A network engineer must enforce access control using special tags, without re-engineering the network design. Which feature should be configured to achieve this in a scalable manner?

Question

Options

• ASGT
• BdACL
• CVLAN
• DRBAC

• A
  89% (49)
• B
  4% (2)
• C
  2% (1)
• D
  5% (3)

Explanation

Security Group Tags (SGT) are a Cisco TrustSec feature that assigns a tag (a numeric label) to traffic based on the identity of the source user or device as authenticated by Cisco ISE. Access control policies are then enforced based on the SGT value rather than IP addresses or VLANs. This approach is highly scalable because you define policies between security groups (e.g., 'Employees can access Servers'), and the tags travel with the traffic - no need to redesign VLANs or subnets. dACL (B) applies per-user downloadable ACLs at the port level, which doesn't scale well for large networks and still relies on IP addressing. VLAN (C) requires network re-engineering to segment traffic. RBAC (D) is a general access control concept but doesn't address the 'without re-engineering the network' and 'special tags' requirements described.

No community discussion yet for this question.