A hospital segments infusion pumps into SGT PUMP and clinical servers into SGT CLIN, and the matrix cell for PUMP to CLIN permits only HTTPS. Access switches tag frames inline, a TrustSec-capable firewall sits at the server edge, and the auditor wants to know where the deny for everything else is applied. Which component enforces that SGACL on a packet?
Select an answer to reveal the explanation.
Short Explanation
TrustSec keeps ISE out of your traffic path entirely: it defines the matrix, then hands the rules to the gear that sees the packets. It's a simple lookup, because the device matches the source tag to the target group and applies the matching SGACL right there.
Full Explanation
The SGACL is enforced by a TrustSec enforcement device in the packet path: it uses the packet’s source SGT and destination SGT to select the applicable matrix policy, then permits or denies the packet. In this scenario, the server-edge firewall is TrustSec-capable and positioned to enforce the PUMP-to-CLIN rule; inline tagging supplies the group information but does not itself apply the deny. An IP-and-port ACL can permit HTTPS between the relevant addresses, but it is not enforcement of the stated SGT-to-SGT matrix and may not follow group membership changes. Selecting policy with the source SGT and destination IP subnet substitutes an address for the destination group, so it does not enforce the matrix cell for PUMP to CLIN. Selecting policy with the destination SGT and ingress interface likewise omits the packet’s source SGT, so it cannot distinguish PUMP traffic from traffic belonging to another source group. Exam caveat: ISE can provision policy and maintain group assignments, but it is not normally the per-packet enforcement point; SXP distributes IP-to-SGT mappings rather than carrying user traffic. Practical check: inspect the firewall’s TrustSec policy and counters to confirm that the matched source and destination SGTs are PUMP and CLIN, and that non-HTTPS traffic increments the deny counter.