300-715 · Question #321
An engineer is working on a switch and must tag packets with SGT values such that it learns via SXP. Which command must be entered to meet this requirement?
The correct answer is D. ip dhcp snooping. To enable a switch to learn Security Group Tag (SGT) values via SXP, DHCP snooping must be configured. DHCP snooping populates the IP-SGT binding table required for SGT assignment.
Question
An engineer is working on a switch and must tag packets with SGT values such that it learns via SXP. Which command must be entered to meet this requirement?
Options
- Aip source guard
- Bip arp inspection
- Cip device tracking maximum
- Dip dhcp snooping
How the community answered
(58 responses)- A7% (4)
- B12% (7)
- C3% (2)
- D78% (45)
Why each option
To enable a switch to learn Security Group Tag (SGT) values via SXP, DHCP snooping must be configured. DHCP snooping populates the IP-SGT binding table required for SGT assignment.
IP Source Guard prevents IP spoofing by filtering traffic based on the DHCP snooping binding database but does not directly enable SGT learning via SXP.
Dynamic ARP Inspection (DAI) prevents ARP spoofing by validating ARP packets against the DHCP snooping binding database but does not directly facilitate SGT learning via SXP.
IP Device Tracking maximum limits the number of devices tracked on an interface, which is unrelated to SGT learning via SXP.
DHCP snooping is essential for SXP on a switch because it monitors DHCP exchanges to build a trusted database of IP-MAC-port bindings. This database is then used by the switch to associate IP addresses with SGTs, allowing it to tag packets with SGT values learned via SXP.
Concept tested: DHCP snooping for SGT learning with SXP
Source: https://www.cisco.com/c/en/us/td/docs/switches/lan/trustsec/config_guide/b_trustsec_cg_xe_3_3_0_sg/trustsec_sgt_exchange_protocol.html
Topics
Community Discussion
No community discussion yet for this question.