CCNP ACLs and CoPP — 30 Questions

Question 1

A network engineer is troubleshooting an issue where SSH access to a Cisco router from a specific management subnet (10.10.10.0/24) is intermittently failing. The router has a CoPP policy applied to the control plane. The engineer checks the CoPP statistics and sees that packets from the management subnet are being dropped by the control-plane service-policy. Which configuration change should the engineer make to allow SSH from the management subnet while still protecting the control plane?

Accepted Answer

Modify the CoPP ACL to include a permit statement for TCP port 22 from 10.10.10.0/24 before the deny statement.. The correct answer adds an ACL entry to permit SSH from the management subnet before the deny statement, ensuring that SSH traffic is matched by the CoPP policy and not dropped. Option B is incorrect because removing the deny statement would leave the control plane unprotected. Option C is incorrect because increasing the police rate might not resolve the issue if the traffic is being dropped by an ACL deny. Option D is incorrect because removing the CoPP policy entirely removes all protection.

Answer

Remove the deny statement from the CoPP ACL to allow all traffic.

Answer

Increase the police rate for the CoPP class that matches SSH traffic.

Answer

Remove the CoPP policy from the control plane and rely on interface ACLs.

Question 2

An enterprise network uses a Cisco Catalyst 9300 switch as a distribution layer device. The network team notices that ICMP echo requests from a monitoring server (192.168.1.100) to the switch's management IP are being dropped intermittently. The switch has a CoPP policy that includes a class-map matching ICMP traffic. The engineer checks the CoPP statistics and sees that ICMP packets from the monitoring server are being dropped by the policy. What is the most likely cause of this issue?

Accepted Answer

The CoPP policy is policing ICMP traffic to a rate that is too low for the monitoring server's traffic.. The correct answer is that the CoPP policy is policing ICMP traffic to a rate that is too low for the monitoring server's traffic. Option B is incorrect because the ACL is not mentioned as blocking ICMP. Option C is incorrect because the monitoring server is not the source of the issue; it is the target. Option D is incorrect because the switch's CPU is not necessarily overloaded; the drops are due to CoPP policing.

Answer

An ACL applied to the management interface is blocking ICMP from the monitoring server.

Answer

The monitoring server is sending ICMP packets with a TTL of 1, causing them to be dropped.

Answer

The switch's CPU is overloaded, causing CoPP to drop all packets.

Question 3

A network engineer is configuring CoPP on a Cisco ASR 1000 router to protect the control plane from excessive traffic. The engineer wants to allow BGP traffic from a specific peer (10.0.0.1) while rate-limiting all other BGP traffic. The engineer creates an ACL that permits TCP port 179 from host 10.0.0.1 and denies all other BGP traffic. The CoPP class-map matches this ACL. However, after applying the policy, BGP sessions from other peers are still being established. What is the most likely reason?

Accepted Answer

The ACL denies all other BGP traffic, so CoPP does not match it, and it falls through to the default class, which permits it.. The correct answer is that the ACL only matches traffic from the specific peer, but CoPP class-maps match traffic based on the ACL; if the ACL denies other BGP traffic, CoPP will not match it, and it will be processed by the default class, which may permit it. Option B is incorrect because the ACL order is not the issue. Option C is incorrect because BGP uses TCP port 179, not UDP. Option D is incorrect because CoPP does not affect routing protocol sessions directly; it only polices traffic to the control plane.

Answer

The ACL is applied in the wrong order; the deny statement should be before the permit statement.

Answer

BGP uses UDP port 179, not TCP, so the ACL does not match BGP traffic.

Answer

CoPP does not affect BGP sessions because they are established before the policy is applied.

Question 4

A network engineer is troubleshooting a connectivity issue between two VLANs on a Cisco Catalyst 3850 switch. The switch has an ACL applied to VLAN 10 that permits traffic from VLAN 20 to VLAN 10, but denies all other traffic. Hosts in VLAN 20 can ping hosts in VLAN 10, but not vice versa. The engineer checks the ACL and finds that it is applied inbound on VLAN 10. What is the most likely cause of the issue?

Accepted Answer

The ACL is applied inbound on VLAN 10, so it only filters traffic entering VLAN 10, not traffic leaving VLAN 10.. The correct answer is that the ACL is applied inbound on VLAN 10, so it filters traffic entering VLAN 10; traffic from VLAN 20 to VLAN 10 is permitted, but traffic from VLAN 10 to VLAN 20 is not affected by this ACL. Option B is incorrect because the ACL is applied inbound, not outbound. Option C is incorrect because the ACL is applied to the VLAN, not the SVI. Option D is incorrect because the ACL does not affect routing between VLANs; it only filters traffic.

Answer

The ACL is applied outbound on VLAN 10, so it filters traffic leaving VLAN 10, preventing replies.

Answer

The ACL is applied to the SVI for VLAN 10, but the hosts are in VLAN 10, so the ACL does not apply.

Answer

The ACL is blocking ICMP echo replies from VLAN 10 to VLAN 20.

Question 5

A network engineer is configuring CoPP on a Cisco Nexus 9000 switch to protect the control plane from a potential DoS attack. The engineer creates a class-map that matches traffic with a specific DSCP value (AF41) and applies a police rate of 10 Mbps. After applying the policy, the engineer notices that legitimate traffic with DSCP AF41 is being dropped even though the traffic rate is only 5 Mbps. What is the most likely cause?

Accepted Answer

The CoPP policy has a conform-action of drop, which drops all traffic matching the class.. The correct answer is that the CoPP policy is using a conform-action of drop, which drops all traffic that matches the class, regardless of rate. Option B is incorrect because the police rate is not exceeded. Option C is incorrect because DSCP AF41 is a valid value. Option D is incorrect because CoPP does not require a specific queue; it uses policing.

Answer

The police rate is too low, and the traffic is being dropped due to exceeding the rate.

Answer

The DSCP value AF41 is not supported on Nexus switches.

Answer

The CoPP policy is applied to the wrong queue, causing all traffic to be dropped.

Question 6

A network engineer is troubleshooting an issue where a Cisco router is not responding to SNMP polls from a network management station (NMS) at 192.168.1.50. The router has a CoPP policy that includes a class-map matching SNMP traffic (UDP port 161). The engineer checks the CoPP statistics and sees that SNMP packets from the NMS are being dropped. The engineer wants to allow SNMP from the NMS while still protecting the control plane. Which configuration change should the engineer make?

Accepted Answer

Modify the CoPP ACL to include a permit statement for UDP port 161 from host 192.168.1.50 before the deny statement.. The correct answer is to modify the CoPP ACL to permit SNMP from the NMS before the deny statement, ensuring that the traffic is matched and permitted. Option B is incorrect because increasing the police rate might not help if the traffic is being denied by an ACL. Option C is incorrect because removing the CoPP policy removes all protection. Option D is incorrect because changing the SNMP port would require reconfiguring the NMS.

Answer

Increase the police rate for the CoPP class that matches SNMP traffic.

Answer

Remove the CoPP policy from the control plane and rely on interface ACLs.

Answer

Change the SNMP port on the router to a non-standard port to avoid the CoPP policy.

Question 7

A network engineer is configuring ACLs on a Cisco router to filter traffic between two subnets. The engineer wants to allow HTTP traffic from subnet 10.1.1.0/24 to subnet 10.2.2.0/24, but deny all other traffic. The engineer applies an ACL inbound on the interface connected to subnet 10.1.1.0/24. The ACL has a permit statement for TCP port 80 from 10.1.1.0/24 to 10.2.2.0/24, followed by a deny ip any any. However, hosts in subnet 10.1.1.0/24 can still ping hosts in subnet 10.2.2.0/24. What is the most likely reason?

Accepted Answer

The ACL is applied outbound on the interface, not inbound, so it filters traffic leaving the interface, not entering.. The correct answer is that the ACL only filters traffic entering the interface; ping traffic is also entering the interface, but the ACL permits only HTTP, so ping should be denied. However, if the ACL is applied inbound, it should block ping. The most likely reason is that the ACL is applied outbound on the interface, not inbound. Option B is incorrect because the ACL order is correct. Option C is incorrect because ICMP is not HTTP. Option D is incorrect because the ACL is applied to the interface, not the subnet.

Answer

The ACL is missing a deny statement for ICMP, so ICMP traffic is implicitly permitted.

Answer

The ACL permits HTTP, but ping uses ICMP, which is not HTTP, so ping should be denied.

Answer

The ACL is applied to the wrong interface; it should be applied to the interface connected to subnet 10.2.2.0/24.

Question 8

A network engineer is configuring CoPP on a Cisco router to protect the control plane from excessive traffic. The engineer creates a class-map that matches traffic with a specific ACL that permits TCP port 22 (SSH) from a management subnet (192.168.1.0/24) and denies all other traffic. The CoPP policy applies a police rate of 1 Mbps to this class. After applying the policy, the engineer notices that SSH sessions from the management subnet are being dropped intermittently. The engineer checks the CoPP statistics and sees that the traffic rate is 500 kbps. What is the most likely cause?

Accepted Answer

The CoPP policy has a conform-action of drop, which drops all traffic matching the class.. The correct answer is that the CoPP policy has a conform-action of drop, which drops all traffic matching the class, regardless of rate. Option B is incorrect because the traffic rate is below the police rate. Option C is incorrect because the ACL permits SSH from the management subnet. Option D is incorrect because the CoPP policy is applied to the control plane, not an interface.

Answer

The police rate is too low, and the traffic is being dropped due to exceeding the rate.

Answer

The ACL is denying SSH traffic from the management subnet.

Answer

The CoPP policy is applied to the wrong interface, so it is not affecting SSH traffic.

Question 9

A network engineer is troubleshooting an issue where a Cisco router is not forwarding traffic between two VLANs. The router has an ACL applied to the subinterface for VLAN 100 that permits traffic from VLAN 200 to VLAN 100, but denies all other traffic. Hosts in VLAN 200 can ping hosts in VLAN 100, but hosts in VLAN 100 cannot ping hosts in VLAN 200. The engineer checks the ACL and finds that it is applied inbound on the subinterface for VLAN 100. What is the most likely cause of the issue?

Accepted Answer

The ACL is applied inbound on VLAN 100, so it only filters traffic entering VLAN 100, not traffic leaving VLAN 100.. The correct answer is that the ACL is applied inbound on VLAN 100, so it filters traffic entering VLAN 100; traffic from VLAN 200 to VLAN 100 is permitted, but traffic from VLAN 100 to VLAN 200 is not affected by this ACL. Option B is incorrect because the ACL is applied inbound, not outbound. Option C is incorrect because the ACL is applied to the subinterface, not the VLAN. Option D is incorrect because the ACL does not affect routing between VLANs; it only filters traffic.

Answer

The ACL is applied outbound on VLAN 100, so it filters traffic leaving VLAN 100, preventing replies.

Answer

The ACL is applied to the wrong subinterface; it should be applied to the subinterface for VLAN 200.

Answer

The ACL is blocking ICMP echo replies from VLAN 100 to VLAN 200.

Question 10

A network engineer runs the following command on Router R1:

R1# show access-lists
Extended IP access list 101
    10 permit tcp host 10.1.1.1 host 192.168.1.100 eq 80 (4 matches)
    20 deny tcp any host 192.168.1.100 eq 80 (12 matches)
    30 permit ip any any (8 matches)

Based on this output, what can be concluded?

Accepted Answer

HTTP traffic from 10.1.1.1 to 192.168.1.100 is permitted, but all other HTTP traffic to that host is denied.. ACL 101 has three entries. The first permits HTTP from a specific host, the second denies HTTP from any source to that host, and the third permits all other IP traffic. The match counts show that 4 packets matched the permit, 12 matched the deny, and 8 matched the final permit. The correct answer is that HTTP traffic from 10.1.1.1 to 192.168.1.100 is permitted, but all other HTTP traffic to that host is denied.

Answer

All HTTP traffic to 192.168.1.100 is denied.

Answer

All traffic from 10.1.1.1 to 192.168.1.100 is permitted.

Answer

The ACL is applied inbound on an interface.

Question 11

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-POLICY

Class-map: ICMP-CLASS (match-all)
      10 packets, 1000 bytes
      5 minute offered rate 0 bps
      Match: access-group name ICMP-ACL
      police:
          cir 8000 bps, bc 1500 bytes, be 1500 bytes
        conformed 10 packets, 1000 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Class-map: SSH-CLASS (match-all)
      5 packets, 500 bytes
      5 minute offered rate 0 bps
      Match: access-group name SSH-ACL
      police:
          cir 16000 bps, bc 3000 bytes, be 3000 bytes
        conformed 5 packets, 500 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Class-map: class-default (match-any)
      20 packets, 2000 bytes
      5 minute offered rate 0 bps
      Match: any
      police:
          cir 64000 bps, bc 8000 bytes, be 8000 bytes
        conformed 20 packets, 2000 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Based on this output, what can be concluded?

Accepted Answer

ICMP traffic to the control plane is rate-limited to 8 kbps, and all packets so far have been within the conform rate.. The output shows a CoPP policy applied to the control plane. The ICMP class has a CIR of 8 kbps, and all 10 ICMP packets conformed. The SSH class has a higher CIR of 16 kbps. The class-default has a CIR of 64 kbps. The correct answer is that ICMP traffic to the control plane is rate-limited to 8 kbps, and all packets so far have been within the conform rate.

Answer

SSH traffic to the control plane is being dropped because it exceeds the CIR.

Answer

The control-plane policy is applied in the output direction.

Answer

All traffic to the control plane is rate-limited to 64 kbps.

Question 12

A network engineer runs the following command on Router R1:

R1# show ip interface GigabitEthernet0/0 | include access list
  Inbound  access list is 101
  Outbound access list is not set

R1# show access-lists 101
Extended IP access list 101
    10 permit tcp 192.168.1.0 0.0.0.255 any eq 80 (100 matches)
    20 deny tcp any any eq 80 (50 matches)
    30 permit ip any any (200 matches)

Based on this output, what can be concluded?

Accepted Answer

HTTP traffic from sources outside 192.168.1.0/24 is denied.. ACL 101 is applied inbound on GigabitEthernet0/0. It permits HTTP from subnet 192.168.1.0/24 to any destination, denies all other HTTP, and permits all other IP traffic. The match counts show 100 HTTP packets from the subnet, 50 denied HTTP packets from other sources, and 200 other packets permitted. The correct answer is that HTTP traffic from sources outside 192.168.1.0/24 is denied.

Answer

All HTTP traffic is permitted.

Answer

The ACL is applied outbound on the interface.

Answer

The ACL permits all traffic from 192.168.1.0/24.

Question 13

A network engineer runs the following command on Router R1:

R1# show ip access-lists
Extended IP access list 120
    10 permit tcp 10.0.0.0 0.255.255.255 any eq 22 (5 matches)
    20 permit tcp 172.16.0.0 0.0.255.255 any eq 22 (3 matches)
    30 deny tcp any any eq 22 (2 matches)
    40 permit ip any any (10 matches)

Based on this output, what can be concluded?

Accepted Answer

SSH access from 192.168.1.0/24 would be denied.. ACL 120 permits SSH (port 22) from 10.0.0.0/8 and 172.16.0.0/16, denies SSH from all other sources, and permits all other IP traffic. The match counts show 5 SSH packets from 10.x.x.x, 3 from 172.16.x.x, 2 denied SSH packets from other sources, and 10 other packets permitted. The correct answer is that SSH access from 192.168.1.0/24 would be denied.

Answer

SSH access from 10.0.0.0/8 is denied.

Answer

All SSH traffic is permitted.

Answer

The ACL has an implicit deny at the end.

Question 14

A network engineer runs the following command on Router R1:

R1# show access-lists 130
Extended IP access list 130
    10 permit icmp host 10.1.1.1 any echo (8 matches)
    20 permit icmp host 10.1.1.1 any echo-reply (5 matches)
    30 deny icmp any any (3 matches)
    40 permit ip any any (12 matches)

Based on this output, what can be concluded?

Accepted Answer

ICMP packets from sources other than 10.1.1.1 are denied.. ACL 130 permits ICMP echo and echo-reply only from host 10.1.1.1, denies all other ICMP, and permits all other IP traffic. The match counts show 8 echo packets from 10.1.1.1, 5 echo-reply packets from 10.1.1.1, 3 denied ICMP packets from other sources, and 12 other packets permitted. The correct answer is that ICMP packets from sources other than 10.1.1.1 are denied.

Answer

All ICMP traffic is permitted.

Answer

The ACL permits all traffic from 10.1.1.1.

Answer

The ACL is applied inbound on an interface.

Question 15

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-POLICY

Class-map: MGMT-CLASS (match-all)
      100 packets, 5000 bytes
      5 minute offered rate 1000 bps
      Match: access-group name MGMT-ACL
      police:
          cir 32000 bps, bc 4000 bytes, be 4000 bytes
        conformed 80 packets, 4000 bytes; actions:
          transmit
        exceeded 15 packets, 750 bytes; actions:
          drop
        violated 5 packets, 250 bytes; actions:
          drop

Class-map: class-default (match-any)
      200 packets, 10000 bytes
      5 minute offered rate 2000 bps
      Match: any
      police:
          cir 64000 bps, bc 8000 bytes, be 8000 bytes
        conformed 200 packets, 10000 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Based on this output, what can be concluded?

Accepted Answer

Management traffic to the control plane is being policed, and some packets are being dropped because they exceed the configured rate.. The MGMT class has a CIR of 32 kbps. Out of 100 packets, 80 conformed and were transmitted, while 20 exceeded or violated and were dropped. This indicates that the traffic rate exceeded the policer's CIR, causing drops. The correct answer is that management traffic to the control plane is being policed, and some packets are being dropped because they exceed the configured rate.

Answer

All management traffic is being transmitted without drops.

Answer

The policer is configured in the output direction.

Answer

The class-default is dropping packets.

Question 16

A network engineer runs the following command on Router R1:

R1# show ip interface GigabitEthernet0/1 | include access list
  Inbound  access list is not set
  Outbound access list is 140

R1# show access-lists 140
Extended IP access list 140
    10 permit tcp 192.168.1.0 0.0.0.255 any eq 443 (25 matches)
    20 deny tcp any any eq 443 (10 matches)
    30 permit ip any any (50 matches)

Based on this output, what can be concluded?

Accepted Answer

HTTPS traffic from sources outside 192.168.1.0/24 is denied when exiting the interface.. ACL 140 is applied outbound on GigabitEthernet0/1. It permits HTTPS (port 443) from subnet 192.168.1.0/24 to any destination, denies all other HTTPS, and permits all other IP traffic. The match counts show 25 HTTPS packets from the subnet, 10 denied HTTPS packets from other sources, and 50 other packets permitted. The correct answer is that HTTPS traffic from sources outside 192.168.1.0/24 is denied when exiting the interface.

Answer

All HTTPS traffic is permitted outbound.

Answer

The ACL is applied inbound on the interface.

Answer

The ACL permits all traffic from 192.168.1.0/24.

Question 17

A network engineer runs the following command on Router R1:

R1# show ip access-lists
Extended IP access list 150
    10 permit tcp 10.0.0.0 0.255.255.255 any eq 23 (2 matches)
    20 deny tcp any any eq 23 (8 matches)
    30 permit tcp 172.16.0.0 0.0.255.255 any eq 22 (4 matches)
    40 deny tcp any any eq 22 (1 match)
    50 permit ip any any (15 matches)

Based on this output, what can be concluded?

Accepted Answer

Telnet from 192.168.1.0/24 would be denied, and SSH from 10.0.0.0/8 would be denied.. ACL 150 permits Telnet (port 23) from 10.0.0.0/8, denies Telnet from all other sources, permits SSH (port 22) from 172.16.0.0/16, denies SSH from all other sources, and permits all other IP traffic. The match counts show 2 Telnet packets from 10.x.x.x, 8 denied Telnet packets from other sources, 4 SSH packets from 172.16.x.x, 1 denied SSH packet from another source, and 15 other packets. The correct answer is that Telnet from 192.168.1.0/24 would be denied, and SSH from 10.0.0.0/8 would be denied because it does not match the SSH permit entry.

Answer

Telnet from 10.0.0.0/8 is denied.

Answer

SSH from 172.16.0.0/16 is denied.

Answer

All traffic is permitted.

Question 18

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-POLICY

Class-map: BGP-CLASS (match-all)
      50 packets, 2500 bytes
      5 minute offered rate 500 bps
      Match: access-group name BGP-ACL
      police:
          cir 64000 bps, bc 8000 bytes, be 8000 bytes
        conformed 50 packets, 2500 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Class-map: SNMP-CLASS (match-all)
      200 packets, 10000 bytes
      5 minute offered rate 2000 bps
      Match: access-group name SNMP-ACL
      police:
          cir 16000 bps, bc 2000 bytes, be 2000 bytes
        conformed 150 packets, 7500 bytes; actions:
          transmit
        exceeded 40 packets, 2000 bytes; actions:
          drop
        violated 10 packets, 500 bytes; actions:
          drop

Class-map: class-default (match-any)
      100 packets, 5000 bytes
      5 minute offered rate 1000 bps
      Match: any
      police:
          cir 32000 bps, bc 4000 bytes, be 4000 bytes
        conformed 100 packets, 5000 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Based on this output, what can be concluded?

Accepted Answer

SNMP traffic to the control plane is experiencing drops due to exceeding its policer rate, while BGP traffic is within its rate.. The BGP class has a CIR of 64 kbps and all 50 packets conformed. The SNMP class has a CIR of 16 kbps, but 50 out of 200 packets exceeded or violated, meaning 50 packets were dropped. The class-default has a CIR of 32 kbps and all 100 packets conformed. The correct answer is that SNMP traffic to the control plane is experiencing drops due to exceeding its policer rate, while BGP traffic is within its rate.

Answer

BGP traffic is being dropped because it exceeds the CIR.

Answer

All traffic to the control plane is being dropped.

Answer

The control-plane policy is applied in the output direction.

Question 19

Examine the following configuration snippet:

interface GigabitEthernet0/1
 ip access-group FILTER_IN in
!
ip access-list extended FILTER_IN
 deny   icmp any any echo
 permit ip any any

What is the effect of this configuration?

Accepted Answer

It blocks inbound ICMP Echo requests on GigabitEthernet0/1.. The ACL denies ICMP Echo (ping) inbound on GigabitEthernet0/1 while permitting all other IP traffic.

Answer

It blocks all ICMP traffic inbound on GigabitEthernet0/1.

Answer

It blocks all inbound traffic on GigabitEthernet0/1.

Answer

It blocks outbound ICMP Echo requests on GigabitEthernet0/1.

Question 20

Consider the following configuration:

ip access-list extended BLOCK_TELNET
 deny tcp any any eq 23
 permit ip any any
!
interface GigabitEthernet0/2
 ip access-group BLOCK_TELNET out

Which statement is true?

Accepted Answer

Telnet traffic leaving GigabitEthernet0/2 is blocked.. The ACL is applied outbound, so it filters traffic leaving the interface. Telnet (port 23) is denied, all other traffic permitted.

Answer

Telnet traffic entering GigabitEthernet0/2 is blocked.

Answer

All outbound traffic is blocked.

Answer

The ACL is incorrectly applied; only named ACLs can be applied outbound.