What is the primary role of Cisco TrustSec SFT (Scalable Fabric Tagging) in microsegmentation?

To propagate SGT-to-IP bindings to legacy devices

To provide encryption for TrustSec traffic

To replace all traditional ACLs with VLAN-based segmentation

To embed security group tags (SGTs) in the packet header for scalable group-based policy enforcement

Why is SXP necessary in a TrustSec network with legacy devices?

To provide encryption for legacy devices

To allow legacy devices to learn SGTs for IP addresses without inline tagging

To enable routing between VLANs

To replace the need for a AAA server

In SXP, what is the role of a 'speaker'?

It receives SGT bindings from other devices

It both sends and receives SGT bindings

It actively sends SGT bindings to other devices

What is the purpose of the SXP hold-down timer?

To speed up the propagation of SGT bindings

To prevent route flapping by delaying the removal of SGT bindings after a peer goes down

CCIE Security

Domain 2Objective 6

2.6 Microsegmentation with Cisco TrustSec Using SFT and SXP CCIE-SECURITY Practice Questions (Page 1)

Part of the 2.0 Secure Connectivity and Segmentation domain, which accounts for 20% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 2–3 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

11concepts

20%of the exam

Questions 1–5

1foundation · easy
What is the primary role of Cisco TrustSec SFT (Scalable Fabric Tagging) in microsegmentation?
Select an answer first
2foundation · easy
Why is SXP necessary in a TrustSec network with legacy devices?
Select an answer first
3foundation · easy
Which of the following are valid SXP connection types?
Select an answer first
4foundation · easy
In SXP, what is the role of a 'speaker'?
Select an answer first
5foundation · easy
What is the purpose of the SXP hold-down timer?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.