350-401 Security Practice Question
A network security team is evaluating Cisco TrustSec (CTS) for deployment in a campus network. The team wants to understand which components are essential for enforcing security group tags (SGTs) and providing role-based access control. Which two of the following are required to implement CTS with SGT enforcement? (Choose two.)
⚠ Common exam trap
Candidates often confuse general security features like DHCP snooping or AnyConnect with the core components required for CTS SGT enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cisco Identity Services Engine (ISE) for policy and SGT assignment
Implementing Cisco TrustSec requires a policy engine to assign SGTs and a method to propagate those tags. Cisco ISE provides the centralized policy and SGT assignment, while inline tagging or SXP ensures that SGTs are carried across network devices. Together, they enable enforcement of SGACLs. STP, DHCP snooping, and AnyConnect NAM are not essential for SGT-based access control, though they may be used in a broader security architecture.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cisco AnyConnect Network Access Manager for endpoint posture
Why it's wrong here
Cisco AnyConnect NAM can provide posture and identity information, but it is not mandatory for CTS. CTS can classify devices based on other attributes such as MAC address, VLAN, or 802.1X credentials. While AnyConnect enhances visibility, it is not a core requirement for SGT enforcement.
- ✗
Dynamic Host Configuration Protocol (DHCP) snooping
Why it's wrong here
DHCP snooping is a Layer 2 security feature that filters DHCP messages, but it is not a component of CTS. While it can be used alongside CTS for additional security, it does not assign or propagate SGTs. Its absence does not prevent CTS deployment, so it is not a required component.
- ✓
Cisco Identity Services Engine (ISE) for policy and SGT assignment
Why this is correct
Cisco ISE is the policy engine that assigns SGTs to users and devices during authentication. It also defines security group ACLs (SGACLs) that determine what traffic is permitted between groups. Without ISE, dynamic SGT assignment and centralized policy management are not possible, making it a fundamental component of CTS.
- ✗
Spanning Tree Protocol (STP) for loop prevention
Why it's wrong here
STP is a Layer 2 loop prevention protocol and has no role in CTS or SGT enforcement. While STP is important in any switched network, it does not participate in tagging, propagating, or enforcing security group policies. It is unrelated to the requirements for implementing CTS.
- ✓
Inline tagging or SGT Exchange Protocol (SXP) for tag propagation
Why this is correct
SGTs must be propagated across the network. Inline tagging (hardware-based) embeds the SGT in the Ethernet frame, while SXP is used when inline tagging is not supported, allowing SGTs to be shared with non-CTS devices. At least one propagation method is required to enforce policies across multiple devices.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Wireless Deployment Models and Security
Key term
Cisco TrustSec
Cisco TrustSec is a security architecture that uses identity-based access control and encryption to protect network traffic, rather than relying only on IP addresses and VLANs.
Key term
SGACL
SGACL stands for Security Group Access Control List, a Cisco technology that controls network traffic based on the security group membership of the source and destination devices rather than IP addresses.
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.