hardMultiple Choice
CCNP Practice Question: Is configuring CoPP on a Cisco Nexus 9000 switch…
A network engineer is configuring CoPP on a Cisco Nexus 9000 switch to protect the control plane from a potential DoS attack. The engineer creates a class-map that matches traffic with a specific DSCP value (AF41) and applies a police rate of 10 Mbps. After applying the policy, the engineer notices that legitimate traffic with DSCP AF41 is being dropped even though the traffic rate is only 5 Mbps. What is the most likely cause?
⚠ Common exam trap
Cisco often tests the distinction between the police rate and the police action, trapping candidates who assume that a rate below the configured limit automatically allows traffic, without checking the conform-action parameter.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The CoPP policy has a conform-action of drop, which drops all traffic matching the class.
The CoPP policy's conform-action of drop explicitly instructs the switch to discard all packets that match the class-map, regardless of the traffic rate. Even though the traffic rate is only 5 Mbps (below the 10 Mbps police rate), the drop action overrides the policing logic, causing legitimate AF41 traffic to be dropped. This is a common misconfiguration where the engineer sets the action to 'drop' instead of 'transmit' for conforming traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The CoPP policy has a conform-action of drop, which drops all traffic matching the class.
Why this is correct
In Control-Plane Policing (CoPP) on Nexus switches, the police command defines separate actions for packets that conform to, exceed, or violate the configured rate. If the conform-action is set to 'drop', the policer drops every packet matching that class map, regardless of its instantaneous rate or whether it falls within the committed burst. Since the observed 5 Mbps is below the 10 Mbps police rate, the traffic is conforming; yet it is still dropped, which precisely matches a conform-action of drop rather than the common 'transmit' conform-action. This effectively turns the class into an unconditional drop filter for control-plane traffic.
- ✗
The police rate is too low, and the traffic is being dropped due to exceeding the rate.
Why it's wrong here
The police rate is configured at 10 Mbps and the control-plane traffic classified as AF41 is measured at 5 Mbps, which is well within the committed information rate (CIR). In a standard policer, packets that conform to the CIR are typically transmitted (or forwarded) unless the conform-action explicitly overrides that. Even if the traffic had exceeded 10 Mbps, only the excess packets would be subject to the exceed-action, not the entire 5 Mbps stream. Therefore, exceeding the police rate cannot explain the wholesale dropping of all traffic in this class.
- ✗
The DSCP value AF41 is not supported on Nexus switches.
Why it's wrong here
DSCP AF41 (Assured Forwarding class 4, low drop precedence) is a standard DSCP value defined in RFC 2597 and is fully supported for classification in CoPP class-maps on all modern Nexus platforms, including the 9000 series. A switch that could not recognize AF41 would either fail to match traffic to the class, resulting in no drops from that class, or reject the class-map configuration entirely. Neither outcome would produce a policy that drops all AF41 traffic while still passing other control-plane traffic. Thus, unsupported DSCP is not the cause of the observed behavior.
- ✗
The CoPP policy is applied to the wrong queue, causing all traffic to be dropped.
Why it's wrong here
CoPP policies are attached to the control-plane logical interface, not to hardware data-plane queues or scheduling queues; they police aggregate CPU-bound traffic before it reaches the CPU. The term 'queue' in the context of CoPP refers to the internal control-plane queueing architecture, but the policy itself is not 'applied' to a queue—it is applied globally to the control plane as a whole. If a CoPP policy were accidentally attached to a data-plane interface's QoS service-policy, it might affect forwarding-plane traffic, but it would not single out DSCP AF41 control-plane packets and drop all of them. Hence, the wrong-queue explanation confuses data-plane queuing with control-plane policing.
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.