CCNP Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Increase the rate limit for the OSPF class in the CoPP policy.

  Why this is correct

  OSPF adjacency flapping indicates that OSPF hello packets are being dropped due to the policer rate being too low. Increasing the rate limit for the OSPF class allows legitimate OSPF control traffic to pass while still protecting the control plane from excessive traffic. This is the correct action because it directly addresses the dropped OSPF packets without removing protection entirely.

• ✗

  Configure OSPF to use a different DSCP value so it matches a higher-priority class in the CoPP policy.

  Why it's wrong here

  Changing the DSCP value of OSPF packets is not a standard practice and would require modifications on all OSPF neighbors. CoPP classification is typically based on ACLs matching protocol and port numbers, not DSCP. This approach is complex and unlikely to resolve the issue without additional changes.

• ✗

  Remove the CoPP policy from the control plane and reapply it after OSPF stabilizes.

  Why it's wrong here

  Removing the CoPP policy entirely would eliminate control plane protection, leaving the router vulnerable to DoS attacks. While it might temporarily resolve the OSPF flapping, it does not maintain the required protection. The goal is to adjust the policy, not disable it, to balance security and routing stability.

• ✗

  Apply the CoPP policy only to the management plane interface instead of the control plane.

  Why it's wrong here

  CoPP is designed to protect the control plane, which handles routing protocol traffic. Applying it to the management plane interface would not protect the control plane from OSPF floods and would leave the router vulnerable. The management plane is separate and typically protected by other means like ACLs.