300-715 · Question #83
A network engineer is configuring a network device that needs to filter traffic based on security group tags using a security policy on a routed into this task?
The correct answer is B. cts role-based enforcement. The cts role-based enforcement command enables Cisco TrustSec Security Group Access (SGA) enforcement on an interface or globally. When applied, the device uses Security Group Tags (SGTs) - numeric labels assigned to endpoints by ISE - to enforce role-based access control…
Question
A network engineer is configuring a network device that needs to filter traffic based on security group tags using a security policy on a routed into this task?
Options
- Acts authorization list
- Bcts role-based enforcement
- Ccts cache enable
- Dcts role-based policy priority-static
How the community answered
(29 responses)- B93% (27)
- C3% (1)
- D3% (1)
Explanation
The cts role-based enforcement command enables Cisco TrustSec Security Group Access (SGA) enforcement on an interface or globally. When applied, the device uses Security Group Tags (SGTs) - numeric labels assigned to endpoints by ISE - to enforce role-based access control policies (SGACLs). Without this command, the device may learn and propagate SGT information but will not actually enforce the policy. Choice A (cts authorization list) associates a named ACL for CTS authorization. Choice C (cts cache enable) enables caching of SGT-to-IP mappings. Choice D is used for static policy priority, not enforcement itself.
Topics
Community Discussion
No community discussion yet for this question.