CCNP Security Practice Question
A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router that runs BGP, SSH management, and SNMP polling. A class-map named CLASS-MGMT matches SNMP and SSH traffic, and a policy-map named COPP-POLICY applies a police rate of 8000 bps with a conform-action transmit and exceed-action drop for that class. After the policy is attached to the control plane, SNMP polling intermittently fails while BGP remains stable. Which action should the engineer take to resolve the SNMP failures while still protecting the route processor?
⚠ Common exam trap
The trap here is assuming that any CoPP drop means the policy should be removed or the exceed-action changed to transmit, rather than tuning the rate to match legitimate control-plane traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Increase the police rate in the CLASS-MGMT class to a value that accommodates the normal SNMP and SSH burst rate.
SNMP polling is bursty and can briefly exceed a very low police rate. When the exceed-action drops packets, polling becomes intermittent. The correct fix is to raise the police rate for the management class to a value that reflects real SNMP and SSH traffic while keeping CoPP in place to protect the route processor from abuse. Disabling enforcement or moving the policy to the data plane is not appropriate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Move the policy-map from the control plane to the data plane interface facing the SNMP server.
Why it's wrong here
CoPP is applied to the control plane with the service-policy input command under control-plane configuration. Applying a policy-map to the data plane interface polices transit traffic, not traffic destined to the route processor. That would not solve SNMP polling failures and would change the traffic handling for all packets on that interface, which is not the intended design.
- ✗
Add a new class-map that matches BGP and apply a lower police rate to it, then reattach the policy.
Why it's wrong here
BGP is already stable, so lowering the police rate for BGP would risk destabilizing routing adjacencies and is unrelated to the SNMP failures. The problem is the management class rate, not BGP. Modifying an unrelated class does not address the SNMP drops and could introduce new control-plane issues.
- ✓
Increase the police rate in the CLASS-MGMT class to a value that accommodates the normal SNMP and SSH burst rate.
Why this is correct
SNMP polling and SSH generate bursty traffic to the route processor. An 8000 bps police rate is far below the normal management traffic rate, so conforming packets are transmitted but excess packets are dropped, causing intermittent SNMP failures. Raising the rate for that class to match observed management traffic preserves CoPP protection while allowing legitimate management polling to reach the control plane.
- ✗
Change the exceed-action from drop to transmit so that SNMP packets are never discarded.
Why it's wrong here
Setting the exceed-action to transmit for the management class removes policing protection for that traffic. While it would stop SNMP drops, it also allows a flood of management-plane traffic to reach the route processor, defeating the purpose of CoPP. CoPP should protect the control plane while still permitting legitimate rates, not disable enforcement for a class.
Visual reference
About these practice questions
This 350-401 question is part of Courseiva's 1,923-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.