In Cisco TrustSec architecture, security group tags (SGTs) are assigned to users to enforce security policies. DHCP and IEEE 802.1x are two methods used for this purpose. DHCP can be used to assign SGTs based on the IP address assigned to a user, while IEEE 802.1x leverages user authentication to dynamically assign SGTs. Modular QoS and policy routing are not directly involved in the assignment of SGTs; they are used for other purposes such as traffic management and route selection based on policies. References: * Understanding Cisco TrustSec4 * Cisco TrustSec Configuration Guide5