2.6 Microsegmentation with Cisco TrustSec Using SFT and SXP CCIE-SECURITY Practice Questions (Page 6)

Questions 26–30

1. 26expert · medium

   A network engineer is troubleshooting an SXP issue where SGT bindings are not being propagated after a link flap on the access switch. The SXP session is up, but the listener is not seeing updated bindings. The engineer checks the SXP hold-down timer and finds it is set to 120 seconds. What is the most likely impact of this setting?

   • AThe speaker will delay sending binding updates for 120 seconds after the flap, causing a temporary lack of policy enforcement.
   • BThe hold-down timer only affects the initial SXP connection, not subsequent updates.
   • CThe speaker will immediately send a full update after the flap, ignoring the hold-down timer.
   • DThe listener will drop the SXP session if no update is received within 120 seconds.
   Reveal Solution Discussion Select an answer first
2. 27expert · medium

   A large enterprise is deploying TrustSec with SXP between multiple domains. They have a requirement to share only a subset of SGT bindings with a partner organization. The partner is using a different SXP version. What is the best approach to ensure compatibility and selective sharing?

   • AUse SXP over IPv6 to avoid version issues.
   • BDisable SXP and use static SGT mappings on the partner device.
   • CUse SXP version 3 only, as it is the most secure.
   • DConfigure a prefix list on the SXP speaker to filter bindings and use SXP version 4, which is backward compatible.
   Reveal Solution Discussion Select an answer first
4. 28expert · medium

   A security engineer is configuring SXP between two switches over an untrusted network. The engineer wants to ensure that the SXP session is authenticated and that the bindings are protected from eavesdropping. Which approach provides the strongest security?

   • AUse SXP password authentication only, as it also encrypts the bindings.
   • BUse SXP password authentication and rely on the underlying network encryption (e.g., IPsec VPN) for confidentiality.
   • CUse SXP over SSH to encrypt the session.
   • DUse SXP over TLS by configuring a certificate on both switches.
   Reveal Solution Discussion Select an answer first
5. 29expert · medium

   A network architect is designing a TrustSec deployment for a campus network. The access switches support SFT, but the distribution switches do not. The architect wants to enforce SGACLs at the distribution layer. Which approach is most effective?

   • AUse static SGT mappings on the distribution switches.
   • BEnforce all SGACLs at the access layer and disable them at the distribution layer.
   • CUse SXP to propagate SGT bindings from the access switches to the distribution switches, and configure SGACLs on the distribution switches.
   • DUpgrade the distribution switches to SFT-capable models to enable inline tagging.
   Reveal Solution Discussion Select an answer first
6. 30expert · medium

   A network administrator is troubleshooting a TrustSec issue where traffic between two SFT-capable switches is not being enforced with the expected SGACL. The administrator verifies that the SGT is correctly assigned at the ingress switch. What is the next step to isolate the issue?

   • AReboot the egress switch to clear any cached SGACL entries.
   • BDisable SFT on the ingress switch to see if the issue is with tagging.
   • CCheck the SXP connections on the ingress switch.
   • DCheck the SGACL configuration on the egress switch and verify that the SGT is present in the packet using 'show cts role-based sgt-map'.
   Reveal Solution Discussion Select an answer first