2.6 Microsegmentation with Cisco TrustSec Using SFT and SXP CCIE-SECURITY Practice Questions (Page 11)

Questions 51–55

1. 51application · medium

   A large enterprise is deploying TrustSec in its campus network. The network team wants to ensure that SGTs are carried end-to-end so that SGACLs can be enforced at every switch. They have enabled SFT on all switches. What is the primary benefit of using SFT for this deployment?

   • AIt eliminates the need for SXP in the entire network.
   • BIt allows SGTs to be embedded in the packet header, enabling consistent policy enforcement.
   • CIt automatically assigns SGTs to endpoints based on user identity.
   • DIt reduces the number of SGACLs needed in the network.
   Reveal Solution Discussion Select an answer first
2. 52application · medium

   A company has a mix of Cisco and third-party switches. The third-party switches do not support inline SGT tagging, but the company still wants to enforce TrustSec policies. They decide to use SXP to propagate SGT bindings. How does SXP accomplish this?

   • ABy embedding SGTs into the data packets as they pass through the switch.
   • BBy configuring static routes for each SGT.
   • CBy exchanging IP-to-SGT binding information over a TCP connection.
   • DBy using multicast to flood SGT bindings to all switches.
   Reveal Solution Discussion Select an answer first
4. 53application · easy

   A network administrator is configuring SXP between two switches. Switch A will send its SGT bindings to Switch B, and Switch B will only receive them. Which SXP mode should be configured on Switch A?

   • ABoth
   • BSpeaker
   • CListener
   • DPassive
   Reveal Solution Discussion Select an answer first
5. 54application · medium

   During a network change, an SXP speaker loses connectivity to its listener for a short period. The administrator notices that the listener continues to use the previously learned SGT bindings for a while before removing them. Which SXP feature is responsible for this behavior?

   • ASXP password
   • BHold-down timer
   • CSFT forwarding
   • DPrefix list filtering
   Reveal Solution Discussion Select an answer first
6. 55application · medium

   A security team wants to ensure that only bindings for a specific subnet are shared via SXP to a partner organization's device. They want to prevent other SGT bindings from being leaked. What should they configure on the SXP speaker?

   • AAn SFT access list to block certain tags.
   • BAn SXP password to secure the session.
   • CA hold-down timer to delay propagation.
   • DAn SXP prefix list to filter which bindings are advertised.
   Reveal Solution Discussion Select an answer first