CCNP Security Practice Question
A network engineer must protect the Cisco IOS control plane from an excessive volume of ARP traffic generated by a compromised host in VLAN 20. The engineer wants to limit ARP packets that are punted to the CPU, while allowing normal data forwarding to continue unaffected. Which feature should be configured to accomplish this goal?
⚠ Common exam trap
The trap here is assuming that any ARP-related security feature, such as DAI, will protect the CPU from ARP floods, when only control plane policing rate-limits traffic punted to the route processor.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Control Plane Policing (CoPP)
Protecting the CPU from excessive punted ARP traffic requires a mechanism that polices traffic destined to the control plane. Control Plane Policing provides exactly this by allowing class-based rate limiting of specific protocols such as ARP. DAI, storm control, and IP Source Guard operate at the access or data plane and address spoofing or broadcast volume, not CPU-bound exception traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Control Plane Policing (CoPP)
Why this is correct
CoPP applies a QoS policy to the control plane and can rate-limit specific punted traffic classes, such as ARP, using a class-map matching ARP and a policy-map with a policer. This directly limits how many ARP packets reach the CPU while leaving transit data-plane forwarding untouched. It is the intended tool for protecting the route processor from excessive exception traffic.
- ✗
Storm control configured for broadcast traffic on the host-facing port
Why it's wrong here
Storm control limits broadcast, multicast, or unknown unicast traffic on a switch port, and ARP is broadcast, so it could reduce some ARP volume at the access edge. However, it acts in the data plane on a per-port basis and does not specifically protect the CPU from ARP traffic arriving from other sources or VLANs. It is not the purpose-built control plane protection mechanism.
- ✗
IP Source Guard on the host-facing port
Why it's wrong here
IP Source Guard uses the DHCP snooping binding table to filter IP traffic with spoofed source addresses at the access port, but it does not police ARP packet rates or protect the CPU. It is an anti-spoofing access control, not a control plane rate-limiting feature. It would not prevent a high volume of ARP from reaching the route processor.
- ✗
Dynamic ARP Inspection (DAI) on VLAN 20
Why it's wrong here
DAI validates ARP packets against the DHCP snooping binding table to stop ARP spoofing, but it does not rate-limit the total volume of legitimate ARP traffic punted to the CPU. A compromised host flooding valid-looking ARP requests would still overwhelm the control plane. DAI addresses spoofing integrity, not CPU protection, so it does not meet the stated requirement.
Visual reference
About these practice questions
This 350-401 question is part of Courseiva's 1,923-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.