CCNP Security Practice Question
A network administrator is deploying Control Plane Policing (CoPP) on a Cisco IOS XE router to protect the route processor from excessive traffic. The router has a single physical interface Gi0/0/0 that carries both management SSH traffic and transit data traffic. The administrator wants the CoPP policy to apply only to traffic destined to the router's control plane, not to transit traffic. Which CoPP configuration element must be applied to achieve this?
⚠ Common exam trap
Many exam-takers confuse interface-level service-policy application with the specialized control-plane interface used by CoPP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply the policy-map to the control-plane global configuration using the service-policy command under control-plane.
CoPP protects the route processor by policing traffic that is punted to the control plane. The policy-map must be attached to the control-plane interface with the service-policy command under the control-plane global configuration. Applying a policy to a physical interface or in the output direction would affect transit or outbound traffic, not the control-plane path.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Apply the policy-map to the Gi0/0/0 interface in the input direction using the service-policy command.
Why it's wrong here
Applying a policy-map directly to the physical interface input direction would police all ingress traffic, including transit traffic, before it is classified as control-plane or data-plane. CoPP is designed to be applied to the control-plane interface, not to physical interfaces, so this approach does not isolate control-plane traffic and would incorrectly police transit packets.
- ✓
Apply the policy-map to the control-plane global configuration using the service-policy command under control-plane.
Why this is correct
CoPP is implemented by attaching a policy-map to the control-plane interface using the service-policy command under the control-plane global configuration mode. This causes the policy to inspect only packets that are punted to the route processor, thereby protecting the control plane without affecting transit traffic on physical interfaces.
- ✗
Apply the policy-map to the Gi0/0/0 interface in the output direction using the service-policy command.
Why it's wrong here
Applying the policy-map in the output direction on the physical interface would affect packets leaving the interface, not packets destined to the router's control plane. CoPP operates on ingress traffic to the control plane, so output direction on a physical interface is the wrong location and direction for this requirement.
- ✗
Apply the policy-map to the management VRF using the service-policy command under vrf definition.
Why it's wrong here
The service-policy command is not supported under vrf definition to implement CoPP. Management VRF can separate management traffic, but it does not provide control-plane policing. CoPP must be applied to the control-plane interface, so this option does not meet the requirement of policing only control-plane destined traffic.
About these practice questions
This 350-401 question is part of Courseiva's 1,923-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.