CCNA QoS Questions

Matchingmedium

Drag and drop each congestion avoidance mechanism on the left to its matching method on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Drops all arriving packets when the queue is full

Drops packets probabilistically based on average queue depth before the queue is full

Drops packets probabilistically with different thresholds per IP precedence or DSCP value

Marks packets instead of dropping them when RED is enabled and endpoints support ECN

Drops packets based on a per-class drop threshold but still drops all when threshold exceeded

Why these pairings

Tail-drop drops all packets when queue is full; RED starts dropping packets probabilistically before queue full; WRED uses IP precedence or DSCP to vary drop probability per class.

Practice this question →

Matchingmedium

Drag and drop each DSCP PHB on the left to its matching queue treatment on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Expedited forwarding, strict priority queuing, low delay and jitter

Assured forwarding, four classes with three drop probabilities per class

Class selector, backward compatible with IP precedence, simple priority queuing

Best-effort, default queue, no guarantees

Default forwarding, same as best-effort (DSCP 0)

Why these pairings

EF PHB (DSCP 46) is for low-loss, low-latency traffic; AF PHBs (AF1x-AF4x) provide assured forwarding with four classes and three drop precedences; CS PHBs (CS1-CS7) are backward-compatible with IP precedence; BE (DSCP 0) is best-effort; DF (DSCP 0) is the default PHB.

Practice this question →

Matchingmedium

Drag and drop each MQC command on the left to its matching configuration level on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Defines a traffic class using match criteria

Associates a traffic class with QoS actions (e.g., bandwidth, priority, police)

Applies a policy-map to an interface (input or output) or globally

Used inside a class-map to specify classification criteria

Used inside a policy-map class to allocate minimum bandwidth

Why these pairings

class-map defines traffic classes; policy-map associates actions with classes; service-policy applies the policy to an interface or globally.

Practice this question →

MCQmedium

Consider the following configuration: class-map match-all HTTP match protocol http policy-map QOS class HTTP police 2000000 1500 3000 conform-action transmit exceed-action drop interface GigabitEthernet0/1 service-policy input QOS What is the effect of this configuration?

A.HTTP traffic is policed to an average rate of 2 Mbps; packets that exceed the rate are dropped, while conforming packets are transmitted.

B.HTTP traffic is shaped to an average rate of 2 Mbps; excess packets are buffered.

C.The police command will mark HTTP packets with a DSCP value of 0 if they exceed the rate.

D.The configuration is invalid because 'police' cannot be used in a 'service-policy input' direction.

AnswerA

Correct. Policing with 'conform-action transmit' and 'exceed-action drop' drops excess traffic.

Why this answer

The police command limits HTTP traffic to an average rate of 2 Mbps with a normal burst of 1500 bytes and an excess burst of 3000 bytes. Traffic within the rate is transmitted; traffic exceeding the rate is dropped.

Practice this question →

MCQhard

An engineer is configuring QoS on a Cisco ISR 4331 router for a site-to-site VPN tunnel. The tunnel interface is configured with a service policy that uses a class map matching DSCP EF. The engineer notices that the policy is not shaping traffic as expected; the tunnel bandwidth is 20 Mbps but the shaper is set to 10 Mbps. However, traffic still exceeds 10 Mbps. What is the most likely cause?

A.The shaper should be applied to the physical interface instead of the tunnel interface

B.The shaper rate should be set to 20 Mbps to match the tunnel bandwidth

C.The class map should match on the outer IP header instead of the inner DSCP

D.The service policy should be applied in the input direction

AnswerA

Correct because tunnel interfaces encapsulate traffic; shaping on the tunnel does not control the actual output rate on the physical link.

Why this answer

The correct answer is that the shaper must be applied to the physical interface, not the tunnel interface, because the tunnel interface does not have a direct view of the underlying bandwidth. Shaping on the tunnel interface is ineffective.

Practice this question →

MCQhard

An engineer is deploying QoS on a WAN link between two sites using a Cisco ISR 4451 router. The link is a 10 Mbps MPLS circuit. The engineer wants to ensure that voice traffic (EF) is never dropped, even during congestion. The current policy uses a single class map for voice with a policer that drops excess traffic. During peak hours, users report choppy voice calls. What change should the engineer make?

A.Change the policer to a shaper and apply it to the voice class

B.Increase the policer rate to 20 Mbps to accommodate voice bursts

C.Remove the policer and rely on FIFO queuing

D.Apply the policy in the output direction only

AnswerA

Correct because shaping buffers excess traffic instead of dropping it, reducing jitter and packet loss for voice.

Why this answer

The correct answer is to replace the policer with a shaper or use a low-latency queue (LLQ) to provide strict priority queuing. A policer drops excess traffic, which can cause voice packet loss. Using LLQ ensures voice gets priority without dropping.

Practice this question →

Multi-Selectmedium

Which two statements about policing and shaping are true? (Choose two.)

Select 2 answers

A.Policing can be configured on both ingress and egress interfaces, whereas shaping is typically applied only on egress interfaces.

B.Shaping drops packets that exceed the configured rate, while policing buffers them to meet the rate.

C.Both policing and shaping use a token bucket algorithm to measure traffic rates.

D.Shaping is more suitable than policing for traffic that must be dropped immediately, such as scavenger-class traffic.

E.Policing always introduces additional latency due to queuing, while shaping does not.

AnswersA, C

Correct. Policing is bidirectional; shaping is unidirectional (outbound) because it requires buffering.

Why this answer

Policing drops or re-marks packets that exceed a configured rate, while shaping buffers excess packets and delays them to smooth traffic. Policing can be applied inbound or outbound, but shaping is typically outbound only. Shaping uses a buffer, which can introduce jitter.

Practice this question →

MCQmedium

Examine the following configuration: policy-map MARKING class VOICE set dscp ef class VIDEO set dscp af41 class class-default set dscp default interface GigabitEthernet0/0 service-policy input MARKING Which statement is true?

A.Incoming packets matching the VOICE class will have their DSCP set to EF (46), VIDEO to AF41 (34), and all others to default (0).

B.The policy-map will only mark packets if the interface is congested.

C.The configuration is invalid because 'set dscp' cannot be used in a 'service-policy input' direction.

D.The policy-map will remark the DSCP of outgoing packets on GigabitEthernet0/0.

AnswerA

Correct. The 'set dscp' command modifies the DSCP field of matching packets.

Why this answer

This policy-map sets DSCP values for incoming traffic based on the class. VOICE traffic is marked as EF (46), VIDEO as AF41 (34), and all other traffic as default (0).

Practice this question →

Drag & Dropmedium

Drag and drop the steps of DSCP-to-CoS mapping at LAN boundary into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

First, trust the DSCP on the ingress interface. Then, map DSCP to CoS using a table-map. Apply the table-map in a policy-map.

Finally, apply the policy-map to the interface.

Practice this question →

Multi-Selecthard

Which three statements about policing and shaping are true? (Choose three.)

Select 3 answers

A.Policing can be applied in both the inbound and outbound directions on an interface.

B.Shaping buffers excess packets and may introduce additional delay.

C.Policing uses a token bucket algorithm to measure traffic rates.

D.Shaping can be applied inbound to limit traffic entering an interface.

E.Policing always drops packets that exceed the configured rate and never re-marks them.

AnswersA, B, C

Correct because policing is supported on both input and output directions in Cisco IOS.

Why this answer

Policing drops or re-marks traffic exceeding a rate and does not buffer, while shaping buffers and smooths traffic to a lower rate. Both use token bucket algorithms. Shaping introduces delay but reduces drops, whereas policing can cause TCP retransmissions due to drops.

Policing can be applied inbound or outbound, shaping typically outbound.

Practice this question →

Multi-Selectmedium

Which two statements about queuing and congestion management are true? (Choose two.)

Select 2 answers

A.CBWFQ allows you to define multiple classes and assign each a guaranteed minimum bandwidth.

B.LLQ combines a strict priority queue with CBWFQ classes to support real-time traffic.

C.Weighted Fair Queuing (WFQ) is the default queuing mechanism on all Cisco router interfaces.

D.Tail drop is the only drop policy available for CBWFQ queues.

E.FIFO queuing provides per-class bandwidth guarantees.

AnswersA, B

Correct because CBWFQ allocates bandwidth to each class based on the 'bandwidth' command.

Why this answer

CBWFQ provides guaranteed bandwidth to classes, while LLQ adds a strict priority queue for delay-sensitive traffic. WFQ is the default on low-speed interfaces. FIFO is used on high-speed interfaces by default.

Tail drop is the default drop policy for FIFO and CBWFQ queues.

Practice this question →

Matchingmedium

Drag and drop each queuing mechanism on the left to its matching feature on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

No classification, single queue, packets served in order of arrival

Automatically classifies flows and provides fair queuing per flow

Allows creation of custom traffic classes with guaranteed bandwidth

Adds a strict priority queue within CBWFQ for delay-sensitive traffic

Multiple queues with strict priority servicing, lower queues starve if higher queues are non-empty

Why these pairings

FIFO is the simplest queuing with no classification; WFQ provides fair bandwidth distribution; CBWFQ allows user-defined classes; LLQ adds a strict priority queue; PQ always services the highest-priority queue first.

Practice this question →

MCQmedium

A network engineer is troubleshooting voice quality issues on a Cisco Catalyst 9300 switch. The switch is configured with auto QoS for voice, which enabled trust on the access ports. However, voice packets are being marked with DSCP EF but are still experiencing jitter. The engineer checks the interface queue statistics and sees that the priority queue is not being used. What is the most likely reason?

A.Auto QoS does not create a priority queue; a manual policy is required

B.The switch does not support DSCP-based queuing

C.The voice VLAN is not configured on the access port

D.The switch is using default CoS-to-queue mapping which maps EF to a non-priority queue

AnswerA

Correct because auto QoS only sets trust and marks; the queuing policy must be applied separately to prioritize voice.

Why this answer

The correct answer is that auto QoS for voice enables trust but does not automatically create a priority queue on the switch; the engineer must also configure a service policy that includes a priority queue for EF traffic.

Practice this question →

MCQhard

An engineer is troubleshooting QoS on a Cisco ASR 1002 router. The router is configured with a policy map that includes a class for voice with a priority command. During congestion, the engineer notices that voice traffic is being dropped even though the priority queue is not congested. The router logs show 'QoS: priority queue overflow'. What is the most likely cause?

A.The priority queue has a default policer that drops traffic exceeding a certain rate

B.The interface bandwidth is set too low, causing the priority queue to be under-provisioned

C.The class map is not matching the voice traffic correctly

D.The router is using WRED on the priority queue

AnswerA

Correct because on ASR routers, the priority command includes an implicit policer to prevent starvation of other queues; exceeding this policer causes drops.

Why this answer

The correct answer is that the priority queue has a default policer that limits the amount of traffic that can be sent as priority. When the voice traffic exceeds this policer, it is dropped, even if the queue is not full.

Practice this question →

Matchingmedium

Drag and drop each DSCP PHB on the left to its matching queue treatment on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Strict priority queue, low latency

Assured forwarding with drop precedence

Class selector, maps to IP precedence

Best-effort, no bandwidth guarantee

Default PHB, identical to BE

Why these pairings

EF is for low-latency traffic (strict priority). AF uses four classes with drop probabilities. CS is backward-compatible with IP precedence.

BE is best-effort with no guarantees. DF is the default PHB (same as BE).

Practice this question →

MCQeasy

What is the default trust state of a Cisco IOS switch port when no 'mls qos trust' command is configured?

A.The port trusts the CoS value of incoming packets.

B.The port trusts the DSCP value of incoming packets.

C.The port is untrusted and marks all incoming packets with CoS 0.

D.The port trusts both CoS and DSCP values.

AnswerC

Correct. By default, the port is untrusted and packets are marked with CoS 0.

Why this answer

By default, Cisco switches do not trust any QoS markings on incoming packets; they are set to the default CoS/DSCP value of 0 unless a trust policy is applied.

Practice this question →

Drag & Dropmedium

Drag and drop the steps of CBWFQ and LLQ queue servicing order into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

LLQ is serviced before any CBWFQ queues to ensure low-latency traffic. Within CBWFQ, queues are serviced in a weighted round-robin fashion based on bandwidth allocation. The default queue is serviced last.

Practice this question →

MCQeasy

A network engineer is configuring QoS on a Cisco Catalyst 2960-X switch to support marking of traffic based on VLAN. The switch has two VLANs: VLAN 10 (voice) and VLAN 20 (data). The engineer wants to mark all traffic from VLAN 10 with CoS 5 and all traffic from VLAN 20 with CoS 0. The engineer applies a policy map that matches on VLAN using a class map. However, the marking is not being applied. What is the most likely reason?

A.The switch does not support VLAN-based classification in QoS

B.The policy map is applied in the wrong direction

C.The class map should use 'match access-group' instead of 'match vlan'

D.The switch requires the 'mls qos' command to be enabled globally

AnswerA

Correct because Catalyst 2960-X switches lack the ability to match on VLAN in a class map; they rely on CoS or DSCP.

Why this answer

The correct answer is that Catalyst 2960-X switches do not support matching on VLAN in a class map for QoS; they only support matching on CoS, DSCP, or IP precedence. The engineer must use a different matching criterion.

Practice this question →

MCQmedium

A network engineer runs the following command on Router R8: R8# show policy-map interface GigabitEthernet0/1 GigabitEthernet0/1 Service-policy output: QOS_POLICY Class-map: VOICE (match-any) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: ip dscp ef (46) Queueing strict priority queue limit 64 packets (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 0/0 police cir 1000000 bc 15625 be 15625 conformed 0 packets, 0 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop Class-map: DATA (match-any) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: ip dscp af31 (26) Queueing (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 0/0 bandwidth remaining percent 50 Class-map: class-default (match-any) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: any Queueing (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 0/0 bandwidth remaining percent 50 Based on this output, what can be concluded?

A.Voice traffic is being prioritized but not policed.

B.The interface is not passing any traffic.

C.Data traffic is being dropped due to policing.

D.The policy-map is applied to input traffic.

AnswerB

All counters are zero, indicating no traffic has been forwarded.

Why this answer

All classes show zero packets, zero bytes, and zero rates. This indicates that no traffic has been processed through this interface. The policy-map is applied but no packets have been seen.

Practice this question →

MCQmedium

An engineer is configuring QoS on a Cisco ASR 1000 router to support three traffic classes: voice (EF), video (AF41), and data (default). The link is a 50 Mbps Ethernet circuit. The engineer wants to guarantee 10 Mbps for voice, 20 Mbps for video, and the remaining for data. The current policy uses bandwidth percent statements. During congestion, voice traffic is not receiving its guaranteed bandwidth. What is the most likely cause?

A.The interface bandwidth command is not set to 50000 kbps

B.The voice class should use priority instead of bandwidth

C.The video class should use bandwidth remaining percent

D.The policy map is applied in the input direction

AnswerA

Correct because bandwidth percent uses the interface bandwidth value; if it is set to a default (e.g., 1000000 for Ethernet), the percentages do not match the actual link speed.

Why this answer

The correct answer is that bandwidth percent is based on the interface bandwidth, which may not match the actual link speed if the interface bandwidth is not set correctly. The engineer should use bandwidth remaining percent or shape the traffic.

Practice this question →

Matchingmedium

Drag and drop each queuing mechanism on the left to its matching feature on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Single queue, no differentiation

Per-flow flow-based fair queuing

User-defined traffic classes with guaranteed bandwidth

Strict priority queue with rate limiting

Always serves highest-priority queue first

Why these pairings

FIFO uses a single queue with no prioritization. WFQ provides per-flow fairness. CBWFQ allows user-defined classes.

LLQ provides strict priority with policing. PQ always services the highest-priority queue first.

Practice this question →

MCQmedium

Given the following configuration on a Cisco IOS router: policy-map SHAPE class class-default shape average 1000000 interface Serial0/0/0 service-policy output SHAPE What is the effect of this configuration?

A.The router will limit the transmit rate on Serial0/0/0 to an average of 1 Mbps by queuing excess packets.

B.The router will drop any traffic exceeding 1 Mbps on Serial0/0/0.

C.The router will mark all traffic with a rate limit of 1 Mbps but not enforce it.

D.The configuration is invalid because 'shape average' requires a class-map with a match statement.

AnswerA

Correct. Shaping buffers traffic to conform to the specified rate.

Why this answer

The 'shape average' command limits the output rate on the interface to an average of 1 Mbps (1000000 bps) by buffering excess traffic.

Practice this question →

Drag & Dropmedium

Drag and drop the steps of Hierarchical QoS (H-QoS) parent/child policy steps into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

H-QoS uses a child policy for per-class actions and a parent policy to shape aggregate traffic. The order ensures child policy is defined first, then parent references it, and finally applied to the interface.

Practice this question →

Multi-Selectmedium

Which two statements about classification and marking in QoS are true? (Choose two.)

Select 3 answers

A.Classification can be based on IP precedence, DSCP, or CoS values.

B.Marking is performed using the 'set' command in a policy-map class configuration.

C.Layer 2 CoS marking uses the first 6 bits of the 802.1Q tag.

D.DSCP uses the first 3 bits of the ToS byte and is not compatible with IP precedence.

E.The 'match ip dscp' command can be used in a class map to match packets based on DSCP values.

AnswersA, B, E

Correct because classification matches existing markings like IP precedence, DSCP, or CoS.

Why this answer

Classification identifies traffic, and marking sets the QoS value. MQC uses class maps and policy maps. Layer 2 marking uses CoS bits, while IP precedence uses the first 3 bits of the ToS byte.

DSCP uses 6 bits and is backward-compatible with IP precedence.

Practice this question →

Multi-Selectmedium

Which two statements about the MQC (Modular QoS CLI) classification process are true? (Choose two.)

Select 2 answers

A.A class map can contain multiple match statements that are evaluated using a logical OR when the match-any keyword is configured.

B.In a policy map, class maps are evaluated in the order they are configured, and the first matching class map is applied to the packet.

C.The class-default class is used only when no other class map is defined in the policy map.

D.Match statements in a class map can reference ACLs, NBAR protocols, or CoS values, but not DSCP values.

E.A class map configured with match-all requires that all match statements be true for the packet to belong to that class.

AnswersA, B

Correct. The match-any keyword causes the class map to match a packet if it satisfies any one of the match statements.

Why this answer

The MQC uses class maps to define match criteria; a packet is matched against class maps in the order they appear in the policy map. The first match wins, and if no match occurs, the default class (class-default) is used. Only one match statement per class map is allowed unless the match-any keyword is used.

Practice this question →

Multi-Selecthard

Which three statements about the Differentiated Services (DiffServ) QoS model are true? (Choose three.)

Select 3 answers

A.DiffServ uses the 6-bit DSCP field in the IP header to mark packets, allowing up to 64 different classes of service.

B.In DiffServ, core routers perform complex classification and marking based on deep packet inspection.

C.The Assured Forwarding (AF) PHB group provides four classes, each with three drop precedence levels.

D.DiffServ requires end-to-end signaling using RSVP to reserve bandwidth along the path.

E.The Expedited Forwarding (EF) PHB is designed for low-loss, low-latency traffic such as voice.

AnswersA, C, E

Correct. DSCP is 6 bits, providing 64 possible codepoints.

Why this answer

DiffServ is a class-based model that uses the DSCP field in the IP header to classify traffic. It provides per-hop behavior (PHB) and is scalable because core routers only need to inspect the DSCP field. The model does not guarantee end-to-end bandwidth reservation like IntServ does; instead, it relies on traffic conditioning at the edge.

Practice this question →

Matchingmedium

Drag and drop each traffic shaping or policing characteristic on the left to its correct description on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Buffers excess traffic to smooth output rate

Drops or marks packets exceeding the rate

Why these pairings

Traffic shaping buffers excess traffic to smooth output rate. Policing drops or marks excess traffic. Shaping introduces delay; policing does not.

Shaping uses a token bucket; policing uses a token bucket. Shaping is applied outbound; policing is typically inbound.

Practice this question →

MCQhard

A network engineer runs the following command on Router R6: R6# show policy-map interface GigabitEthernet0/1 GigabitEthernet0/1 Service-policy output: QOS_POLICY Class-map: VOICE (match-any) 500 packets, 50000 bytes 5 minute offered rate 50000 bps, drop rate 0 bps Match: ip dscp ef (46) Queueing strict priority queue limit 64 packets (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 500/50000 police cir 1000000 bc 15625 be 15625 conformed 500 packets, 50000 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop Class-map: DATA (match-any) 1000 packets, 100000 bytes 5 minute offered rate 100000 bps, drop rate 0 bps Match: ip dscp af31 (26) Queueing (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 1000/100000 bandwidth remaining percent 50 Class-map: class-default (match-any) 2000 packets, 200000 bytes 5 minute offered rate 200000 bps, drop rate 0 bps Match: any Queueing (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 2000/200000 bandwidth remaining percent 50 Based on this output, what can be concluded?

A.Voice traffic is being dropped because it exceeds the police rate.

B.Data traffic is being guaranteed 50% of the remaining bandwidth.

C.All traffic is being shaped to a CIR of 1 Mbps.

D.The policy-map is applied to input traffic.

AnswerB

The DATA class has 'bandwidth remaining percent 50', meaning it gets 50% of the bandwidth left after priority queuing.

Why this answer

The VOICE class uses strict priority queuing and is policing at 1 Mbps. The offered rate for voice is 50 kbps, well below the police rate, so all voice packets are conforming and transmitted. The DATA and class-default classes share remaining bandwidth equally (50% each).

The total offered rate is 350 kbps, and since the interface bandwidth is likely higher, no drops occur.

Practice this question →

Multi-Selecthard

Which three statements about the classification and marking tools in Cisco IOS are true? (Choose three.)

Select 3 answers

A.The trust boundary can be configured using the 'mls qos trust' command on a switch port to trust the CoS or DSCP value received from an attached device.

B.NBAR (Network-Based Application Recognition) can classify traffic based on application signatures, including HTTP URLs and SSL certificate fields.

C.Layer 2 CoS marking uses a 3-bit field in the 802.1Q tag, providing 8 possible values, while DSCP uses 6 bits for 64 values.

D.The 'set dscp' command in a policy map can be used to mark packets with a DSCP value, but only on egress interfaces.

E.MPLS EXP bits are a 3-bit field used for QoS in MPLS networks and are always directly mapped from the IP DSCP value without any configuration.

AnswersA, B, C

Correct. The trust boundary is set with 'mls qos trust' to honor incoming markings.

Why this answer

Classification identifies traffic based on various fields, while marking sets the QoS value. Trust boundaries determine where marking is honored. NBAR can perform deep packet inspection for classification.

CoS is a Layer 2 marking in 802.1Q frames, while DSCP is Layer 3. MPLS uses EXP bits.

Practice this question →

MCQmedium

A network engineer runs the following command on Router R4: R4# show policy-map interface GigabitEthernet0/1 GigabitEthernet0/1 Service-policy input: SHAPE_POLICY Class-map: class-default (match-any) 1000 packets, 100000 bytes 5 minute offered rate 100000 bps, drop rate 0 bps Match: any Queueing shape (average) cir 500000, bc 5000, be 5000 target shape rate 500000 Based on this output, what can be concluded?

A.Traffic is being shaped to an average rate of 500 kbps.

B.Traffic is being policed to 500 kbps.

C.The policy is applied to output traffic.

D.The offered rate exceeds the shaping rate, causing drops.

AnswerA

The shape command specifies cir 500000, which is 500 kbps.

Why this answer

The policy-map is applied to the input direction. Shaping is typically used on output to smooth traffic, but it can be applied to input as well, though it is less common. The shape command is shaping all traffic to an average CIR of 500 kbps.

The offered rate is 100 kbps, which is below the shaping rate, so no drops occur.

Practice this question →

Drag & Dropmedium

Drag and drop the steps of configuring and applying a QoS policy using MQC into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

The MQC process first defines traffic classes with class maps, then associates actions with policy maps, and finally applies the policy to an interface with a service-policy statement. Verification ensures correct operation.

Practice this question →

MCQmedium

Examine the following configuration snippet on a Cisco IOS-XE router: interface GigabitEthernet0/1 service-policy output QOS_POLICY policy-map QOS_POLICY class VOICE priority percent 10 class VIDEO bandwidth percent 30 class class-default fair-queue What is the effect of this configuration?

A.VOICE traffic is guaranteed 10% of the interface bandwidth with strict priority queuing, VIDEO traffic is guaranteed 30%, and all other traffic shares the remaining bandwidth using fair-queuing.

B.VOICE traffic is limited to 10% of bandwidth, VIDEO to 30%, and all other traffic is dropped if the interface is congested.

C.VOICE traffic is given priority over VIDEO, but VIDEO can use up to 30% of bandwidth only if VOICE is not using its allocation.

D.The policy-map is invalid because 'priority' and 'bandwidth' cannot be used together in the same policy-map.

AnswerA

Correct. The 'priority' command provides strict priority queuing with a bandwidth guarantee, and 'fair-queue' enables fair sharing among the default class.

Why this answer

The policy-map applies a priority queue for VOICE traffic, guarantees bandwidth for VIDEO, and uses fair-queue for all other traffic on the output interface.

Practice this question →

MCQmedium

A network engineer runs the following command on Router R3: R3# show mls qos interface GigabitEthernet0/1 GigabitEthernet0/1 trust state: trust DSCP trust mode: trust dscp COS override: dis default COS: 0 DSCP Mutation Map: default dscp mutation map trust device: none qos mode: port-based R3# show mls qos QoS is enabled globally QoS global counters: total packets not matching QoS criteria = 0 Total packets with known CoS = 0 Total packets dropped by policing = 0 Based on this output, what can be concluded?

A.The interface is configured to trust CoS values.

B.The interface will overwrite incoming DSCP values with default CoS.

C.The interface trusts the DSCP markings of incoming packets.

D.QoS is disabled globally.

AnswerC

The output clearly states 'trust state: trust DSCP' and 'trust mode: trust dscp'.

Why this answer

The interface is configured to trust DSCP values. This means incoming packets will have their DSCP values preserved and used for QoS classification. The global QoS is enabled.

The trust mode is 'trust dscp', indicating that the switch will trust the DSCP markings of received packets.

Practice this question →

Drag & Dropmedium

Drag and drop the steps of implementing QoS trust boundaries on a Cisco switch into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

First, identify the trust boundary (e.g., access port). Then configure the trusted interface to trust CoS or DSCP. Next, set the default CoS for untrusted frames.

Finally, verify the configuration and adjust as needed.

Practice this question →

MCQmedium

A network engineer is configuring QoS on a Cisco Catalyst 3850 switch to prioritize voice traffic. The switch is connected to an IP phone and a PC using a single access port. The engineer applies a service policy on the access port that marks CoS 5 for voice and CoS 0 for data. However, the IP phone is not receiving any voice packets. What is the most likely cause?

A.The switchport is configured as an access port without 'mls qos trust cos'

B.The IP phone is not configured with the correct VLAN for voice traffic

C.The service policy is applied in the output direction instead of input

D.The switch does not support CoS marking on access ports

AnswerA

Correct because without trusting CoS, the switch ignores the phone's markings and treats all traffic as best-effort.

Why this answer

The correct answer identifies that the switchport must be configured to trust the CoS markings from the IP phone. If the port is set to untrusted, the switch will re-mark all incoming CoS values to 0, overriding the phone's markings.

Practice this question →

MCQmedium

Consider the following configuration on a Cisco router: class-map match-any CRITICAL_DATA match ip dscp af21 af22 af23 policy-map QOS class CRITICAL_DATA bandwidth remaining percent 50 class class-default fair-queue interface GigabitEthernet0/0 service-policy output QOS Which statement about this configuration is true?

A.Traffic matching DSCP AF21, AF22, or AF23 is guaranteed 50% of the interface bandwidth, and all other traffic is subject to fair-queuing.

B.Only traffic with DSCP AF21 is matched; AF22 and AF23 are ignored because 'match-any' requires all conditions to be true.

C.The configuration is invalid because 'bandwidth remaining percent' cannot be used with 'fair-queue' in the same policy-map.

D.The policy-map will only be applied to incoming traffic on GigabitEthernet0/0.

AnswerA

Correct. 'bandwidth remaining percent' guarantees a percentage of the bandwidth left after priority queues, and the default class uses fair-queue.

Why this answer

The class-map matches DSCP values AF21, AF22, and AF23 (which are Assured Forwarding classes). The policy-map allocates 50% of remaining bandwidth to this class after any priority queues, and uses fair-queue for the default class.

Practice this question →

MCQhard

A network engineer runs the following command on Router R7: R7# show mls qos interface GigabitEthernet0/1 statistics GigabitEthernet0/1 Ingress statistics: dscp: incoming no_change classified policed dropped default: 0 0 0 0 0 ef: 100 100 100 0 0 af31: 200 200 200 0 0 other: 300 300 300 0 0 Egress statistics: dscp: queued dropped default: 0 0 ef: 100 0 af31: 200 0 other: 300 0 Based on this output, what can be concluded?

A.Packets with DSCP EF are being dropped at ingress.

B.All packets are being queued without drops at egress.

C.Policing is dropping packets with DSCP AF31.

D.The interface is not using any QoS policy.

AnswerB

The egress statistics show queued packets equal to incoming, with zero drops.

Why this answer

The ingress statistics show that packets with DSCP EF, AF31, and other values are being classified and no policing drops occur. The egress statistics show that all packets are queued without drops. This indicates that the QoS policy is not dropping any traffic, and the interface is likely not congested.

Practice this question →

MCQeasy

A network engineer is deploying QoS on a Cisco Catalyst 4500 switch to support four queues per port. The engineer wants to assign voice traffic to queue 1 (priority), video to queue 2, critical data to queue 3, and best-effort to queue 4. The switch is configured with the default CoS-to-queue mapping. However, video traffic is being placed in queue 1 along with voice. What should the engineer do to separate them?

A.Modify the CoS-to-queue mapping using the 'mls qos srr-queue output cos-map' command

B.Change the video traffic marking to DSCP AF41 and rely on DSCP-to-queue mapping

C.Apply a service policy that uses a priority queue for voice only

D.Increase the number of queues to eight

AnswerA

Correct because this command allows the engineer to map specific CoS values to specific queues, separating voice and video.

Why this answer

The correct answer is to modify the CoS-to-queue mapping using the 'mls qos srr-queue output cos-map' command to assign different CoS values to different queues.

Practice this question →

Drag & Dropmedium

Drag and drop the steps of QoS policing with two-rate three-color marker (RFC 2698) into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

First, configure the police command with cir, pir, and conform, exceed, violate actions. Then, apply the policy to the interface. The marker uses CIR and PIR to assign colors.

Practice this question →

MCQmedium

A network engineer runs the following command on Router R5: R5# show queueing interface GigabitEthernet0/1 Interface GigabitEthernet0/1 queueing strategy: weighted fair Queueing on output: Weighted Fair Queueing Current fair queue configuration: Number of queues: 256 Dynamic queues: 256 Reserved queues: 0 Current WFQ global configuration: Total dynamic queues: 256 Total reserved queues: 0 Class based weighted fair queueing: enabled Queueing on input: FIFO Based on this output, what can be concluded?

A.The interface uses FIFO queuing for output.

B.The interface uses Weighted Fair Queueing for output with 256 queues.

C.The interface uses Class-Based Weighted Fair Queueing (CBWFQ).

D.The interface uses Priority Queuing.

AnswerB

The output clearly states 'Weighted Fair Queueing' and 'Number of queues: 256'.

Why this answer

The output shows that the output queueing strategy is Weighted Fair Queueing (WFQ) with 256 queues. Input queueing is FIFO. WFQ is a flow-based queuing method that provides fair bandwidth allocation among flows.

Practice this question →

Multi-Selecthard

Which three statements about QoS trust boundaries and marking are true? (Choose three.)

Select 3 answers

A.By default, Cisco Catalyst switches trust the CoS value received from connected devices.

B.The 'mls qos trust cos' command configures the switch to trust the CoS marking on incoming packets.

C.The trust boundary can be extended to an IP phone using CDP, allowing the phone to mark traffic.

D.Marking at Layer 2 uses DSCP values in the IP header.

E.A switch can re-mark packets by using a policy map with the 'set' command applied to an interface.

AnswersB, C, E

Correct because this command sets the trust state to CoS on a switch port.

Why this answer

The trust boundary defines where the device trusts or re-marks QoS markings. Typically, the boundary is at the access layer switch. The 'mls qos trust' command sets trust.

By default, Cisco switches do not trust CoS or DSCP; they must be configured. Trust can be extended to IP phones via CDP. Marking can be done at Layer 2 (CoS) or Layer 3 (DSCP).

Practice this question →

Drag & Dropmedium

Drag and drop the steps of QoS policing with two-rate three-color marker (RFC 2698) into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

RFC 2698 uses committed and peak rates to mark packets as green, yellow, or red. The order follows the token bucket algorithm: first check committed bucket, then peak bucket, and finally mark or drop accordingly.

Practice this question →

MCQmedium

A network engineer runs the following command on Router R1: R1# show policy-map interface GigabitEthernet0/1 GigabitEthernet0/1 Service-policy output: QOS_POLICY Class-map: VOICE (match-any) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: ip dscp ef (46) Queueing queue limit 64 packets (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 0/0 police cir 1000000 bc 15625 be 15625 conformed 0 packets, 0 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop Class-map: class-default (match-any) 100 packets, 10000 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: any Queueing queue limit 64 packets (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 100/10000 Based on this output, what can be concluded?

A.Voice traffic is being marked with DSCP EF and is being policed at 1 Mbps.

B.Voice traffic is not being classified because no packets match the VOICE class.

C.All traffic is being dropped due to the police action.

D.The policy-map is applied in the input direction.

AnswerB

The VOICE class has 0 packets, meaning no traffic matched the DSCP EF criteria.

Why this answer

The output shows that the VOICE class is matching DSCP EF (46) and has a police command with a CIR of 1 Mbps. Since no packets have been matched (0 packets, 0 bytes), the voice traffic is not being classified. This indicates that either no voice traffic is present or the DSCP marking is not EF.

The class-default is handling all traffic.

Practice this question →

MCQmedium

In a Cisco QoS policy, what is the difference between 'bandwidth' and 'bandwidth remaining' commands?

A.There is no difference; both commands allocate bandwidth based on the total interface bandwidth.

B.'bandwidth' allocates from the total bandwidth, while 'bandwidth remaining' allocates from the bandwidth left after priority queues.

C.'bandwidth' is used for output policies, while 'bandwidth remaining' is used for input policies.

D.'bandwidth' guarantees a minimum rate, while 'bandwidth remaining' sets a maximum rate.

AnswerB

Correct. 'bandwidth remaining' is used for fair sharing of leftover bandwidth.

Why this answer

The 'bandwidth' command allocates a percentage of the total interface bandwidth, while 'bandwidth remaining' allocates a percentage of the bandwidth left after priority queues and other guaranteed allocations have been served.

Practice this question →

MCQhard

A network engineer runs the following command on Router R9: R9# show queueing interface GigabitEthernet0/1 Interface GigabitEthernet0/1 queueing strategy: class-based weighted fair Queueing on output: Class-based Weighted Fair Queueing Queueing on input: FIFO R9# show policy-map interface GigabitEthernet0/1 GigabitEthernet0/1 Service-policy output: QOS_POLICY Class-map: VOICE (match-any) 100 packets, 10000 bytes 5 minute offered rate 10000 bps, drop rate 0 bps Match: ip dscp ef (46) Queueing strict priority queue limit 64 packets (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 100/10000 police cir 1000000 bc 15625 be 15625 conformed 100 packets, 10000 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop Class-map: DATA (match-any) 200 packets, 20000 bytes 5 minute offered rate 20000 bps, drop rate 0 bps Match: ip dscp af31 (26) Queueing (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 200/20000 bandwidth remaining percent 50 Class-map: class-default (match-any) 300 packets, 30000 bytes 5 minute offered rate 30000 bps, drop rate 0 bps Match: any Queueing (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 300/30000 bandwidth remaining percent 50 Based on this output, what can be concluded?

A.The interface uses WFQ for output queuing.

B.Voice traffic is being dropped because it exceeds the police rate.

C.Data traffic is guaranteed 50% of the remaining bandwidth after priority queuing.

D.The policy-map is applied to input traffic.

AnswerC

The DATA class has 'bandwidth remaining percent 50'.

Why this answer

The output queueing strategy is CBWFQ. The VOICE class uses strict priority and is policed at 1 Mbps. All voice packets conform (100 packets).

DATA and class-default share remaining bandwidth equally. The total offered rate is 60 kbps, well below any congestion, so no drops occur.

Practice this question →

Drag & Dropmedium

Drag and drop the steps of Hierarchical QoS (H-QoS) parent/child policy steps into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

First, create the child policy for per-class queuing. Then, create the parent policy that shapes and references the child. Apply the parent policy to the interface.

Practice this question →

Drag & Dropmedium

Drag and drop the steps of DSCP-to-CoS mapping at LAN boundary into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

At the LAN boundary (switch port), DSCP is mapped to CoS for 802.1Q trunking. The order ensures proper trust, mapping, and queuing for consistent QoS across the campus network.

Practice this question →

Matchingmedium

Drag and drop each congestion avoidance mechanism on the left to its method on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Drops all packets when queue is full

Random early detection based on average queue depth

Weighted random early detection using IP precedence or DSCP

No selective drop before congestion

Drops packets with lower priority more aggressively

Why these pairings

Tail-drop drops all packets when queue is full. RED randomly drops packets before congestion. WRED uses IP precedence or DSCP to vary drop probability.

Practice this question →

Drag & Dropmedium

Drag and drop the steps of configuring LLQ (Low Latency Queuing) on a Cisco router into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

LLQ requires first classifying traffic, then assigning it to a priority queue in a policy map, applying bandwidth/queue-limit, attaching the policy to an interface, and finally verifying queue statistics.

Practice this question →

MCQmedium

Examine the following configuration: policy-map QUEUE class GOLD bandwidth percent 25 queue-limit 64 packets class SILVER bandwidth percent 25 queue-limit 128 packets class class-default fair-queue interface GigabitEthernet0/2 service-policy output QUEUE Which statement about this configuration is true?

A.The GOLD class has a smaller queue limit than SILVER, which may cause more packet drops for GOLD traffic under congestion.

B.The SILVER class will always receive more bandwidth than GOLD because of its larger queue limit.

C.The configuration is invalid because 'queue-limit' cannot be used with 'bandwidth percent' in the same class.

D.The 'fair-queue' command in class-default will override the bandwidth allocation for GOLD and SILVER.

AnswerA

Correct. A smaller queue limit means fewer packets can be buffered, increasing the likelihood of drops when the queue is full.

Why this answer

The policy-map allocates 25% of bandwidth to both GOLD and SILVER classes, with queue limits of 64 and 128 packets respectively. The default class uses fair-queue. This configuration is valid and provides differentiated queuing.

Practice this question →

MCQhard

A network engineer runs the following command on Router R2: R2# show class-map Class Map match-any VOICE (id 1) Match ip dscp ef (46) Class Map match-any DATA (id 2) Match ip dscp af31 (26) Class Map match-any class-default (id 0) Match any R2# show policy-map Policy Map QOS_POLICY Class VOICE priority level 1 police cir 1000000 bc 15625 be 15625 Class DATA bandwidth remaining percent 50 Class class-default bandwidth remaining percent 50 R2# show policy-map interface GigabitEthernet0/1 GigabitEthernet0/1 Service-policy output: QOS_POLICY Class-map: VOICE (match-any) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: ip dscp ef (46) Queueing strict priority queue limit 64 packets (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 0/0 police cir 1000000 bc 15625 be 15625 conformed 0 packets, 0 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop Class-map: DATA (match-any) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: ip dscp af31 (26) Queueing (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 0/0 bandwidth remaining percent 50 (0 kbps) Class-map: class-default (match-any) 100 packets, 10000 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: any Queueing (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 100/10000 bandwidth remaining percent 50 (0 kbps) Based on this output, what can be concluded?

A.Voice traffic is being prioritized with strict priority queuing and policed at 1 Mbps.

B.Data traffic is being guaranteed 50% of the remaining bandwidth.

C.All traffic is being handled by class-default, which gets 100% of the bandwidth.

D.The police command on VOICE is causing drops for voice traffic.

AnswerC

Only class-default has traffic (100 packets), and since it is the only class with traffic, it uses all bandwidth.

Why this answer

The VOICE class uses strict priority queuing (priority level 1). However, with 0 packets matched, no voice traffic is being classified. The DATA class also shows 0 packets.

All traffic falls into class-default. The bandwidth remaining percent commands allocate remaining bandwidth, but since only class-default has traffic, it effectively gets 100% of the bandwidth. The police command on VOICE is not affecting anything because no packets match.

Practice this question →

MCQhard

A network engineer is troubleshooting QoS on a Cisco Nexus 9000 switch. The switch is configured with a policy map that uses a class-default with a bandwidth remaining percent of 100. However, during congestion, traffic in a priority queue (class-map for EF) is experiencing drops even though the priority queue is not fully utilized. What is the most likely cause?

A.The priority queue is implicitly policed to a default rate on Nexus switches

B.The class-default bandwidth remaining percent should be set to 0

C.The priority queue is not configured with a queue-limit

D.The switch is using strict priority queuing without any shaping

AnswerA

Correct because Nexus switches enforce a default policer on the priority queue to protect other traffic, which can cause drops.

Why this answer

The correct answer is that the priority queue is policed by default on Nexus switches to prevent starvation of other queues. The priority queue has a policer that drops traffic if it exceeds a certain rate, even if the queue is not congested.

Practice this question →

Drag & Dropmedium

Drag and drop the steps of CBWFQ and LLQ queue servicing order into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

LLQ is serviced first to guarantee low-latency traffic, then CBWFQ queues are serviced in a weighted round-robin manner based on configured bandwidths. This order ensures strict priority for voice/video while providing fair sharing for other classes.

Practice this question →

Drag & Dropmedium

Drag and drop the steps of QoS pre-classify for encrypted VPN traffic into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

QoS pre-classify copies the original IP header before encryption, allowing classification based on original DSCP. The crypto map references the QoS pre-classify configuration.

Practice this question →

Matchingmedium

Drag and drop each traffic shaping or policing characteristic on the left to its matching description on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Buffers excess packets to send later, smoothing traffic rate

Drops or re-marks packets exceeding the configured rate

Uses a token bucket plus a queue to hold excess packets

Uses a token bucket without a queue; excess is dropped or re-marked

Typically applied inbound to enforce ingress rate limits

Why these pairings

Shaping buffers excess traffic to smooth bursts; policing drops or re-marks excess traffic; shaping uses a token bucket with a queue; policing typically uses a single or dual token bucket without queuing; policing can be applied inbound or outbound.

Practice this question →

Matchingmedium

Drag and drop each MQC command on the left to its configuration level on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Defines traffic classification criteria

Associates class-maps with QoS actions

Applies a policy-map to an interface

References a class-map for actions

Specifies classification criteria

Why these pairings

class-map defines traffic classes. policy-map associates class-maps with QoS actions. service-policy applies the policy-map to an interface. class (within policy-map) references a class-map. match (within class-map) specifies classification criteria.

Practice this question →

MCQmedium

Which QoS mechanism is used to prevent head-of-line blocking by ensuring that a single queue does not consume all available buffer space?

A.Policing

B.Shaping

C.Weighted Random Early Detection (WRED)

D.Priority Queuing

AnswerC

Correct. WRED drops packets randomly based on queue depth to avoid congestion and head-of-line blocking.

Why this answer

Congestion avoidance mechanisms like Weighted Random Early Detection (WRED) proactively drop packets before queues become full, preventing tail drops and head-of-line blocking.

Practice this question →

Drag & Dropmedium

Drag and drop the steps of QoS pre-classify for encrypted VPN traffic into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

QoS pre-classify copies original IP precedence/DSCP before encryption, so the VPN tunnel interface can apply QoS policies based on original markings. The order ensures classification occurs before encryption and is preserved after encapsulation.

Practice this question →