TrustSec Static Security Group Tag Classifications
Short answer
CE The engineer must configure VLAN and interface for static security group tag classifications.
Question
Key Takeaways
TrustSec static SGT classification maps tags to fixed network attributes like VLAN and interface, whereas dynamic classification maps tags to authenticated user identities.
This guide identifies the valid static security group tag (SGT) classifications for a Cisco TrustSec proof of concept. It confirms that VLAN and interface are the correct static classification methods on a network device.
Common mistake: Choosing user ID (D) because it is a common classification method, but it is used for dynamic classification via ISE, not static classification on the switch.
Expert Analysis
Why the Answer Is Correct
In Cisco TrustSec, Security Group Tags (SGTs) can be assigned statically on network devices or dynamically via Cisco ISE. Static classification maps an SGT to a fixed network attribute that does not change based on the authenticated user, such as a VLAN or a physical interface. For a proof of concept requiring static bindings, configuring VLAN and interface are the appropriate and valid choices. This allows the switch to locally enforce TrustSec policies based on the point of attachment.Why the Other Options Are Wrong
User ID (Option D) is a dynamic classification method typically assigned by ISE during authentication and authorization, not a static switch configuration. Switch ID (Option A) is not a valid classification source for mapping SGTs on a network device. MAC address (Option B) is generally used for dynamic authentication methods like MAB rather than static SGT classification on the switch. Therefore, these options do not fit the requirement for static SGT classification.Community Comment Notes
The community correctly identifies VLAN and interface as the correct static classification methods. As TiberiuszSun noted, "map the SGT to some thing, like a VLAN, subnet, IP Address" for static assignments, contrasting with dynamic user assignments. Other users like qqqqqqqqqqq123 simply confirmed "VLAN & Interface" as the correct choices. This consensus aligns perfectly with the official Cisco TrustSec configuration guidelines for static SGT mapping.Official Reference
This link opens the official vendor documentation in a new tab.
Exam Strategy
When asked about TrustSec static classifications, remember that static bindings are tied to non-user-specific network entities like VLANs, subnets, or interfaces. Dynamic bindings involve authentication results like user IDs.
Community Votes
100% of anonymous learners picked answer CE. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 5 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors, not of islever. The comments shown first are the most substantive of the thread — ranked by depth, community endorsement and relevance; expand the list below to read the rest.
From public community threads 5
-
HercJ 👍 2I believe it should be VLAN and interface
-
TiberiuszSun 👍 1The process of assigning the SGT is called Classification. A SGT can be assigned dynamically as the result of an ISE authorization or it can be assigned via static methods that map the SGT to some thing, like a VLAN, subnet, IP Address, or port-profile (for VMs or interface). Dynamic classification is typically used to assign SGT to users because users are mobile. They could be connected from any location via wireless, wired, or vpn. On the other hand, servers tend not to move, so typically static classification methods are used.
-
logitrain 👍 1The correct answer is C. VLAN. Reason: In the context of Cisco TrustSec, VLAN (Virtual Local Area Network) is a common classification used to segment network traffic based on logical groupings. By configuring VLANs as security group tags, the engineer can enforce policy-based access controls and ensure that traffic within the same VLAN is treated consistently. This is essential for maintaining security across different segments of the network.
-
qqqqqqqqqqq123 👍 3VLAN & Interface
-
NullNull88 👍 1vlan and int
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.