CCNP ACLs and CoPP Practice Test 2 — 15 Questions

Question 1

A network engineer runs the following command on Router R1:

R1# show ip interface GigabitEthernet0/1 | include access list
  Inbound  access list is not set
  Outbound access list is 140

R1# show access-lists 140
Extended IP access list 140
    10 permit tcp 192.168.1.0 0.0.0.255 any eq 443 (25 matches)
    20 deny tcp any any eq 443 (10 matches)
    30 permit ip any any (50 matches)

Based on this output, what can be concluded?

Accepted Answer

HTTPS traffic from sources outside 192.168.1.0/24 is denied when exiting the interface.. ACL 140 is applied outbound on GigabitEthernet0/1. It permits HTTPS (port 443) from subnet 192.168.1.0/24 to any destination, denies all other HTTPS, and permits all other IP traffic. The match counts show 25 HTTPS packets from the subnet, 10 denied HTTPS packets from other sources, and 50 other packets permitted. The correct answer is that HTTPS traffic from sources outside 192.168.1.0/24 is denied when exiting the interface.

Answer

All HTTPS traffic is permitted outbound.

Answer

The ACL is applied inbound on the interface.

Answer

The ACL permits all traffic from 192.168.1.0/24.

Question 2

A network engineer runs the following command on Router R1:

R1# show ip access-lists
Extended IP access list 150
    10 permit tcp 10.0.0.0 0.255.255.255 any eq 23 (2 matches)
    20 deny tcp any any eq 23 (8 matches)
    30 permit tcp 172.16.0.0 0.0.255.255 any eq 22 (4 matches)
    40 deny tcp any any eq 22 (1 match)
    50 permit ip any any (15 matches)

Based on this output, what can be concluded?

Accepted Answer

Telnet from 192.168.1.0/24 would be denied, and SSH from 10.0.0.0/8 would be denied.. ACL 150 permits Telnet (port 23) from 10.0.0.0/8, denies Telnet from all other sources, permits SSH (port 22) from 172.16.0.0/16, denies SSH from all other sources, and permits all other IP traffic. The match counts show 2 Telnet packets from 10.x.x.x, 8 denied Telnet packets from other sources, 4 SSH packets from 172.16.x.x, 1 denied SSH packet from another source, and 15 other packets. The correct answer is that Telnet from 192.168.1.0/24 would be denied, and SSH from 10.0.0.0/8 would be denied because it does not match the SSH permit entry.

Answer

Telnet from 10.0.0.0/8 is denied.

Answer

SSH from 172.16.0.0/16 is denied.

Answer

All traffic is permitted.

Question 3

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-POLICY

Class-map: BGP-CLASS (match-all)
      50 packets, 2500 bytes
      5 minute offered rate 500 bps
      Match: access-group name BGP-ACL
      police:
          cir 64000 bps, bc 8000 bytes, be 8000 bytes
        conformed 50 packets, 2500 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Class-map: SNMP-CLASS (match-all)
      200 packets, 10000 bytes
      5 minute offered rate 2000 bps
      Match: access-group name SNMP-ACL
      police:
          cir 16000 bps, bc 2000 bytes, be 2000 bytes
        conformed 150 packets, 7500 bytes; actions:
          transmit
        exceeded 40 packets, 2000 bytes; actions:
          drop
        violated 10 packets, 500 bytes; actions:
          drop

Class-map: class-default (match-any)
      100 packets, 5000 bytes
      5 minute offered rate 1000 bps
      Match: any
      police:
          cir 32000 bps, bc 4000 bytes, be 4000 bytes
        conformed 100 packets, 5000 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

Based on this output, what can be concluded?

Accepted Answer

SNMP traffic to the control plane is experiencing drops due to exceeding its policer rate, while BGP traffic is within its rate.. The BGP class has a CIR of 64 kbps and all 50 packets conformed. The SNMP class has a CIR of 16 kbps, but 50 out of 200 packets exceeded or violated, meaning 50 packets were dropped. The class-default has a CIR of 32 kbps and all 100 packets conformed. The correct answer is that SNMP traffic to the control plane is experiencing drops due to exceeding its policer rate, while BGP traffic is within its rate.

Answer

BGP traffic is being dropped because it exceeds the CIR.

Answer

All traffic to the control plane is being dropped.

Answer

The control-plane policy is applied in the output direction.

Question 4

Examine the following configuration snippet:

interface GigabitEthernet0/1
 ip access-group FILTER_IN in
!
ip access-list extended FILTER_IN
 deny   icmp any any echo
 permit ip any any

What is the effect of this configuration?

Accepted Answer

It blocks inbound ICMP Echo requests on GigabitEthernet0/1.. The ACL denies ICMP Echo (ping) inbound on GigabitEthernet0/1 while permitting all other IP traffic.

Answer

It blocks all ICMP traffic inbound on GigabitEthernet0/1.

Answer

It blocks all inbound traffic on GigabitEthernet0/1.

Answer

It blocks outbound ICMP Echo requests on GigabitEthernet0/1.

Question 5

Consider the following configuration:

ip access-list extended BLOCK_TELNET
 deny tcp any any eq 23
 permit ip any any
!
interface GigabitEthernet0/2
 ip access-group BLOCK_TELNET out

Which statement is true?

Accepted Answer

Telnet traffic leaving GigabitEthernet0/2 is blocked.. The ACL is applied outbound, so it filters traffic leaving the interface. Telnet (port 23) is denied, all other traffic permitted.

Answer

Telnet traffic entering GigabitEthernet0/2 is blocked.

Answer

All outbound traffic is blocked.

Answer

The ACL is incorrectly applied; only named ACLs can be applied outbound.

Question 6

Given the following CoPP configuration:

class-map match-all COPP_ICMP
 match access-group name ICMP_ACL
!
policy-map COPP_POLICY
 class COPP_ICMP
  police 8000 conform-action transmit exceed-action drop
!
control-plane
 service-policy input COPP_POLICY

What is the effect?

Accepted Answer

All ICMP traffic to the control plane is rate-limited to 8000 bps.. This CoPP policy polices traffic matching class COPP_ICMP to 8000 bps; conforming traffic is transmitted, exceeding traffic is dropped.

Answer

ICMP traffic is permitted unconditionally.

Answer

The policy is applied to all interfaces, not just the control plane.

Answer

The class-map is missing a match-all statement.

Question 7

Review the ACL configuration:

ip access-list extended TEST
 permit tcp 192.168.1.0 0.0.0.255 any eq 80
 permit tcp 192.168.1.0 0.0.0.255 any eq 443
 deny ip any any
!
interface GigabitEthernet0/3
 ip access-group TEST in

What is missing or incorrect?

Accepted Answer

The deny ip any any is redundant because ACLs have an implicit deny at the end.. The ACL permits HTTP and HTTPS from 192.168.1.0/24 to any destination, but denies all other traffic. The configuration is syntactically correct.

Answer

The ACL should use a wildcard mask of 255.255.255.0 instead of 0.0.0.255.

Answer

The ACL must be applied outbound to filter incoming traffic.

Answer

The ACL should use the keyword 'established' to allow return traffic.

Question 8

Examine the CoPP configuration:

class-map match-any COPP_SSH
 match access-group name SSH_ACL
!
policy-map COPP_POLICY
 class COPP_SSH
  police 10000 conform-action transmit exceed-action drop
 class class-default
  police 5000 conform-action transmit exceed-action drop
!
control-plane
 service-policy input COPP_POLICY

Which statement is true?

Accepted Answer

SSH traffic is limited to 10 kbps; all other control plane traffic is limited to 5 kbps.. The policy applies two police rates: 10 kbps for SSH traffic and 5 kbps for all other control plane traffic.

Answer

All control plane traffic is limited to 10 kbps.

Answer

The class-default police rate is ignored because it is not explicitly matched.

Answer

The policy-map should be applied to an interface, not the control plane.

Question 9

Given the following configuration:

ip access-list extended FILTER
 permit tcp any host 10.1.1.1 eq 22
 permit icmp any any echo-reply
!
interface GigabitEthernet0/4
 ip access-group FILTER in

What traffic is permitted?

Accepted Answer

SSH to 10.1.1.1 and ICMP Echo Reply are permitted.. The ACL permits TCP traffic to host 10.1.1.1 on port 22 (SSH) and ICMP Echo Reply messages from any source.

Answer

Only SSH traffic to 10.1.1.1 is permitted.

Answer

All ICMP traffic is permitted.

Answer

Only traffic from host 10.1.1.1 is permitted.

Question 10

What is the default OSPF hello interval on a broadcast multi-access network (e.g., Ethernet)?

Accepted Answer

10 seconds. OSPF defaults to a 10-second hello interval on broadcast and point-to-point networks.

Answer

30 seconds

Answer

40 seconds

Answer

5 seconds

Question 11

Which BGP attribute is preferred when it has the lowest value?

Accepted Answer

MED (Multi-Exit Discriminator). In BGP path selection, a lower weight is preferred over a higher weight.

Answer

Weight

Answer

Local Preference

Answer

Origin

Question 12

What is the maximum hop count for EIGRP?

Accepted Answer

255. EIGRP uses a maximum hop count of 255, but the default is 100.

Answer

100

Answer

15

Answer

Unlimited

Question 13

Drag and drop the steps of CoPP policy evaluation order into the correct order, from first to last.

Accepted Answer

Match against class-map with highest priority. CoPP evaluates packets against class maps in sequential order. The first match determines the action. The default class is processed last if no match occurs.

Question 14

Drag and drop the steps of deploying a CoPP policy on a Cisco IOS-XE router into the correct order, from first to last.

Accepted Answer

Create access-lists for traffic classification. Deploying CoPP requires first defining ACLs to classify traffic, then creating class maps, then a policy map, then applying it to the control plane, and finally verifying the policy.

Question 15

Drag and drop the steps of configuring a standard ACL for traffic filtering on a Cisco IOS router into the correct order, from first to last.

Accepted Answer

Enter global configuration mode. Standard ACLs are configured by first entering global config, defining the ACL with permit/deny statements, then applying it to an interface in the correct direction. Verification confirms the ACL is active.