Drag and drop the three phases of Cisco TrustSec
DRAG DROP
Drag and drop the phases of TrustSec from the left onto the targets on the right. Not all options are used.
Community Insight
The item tests recall of the TrustSec three-phase workflow, and the trap is confusing policy evaluation (propagation) with where the SGT is first assigned or where the policy is actually applied.
Cisco TrustSec operates in three sequential functional phases, and this drag-and-drop item requires placing them in order on the targets. The page establishes that the correct sequence is classification, then propagation, then enforcement, with unused distractor options remaining in the source column.
Learners typically swap propagation and enforcement, assuming SGT enforcement happens at the source, or they drag an extra non-phase option such as authentication into a slot because the instructions warn that not all options are used.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
TrustSec first performs classification, where the endpoint or ingress device assigns a Security Group Tag based on identity, VLAN, or authentication results. The tag is then propagated across the fabric, carried in packet headers or via SXP so downstream devices know the source group. Finally, enforcement occurs at the egress or intermediate device, which applies aSGT-based permission list to permit or drop traffic. This classification → propagation → enforcement ordering matches Cisco's documented TrustSec functional model and the sequence named by multiple commenters.Why Other Candidate Answers Are Wrong
Any ordering that places enforcement before propagation is invalid, because the device applying the policy must already know the tag, which only propagation delivers. Placing classification last is also wrong, since no tag exists to propagate or enforce until the ingress classifies the traffic. Options such as authentication, authorization, or SGT allocation are sub-steps or inputs to classification rather than standalone TrustSec phases, and the prompt explicitly states that not all left-side options are used, so unused distractors should be left in place.Community Comment Notes
Traktark, whose comment carries the highest like count, states the answer as "classification target 2: propagation target 3: enforcement" and links Cisco's TrustSec configuration guide. BECAUSE agreed, writing "Agreed the correct answer is Target 1. Classification Target 2. Propagation Target 3. Enforcement," and cc37f90 repeated the identical three-target mapping. westh4m1234 likewise summarized that "Cisco TrustSec operates through three core functional phases: classification, propagation, and enforcemen" — so the community consensus aligns with the Cisco documentation.Official Reference
Exam Strategy
On drag-and-drop items with unused options, anchor yourself on the one phase that must logically come first — classification, since it creates the SGT — then order the remaining two by what needs the tag before it can act. Always verify how many targets exist versus how many plausible phases, and leave the leftovers untouched.
Frequently Asked Questions
What are the three phases of Cisco TrustSec in order?
Classification assigns the Security Group Tag, propagation shares that tag across the network, and enforcement applies the tag-based policy at the device handling the traffic.
Why are some drag-and-drop options left unused in the TrustSec question?
The item states not all options are used, so distractors such as authentication or SGT allocation are sub-steps of classification rather than separate phases and should stay in the source column.
Related Analysis
Practice All 300-415 Questions
Access 120 questions with complete answers and detailed explanations.
View Full 300-415 Practice Test →