CCNP Practice Question: Examine the following CoPP configuration on a…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Traffic matching the ACL is rate-limited to 1 Mbps; traffic exceeding the rate is dropped.

  Why this is correct

  This answer is correct because the class-map references an access control list (ACL) that selects specific control-plane traffic, and the police command in the policy-map enforces a committed information rate (CIR) of 1 Mbps. When a packet matches the ACL, it is evaluated by the token bucket; conforming traffic is transmitted, while non-conforming (excess) traffic is dropped due to the configured exceed-action drop. This rate limiting is therefore applied narrowly to only the ACL-matched subset of control-plane traffic, not to all traffic or any other class.

• ✗

  All control plane traffic is rate-limited to 1 Mbps.

  Why it's wrong here

  This answer is incorrect because the policy-map does not apply to all control-plane traffic; it only applies to traffic that matches the class-map, which in turn references a specific ACL. Control-plane traffic that does not match that ACL (e.g., routing protocol packets, ICMP, or other management traffic) is not evaluated by the police command and will not be rate-limited. The term 'all control plane traffic' is much broader than what the configuration actually selects, so the rate limit is scoped to a defined subset rather than the entire control plane.

• ✗

  Traffic exceeding 1 Mbps is marked down but still transmitted.

  Why it's wrong here

  This answer is incorrect because the exceed-action configured in the police command is 'drop', not a marking action such as set precedence or set qos-group. When traffic exceeds the 1 Mbps CIR, the router immediately drops the excess packets rather than marking and forwarding them. Marking down and still transmitting would require an action like 'exceed-action set precedence ...' or 'set discard-class', neither of which is specified in this policy-map.

• ✗

  The policy-map is applied to the data plane, not the control plane.

  Why it's wrong here

  This answer is incorrect because the configuration snippet shows the service-policy statement applied inside the 'control-plane' configuration section, not under an interface or a data-plane construct. In Cisco IOS/IOS-XE, entering the 'control-plane' section and applying a policy-map there explicitly directs the policy to inspect and rate-limit traffic destined for the route processor (the control plane). A data-plane application would instead use 'service-policy' on an interface in the 'interface' configuration mode, which is not the case here.