2.6 Microsegmentation with Cisco TrustSec Using SFT and SXP CCIE-SECURITY Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A network engineer is troubleshooting why a particular host is not being assigned the expected SGT. The host is connected to a switch that uses SXP to learn bindings from an upstream device. Which command would be most useful to verify the SGT binding for that host's IP address?

   • Ashow cts sxp bindings
   • Bshow authentication sessions
   • Cshow cts sft table
   • Dshow cts role-based permissions
   Reveal Solution Discussion Select an answer first
2. 42application · easy

   A network administrator is configuring SXP between two devices. They want the device to both send its own bindings and receive bindings from the peer. Which SXP mode should be configured?

   • ASpeaker
   • BBoth
   • CListener
   • DActive
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   An administrator has configured SXP between a core switch (speaker) and an access switch (listener). They notice that after a brief network blip, the access switch immediately removes all SGT bindings, causing a temporary security policy gap. They want to prevent this by having the access switch retain the bindings for at least 2 minutes after the SXP session is lost. What should they do?

   • AEnable SFT on the access switch to maintain bindings.
   • BConfigure a prefix list on the access switch to retain the bindings.
   • CDecrease the hold-down timer on the core switch to 30 seconds.
   • DIncrease the hold-down timer on the access switch to 120 seconds.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A service provider offers TrustSec-based microsegmentation to multiple tenants. They use SXP to share SGT bindings with each tenant's edge device. However, they want to ensure that each tenant only receives bindings for their own IP subnets, not other tenants' bindings. What is the most efficient way to achieve this?

   • ADisable SXP and use static bindings on each tenant device.
   • BConfigure a separate SXP connection for each tenant with a prefix list filtering only that tenant's subnets.
   • CUse SFT instead of SXP to avoid binding leakage.
   • DUse a single SXP connection and rely on the tenant to filter bindings.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A security engineer is configuring SXP between two switches over a network that is not fully trusted. They want to ensure that the SXP session is authenticated and that the binding data is not tampered with. However, they are concerned about the overhead of encryption. What is the most appropriate security mechanism to use?

   • AUse a prefix list to restrict bindings.
   • BConfigure an SXP password on both peers.
   • CUse SFT to encrypt the SXP traffic.
   • DUse IPsec to encrypt the SXP traffic.
   Reveal Solution Discussion Select an answer first