CCNP Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Control Plane Policing (CoPP)

  Why this is correct

  CoPP uses a modular QoS CLI policy attached to the control-plane interface to rate-limit and classify traffic destined to the route processor. It allows the engineer to define class maps for protocols such as IKE, SSH, and SNMP, then apply policing actions so that a flood of tunnel negotiation packets cannot exhaust CPU resources. This directly addresses the hardening goal for the IPsec headend by protecting the control plane from abusive traffic.

• ✗

  MACsec on the WAN interface

  Why it's wrong here

  MACsec provides Layer 2 hop-by-hop encryption and integrity on Ethernet links, typically between switches or between a router and a switch. It does not rate-limit or classify traffic destined to the router's CPU, so it cannot protect the control plane from a flood of IKE or SSH packets. MACsec is a data confidentiality mechanism, not a control plane policing mechanism, and it is irrelevant to the CPU protection goal in this scenario.

• ✗

  Zone-Based Policy Firewall (ZBFW)

  Why it's wrong here

  ZBFW applies stateful inspection policies between security zones for transit traffic, controlling what flows from one zone to another. While it can drop unwanted traffic, it is not designed to rate-limit traffic destined to the router's own control plane and does not offer the granular per-protocol policing that CoPP and CPPr provide. Using ZBFW alone would not prevent a CPU-exhausting flood of IKE packets aimed at the router itself.

• ✓

  Control Plane Protection (CPPr)

  Why this is correct

  CPPr extends CoPP by dividing the control plane into subinterfaces such as host, transit, and CEF-exception, allowing more granular policies for traffic destined to the router itself versus traffic being forwarded. For an IPsec headend, CPPr can police IKE and ISAKMP traffic specifically while leaving transit traffic untouched. It is a Cisco IOS feature purpose-built for protecting the route processor from control plane overload.

• ✗

  IPsec DMVPN with IKEv2

  Why it's wrong here

  DMVPN with IKEv2 is a tunneling and encryption architecture for building scalable hub-and-spoke or partial-mesh VPNs. It secures data in transit but does not include a mechanism to police or rate-limit control plane traffic destined to the route processor. An attacker can still flood the router with IKE negotiation attempts, so DMVPN does not fulfill the control plane protection requirement described in the scenario.