300-410 Control Plane Policing (CoPP) Practice Test 2 — 15 Questions

Question 1

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-IN

Class-map: CoPP-EIGRP (match-all)
      200 packets, 12000 bytes
      5 minute offered rate 1000 bps, drop rate 0000 bps
      Match: access-group 150
      police:
          cir 16000 bps, bc 3000 bytes, be 3000 bytes
        conformed 200 packets, 12000 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

R1# show ip eigrp neighbors
EIGRP-IPv4 neighbors for process 100
H   Address                 Interface       Hold Uptime    SRTT   RTO  Q  Seq
                                            (sec)         (ms)       Cnt Num
0   10.1.1.2                Gi0/0            13 00:10:00    1   200  0  5

Based on this output, which statement is correct?

Accepted Answer

EIGRP traffic is being rate-limited but no packets are dropped.. The CoPP-EIGRP class is matching EIGRP traffic and all packets are conforming. The EIGRP neighbor is established and stable, indicating that the CoPP policy is not negatively impacting EIGRP.

Answer

EIGRP packets are being dropped, causing neighbor flapping.

Answer

The police rate is set to 8000 bps.

Answer

The EIGRP neighbor is not established.

Question 2

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-IN

Class-map: CoPP-BGP (match-all)
      0 packets, 0 bytes
      5 minute offered rate 0000 bps, drop rate 0000 bps
      Match: access-group 120
      police:
          cir 32000 bps, bc 6000 bytes, be 6000 bytes
        conformed 0 packets, 0 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        violated 0 packets, 0 bytes; actions:
          drop

R1# show ip bgp summary
BGP router identifier 1.1.1.1, local AS number 100
BGP table version is 1, main routing table version 1
Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
10.1.1.2        4          200      10      10        1    0    0 00:05:00        5

Based on this output, what is the most likely problem?

Accepted Answer

The access-list 120 is not matching BGP traffic, so it is falling into class-default.. The CoPP-BGP class shows zero packets, but the BGP session is established and exchanging messages. This indicates that BGP traffic is not being classified by the CoPP-BGP class, likely because the access-group 120 is not matching the BGP packets. The BGP session is up, so the traffic is being processed by the class-default instead.

Answer

The BGP session is down.

Answer

The police rate is too low and is dropping all BGP packets.

Answer

The policy-map is applied to the output direction.

Question 3

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-IN

Class-map: CoPP-ICMP (match-all)
      100 packets, 6000 bytes
      5 minute offered rate 500 bps, drop rate 500 bps
      Match: access-group 100
      police:
          cir 8000 bps, bc 1500 bytes, be 1500 bytes
        conformed 50 packets, 3000 bytes; actions:
          transmit
        exceeded 25 packets, 1500 bytes; actions:
          drop
        violated 25 packets, 1500 bytes; actions:
          drop

Based on this output, what is the most likely impact on the router?

Accepted Answer

ICMP traffic is being rate-limited, causing some ping requests to fail.. The CoPP-ICMP class is dropping half of the ICMP packets due to exceeding the police rate. This could cause ping failures or traceroute issues from network devices, but it is not necessarily critical for router operation. However, it indicates that ICMP traffic is being rate-limited.

Answer

All ICMP packets are being transmitted without drops.

Answer

The police rate is set to 16000 bps.

Answer

The class-default is matching ICMP traffic.

Question 4

Examine the following CoPP configuration on a Cisco IOS-XE router:

!--- ACL to match traffic
access-list 100 permit tcp any any eq 22
access-list 100 permit tcp any any eq 23
access-list 100 permit icmp any any echo
!
!--- Class-map
class-map match-all COPP-MGMT
 match access-group 100
!
!--- Policy-map
policy-map COPP-POLICY
 class COPP-MGMT
  police 8000 conform-action transmit exceed-action drop
 class class-default
  police 64000 conform-action transmit exceed-action drop
!
!--- Apply to control-plane
control-plane
 service-policy input COPP-POLICY

What is the effect of this configuration?

Accepted Answer

SSH, Telnet, and ICMP echo packets are rate-limited to 8000 bps; all other control-plane traffic is rate-limited to 64000 bps.. The policy limits SSH, Telnet, and ICMP echo traffic to 8000 bps, dropping excess. All other control-plane traffic is limited to 64000 bps. This protects the router from control-plane overload.

Answer

Only SSH and Telnet are rate-limited to 8000 bps; ICMP echo is not affected because it is matched by a different class.

Answer

All control-plane traffic is rate-limited to 64000 bps, because the class-default overrides the COPP-MGMT class.

Answer

The configuration is invalid because the class-map must be named 'COPP-CLASS' to be used in the policy-map.

Question 5

Consider the following CoPP configuration:

class-map match-any COPP-ROUTING
 match protocol ospf
 match protocol eigrp
 match protocol bgp
!
policy-map COPP-POLICY
 class COPP-ROUTING
  police 32000 conform-action transmit exceed-action drop
 class class-default
  police 64000 conform-action transmit exceed-action drop
!
control-plane
 service-policy input COPP-POLICY

What is a potential issue with this configuration?

Accepted Answer

The 'match protocol' command is not supported in CoPP class-maps; only ACLs or DSCP/IP precedence can be used.. Using match protocol in a class-map for CoPP is not supported; CoPP only matches on ACLs or DSCP/IP precedence. The policy will not classify routing protocol traffic correctly.

Answer

The class-map uses match-any instead of match-all, which will cause incorrect matching.

Answer

The police rate of 32000 bps is too low for routing protocol traffic and may cause adjacency drops.

Answer

The policy-map must be applied to the control-plane with the 'output' keyword instead of 'input'.

Question 6

Analyze the following partial configuration:

access-list 101 permit tcp any any eq 179
access-list 101 permit udp any any eq 646
access-list 101 permit ospf any any
!
class-map match-all COPP-BGP
 match access-group 101
!
policy-map COPP-POLICY
 class COPP-BGP
  police 48000 conform-action transmit exceed-action drop
 class class-default
  police 128000 conform-action transmit exceed-action drop
!
interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
!
control-plane
 service-policy input COPP-POLICY

Which statement is true?

Accepted Answer

The ACL matches OSPF, BGP, and LDP traffic, and all are rate-limited to 48000 bps.. The ACL includes OSPF, BGP (TCP port 179), and LDP (UDP port 646). These are all control-plane protocols. The policer rate of 48000 bps may be insufficient for BGP updates but the configuration is valid.

Answer

The ACL is missing 'permit eigrp any any' to include EIGRP traffic.

Answer

The class-map must use 'match-all' to match all protocols simultaneously, but the ACL uses 'permit' which is OR logic, so the class-map will not work.

Answer

The policy-map should be applied to the interface, not the control-plane.

Question 7

Examine this CoPP configuration:

ip access-list extended COPP-ACL
 permit tcp any any eq 22
 permit tcp any any eq 23
 permit icmp any any echo
!
class-map match-all COPP-CLASS
 match access-group name COPP-ACL
!
policy-map COPP-POLICY
 class COPP-CLASS
  police 10000 1500 1500 conform-action transmit exceed-action drop violate-action drop
 class class-default
  police 64000 conform-action transmit exceed-action drop
!
control-plane
 service-policy input COPP-POLICY

What is the effect of the police command in class COPP-CLASS?

Accepted Answer

Traffic is limited to 10000 bps with a burst of 1500 bytes; excess traffic is dropped.. The police command uses a conform rate of 10000 bps, a normal burst of 1500 bytes, and an excess burst of 1500 bytes. Traffic exceeding the burst is dropped (exceed-action drop and violate-action drop).

Answer

Traffic is limited to 10000 bps with a burst of 3000 bytes; excess traffic is dropped.

Answer

The police command is invalid because it uses three parameters after the rate.

Answer

Traffic is limited to 10000 bps, but the burst values are ignored because they are not configured in bytes.

Question 8

Consider the following CoPP configuration:

access-list 150 permit tcp any any eq 179
access-list 150 permit udp any any eq 646
!
class-map match-all COPP-CORE
 match access-group 150
!
policy-map COPP-POLICY
 class COPP-CORE
  police 64000 conform-action transmit exceed-action drop
 class class-default
  police 128000 conform-action transmit exceed-action drop
!
control-plane
 service-policy input COPP-POLICY

What is missing from this configuration to also protect against ICMP-based control-plane attacks?

Accepted Answer

Add 'permit icmp any any' to access-list 150 to include ICMP in the COPP-CORE class.. The ACL only matches BGP (TCP 179) and LDP (UDP 646). ICMP is not included, so ICMP traffic falls into class-default and is only limited to 128000 bps, which may be too high for protection.

Answer

Change the class-default police rate to 64000 bps to match the COPP-CORE rate.

Answer

Add a second class-map for ICMP and apply a separate policer.

Answer

The configuration is complete; ICMP is not a significant control-plane threat.

Question 9

Examine this CoPP configuration:

ip access-list extended PROTECT-ACL
 permit tcp any any eq 22
 permit tcp any any eq 23
 permit tcp any any eq 179
!
class-map match-all PROTECT-CLASS
 match access-group name PROTECT-ACL
!
policy-map PROTECT-POLICY
 class PROTECT-CLASS
  police 16000 conform-action transmit exceed-action drop
 class class-default
  police 64000 conform-action transmit exceed-action drop
!
control-plane
 service-policy input PROTECT-POLICY

What will happen to SSH traffic that exceeds 16000 bps?

Accepted Answer

SSH traffic exceeding 16000 bps is dropped.. The policer for class PROTECT-CLASS drops packets that exceed the conform rate. SSH traffic is matched by the ACL and thus subject to the 16000 bps policer.

Answer

SSH traffic exceeding 16000 bps is still accepted because SSH is critical.

Answer

SSH traffic is not affected because the ACL uses 'permit' and the class-map uses 'match-all'.

Answer

SSH traffic exceeding 16000 bps is sent with a lower priority.

Question 10

What is the default CoPP policy on a Cisco IOS-XE router if no service-policy is applied to the control-plane?

Accepted Answer

No CoPP policy is applied; all control-plane traffic is processed without rate-limiting.. By default, no CoPP policy is applied. The control-plane processes all traffic without rate-limiting. CoPP must be explicitly configured.

Answer

All control-plane traffic is rate-limited to 64000 bps.

Answer

Only management traffic (SSH, Telnet) is rate-limited to 32000 bps.

Answer

A default policy is applied that drops all traffic exceeding 128000 bps.

Question 11

Which of the following is NOT a valid match criterion for a class-map used in Control Plane Policing?

Accepted Answer

match protocol. CoPP supports match access-group (ACL), match ip dscp, and match ip precedence. match protocol is not supported in CoPP class-maps.

Answer

match access-group

Answer

match ip dscp

Answer

match ip precedence

Question 12

In a CoPP policy, what is the effect of the 'violate-action' parameter in the police command?

Accepted Answer

It specifies the action for packets that exceed both the conform rate and the excess burst.. The violate-action is used in the three-color policer (single-rate or two-rate) to specify the action for packets that exceed the excess burst. If not configured, the exceed-action is used for violate traffic.

Answer

It specifies the action for packets that exceed the conform rate but are within the excess burst.

Answer

It specifies the action for packets that are below the conform rate.

Answer

It is only used in two-rate policers and is ignored in single-rate policers.

Question 13

Which TWO commands verify the operational status and packet statistics of a Control Plane Policing (CoPP) policy on a Cisco IOS-XE device? (Choose TWO.)

Accepted Answer

show policy-map control-plane. The 'show policy-map control-plane' command displays per-class packet statistics (conform/exceed/violate) for the CoPP policy applied to the control plane. The 'show control-plane host open-ports' command lists listening ports and their associated CoPP class maps, aiding in verification. 'show ip interface brief' shows interface status, not CoPP. 'show access-lists' only shows ACL hit counts, not full CoPP statistics. 'show running-config | section policy-map' shows configuration but not operational statistics.

Answer

show ip interface brief

Answer

show access-lists

Answer

show running-config | section policy-map

Question 14

Which TWO statements about Control Plane Policing (CoPP) are true? (Choose TWO.)

Accepted Answer

CoPP uses Modular QoS CLI (MQC) to define traffic classes and actions.. CoPP applies a QoS service policy to the control plane to rate-limit traffic, protecting the CPU from excessive packets. It uses MQC (class maps and policy maps) to classify and police traffic. CoPP is not applied to interfaces directly; it is applied to the control plane. It does not filter traffic at Layer 2; it works at Layer 3 and above. CoPP does not replace ACLs; it works alongside them.

Answer

CoPP is applied directly to physical interfaces to protect the control plane.

Answer

CoPP operates at Layer 2 to filter Ethernet frames before they reach the CPU.

Answer

CoPP replaces the need for access control lists (ACLs) on the device.

Question 15

Which TWO configuration steps are required to implement Control Plane Policing (CoPP) on a Cisco IOS-XE router? (Choose TWO.)

Accepted Answer

Create a policy map that defines a police action for the classified traffic.. The two mandatory steps are: (1) creating a class map to classify traffic (e.g., matching ACLs or protocols) and (2) creating a policy map that applies a police action to that class. Applying the policy to the control plane is also required but is a separate step; however, the question asks for two steps from the list. Option B (creating a policy map) and Option C (creating a class map) are the fundamental building blocks. Applying to an interface is incorrect; applying to the control plane is correct but not listed as a separate option here. Option D is incorrect because CoPP uses 'police' not 'shape'. Option E is incorrect because 'service-policy' is applied under control-plane, not interface.

Answer

Apply the policy map to a physical interface using the 'service-policy input' command.

Answer

Configure a 'shape average' command in the policy map to limit traffic rate.

Answer

Apply the policy map to the control plane using the 'service-policy input' command under the interface configuration mode.