A financial services firm is deploying Cisco TrustSec to enforce microsegmentation between application tiers in its data center. The network team wants to leverage SFT on the access switches to embed SGTs in traffic at the ingress and enforce SGACLs at the egress. However, the core routers are legacy devices that do not support SFT. Which approach ensures end-to-end policy enforcement while accommodating the legacy core?

Replace the legacy core routers with SFT-capable models to ensure inline tagging is preserved throughout the network.

Enable SFT on the access switches and SXP on the legacy core routers to propagate SGT bindings, allowing the core to enforce SGACLs based on IP-to-SGT mappings.

Disable SFT on the access switches and rely solely on SXP to propagate SGTs to all devices, including the access layer.

Configure the access switches to strip SGTs before forwarding to the core and re-apply them at the egress switch.

A multinational corporation is deploying TrustSec across its global network. The network consists of SFT-capable switches in the data center and legacy routers in the WAN. The security team wants to enforce microsegmentation between business units. Which design best integrates SFT and SXP to achieve end-to-end policy enforcement?

Use only SFT across the entire network, disabling SXP.

Use SFT on the data center switches to tag traffic and enforce SGACLs, and use SXP to propagate bindings to the WAN routers for enforcement.

Use SXP on the data center switches and SFT on the WAN routers.

Use only SXP across the entire network, disabling SFT.

A network administrator is verifying TrustSec operations on an SFT-capable switch. The administrator wants to confirm that a specific IP address is mapped to the correct SGT and that the SGACL is being enforced. Which command should be used?

show cts role-based permissions

CCIE Security

Domain 2Objective 6

2.6 Microsegmentation with Cisco TrustSec Using SFT and SXP CCIE-SECURITY Practice Questions (Page 5)

Part of the 2.0 Secure Connectivity and Segmentation domain, which accounts for 20% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 2–3 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

11concepts

20%of the exam

Questions 21–25

21foundation · easy
At which layer of the network does SFT enforce SGACLs?
Select an answer first
22foundation · easy
What information does SXP exchange between TrustSec devices?
Select an answer first
23application · medium
A financial services firm is deploying Cisco TrustSec to enforce microsegmentation between application tiers in its data center. The network team wants to leverage SFT on the access switches to embed SGTs in traffic at the ingress and enforce SGACLs at the egress. However, the core routers are legacy devices that do not support SFT. Which approach ensures end-to-end policy enforcement while accommodating the legacy core?
Select an answer first
24application · medium
A multinational corporation is deploying TrustSec across its global network. The network consists of SFT-capable switches in the data center and legacy routers in the WAN. The security team wants to enforce microsegmentation between business units. Which design best integrates SFT and SXP to achieve end-to-end policy enforcement?
Select an answer first
25application · medium
A network administrator is verifying TrustSec operations on an SFT-capable switch. The administrator wants to confirm that a specific IP address is mapped to the correct SGT and that the SGACL is being enforced. Which command should be used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.

2.6 Microsegmentation with Cisco TrustSec Using SFT and SXP CCIE-SECURITY Practice Questions (Page 5)

Questions 21–25

At which layer of the network does SFT enforce SGACLs?

What information does SXP exchange between TrustSec devices?

A network administrator is verifying TrustSec operations on an SFT-capable switch. The administrator wants to confirm that a specific IP address is mapped to the correct SGT and that the SGACL is being enforced. Which command should be used?

Keep studying — 2.0 Secure Connectivity and Segmentation