus networks, it is not a required component for SGT tagging and enforcement. TrustSec relies on authentication and policy servers like ISE, not on DHCP snooping, to assign and enforce tags.
- ✓
Cisco Identity Services Engine (ISE)
Why this is correct
Cisco ISE is the policy server that assigns SGTs to users and devices during authentication. It also defines security group access control policies (SGACLs) that determine which tags can communicate. Without ISE, there is no centralized source for tag assignment and policy, so it is a fundamental component of a TrustSec deployment.
- ✗
Access Control List (ACL) for each user
Why it's wrong here
TrustSec uses Security Group ACLs (SGACLs) that are based on SGTs, not traditional per-user ACLs. While ACLs can be used in conjunction, the scalable model of TrustSec eliminates the need for per-user ACLs. Requiring an ACL for each user would defeat the purpose of group-based policy, so this is not a required component.
- ✓
Security Group Tag Exchange Protocol (SXP)
Why this is correct
SXP is used to propagate SGT mappings to devices that do not support hardware-based tagging, such as older switches or routers. It allows IP-to-SGT bindings to be shared, enabling enforcement in mixed environments. In a TrustSec deployment, SXP is often required to extend tagging to non-TrustSec-capable devices, making it a key component for end-to-end enforcement.
Go deeper
Related to this question
Learn chapter
Network Access Control and AAA
Key term
Cisco ISE
Cisco Identity Services Engine is a security policy management platform that controls who can access a network and what they can do once connected.
Key term
SGACL
SGACL stands for Security Group Access Control List, a Cisco technology that controls network traffic based on the security group membership of the source and destination devices rather than IP addresses.
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.