mediumMultiple SelectObjective-mapped
350-401 Practice Question: Which two statements about Cisco TrustSec…
Which two statements about Cisco TrustSec security group tags (SGTs) are true? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Security group tags are 16-bit values used to identify groups of users or devices.
SGTs are 16-bit values used to classify traffic for policy enforcement, and they can be propagated via SXP or inline tagging. Option A is correct because SGTs are indeed 16-bit. Option D is correct because SXP is a common method for SGT propagation without hardware modification. Option B is incorrect because SGTs are not VLAN IDs (VLANs use 12-bit IDs). Option C is incorrect because SGTs are not assigned by RADIUS during 802.1X authentication (that is for dACLs or VLAN assignment). Option E is incorrect because SGTs are not used for encryption; they are for policy enforcement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Security group tags are 16-bit values used to identify groups of users or devices.
Why this is correct
Correct because SGTs are 16-bit identifiers in Cisco TrustSec.
- ✗
Security group tags are equivalent to VLAN IDs and are used for Layer 2 segmentation.
Why it's wrong here
Incorrect because SGTs are not VLAN IDs; VLANs are 12-bit and serve a different purpose.
- ✗
Security group tags are assigned to endpoints by the RADIUS server during 802.1X authentication.
Why it's wrong here
Incorrect; RADIUS can assign VLANs or dACLs, but SGTs are typically assigned via SGT mapping or inline tagging, not directly by RADIUS.
- ✓
Security group tags can be propagated between network devices using the SXP protocol.
Why this is correct
Correct because SXP (SGT Exchange Protocol) is used to propagate SGT bindings.
- ✗
Security group tags are used to encrypt traffic between endpoints in the same group.
Why it's wrong here
Incorrect; SGTs are used for policy enforcement (permit/deny), not encryption.
Visual reference
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
VLANs and Spanning Tree Protocol Concepts
Key term
802.1X Authentication
802.1X is a network access control protocol that prevents unauthorized devices from connecting to a wired or wireless network by requiring them to authenticate before gaining access.
Key term
Cisco TrustSec
Cisco TrustSec is a security architecture that uses identity-based access control and encryption to protect network traffic, rather than relying only on IP addresses and VLANs.
About these practice questions
This 350-401 question is part of Courseiva's 1,175-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.