2.6 Microsegmentation with Cisco TrustSec Using SFT and SXP CCIE-SECURITY Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A service provider is implementing TrustSec across a multi-vendor network. They have SFT-capable Cisco switches at the edge and legacy routers in the core. They need to propagate SGT bindings from the edge to the core using SXP. The core routers will only enforce policies for a specific subset of subnets. What should the engineer configure on the SXP speaker to limit the bindings sent to the core?

   • ADisable SXP on the core router and use static SGT mappings.
   • BUse SXP password authentication to restrict the bindings.
   • CApply a prefix list on the SXP speaker to filter which IP-to-SGT bindings are advertised.
   • DConfigure the core router as an SXP listener with a route-map to filter received bindings.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A network administrator is troubleshooting an SXP issue where SGT bindings are not being propagated after a link flap on the access switch. The SXP session is up, but the listener is not seeing updated bindings. What is the most likely cause?

   • AThe SXP password is incorrect, causing the session to drop.
   • BThe SXP connection is using IPv6, but the bindings are IPv4.
   • CThe SXP hold-down timer is still active, preventing the speaker from sending updates until the timer expires.
   • DThe listener is configured as a speaker, so it ignores incoming updates.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A network engineer is configuring SXP between two Cisco switches. The engineer wants to ensure that the SXP session is authenticated and that the bindings are protected from tampering. Which configuration is required?

   • AEnable SXP over SSH.
   • BUse IPsec to encrypt the SXP traffic.
   • CConfigure the same SXP password on both switches.
   • DConfigure a route-map to filter bindings.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A financial services firm is deploying Cisco TrustSec to enforce microsegmentation between application tiers in their data center. The network team has already deployed SFT-capable switches and wants to ensure that security group tags are embedded in every packet as it traverses the fabric. Which configuration step is essential to achieve this goal?

   • AUse VRF-lite to separate traffic between application tiers.
   • BDeploy a Cisco ISE policy server to assign SGTs to endpoints.
   • CConfigure SFT on the switches to support inline tagging of packets with SGTs.
   • DEnable SXP on the access switches to propagate SGT bindings to the core.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A global enterprise is rolling out TrustSec across its WAN. Some sites have SFT-capable routers, while others have older routers that only support SXP. The goal is to enforce consistent microsegmentation across all sites. What is the best approach to achieve this?

   • AUse only SXP across the entire network, disabling SFT.
   • BUse SXP only on SFT-capable devices and ignore legacy devices.
   • CReplace all legacy routers with SFT-capable models.
   • DUse SFT on SFT-capable devices and SXP to extend SGT information to legacy devices.
   Reveal Solution Discussion Select an answer first