A city government network has three trust groups: staff workstations (SGT 12), research servers (SGT 51), and records servers (SGT 76). Policy allows staff to reach research, but only administrators (SGT 40) may reach records, and the network team wants policy keyed to trust groups rather than subnets. Which TrustSec enforcement step makes this SGT-to-SGT policy take effect on east-west traffic?
Select an answer to reveal the explanation.
Short Explanation
The matrix in ISE writes the intent, but the enforcement point has to install the resulting SGACL where packets actually cross. Your layer-3 switch is exactly where staff-to-records flows leave their VLANs, so that's where the rule bites. A house rule nobody posts on the wall never gets followed, which is why tags alone change nothing.
Full Explanation
The correct step is to publish the source-to-destination SGT policy matrix in ISE and have the layer-3 switch enforce the resulting SGACLs where east-west traffic between the server VLANs passes. That makes the policy depend on trust-group identities rather than IP subnets and applies it to the campus traffic in question. SXP can distribute SGT-to-IP mappings, and an Internet-edge firewall can enforce SGACLs, but placing enforcement only at the edge misses the stated east-west traffic path; those flows need not traverse that firewall. VLAN ACLs on the server SVIs are a familiar way to filter routed traffic and can permit the described staff and administrator cases, but they classify by subnet or VLAN rather than by SGT, so they do not meet the trust-group-based policy requirement. ISE-assigned SGTs combined with downloadable ACLs are also a valid access-control design, but those session ACLs do not implement the required SGT-to-SGT matrix on the layer-3 switch. Exam caveat: learning or assigning SGTs does not itself enforce policy; an SGACL-capable enforcement point must receive and apply the policy. Practical check: verify the switch supports TrustSec SGACL enforcement, receives the matrix from ISE, and has the relevant SGTs and SGACL counters visible for a test flow.