300-415 Question 235
Single answerA company is implementing Cisco SD-WAN in its network and wants to utilize TrustSec to enforce segmentation policies across the WAN. Which foundational component must be configured in the SD-WAN environment to ensure TrustSec policies are applied effectively?
- A
Security Group Tags (SGTs) must be applied to traffic at the branch edge routers.
- B
IKEv2 tunnels must be established between all SD-WAN edge devices.
- C
The vSmart controller must be configured to propagate TrustSec classification policies.
- D
The SD-WAN data plane must be configured to use OSPF for routing TrustSec-labeled traffic.
Show answer and explanation
Correct answer: C
Explanation
TrustSec in a Cisco SD-WAN environment requires the vSmart controller to propagate TrustSec policies to ensure proper segmentation and enforcement across the WAN. While SGTs are essential for tagging traffic, it is the vSmart controller that enables consistent TrustSec policy application across the SD-WAN fabric.
- A. Incorrect.
While Security Group Tags (SGTs) are critical for TrustSec, they alone are not sufficient unless the vSmart controller is configured to propagate TrustSec policies across the SD-WAN fabric.
- B. Incorrect.
IKEv2 tunnels are not required for TrustSec functionality. They are used for establishing secure communication between SD-WAN devices but do not directly relate to TrustSec policy enforcement.
- C. Correct.
The vSmart controller is responsible for central policy management and orchestration in Cisco SD-WAN. To enforce TrustSec policies across the WAN, vSmart must propagate these policies to the edge devices.
- D. Incorrect.
OSPF is not used for TrustSec policy propagation. The SD-WAN control plane manages traffic segmentation and policy enforcement, not OSPF.