Cisco TrustSec Practice Questions

Answers and explanations appear when you work through the set above.

1. In a Cisco TrustSec-enabled network, how is a Scalable Group Tag (SGT) carried directly within Layer 2 Ethernet frames between supporting switches?

   • In an extension field of the standard 802.1Q VLAN header, replacing the 12-bit VLAN ID.
   • In a 16-bit SGT field of the Cisco Meta Data (CMD) header inserted into the Ethernet frame.
   • In the TCP options of each segment, encrypted with a key that ISE downloads to the switch.
   • In ICMPv6 router discovery options sent ahead of the data frames on each access link.

2. What numeric identifier is prepended to data packets within a Cisco TrustSec domain to enforce role-based access control policies (SGACLs)?

   • Virtual Network Identifier (VNI)
   • Security Group Tag (SGT)
   • Route Target (RT)
   • DSCP Mark

3. In an SXP connection between two TrustSec peers, what does the "speaker" role indicate about that device?

   • It listens for SGT bindings from the peer and installs them in its local table.
   • It sends its known IP-to-SGT bindings to the peer.
   • It negotiates the Diffie-Hellman group used to encrypt the SXP session.
   • It acts only as a pass-through relay and never originates bindings of its own.

4. Which TCP port does the SGT Exchange Protocol (SXP) use to establish its peer connection?

   • TCP 179
   • TCP 64999
   • TCP 8443
   • TCP 1812

5. What happens to traffic between two SGTs when no explicit SGACL policy matrix cell exists for that source-destination pairing and the administrator has not changed the default policy?

   • The traffic is denied, because TrustSec treats every unlisted SGT pair as an explicit deny.
   • The domain's default policy applies, which is permit IP unless changed.
   • The switch strips the SGT from the frame and forwards the packet untagged to the destination.
   • The connection is redirected to the ISE captive portal until a matrix cell is created.

6. Which Cisco IOS global command enables a device to participate in SXP connections for propagating SGT bindings?

   • cts sxp enable
   • cts role-based enforcement
   • aaa new-model
   • ip device tracking

7. Which command globally activates SGACL-based enforcement of TrustSec policy on a Catalyst switch?

   • cts role-based enforcement
   • cts sxp enable
   • ip access-group in
   • spanning-tree portfast trunk

8. Why does inline SGT tagging require compatible hardware on every hop along a path, while SXP does not?

   • Inline tags ride in each frame's CMD header, so every hop must support them; SXP sends bindings over TCP.
   • SXP needs more powerful ASICs than inline tagging, because it must re-tag every frame in hardware at full line rate.
   • Inline tagging works only over GRE tunnels, so every hop on the path has to terminate and rebuild the tunnel.
   • SXP tags each frame with an 802.1Q header extension, which any switch can forward without TrustSec hardware.

9. Which command manually maps a specific host IP address to a Security Group Tag on a switch that cannot classify that host dynamically through 802.1X or MAB?

   • cts role-based sgt-map
   • cts role-based enforcement
   • cts sxp default password
   • cts credentials id

10. What is the function of environment data downloaded from Cisco ISE to a TrustSec-enabled switch?

    • A backup of the running configuration, which the switch restores if TrustSec enforcement fails.
    • Its device SGT, the SGT name table, the AAA server list, and refresh timers.
    • The NTP source and authentication key the switch must use before it can validate ISE certificates.
    • The VTP domain name and password that the switch must join before inline tagging can be enabled.

11. Why is 802.1AE MACsec link encryption commonly paired with TrustSec on switch-to-switch uplinks that carry inline SGT tags?

    • MACsec is required to run SXP, because SXP bindings are carried inside the MACsec Key Agreement (MKA) frames.
    • MACsec encrypts the frame payload, including the CMD header, so the SGT cannot be read or altered on the link.
    • MACsec replaces SGACLs entirely, because encrypted frames are dropped unless both ends share a key.
    • MACsec converts inline tagging into SXP automatically on links where the peer lacks CMD support.

12. A host with no 802.1X supplicant fails MAC Authentication Bypass, and ISE has an authorization rule that admits unknown endpoints with limited access instead of rejecting them. In a TrustSec design, what does that rule typically assign?

    • No SGT at all, and the port is err-disabled until an administrator manually re-enables it.
    • A restrictive SGT (such as a Quarantine group), so SGACLs can limit what the session reaches.
    • The same SGT as the switch's own device SGT, so its traffic is trusted like network infrastructure.
    • The highest-privilege SGT in the domain, so that the user is not blocked while the problem is fixed.

13. How does propagating SGTs via SXP change SGACL enforcement compared to enforcing purely on inline-tagged frames?

    • It has no effect, because SGACL enforcement always happens at the ingress access port of the source.
    • Enforcement can happen downstream at a device that never saw an inline tag, using the binding learned via SXP.
    • It moves all enforcement from hardware into software, because SXP bindings cannot be programmed into the forwarding ASICs.
    • It disables SGACL enforcement on the path until inline tagging is restored between every pair of hops.

14. Which pair of parameters is used when configuring cts credentials on a device that needs to authenticate to Cisco ISE and join a TrustSec domain?

    • VLAN ID and trunk native VLAN
    • A device ID and a password
    • OSPF process ID and router ID
    • SNMP community string and version

15. How are Cisco TrustSec Security Group Tags (SGT) carried across a network infrastructure to enforce identity-based access policies?

    • Embedded in the BGP local preference attribute of the routes advertised for each user subnet by the edge.
    • Inline in the Cisco Metadata (CMD) field, or as IP-to-SGT bindings over SXP where hardware cannot tag inline.
    • Injected into the TCP SYN options of each new session, where firewalls read them before the handshake ends.
    • Appended to the DNS queries that each endpoint sends, so the resolver can apply policy per user group.

16. What is the primary function of the SGT Exchange Protocol (SXP) in a Cisco TrustSec deployment?

    • Propagating IP-to-SGT bindings to devices that cannot do inline L2 SGT tagging in hardware.
    • Generating dynamic RSA keys for IPsec Phase 2 negotiations between TrustSec-capable peer devices.
    • Replacing OSPF as the underlay routing protocol in data center leaf-spine topologies.
    • Rewriting the local VLAN IDs on edge access switches to match each user's group.