CCNP Security Practice Question
A network administrator is implementing Control Plane Policing on a Cisco IOS-XE router to protect the route processor from excessive BGP, SSH, and SNMP traffic. After applying the policy, legitimate BGP keepalives are being dropped, causing peer resets. Which action should the administrator take to resolve this while still protecting the control plane?
⚠ Common exam trap
The trap here is assuming that removing the BGP class or switching to queuing solves the problem, when the actual fix is to tune the policer rate and verify classification order so BGP matches its dedicated class before the default class.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Raise the conform-action rate for the BGP class and verify BGP is classified before the default class
CoPP classifies control-plane traffic and applies policers per class. BGP keepalives are small and periodic; if the BGP class rate is too low or BGP is not matched before the default class, keepalives get dropped and peers reset. Increasing the conform rate for the BGP class and ensuring correct classification order restores keepalive delivery while continuing to protect the route processor from abusive traffic in other classes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Remove the BGP class from the policy map so BGP is not policed at all
Why it's wrong here
Removing the BGP class entirely means BGP traffic falls into the default class, which is often policed at a lower aggregate rate, potentially causing worse drops. It also removes any explicit protection or visibility for BGP. A more surgical adjustment to the BGP class rate and classification order is preferred over eliminating the class.
- ✗
Apply the policy to the data plane interfaces instead of the control plane
Why it's wrong here
Applying the policy to data-plane interfaces changes its scope entirely and would police transit traffic rather than traffic destined to the route processor, defeating the purpose of CoPP. It would not protect the control plane and could disrupt customer traffic. CoPP must be attached to the control plane via the service-policy input command under control-plane configuration.
- ✗
Change the policy map to use priority queuing instead of policing for the BGP class
Why it's wrong here
CoPP is a policing mechanism, not a queuing mechanism; priority queuing is not a valid conform-action within a CoPP policy map on IOS-XE control-plane policies. The correct approach is to tune the policer rate and classification, not to substitute a queuing discipline that the feature does not support in this context. This change would not compile or would not achieve the intended effect.
- ✓
Raise the conform-action rate for the BGP class and verify BGP is classified before the default class
Why this is correct
BGP keepalives are small but time-sensitive; if the policed rate for the BGP class is too low, drops cause peer resets. Increasing the conform rate for that class and ensuring BGP traffic matches its dedicated class before falling into the default class restores keepalive delivery while still rate-limiting other unwanted traffic. This preserves control-plane protection without harming BGP.
Visual reference
About these practice questions
One of 1,923 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.