An IT company experienced the spread of malicious content between user endpoints, which impacted business...

The spread of malicious content between endpoints is a classic case oflateral movement. To control and restrict communication between individual endpoints—regardless of their physical location or IP address—Cisco TrustSecis the recommended architectural approach. TrustSec moves away from traditional, IP-based Access Control Lists (ACLs), which are difficult to manage and scale, and instead usesScalable Group Tags (SGTs).

With TrustSec, every endpoint is assigned an SGT based on its role or security context (e.g., "Employee," "Contractor," or "HR"). Security policies are then defined in a centralized matrix (the egress policy matrix) that dictates which SGTs can talk to one another. For example, a policy can be set so that endpoints in the "Developer" group cannot communicate directly with endpoints in the "Sales" group, effectively preventing malware from hopping between machines. WhileRADIUS(Option A) is the protocol used for authentication, it does not perform the segmentation itself.Posture(Option C) checks the health of the device, andProfiling(Option D) identifies what the device is, but neither provides the policy-based traffic control of TrustSec. By implementing TrustSec, the company achievesmicro-segmentation, significantly reducing the internal attack surface and containing potential breaches within a single group, which is a core goal of modern secure infrastructure design.