A university's campus switches run in TrustSec monitor mode. The security team wants GenSeq SGT 205 limited to TCP 8443 when it reaches Compute SGT 215, every other SGT pair to behave as it does today, and the rule verified from switch counters before enforcement starts. Which configuration step implements this SGACL matrix requirement?
Select an answer to reveal the explanation.
Short Explanation
Set the GenSeq-to-Compute matrix cell to permit TCP 8443 and deny other traffic, leaving every other SGT pair unchanged. Monitor mode is like a dress rehearsal: review the switch counters to verify the rule before you enable enforcement.
Full Explanation
An SGACL is written in ISE and attached to a cell of the security group matrix, where the row is the source tag and the column is the destination tag. The switch applies the policy to matching tag pairs, so editing one cell leaves the other pairs' policies unchanged. In monitor mode, traffic that the SGACL would deny is not dropped; use the available counters to review the policy's effects before enabling enforcement. An extended port ACL is an interface-address approach and does not implement the requested tag-pair matrix policy. Entering enforced mode before reviewing counters skips the requested validation step. SXP distributes mappings between IP addresses and security group tags; by itself, it does not install an SGACL or filter traffic. Monitor-mode terminology and counter details can vary by release and platform. Practical check: generate traffic on TCP 8443 and another port, then review the relevant counters before enabling enforcement.