CCNP Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  CoPP can only classify traffic using NBAR2 deep packet inspection, so it cannot match IKE or SSH and requires a separate Zone-Based Firewall policy to protect the control plane.

  Why it's wrong here

  CoPP classification uses standard MQC match criteria such as ACLs, DSCP, and protocol port numbers, and it can absolutely match IKE (UDP 500/4500) and SSH (TCP 22). NBAR2 is not required, and Zone-Based Firewall is a separate technology for transit traffic inspection. This option incorrectly limits CoPP's classification capabilities and conflates two distinct features.

• ✓

  CoPP uses MQC to classify traffic destined to the route processor and applies a policer in the control-plane host path, so it can rate-limit IKE and SSH without affecting transit traffic that is forwarded in hardware.

  Why this is correct

  CoPP leverages Modular QoS CLI to classify packets punted to the route processor, including IKE, SSH, and SNMP, and polices them in a dedicated control-plane host path. Because the policy is applied with 'service-policy input' under 'control-plane', it only affects traffic destined to the device itself, leaving hardware-forwarded transit traffic untouched. This matches the requirement to protect the CPU while preserving legitimate tunnel establishment.

• ✗

  CoPP requires enabling 'ip cef distributed' and a PFC on the supervisor to offload policed control traffic to hardware, otherwise it cannot rate-limit IKE packets.

  Why it's wrong here

  CoPP operates in the control-plane host path on the route processor and does not depend on distributed CEF or a PFC to police control traffic. While PFCs handle certain ACL and QoS offloads in the data plane, they are not prerequisites for CoPP. The claim that IKE packets cannot be policed without these features is incorrect for IOS-XE routers.

• ✗

  CoPP classifies and polices all packets entering any interface, including transit traffic, so it must be applied with 'service-policy input' on every physical interface to be effective.

  Why it's wrong here

  This describes interface-level QoS policing, not CoPP. CoPP is applied once under the 'control-plane' configuration stanza, not per physical interface, and it targets only traffic punted to the route processor. Applying a policer on every interface would affect transit traffic and is unnecessary for CPU protection, so this approach mischaracterizes how CoPP actually functions on IOS-XE.