Users' access rights must follow their role, such as contractor or finance, wherever they connect on campus, without redesigning VLANs or maintaining IP-based ACLs for every subnet. Which segmentation approach fits?
Select an answer to reveal the explanation.
Short Explanation
Security group tags work like colored wristbands at a festival: whatever gate you came through, staff check the color, not where you're standing. The tag follows the user's role. The trap is anything tied to VLANs, subnets or ports, because those change every time the user moves.
Full Explanation
Cisco TrustSec decouples policy from network topology. When a user or device authenticates, typically through 802.1X or MAB with Cisco ISE, the authorization result assigns a security group tag that represents the role, such as contractor or finance. The tag is propagated inline or through SXP to enforcement points, which apply a policy matrix of source group to destination group permissions using security group ACLs. Because enforcement keys on the group rather than on VLAN or IP address, the same rules apply wherever the user connects, and adding a subnet does not require rewriting ACLs. A dedicated VLAN per role on every switch is the classic topology-bound approach; it requires extending VLANs everywhere and maintaining routed ACLs per subnet, which the stem rules out. Private address ranges with NAT between buildings tie identity to location and translate addresses, which complicates policy rather than expressing roles. Per-port ACLs listing server addresses must be maintained on every access port and do not follow users who move. Exam caveat: TrustSec complements VLANs rather than eliminating them; VLANs still provide Layer 2 separation while tags express policy. Operational check: authenticate a test user, confirm the expected tag is assigned in the session details, and verify that the enforcement point applies the matrix entry for that tag.