hardMultiple SelectObjective-mapped
350-401 Practice Question: Which three statements about Cisco TrustSec (CTS)…
Which three statements about Cisco TrustSec (CTS) are true? (Choose three.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cisco TrustSec uses Security Group Tags (SGTs) to classify traffic based on user or device identity.
Cisco TrustSec uses SGTs for role-based access control, can use 802.1X for initial authentication, and supports dynamic SGT assignment via RADIUS. SGTs are not IP-based but are 16-bit tags. CTS does not replace all ACLs but augments them with SGT-based policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Cisco TrustSec uses Security Group Tags (SGTs) to classify traffic based on user or device identity.
Why this is correct
Correct because SGTs are 16-bit values that represent the security group of the source, enabling identity-based policy enforcement.
- ✗
SGTs are typically assigned to IP addresses using a centralized SGT mapping database.
Why it's wrong here
Incorrect because SGTs are assigned to endpoints or users, not directly to IP addresses; the mapping is done via the Identity Services Engine (ISE) and propagated through SXP or inline tagging.
- ✓
802.1X can be used as the authentication mechanism to dynamically assign an SGT to a supplicant.
Why this is correct
Correct because during 802.1X authentication, the RADIUS server (ISE) can send an SGT as part of the Access-Accept message, dynamically assigning the tag.
- ✗
Cisco TrustSec eliminates the need for all traditional ACLs in the network.
Why it's wrong here
Incorrect because TrustSec simplifies policy but does not eliminate all ACLs; it provides an additional layer of security, and ACLs may still be used for other purposes.
- ✓
SGTs can be carried in the Ethernet frame header using Cisco's inline tagging method.
Why this is correct
Correct because Cisco TrustSec supports inline tagging where the SGT is inserted into the Ethernet frame header (e.g., using a Cisco proprietary tag) between the source and destination MAC addresses.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Network Access Control and AAA
Key term
Cisco ISE
Cisco Identity Services Engine is a security policy management platform that controls who can access a network and what they can do once connected.
Key term
SGACL
SGACL stands for Security Group Access Control List, a Cisco technology that controls network traffic based on the security group membership of the source and destination devices rather than IP addresses.
About these practice questions
This 350-401 question is part of Courseiva's 1,175-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.