A network engineer responsible for the switching environment must provision a new switch to properly propagate security group tags within the TrustSec inline method. Which CLI command must the network

`cts sxp enable` enables Security Group Tag Exchange Protocol (SXP), which is used for SGT propagation when devices do not support inline tagging, not for globally enabling inline tagging itself.

The `cts manual` command enables the Cisco TrustSec feature set globally on the switch, which is a prerequisite for propagating Security Group Tags (SGTs) in the inline tagging method. This command transitions the device into a state where it can participate in TrustSec.

`cts role-based sgt-map` is used for mapping SGTs to IP addresses for SXP, not for globally enabling inline tagging.

`cts role-based enforcement` is used to enable enforcement of Security Group Access Control Lists (SGACLs), which is a consequence of TrustSec, not the command to globally enable SGT tagging.