2.6 Microsegmentation with Cisco TrustSec Using SFT and SXP CCIE-SECURITY Practice Questions (Page 7)

Questions 31–35

1. 31expert · medium

   A network engineer is configuring SXP between two switches. The engineer wants to ensure that the SXP session is resilient to link flaps and that bindings are not lost. Which configuration should be applied?

   • AConfigure SXP with a password to prevent session drops.
   • BUse SXP over IPv6 to improve reliability.
   • CIncrease the SXP hold-down timer and configure the SXP retry timer to a lower value.
   • DDecrease the SXP hold-down timer and increase the retry timer.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A university campus has a mix of Cisco switches that support SFT and older distribution switches that do not. The security team wants to enforce TrustSec policies for student, faculty, and guest traffic. They plan to use SXP to propagate SGT bindings from the access layer to the distribution layer. Which SXP connection mode should be configured on the distribution switch to receive bindings from multiple access switches?

   • ASpeaker
   • BPeer
   • CBoth
   • DListener
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A healthcare organization is implementing TrustSec to separate patient records, billing, and research departments. They have defined SGTs for each department and created SGACLs to permit or deny traffic between them. The network includes both SFT-capable and non-SFT-capable switches. Which statement correctly describes how SGTs and SGACLs are enforced in this mixed environment?

   • AAll switches must be SFT-capable to enforce SGACLs; SXP is only used for management plane communication.
   • BSGTs are assigned only at the egress switch, and SGACLs are applied at the ingress switch.
   • CSFT-capable switches enforce SGACLs based on the SGT embedded in the packet, while non-SFT switches rely on SXP-learned IP-to-SGT bindings to enforce SGACLs.
   • DSGACLs are only enforced at the access layer, and SGTs are stripped at the distribution layer.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A large enterprise is deploying SFT on its campus access switches to enforce microsegmentation between IoT devices and corporate PCs. The network team wants to ensure that SFT operates correctly at the data plane. Which action is required for SFT to forward traffic with embedded SGTs and enforce SGACLs?

   • AUse a centralized controller to assign SGTs to every packet at the data plane.
   • BEnable SFT globally and on the relevant interfaces, and ensure the switches have the necessary TCAM resources for SGACL lookup.
   • CConfigure SXP on all switches to propagate SGTs, even if they are SFT-capable.
   • DDisable hardware acceleration to allow software-based SGACL enforcement.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A retail chain has legacy switches that do not support SFT. They are deploying TrustSec to enforce policies between point-of-sale (POS) systems and back-office servers. The network engineer needs to propagate SGT bindings from the access switches (which are SFT-capable) to the legacy distribution switches. Which SXP configuration is appropriate?

   • AEnable SFT on the legacy switches to avoid using SXP.
   • BConfigure the access switch as SXP listener and the distribution switch as SXP speaker.
   • CUse SXP over UDP port 64999 to reduce overhead.
   • DConfigure the access switch as SXP speaker and the distribution switch as SXP listener over TCP port 64999.
   Reveal Solution Discussion Select an answer first