350-401 ACLs and CoPP Practice Questions

Question 1

A network engineer is troubleshooting an issue where SSH access to a Cisco router from a specific management subnet (10.10.10.0/24) is intermittently failing. The router has a CoPP policy applied to the control plane. The engineer checks the CoPP statistics and sees that packets from the management subnet are being dropped by the control-plane service-policy. Which configuration change should the engineer make to allow SSH from the management subnet while still protecting the control plane?

Accepted Answer

Modify the CoPP ACL to include a permit statement for TCP port 22 from 10.10.10.0/24 before the deny statement.. The correct answer adds an ACL entry to permit SSH from the management subnet before the deny statement, ensuring that SSH traffic is matched by the CoPP policy and not dropped. Option B is incorrect because removing the deny statement would leave the control plane unprotected. Option C is incorrect because increasing the police rate might not resolve the issue if the traffic is being dropped by an ACL deny. Option D is incorrect because removing the CoPP policy entirely removes all protection.

Answer

Remove the deny statement from the CoPP ACL to allow all traffic.

Answer

Increase the police rate for the CoPP class that matches SSH traffic.

Answer

Remove the CoPP policy from the control plane and rely on interface ACLs.

Question 2

An enterprise network uses a Cisco Catalyst 9300 switch as a distribution layer device. The network team notices that ICMP echo requests from a monitoring server (192.168.1.100) to the switch's management IP are being dropped intermittently. The switch has a CoPP policy that includes a class-map matching ICMP traffic. The engineer checks the CoPP statistics and sees that ICMP packets from the monitoring server are being dropped by the policy. What is the most likely cause of this issue?

Accepted Answer

The CoPP policy is policing ICMP traffic to a rate that is too low for the monitoring server's traffic.. The correct answer is that the CoPP policy is policing ICMP traffic to a rate that is too low for the monitoring server's traffic. Option B is incorrect because the ACL is not mentioned as blocking ICMP. Option C is incorrect because the monitoring server is not the source of the issue; it is the target. Option D is incorrect because the switch's CPU is not necessarily overloaded; the drops are due to CoPP policing.

Answer

An ACL applied to the management interface is blocking ICMP from the monitoring server.

Answer

The monitoring server is sending ICMP packets with a TTL of 1, causing them to be dropped.

Answer

The switch's CPU is overloaded, causing CoPP to drop all packets.

Question 3

A network engineer is configuring CoPP on a Cisco ASR 1000 router to protect the control plane from excessive traffic. The engineer wants to allow BGP traffic from a specific peer (10.0.0.1) while rate-limiting all other BGP traffic. The engineer creates an ACL that permits TCP port 179 from host 10.0.0.1 and denies all other BGP traffic. The CoPP class-map matches this ACL. However, after applying the policy, BGP sessions from other peers are still being established. What is the most likely reason?

Accepted Answer

The ACL denies all other BGP traffic, so CoPP does not match it, and it falls through to the default class, which permits it.. The correct answer is that the ACL only matches traffic from the specific peer, but CoPP class-maps match traffic based on the ACL; if the ACL denies other BGP traffic, CoPP will not match it, and it will be processed by the default class, which may permit it. Option B is incorrect because the ACL order is not the issue. Option C is incorrect because BGP uses TCP port 179, not UDP. Option D is incorrect because CoPP does not affect routing protocol sessions directly; it only polices traffic to the control plane.

Answer

The ACL is applied in the wrong order; the deny statement should be before the permit statement.

Answer

BGP uses UDP port 179, not TCP, so the ACL does not match BGP traffic.

Answer

CoPP does not affect BGP sessions because they are established before the policy is applied.

Question 4

A network engineer is troubleshooting a connectivity issue between two VLANs on a Cisco Catalyst 3850 switch. The switch has an ACL applied to VLAN 10 that permits traffic from VLAN 20 to VLAN 10, but denies all other traffic. Hosts in VLAN 20 can ping hosts in VLAN 10, but not vice versa. The engineer checks the ACL and finds that it is applied inbound on VLAN 10. What is the most likely cause of the issue?

Accepted Answer

The ACL is applied inbound on VLAN 10, so it only filters traffic entering VLAN 10, not traffic leaving VLAN 10.. The correct answer is that the ACL is applied inbound on VLAN 10, so it filters traffic entering VLAN 10; traffic from VLAN 20 to VLAN 10 is permitted, but traffic from VLAN 10 to VLAN 20 is not affected by this ACL. Option B is incorrect because the ACL is applied inbound, not outbound. Option C is incorrect because the ACL is applied to the VLAN, not the SVI. Option D is incorrect because the ACL does not affect routing between VLANs; it only filters traffic.

Answer

The ACL is applied outbound on VLAN 10, so it filters traffic leaving VLAN 10, preventing replies.

Answer

The ACL is applied to the SVI for VLAN 10, but the hosts are in VLAN 10, so the ACL does not apply.

Answer

The ACL is blocking ICMP echo replies from VLAN 10 to VLAN 20.

Question 5

A network engineer is configuring CoPP on a Cisco Nexus 9000 switch to protect the control plane from a potential DoS attack. The engineer creates a class-map that matches traffic with a specific DSCP value (AF41) and applies a police rate of 10 Mbps. After applying the policy, the engineer notices that legitimate traffic with DSCP AF41 is being dropped even though the traffic rate is only 5 Mbps. What is the most likely cause?

Accepted Answer

The CoPP policy has a conform-action of drop, which drops all traffic matching the class.. The correct answer is that the CoPP policy is using a conform-action of drop, which drops all traffic that matches the class, regardless of rate. Option B is incorrect because the police rate is not exceeded. Option C is incorrect because DSCP AF41 is a valid value. Option D is incorrect because CoPP does not require a specific queue; it uses policing.

Answer

The police rate is too low, and the traffic is being dropped due to exceeding the rate.

Answer

The DSCP value AF41 is not supported on Nexus switches.

Answer

The CoPP policy is applied to the wrong queue, causing all traffic to be dropped.

Question 6

A network engineer is troubleshooting an issue where a Cisco router is not responding to SNMP polls from a network management station (NMS) at 192.168.1.50. The router has a CoPP policy that includes a class-map matching SNMP traffic (UDP port 161). The engineer checks the CoPP statistics and sees that SNMP packets from the NMS are being dropped. The engineer wants to allow SNMP from the NMS while still protecting the control plane. Which configuration change should the engineer make?

Accepted Answer

Modify the CoPP ACL to include a permit statement for UDP port 161 from host 192.168.1.50 before the deny statement.. The correct answer is to modify the CoPP ACL to permit SNMP from the NMS before the deny statement, ensuring that the traffic is matched and permitted. Option B is incorrect because increasing the police rate might not help if the traffic is being denied by an ACL. Option C is incorrect because removing the CoPP policy removes all protection. Option D is incorrect because changing the SNMP port would require reconfiguring the NMS.

Answer

Increase the police rate for the CoPP class that matches SNMP traffic.

Answer

Remove the CoPP policy from the control plane and rely on interface ACLs.

Answer

Change the SNMP port on the router to a non-standard port to avoid the CoPP policy.

Question 7

A network engineer is configuring ACLs on a Cisco router to filter traffic between two subnets. The engineer wants to allow HTTP traffic from subnet 10.1.1.0/24 to subnet 10.2.2.0/24, but deny all other traffic. The engineer applies an ACL inbound on the interface connected to subnet 10.1.1.0/24. The ACL has a permit statement for TCP port 80 from 10.1.1.0/24 to 10.2.2.0/24, followed by a deny ip any any. However, hosts in subnet 10.1.1.0/24 can still ping hosts in subnet 10.2.2.0/24. What is the most likely reason?

Accepted Answer

The ACL is applied outbound on the interface, not inbound, so it filters traffic leaving the interface, not entering.. The correct answer is that the ACL only filters traffic entering the interface; ping traffic is also entering the interface, but the ACL permits only HTTP, so ping should be denied. However, if the ACL is applied inbound, it should block ping. The most likely reason is that the ACL is applied outbound on the interface, not inbound. Option B is incorrect because the ACL order is correct. Option C is incorrect because ICMP is not HTTP. Option D is incorrect because the ACL is applied to the interface, not the subnet.

Answer

The ACL is missing a deny statement for ICMP, so ICMP traffic is implicitly permitted.

Answer

The ACL permits HTTP, but ping uses ICMP, which is not HTTP, so ping should be denied.

Answer

The ACL is applied to the wrong interface; it should be applied to the interface connected to subnet 10.2.2.0/24.

Question 8

A network engineer is configuring CoPP on a Cisco router to protect the control plane from excessive traffic. The engineer creates a class-map that matches traffic with a specific ACL that permits TCP port 22 (SSH) from a management subnet (192.168.1.0/24) and denies all other traffic. The CoPP policy applies a police rate of 1 Mbps to this class. After applying the policy, the engineer notices that SSH sessions from the management subnet are being dropped intermittently. The engineer checks the CoPP statistics and sees that the traffic rate is 500 kbps. What is the most likely cause?

Accepted Answer

The CoPP policy has a conform-action of drop, which drops all traffic matching the class.. The correct answer is that the CoPP policy has a conform-action of drop, which drops all traffic matching the class, regardless of rate. Option B is incorrect because the traffic rate is below the police rate. Option C is incorrect because the ACL permits SSH from the management subnet. Option D is incorrect because the CoPP policy is applied to the control plane, not an interface.

Answer

The police rate is too low, and the traffic is being dropped due to exceeding the rate.

Answer

The ACL is denying SSH traffic from the management subnet.

Answer

The CoPP policy is applied to the wrong interface, so it is not affecting SSH traffic.

Question 9

A network engineer is troubleshooting an issue where a Cisco router is not forwarding traffic between two VLANs. The router has an ACL applied to the subinterface for VLAN 100 that permits traffic from VLAN 200 to VLAN 100, but denies all other traffic. Hosts in VLAN 200 can ping hosts in VLAN 100, but hosts in VLAN 100 cannot ping hosts in VLAN 200. The engineer checks the ACL and finds that it is applied inbound on the subinterface for VLAN 100. What is the most likely cause of the issue?

Accepted Answer

The ACL is applied inbound on VLAN 100, so it only filters traffic entering VLAN 100, not traffic leaving VLAN 100.. The correct answer is that the ACL is applied inbound on VLAN 100, so it filters traffic entering VLAN 100; traffic from VLAN 200 to VLAN 100 is permitted, but traffic from VLAN 100 to VLAN 200 is not affected by this ACL. Option B is incorrect because the ACL is applied inbound, not outbound. Option C is incorrect because the ACL is applied to the subinterface, not the VLAN. Option D is incorrect because the ACL does not affect routing between VLANs; it only filters traffic.

Answer

The ACL is applied outbound on VLAN 100, so it filters traffic leaving VLAN 100, preventing replies.

Answer

The ACL is applied to the wrong subinterface; it should be applied to the subinterface for VLAN 200.

Answer

The ACL is blocking ICMP echo replies from VLAN 100 to VLAN 200.

Question 10

A network engineer runs the following command on Router R1:

R1# show access-lists
Extended IP access list 101
    10 permit tcp host 10.1.1.1 host 192.168.1.100 eq 80 (4 matches)
    20 deny tcp any host 192.168.1.100 eq 80 (12 matches)
    30 permit ip any any (8 matches)

Based on this output, what can be concluded?

Accepted Answer

HTTP traffic from 10.1.1.1 to 192.168.1.100 is permitted, but all other HTTP traffic to that host is denied.. ACL 101 has three entries. The first permits HTTP from a specific host, the second denies HTTP from any source to that host, and the third permits all other IP traffic. The match counts show that 4 packets matched the permit, 12 matched the deny, and 8 matched the final permit. The correct answer is that HTTP traffic from 10.1.1.1 to 192.168.1.100 is permitted, but all other HTTP traffic to that host is denied.

Answer

All HTTP traffic to 192.168.1.100 is denied.

Answer

All traffic from 10.1.1.1 to 192.168.1.100 is permitted.

Answer

The ACL is applied inbound on an interface.

ACLs and CoPP

350-401 ACLs and CoPP — Practice Questions

What is the default OSPF hello interval on a broadcast multi-access network (e.g., Ethernet)?

Which BGP attribute is preferred when it has the lowest value?

What is the maximum hop count for EIGRP?

Drag and drop the steps of CoPP policy evaluation order into the correct order, from first to last.

Drag and drop the steps of deploying a CoPP policy on a Cisco IOS-XE router into the correct order, from first to last.

Drag and drop the steps of configuring a standard ACL for traffic filtering on a Cisco IOS router into the correct order, from first to last.

All 350-401 Objectives