Cisco CCNP Security Core (SCOR) 350-701Endpoint Security and Secure Network AccessMedium
A security team is implementing a network segmentation strategy using Cisco TrustSec. The goal is to classify users and devices into logical groups and apply security policies based on these groups, regardless of their IP address or network location. Which core element of Cisco TrustSec is responsible for assigning these logical labels to network traffic, enabling policy enforcement?
- ASecurity Group Tag (SGT)
- BTrustSec Policy Matrix (TPM)
- CSecurity Group Access (SGA)
- DSecurity Group Policy (SGP)
Show answer & explanationAnswer & explanation
Correct answer: A. Security Group Tag (SGT)
The Security Group Tag (SGT) is the core element in Cisco TrustSec. It is a logical label assigned to user or device traffic flows, representing the security group an entity belongs to. This tag is then used by network devices to enforce policies based on source and destination SGTs, enabling identity-based segmentation.
Why the other options are wrong
- B. TPM is the matrix where Security Group Policies (SGPs) are defined, not the label.
- C. SGA refers to the overall framework or component that handles SGT propagation and enforcement, not the tag itself.
- D. SGP is a policy that defines what traffic is allowed or denied between SGTs, it's not the label itself.
Cisco TrustSec Security Group Tag (SGT)
A logical label assigned to network traffic that identifies the security group of the source user or device, enabling identity-based segmentation and policy enforcement.
- Represents a logical security group.
- Carried in network frames/packets (e.g., SGT in SGT-Encapsulated IP header).
- Used by network devices to enforce policies.
Memory trick: TrustSec uses 'Tags' (SGTs) like VIP badges to define who can go where.