A financial services firm requires the Employee-to-Finance-Server rule to be enforced at the access port, to survive a server readdressing, and to avoid a separate rule hand-entered on every access switch. Which TrustSec enforcement design should be deployed?
Select an answer to reveal the explanation.
Short Explanation
You want one rule that travels with the device, not with its address. ISE pushes the matrix SGACL to the switch, which matches the SGT pair instead of the IP, so readdressing the server doesn't break anything.
Full Explanation
The correct design distributes the Employee-to-Finance-Server matrix SGACL to the access switch and enforces it using the source and destination security group tags. Because the policy identifies the server by its SGT rather than its current IP address, readdressing does not require rewriting the rule; centralized matrix management also avoids hand-entering a separate rule on every switch. A downloadable ACL applied at the access port can enforce the required services there and be centrally provisioned, but if it matches the server’s IP address, a server address change makes that match stale until the ACL is updated. SGT-pair rules on a zone firewall can be centrally managed and remain independent of the server address, but enforcement occurs at the firewall boundary, not at the access port as required. Manually configuring the SGACL on each access switch can provide access-port enforcement and use SGTs, but it fails the requirement to avoid separate hand-entered rules across switches. Exam caveat: TrustSec behavior depends on platform support, SGT propagation, and where SGACL enforcement is enabled; a tag-based policy is not enforced merely because tags are assigned. In practice, verify the SGT-to-SGACL mapping and enforcement counters on the access switch, then test permitted and denied traffic after changing the server address.