How do SFT and SXP work together in a TrustSec deployment?

They are mutually exclusive and cannot be used together

SFT provides inline tagging on capable devices, while SXP propagates bindings to non-SFT devices

SFT is used for control plane, SXP for data plane

Which benefit does SFT provide over traditional IP-based policy enforcement in a TrustSec deployment?

It eliminates the need for any routing protocols

It requires a central controller for every forwarding decision

It automatically encrypts all traffic between groups

It reduces the number of ACLs by using group-based policies that scale independently of IP addressing

In a TrustSec network, what is the role of a device that supports SFT but also runs SXP?

It only uses SFT and ignores SXP

It uses SXP to encrypt SFT tags

It can tag packets inline and also share bindings with non-SFT devices

It must disable SFT when SXP is enabled

When troubleshooting TrustSec, which command would you use to check whether SGACLs are being enforced on an interface?

show cts role-based permissions

CCIE Security

Domain 2Objective 6

2.6 Microsegmentation with Cisco TrustSec Using SFT and SXP CCIE-SECURITY Practice Questions (Page 3)

Part of the 2.0 Secure Connectivity and Segmentation domain, which accounts for 20% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 2–3 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

11concepts

20%of the exam

Questions 11–15

11foundation · easy
How do SFT and SXP work together in a TrustSec deployment?
Select an answer first
12foundation · easy
Which benefit does SFT provide over traditional IP-based policy enforcement in a TrustSec deployment?
Select an answer first
13foundation · easy
In a TrustSec network, what is the role of a device that supports SFT but also runs SXP?
Select an answer first
14foundation · easy
Which command is used to verify SGT bindings learned via SXP on a Cisco IOS device?
Select an answer first
15foundation · easy
When troubleshooting TrustSec, which command would you use to check whether SGACLs are being enforced on an interface?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.