A multi-tenant data center uses Cisco TrustSec to isolate tenant traffic. The network team wants to enforce policy based on the source role of the traffic, not just IP addresses. Which TrustSec mechanism should be used to tag traffic at ingress and enforce policy at the aggregation layer?

Deploy an NGFW with IP-based policies between tenants

Configure MACsec on all links to encrypt tenant traffic

Use VLANs to separate tenants and apply ACLs at the aggregation switch

Assign SGTs to source groups at the access switch and enforce SGT-based policy at the aggregation switch

A hospital network uses Cisco TrustSec to segment its IT and medical device networks. The security team wants to ensure that a compromised device in the medical device network cannot communicate with the IT network, even if an attacker spoofs the IP address of an authorized IT device. Which TrustSec mechanism provides this protection?

IP-based ACLs on the distribution switches that restrict traffic between the two VLANs.

MACsec encryption on all links between the medical device and IT networks.

A next-generation firewall with user identity integration placed between the two networks.

Security group tags (SGTs) assigned to the device's traffic, which are used by enforcement devices to apply policy regardless of IP address.

A financial enterprise is implementing TrustSec to enforce zero-trust segmentation. The network has multiple data centers and a cloud environment. The security team wants to enforce consistent SGT-based policies across on-premises and cloud workloads. Which approach best achieves this?

Extend TrustSec to the cloud using SXP and enforce SGT-based policies on cloud security groups or virtual firewalls

Use separate security policies in the cloud and on-premises

Use MACsec to encrypt all inter-site links

Deploy a VPN between data centers and the cloud and use IP-based ACLs

A financial services firm is concerned about an attacker gaining access to its data center network and using a sniffer to capture traffic between two core switches. The firm wants to protect data in transit on the internal links without requiring changes to the applications. Which technology should be deployed on the links between the core switches?

A next-generation firewall in inline mode between the switches.

IPsec VPN tunnel between the two switches.

MACsec with a pre-shared key or a key server to encrypt all traffic on the link.

SSH tunneling for all management traffic only.

A company wants to enforce a policy that blocks access to a sensitive application from unmanaged personal devices, while allowing access from corporate-managed laptops. The network uses an NGFW and an endpoint security solution. Which integration approach best achieves this policy?

Integrate the NGFW with the endpoint security solution to receive device posture and enforce policy based on device compliance

Use IP-based ACLs on the NGFW to block personal devices

Deploy a VPN for all remote access and require client certificates

Use 802.1X with MAC authentication bypass (MAB) for all devices

CiscoCertified Network Professional Enterprise

Domain 5Objective 4

5.4 Describe the Components of Network Security Design 350-401 Practice Questions (Page 4)

Part of the 5.0 Security domain, which accounts for 20% of the 350-401 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 3–4 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

13concepts

20%of the exam

Questions 16–20

16application · medium
A multi-tenant data center uses Cisco TrustSec to isolate tenant traffic. The network team wants to enforce policy based on the source role of the traffic, not just IP addresses. Which TrustSec mechanism should be used to tag traffic at ingress and enforce policy at the aggregation layer?
Select an answer first
17application · medium
A hospital network uses Cisco TrustSec to segment its IT and medical device networks. The security team wants to ensure that a compromised device in the medical device network cannot communicate with the IT network, even if an attacker spoofs the IP address of an authorized IT device. Which TrustSec mechanism provides this protection?
Select an answer first
18expert · hard
A financial enterprise is implementing TrustSec to enforce zero-trust segmentation. The network has multiple data centers and a cloud environment. The security team wants to enforce consistent SGT-based policies across on-premises and cloud workloads. Which approach best achieves this?
Select an answer first
19application · medium
A financial services firm is concerned about an attacker gaining access to its data center network and using a sniffer to capture traffic between two core switches. The firm wants to protect data in transit on the internal links without requiring changes to the applications. Which technology should be deployed on the links between the core switches?
Select an answer first
20expert · hard
A company wants to enforce a policy that blocks access to a sensitive application from unmanaged personal devices, while allowing access from corporate-managed laptops. The network uses an NGFW and an endpoint security solution. Which integration approach best achieves this policy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-401

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-401” is a trademark of its owner, used for identification only.

5.4 Describe the Components of Network Security Design 350-401 Practice Questions (Page 4)

Questions 16–20

A multi-tenant data center uses Cisco TrustSec to isolate tenant traffic. The network team wants to enforce policy based on the source role of the traffic, not just IP addresses. Which TrustSec mechanism should be used to tag traffic at ingress and enforce policy at the aggregation layer?

A financial enterprise is implementing TrustSec to enforce zero-trust segmentation. The network has multiple data centers and a cloud environment. The security team wants to enforce consistent SGT-based policies across on-premises and cloud workloads. Which approach best achieves this?

A company wants to enforce a policy that blocks access to a sensitive application from unmanaged personal devices, while allowing access from corporate-managed laptops. The network uses an NGFW and an endpoint security solution. Which integration approach best achieves this policy?

Keep studying — 5.0 Security