Drag and drop the three phases of Cisco TrustSec

Why the Answer Is Correct

TrustSec first performs classification, where the endpoint or ingress device assigns a Security Group Tag based on identity, VLAN, or authentication results. The tag is then propagated across the fabric, carried in packet headers or via SXP so downstream devices know the source group. Finally, enforcement occurs at the egress or intermediate device, which applies aSGT-based permission list to permit or drop traffic. This classification → propagation → enforcement ordering matches Cisco's documented TrustSec functional model and the sequence named by multiple commenters.

Why Other Candidate Answers Are Wrong

Any ordering that places enforcement before propagation is invalid, because the device applying the policy must already know the tag, which only propagation delivers. Placing classification last is also wrong, since no tag exists to propagate or enforce until the ingress classifies the traffic. Options such as authentication, authorization, or SGT allocation are sub-steps or inputs to classification rather than standalone TrustSec phases, and the prompt explicitly states that not all left-side options are used, so unused distractors should be left in place.

Community Comment Notes

Traktark, whose comment carries the highest like count, states the answer as "classification target 2: propagation target 3: enforcement" and links Cisco's TrustSec configuration guide. BECAUSE agreed, writing "Agreed the correct answer is Target 1. Classification Target 2. Propagation Target 3. Enforcement," and cc37f90 repeated the identical three-target mapping. westh4m1234 likewise summarized that "Cisco TrustSec operates through three core functional phases: classification, propagation, and enforcemen" — so the community consensus aligns with the Cisco documentation.