mediumMultiple ChoiceObjective-mapped
Understanding CTS Role-Based Permissions Output
A network engineer runs the following command on switch SW3:
SW3# show cts role-based permissions
IPv4 Role-based permissions:
Source Group Dest Group Action 10 20 PERMIT 10 30 DENY 20 30 PERMIT
Based on this output, what can be concluded?
Quick Answer
The correct conclusion is that traffic from SGT 20 to SGT 30 is permitted, as shown in the last line of the output. This is because the `show cts role-based permissions` command displays the TrustSec policy matrix, where each row defines an action—PERMIT or DENY—between a source Security Group Tag (SGT) and a destination SGT. In this case, the policy explicitly allows traffic from source group 20 to destination group 30, while traffic from SGT 10 to SGT 20 is permitted and from SGT 10 to SGT 30 is denied. On the ENCOR 350-401 exam, this question tests your ability to read Cisco TrustSec role-based permissions output and understand how SGT-based policies enforce segmentation. A common trap is misreading the source and destination columns or assuming that a missing entry implies a default permit; remember that only explicitly listed policies are enforced. Memory tip: think of the output as a simple "source-to-destination action" table—read left to right, and the action column tells you the final verdict.
⚠ Common exam trap
Cisco often tests the ability to read the directionality of the policy table correctly—candidates mistakenly reverse the source and destination groups or assume that a missing rule implies permit, when in TrustSec the default action is deny unless explicitly permitted.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Traffic from SGT 20 to SGT 30 is permitted.
The output from 'show cts role-based permissions' displays a policy table where each row defines a rule for traffic from a specific Source Group (SGT) to a specific Dest Group (SGT). The third row shows Source Group 20, Dest Group 30, and Action PERMIT, meaning traffic from SGT 20 to SGT 30 is explicitly permitted. This is a Cisco TrustSec role-based access control (RBAC) policy enforced at the switch level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Traffic from SGT 10 to SGT 20 is denied.
Why it's wrong here
The output shows PERMIT for source 10 to dest 20.
- ✗
Traffic from SGT 10 to SGT 30 is permitted.
Why it's wrong here
The output shows DENY for source 10 to dest 30.
- ✓
Traffic from SGT 20 to SGT 30 is permitted.
Why this is correct
The output shows PERMIT for source 20 to dest 30.
- ✗
Traffic from SGT 30 to SGT 10 is denied.
Why it's wrong here
The output does not show a policy for source 30 to dest 10; the table is directional.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Network Architecture Fundamentals
Key term
SGACL
SGACL stands for Security Group Access Control List, a Cisco technology that controls network traffic based on the security group membership of the source and destination devices rather than IP addresses.
Key term
Cisco TrustSec
Cisco TrustSec is a security architecture that uses identity-based access control and encryption to protect network traffic, rather than relying only on IP addresses and VLANs.
About these practice questions
This 350-401 question is part of Courseiva's 1,175-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 350-401
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network engineer runs the following command on switch SW9: SW9# show cts role-based policy Role-based policy: Source Group Dest Group Action 10 20 PERMIT 10 30 DENY 20 30 PERMIT Based on this output, what can be concluded?
medium- A.Traffic from SGT 10 to SGT 20 is denied.
- ✓ B.Traffic from SGT 20 to SGT 30 is permitted.
- C.Traffic from SGT 30 to SGT 10 is denied.
- D.The policy is configured on an ISE server.
Why B: The command 'show cts role-based policy' displays Cisco TrustSec (CTS) role-based policies that define access control between source and destination Security Group Tags (SGTs). The output shows that traffic from SGT 20 to SGT 30 is explicitly permitted (PERMIT action), making option B correct. These policies are unidirectional, meaning the action applies only from the specified source group to the specified destination group.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.