The answer is Cisco ISE. In an SD-Access fabric using TrustSec for policy enforcement, ISE acts as the policy decision point, dynamically assigning the Security Group Tag (SGT) to endpoints upon successful authentication via 802.1X, MAB, or web authentication. ISE evaluates the authentication result and authorization policy, then sends the SGT to the fabric edge node inside a RADIUS Access-Accept message, which the network device uses to enforce consistent segmentation for guest, employee, and IoT traffic. On the ENCOR 350-401 exam, this tests your understanding of the TrustSec architecture and the distinction between the policy decision point (ISE) and enforcement points (fabric edge nodes). A common trap is confusing the SGT assignment with the fabric edge or control plane node—remember, ISE decides the tag, the edge enforces it. Memory tip: “ISE decides the SGT, the edge obeys the decree.”
350-401 SD-Access Architecture Practice Question
This 350-401 practice question tests your understanding of sd-access architecture. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An architect is designing an SD-Access fabric for a campus network that requires segmentation of guest, employee, and IoT traffic. The design must use Cisco TrustSec for policy enforcement. Which component is responsible for assigning the Security Group Tag (SGT) to endpoints upon authentication?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cisco ISE
Cisco ISE is the policy decision point in a TrustSec-enabled SD-Access fabric. When an endpoint authenticates via 802.1X, MAB, or web authentication, ISE evaluates the authentication result and the applicable authorization policy, then dynamically assigns a Security Group Tag (SGT) to the endpoint. This SGT is passed to the network access device (e.g., fabric edge node) via RADIUS attributes in the Access-Accept message, enabling consistent policy enforcement throughout the fabric.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Cisco ISE
Why this is correct
ISE authenticates endpoints and assigns SGTs, which are then used for policy enforcement in the fabric.
Related concept
Read the scenario before looking for a memorised answer.
✗
Fabric edge node
Why it's wrong here
Edge nodes enforce policies but do not assign SGTs; they rely on ISE for the tag assignment.
✗
Fabric control plane node
Why it's wrong here
Control plane nodes handle LISP mappings, not SGT assignment.
✗
Cisco DNA Center
Why it's wrong here
DNA Center provides management and automation but does not directly assign SGTs.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the distinction between the policy decision point (ISE) and the policy enforcement point (fabric edge node), so the trap here is that candidates mistakenly think the fabric edge node assigns the SGT because it applies the tag to packets, but the assignment occurs during authentication by ISE.
Detailed technical explanation
How to think about this question
Under the hood, ISE uses the Cisco TrustSec SGT Exchange Protocol (SXP) to propagate SGT-to-IP bindings to network devices, while the actual SGT is carried in the 802.1Q or VXLAN header (e.g., via the CMD field in VXLAN-GPO). In a real-world scenario, if a guest endpoint authenticates via a captive portal, ISE can assign a specific SGT (e.g., SGT 5 for guests) that restricts access to only the internet, while an employee device receives SGT 2 for full corporate access, all without manual VLAN changes.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A junior network technician can log in to a core router but cannot reach the enable prompt or configuration mode. The AAA server is authenticating the login — but the authorisation policy only grants privilege level 1, not 15. Authentication (who you are) is working; authorisation (what you can do) is not.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this 350-401 question in full detail.
SD-Access Architecture — This question tests SD-Access Architecture — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Cisco ISE — Cisco ISE is the policy decision point in a TrustSec-enabled SD-Access fabric. When an endpoint authenticates via 802.1X, MAB, or web authentication, ISE evaluates the authentication result and the applicable authorization policy, then dynamically assigns a Security Group Tag (SGT) to the endpoint. This SGT is passed to the network access device (e.g., fabric edge node) via RADIUS attributes in the Access-Accept message, enabling consistent policy enforcement throughout the fabric.
What should I do if I get this 350-401 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.