300-410 Practice Test 13 — 15 Questions

Question 1

Examine the following CoPP configuration on a Cisco IOS-XE router:

!--- ACL to match traffic
access-list 100 permit tcp any any eq 22
access-list 100 permit tcp any any eq 23
access-list 100 permit icmp any any echo
!
!--- Class-map
class-map match-all COPP-MGMT
 match access-group 100
!
!--- Policy-map
policy-map COPP-POLICY
 class COPP-MGMT
  police 8000 conform-action transmit exceed-action drop
 class class-default
  police 64000 conform-action transmit exceed-action drop
!
!--- Apply to control-plane
control-plane
 service-policy input COPP-POLICY

What is the effect of this configuration?

Accepted Answer

SSH, Telnet, and ICMP echo packets are rate-limited to 8000 bps; all other control-plane traffic is rate-limited to 64000 bps.. The policy limits SSH, Telnet, and ICMP echo traffic to 8000 bps, dropping excess. All other control-plane traffic is limited to 64000 bps. This protects the router from control-plane overload.

Answer

Only SSH and Telnet are rate-limited to 8000 bps; ICMP echo is not affected because it is matched by a different class.

Answer

All control-plane traffic is rate-limited to 64000 bps, because the class-default overrides the COPP-MGMT class.

Answer

The configuration is invalid because the class-map must be named 'COPP-CLASS' to be used in the policy-map.

Question 2

In a CoPP policy, what is the effect of the 'violate-action' parameter in the police command?

Accepted Answer

It specifies the action for packets that exceed both the conform rate and the excess burst.. The violate-action is used in the three-color policer (single-rate or two-rate) to specify the action for packets that exceed the excess burst. If not configured, the exceed-action is used for violate traffic.

Answer

It specifies the action for packets that exceed the conform rate but are within the excess burst.

Answer

It specifies the action for packets that are below the conform rate.

Answer

It is only used in two-rate policers and is ignored in single-rate policers.

Question 3

Consider the following CoPP configuration:

class-map match-any COPP-ROUTING
 match protocol ospf
 match protocol eigrp
 match protocol bgp
!
policy-map COPP-POLICY
 class COPP-ROUTING
  police 32000 conform-action transmit exceed-action drop
 class class-default
  police 64000 conform-action transmit exceed-action drop
!
control-plane
 service-policy input COPP-POLICY

What is a potential issue with this configuration?

Accepted Answer

The 'match protocol' command is not supported in CoPP class-maps; only ACLs or DSCP/IP precedence can be used.. Using match protocol in a class-map for CoPP is not supported; CoPP only matches on ACLs or DSCP/IP precedence. The policy will not classify routing protocol traffic correctly.

Answer

The class-map uses match-any instead of match-all, which will cause incorrect matching.

Answer

The police rate of 32000 bps is too low for routing protocol traffic and may cause adjacency drops.

Answer

The policy-map must be applied to the control-plane with the 'output' keyword instead of 'input'.

Question 4

Analyze the following partial configuration:

access-list 101 permit tcp any any eq 179
access-list 101 permit udp any any eq 646
access-list 101 permit ospf any any
!
class-map match-all COPP-BGP
 match access-group 101
!
policy-map COPP-POLICY
 class COPP-BGP
  police 48000 conform-action transmit exceed-action drop
 class class-default
  police 128000 conform-action transmit exceed-action drop
!
interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
!
control-plane
 service-policy input COPP-POLICY

Which statement is true?

Accepted Answer

The ACL matches OSPF, BGP, and LDP traffic, and all are rate-limited to 48000 bps.. The ACL includes OSPF, BGP (TCP port 179), and LDP (UDP port 646). These are all control-plane protocols. The policer rate of 48000 bps may be insufficient for BGP updates but the configuration is valid.

Answer

The ACL is missing 'permit eigrp any any' to include EIGRP traffic.

Answer

The class-map must use 'match-all' to match all protocols simultaneously, but the ACL uses 'permit' which is OR logic, so the class-map will not work.

Answer

The policy-map should be applied to the interface, not the control-plane.

Question 5

Which TWO configuration steps are required to implement Control Plane Policing (CoPP) on a Cisco IOS-XE router? (Choose TWO.)

Accepted Answer

Create a policy map that defines a police action for the classified traffic.. The two mandatory steps are: (1) creating a class map to classify traffic (e.g., matching ACLs or protocols) and (2) creating a policy map that applies a police action to that class. Applying the policy to the control plane is also required but is a separate step; however, the question asks for two steps from the list. Option B (creating a policy map) and Option C (creating a class map) are the fundamental building blocks. Applying to an interface is incorrect; applying to the control plane is correct but not listed as a separate option here. Option D is incorrect because CoPP uses 'police' not 'shape'. Option E is incorrect because 'service-policy' is applied under control-plane, not interface.

Answer

Apply the policy map to a physical interface using the 'service-policy input' command.

Answer

Configure a 'shape average' command in the policy map to limit traffic rate.

Answer

Apply the policy map to the control plane using the 'service-policy input' command under the interface configuration mode.

Question 6

Examine this CoPP configuration:

ip access-list extended COPP-ACL
 permit tcp any any eq 22
 permit tcp any any eq 23
 permit icmp any any echo
!
class-map match-all COPP-CLASS
 match access-group name COPP-ACL
!
policy-map COPP-POLICY
 class COPP-CLASS
  police 10000 1500 1500 conform-action transmit exceed-action drop violate-action drop
 class class-default
  police 64000 conform-action transmit exceed-action drop
!
control-plane
 service-policy input COPP-POLICY

What is the effect of the police command in class COPP-CLASS?

Accepted Answer

Traffic is limited to 10000 bps with a burst of 1500 bytes; excess traffic is dropped.. The police command uses a conform rate of 10000 bps, a normal burst of 1500 bytes, and an excess burst of 1500 bytes. Traffic exceeding the burst is dropped (exceed-action drop and violate-action drop).

Answer

Traffic is limited to 10000 bps with a burst of 3000 bytes; excess traffic is dropped.

Answer

The police command is invalid because it uses three parameters after the rate.

Answer

Traffic is limited to 10000 bps, but the burst values are ignored because they are not configured in bytes.

Question 7

Consider the following CoPP configuration:

access-list 150 permit tcp any any eq 179
access-list 150 permit udp any any eq 646
!
class-map match-all COPP-CORE
 match access-group 150
!
policy-map COPP-POLICY
 class COPP-CORE
  police 64000 conform-action transmit exceed-action drop
 class class-default
  police 128000 conform-action transmit exceed-action drop
!
control-plane
 service-policy input COPP-POLICY

What is missing from this configuration to also protect against ICMP-based control-plane attacks?

Accepted Answer

Add 'permit icmp any any' to access-list 150 to include ICMP in the COPP-CORE class.. The ACL only matches BGP (TCP 179) and LDP (UDP 646). ICMP is not included, so ICMP traffic falls into class-default and is only limited to 128000 bps, which may be too high for protection.

Answer

Change the class-default police rate to 64000 bps to match the COPP-CORE rate.

Answer

Add a second class-map for ICMP and apply a separate policer.

Answer

The configuration is complete; ICMP is not a significant control-plane threat.

Question 8

Examine this CoPP configuration:

ip access-list extended PROTECT-ACL
 permit tcp any any eq 22
 permit tcp any any eq 23
 permit tcp any any eq 179
!
class-map match-all PROTECT-CLASS
 match access-group name PROTECT-ACL
!
policy-map PROTECT-POLICY
 class PROTECT-CLASS
  police 16000 conform-action transmit exceed-action drop
 class class-default
  police 64000 conform-action transmit exceed-action drop
!
control-plane
 service-policy input PROTECT-POLICY

What will happen to SSH traffic that exceeds 16000 bps?

Accepted Answer

SSH traffic exceeding 16000 bps is dropped.. The policer for class PROTECT-CLASS drops packets that exceed the conform rate. SSH traffic is matched by the ACL and thus subject to the 16000 bps policer.

Answer

SSH traffic exceeding 16000 bps is still accepted because SSH is critical.

Answer

SSH traffic is not affected because the ACL uses 'permit' and the class-map uses 'match-all'.

Answer

SSH traffic exceeding 16000 bps is sent with a lower priority.

Question 9

What is the default CoPP policy on a Cisco IOS-XE router if no service-policy is applied to the control-plane?

Accepted Answer

No CoPP policy is applied; all control-plane traffic is processed without rate-limiting.. By default, no CoPP policy is applied. The control-plane processes all traffic without rate-limiting. CoPP must be explicitly configured.

Answer

All control-plane traffic is rate-limited to 64000 bps.

Answer

Only management traffic (SSH, Telnet) is rate-limited to 32000 bps.

Answer

A default policy is applied that drops all traffic exceeding 128000 bps.

Question 10

Which of the following is NOT a valid match criterion for a class-map used in Control Plane Policing?

Accepted Answer

match protocol. CoPP supports match access-group (ACL), match ip dscp, and match ip precedence. match protocol is not supported in CoPP class-maps.

Answer

match access-group

Answer

match ip dscp

Answer

match ip precedence

Question 11

Which TWO commands verify the operational status and packet statistics of a Control Plane Policing (CoPP) policy on a Cisco IOS-XE device? (Choose TWO.)

Accepted Answer

show policy-map control-plane. The 'show policy-map control-plane' command displays per-class packet statistics (conform/exceed/violate) for the CoPP policy applied to the control plane. The 'show control-plane host open-ports' command lists listening ports and their associated CoPP class maps, aiding in verification. 'show ip interface brief' shows interface status, not CoPP. 'show access-lists' only shows ACL hit counts, not full CoPP statistics. 'show running-config | section policy-map' shows configuration but not operational statistics.

Answer

show ip interface brief

Answer

show access-lists

Answer

show running-config | section policy-map

Question 12

A network engineer runs the following command on Router R1:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
udp 192.0.2.10:1234    10.0.0.10:1234     203.0.113.5:53    203.0.113.5:53
tcp 192.0.2.10:5678    10.0.0.10:5678     198.51.100.20:80  198.51.100.20:80
--- 192.0.2.11         10.0.0.11          ---                ---

R1# show ip nat statistics
Total active translations: 3 (0 static, 3 dynamic; 3 extended)
Outside interfaces: GigabitEthernet0/1
Inside interfaces: GigabitEthernet0/0
Hits: 100  Misses: 0
CEF Translated packets: 100, CEF Punted packets: 0
Expired translations: 0
Dynamic mappings:
-- Inside Source
[Id] ip nat pool POOL1 192.0.2.10 192.0.2.20 netmask 255.255.255.240
   refcount 3
   map-id 1
   overload
   [Id] ip nat inside source list ACL1 pool POOL1 overload
   refcount 3

Based on this output, what is the problem?

Accepted Answer

The third translation is not using PAT, indicating a possible ACL or route-map misconfiguration.. The output shows two PAT translations (UDP and TCP) for 10.0.0.10 using the same inside global address 192.0.2.10, plus a dynamic NAT translation for 10.0.0.11 without protocol/port. The problem is that the third translation (10.0.0.11) is not using PAT (no port), which could indicate a misconfiguration or that ACL1 does not match traffic from 10.0.0.11 properly, or that the pool is misapplied. However, the key clue is that the third entry lacks a protocol, meaning it is a basic NAT translation, not PAT, which is inconsistent with the overload configuration. This could be due to a route-map or ACL issue.

Answer

The pool is exhausted because 192.0.2.10 is used twice.

Answer

The outside interface is misconfigured as inside.

Answer

The NAT translations are all static.

Question 13

Which TWO statements about Control Plane Policing (CoPP) are true? (Choose TWO.)

Accepted Answer

CoPP uses Modular QoS CLI (MQC) to define traffic classes and actions.. CoPP applies a QoS service policy to the control plane to rate-limit traffic, protecting the CPU from excessive packets. It uses MQC (class maps and policy maps) to classify and police traffic. CoPP is not applied to interfaces directly; it is applied to the control plane. It does not filter traffic at Layer 2; it works at Layer 3 and above. CoPP does not replace ACLs; it works alongside them.

Answer

CoPP is applied directly to physical interfaces to protect the control plane.

Answer

CoPP operates at Layer 2 to filter Ethernet frames before they reach the CPU.

Answer

CoPP replaces the need for access control lists (ACLs) on the device.

Question 14

Which THREE symptoms indicate that Control Plane Policing (CoPP) might be misconfigured or causing connectivity issues? (Choose THREE.)

Accepted Answer

OSPF or BGP neighbors are flapping, with log messages indicating adjacency timeouts.. Symptoms of CoPP misconfiguration include: (1) routing protocol neighbors flapping because CoPP drops hello packets, (2) management access (SSH/Telnet) becoming intermittent due to policing, and (3) high CPU utilization because CoPP is not properly filtering unwanted traffic. Option D (low CPU utilization) is the opposite of a typical CoPP issue. Option E (increased throughput on data interfaces) is unrelated to CoPP affecting the control plane.

Answer

CPU utilization is consistently low, and all control plane traffic is passing without drops.

Answer

Throughput on data interfaces increases significantly.

Question 15

Which TWO commands are used to troubleshoot Control Plane Policing (CoPP) and identify which traffic is being dropped? (Choose TWO.)

Accepted Answer

show policy-map control-plane. The 'show policy-map control-plane' command provides per-class packet counters (conform/exceed/violate) to see drops. The 'show control-plane host open-ports' command helps map open ports to CoPP class maps, aiding in identifying misclassification. 'debug policy-map control-plane' is not a valid command; 'debug policy-map' is used but not specific to control plane. 'show ip cache flow' shows NetFlow data, not CoPP drops. 'show access-lists' shows ACL hit counts but not CoPP-specific drop statistics.

Answer

debug policy-map control-plane

Answer

show ip cache flow

Answer

show access-lists