CCNP Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  A policy map that references the control-plane host and matches all IP traffic by default.

  Why it's wrong here

  A policy map defines actions but still requires class maps to identify the specific traffic. Matching all IP traffic by default would police all control-plane traffic indiscriminately, including routing protocols, which the scenario says must not be restricted. The classification step must occur in class maps before the policy map is applied.

• ✗

  An access list applied directly to the control-plane interface with the ip access-group command.

  Why it's wrong here

  Applying an ACL to the control-plane interface filters traffic but does not perform rate limiting or policing. CoPP requires a policy map with police actions, applied via service-policy. An ACL alone cannot rate-limit ARP or DHCP snooping traffic destined to the route processor.

• ✓

  A class map that matches traffic using ACLs and/or match protocol commands.

  Why this is correct

  CoPP uses a modular QoS CLI structure: class maps define the traffic to be matched, policy maps define the actions, and the service-policy is applied to the control-plane interface. To rate-limit ARP and DHCP snooping traffic, the engineer must first create class maps that identify those protocols using ACLs or match protocol statements, then reference them in a policy map.

• ✗

  A route map applied to the control-plane interface with the service-policy command.

  Why it's wrong here

  Route maps are used for route redistribution, policy-based routing, and BGP attribute manipulation, not for classifying control-plane traffic in CoPP. The control-plane interface accepts a service-policy that references a policy map, not a route map. Using a route map here would not match ARP or DHCP snooping packets for policing.