A community college district wants payment kiosks micro-segmented inside the SD-Access fabric using scalable group tags. What role do SGTs play in that design?
Select an answer to reveal the explanation.
Short Explanation
An SGT is a nametag on the laptop or kiosk—“cashier device,” “student BYOD”—so policy can say who talks to whom without carving a VLAN per device. In the fabric, those tags ride with the traffic and enforce micro-segmentation. That’s TrustSec thinking inside SD-Access.
Full Explanation
A community college that wants payment kiosks micro-segmented inside SD-Access uses TrustSec Scalable Group Tags (SGTs) to classify endpoints and drive group-based policy. SGTs enable micro-segmentation within and across virtual networks so kiosk traffic can be permitted only to payment processors and blocked from lateral movement into student or faculty segments—without exploding VLAN count.
SGTs replacing VXLAN VNIs so every kiosk needs a unique underlay VLAN confuses security group identity with overlay network identifiers and underlay VLAN sprawl.
SGTs only written to DHCP option 82 and never enforced in the fabric data plane understates enforcement; group-based policy is enforced in the fabric/policy plane, not merely logged in DHCP.
SGTs functioning solely as OSPF route tags on the IS-IS underlay invents a routing-tag fantasy; SGTs are security-group identifiers, and the underlay is often IS-IS rather than OSPF-tagged SGT transport.
Exam caveat: classification (ISE/SGT assignment) without enforcement matrices yields tags without effect—both assignment and policy download/enforcement must work.
Operational check: authenticate a kiosk test host, confirm SGT assignment, and verify group-based policy blocks unauthorized east-west flows while allowing payment paths. Keep the SGT matrix in the college PCI-minded network policy pack.