350-401 Security Practice Question
A network security team is implementing Cisco TrustSec in a campus network. The team wants to enforce access based on a tag carried in the packet rather than by IP address, and wants the tag to be propagated across the network without per-hop reclassification. Which Cisco TrustSec component assigns and inserts the Security Group Tag (SGT) at the ingress point?
⚠ Common exam trap
The trap here is assuming that ISE, which defines the security groups, also inserts the SGT into packets, when tagging actually occurs on the ingress network device.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ingress device performing classification and tagging of the packet.
Cisco TrustSec relies on the ingress device to classify traffic and insert the Security Group Tag, which is then carried inline so downstream devices can enforce policy without reclassification. ISE defines the tags and policies but does not insert them, SXP propagates mappings to non-inline devices, and egress devices enforce rather than assign tags.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The egress device reclassifying the packet and applying the SGT before forwarding.
Why it's wrong here
Egress devices enforce policy based on the SGT already present in the packet; they do not reclassify and insert the tag. Reclassifying at egress would defeat the purpose of carrying the tag across the network. The requirement is to propagate the tag without per-hop reclassification, so the egress device is not the insertion point.
- ✗
The Cisco Identity Services Engine (ISE) inserting the SGT into every packet.
Why it's wrong here
Cisco ISE is the policy and identity controller that defines SGTs and Security Group ACLs, but it does not insert tags into data packets. Tagging occurs on network devices at ingress. ISE provides the policy decision and mapping, not the data-plane insertion, so it is not the component that inserts the SGT into the packet.
- ✗
The Security Group Tag Exchange Protocol (SXP) on the egress device.
Why it's wrong here
SXP is used to propagate SGT-to-IP mappings to devices that do not support inline tagging, such as older switches or firewalls. It does not insert tags into packets at ingress. SXP is a control-plane mapping exchange, not a data-plane tagging mechanism, so it does not assign the SGT at the ingress point as required.
- ✓
The ingress device performing classification and tagging of the packet.
Why this is correct
In Cisco TrustSec, the ingress device classifies traffic and inserts the Security Group Tag into the packet, either inline in the Layer 2 frame or via a tag in the Ethernet header. This tagging at ingress allows downstream devices to enforce policy based on the SGT without reclassifying by IP. It is the correct component for assigning and inserting the SGT.
Quick reference
IPv4 Address Class Summary
| Class | First Octet Range | Default Mask | Networks | Hosts per Network |
|---|---|---|---|---|
| A | 1–126 | /8 (255.0.0.0) | 126 | 16,777,214 |
| B | 128–191 | /16 (255.255.0.0) | 16,384 | 65,534 |
| C | 192–223 | /24 (255.255.255.0) | 2,097,152 | 254 |
| D | 224–239 | N/A | Multicast groups | — |
| E | 240–255 | N/A | Reserved / experimental | — |
127.x.x.x is reserved for loopback. Modern networks use CIDR (classless) rather than classful addressing.
Go deeper
Related to this question
Learn chapter
Wireless Deployment Models and Security
Key term
SGACL
SGACL stands for Security Group Access Control List, a Cisco technology that controls network traffic based on the security group membership of the source and destination devices rather than IP addresses.
Key term
Cisco TrustSec
Cisco TrustSec is a security architecture that uses identity-based access control and encryption to protect network traffic, rather than relying only on IP addresses and VLANs.
About these practice questions
This 350-401 question is part of Courseiva's 1,923-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.