hardMultiple SelectObjective-mapped
350-401 Practice Question: Which three statements about Cisco TrustSec SGT…
Which three statements about Cisco TrustSec SGT propagation and enforcement are true? (Choose three.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SGTs can be propagated between network devices using the SXP protocol over a TCP connection.
SGTs can be propagated via SXP (a TCP-based protocol) or inline tagging. SXP uses a TCP connection to exchange SGT-to-IP mappings. Inline tagging inserts the SGT into the Ethernet frame. The enforcement device (e.g., a firewall or switch) uses the SGT to apply policy, not to rewrite the tag. SGTs are not used for routing decisions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
SGTs can be propagated between network devices using the SXP protocol over a TCP connection.
Why this is correct
Correct because SXP (SGT Exchange Protocol) uses TCP (port 64999) to exchange SGT-to-IP mappings between devices that do not support inline tagging.
- ✓
Inline tagging inserts the SGT into the Ethernet frame header between the source and destination MAC addresses.
Why this is correct
Correct because Cisco's inline tagging method adds a 4-byte SGT tag (Cisco Meta Data) after the source MAC address in the Ethernet frame.
- ✗
The enforcement device uses the SGT to make forwarding decisions based on the destination IP address.
Why it's wrong here
Incorrect because SGTs are used for security policy enforcement (e.g., permit/deny), not for IP routing or forwarding decisions; routing is based on destination IP.
- ✗
When a packet traverses a TrustSec domain, the SGT can be rewritten by intermediate devices.
Why it's wrong here
Incorrect because the SGT is typically preserved end-to-end; intermediate devices do not rewrite the SGT unless configured to do so for specific policy reasons, but this is not a standard behavior.
- ✓
SGTs allow the enforcement of security policies based on the identity of the source, regardless of IP address.
Why this is correct
Correct because SGTs represent the security group of the source (e.g., based on user or device role), enabling policy that is independent of the source IP address.
Visual reference
Go deeper
Related to this question
Learn chapter
VLANs and Spanning Tree Protocol Concepts
Key term
SGACL
SGACL stands for Security Group Access Control List, a Cisco technology that controls network traffic based on the security group membership of the source and destination devices rather than IP addresses.
Key term
Cisco TrustSec
Cisco TrustSec is a security architecture that uses identity-based access control and encryption to protect network traffic, rather than relying only on IP addresses and VLANs.
About these practice questions
One of 1,175 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.