mediumMultiple Choice
CCNP Practice Question: An enterprise is designing a QoS architecture for…
An enterprise is designing a QoS architecture for its WAN edge routers connecting to multiple service providers. The design must support traffic shaping to avoid packet drops due to provider policers, while also prioritizing real-time traffic. Which approach should the architect use to shape traffic to the contracted CIR while still allowing bursts?
⚠ Common exam trap
Cisco often tests the distinction between shaping and policing—the trap here is that candidates may choose policing (Option B) because it seems simpler, but they overlook that shaping buffers bursts to avoid drops, which is essential when the provider enforces a policer downstream.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply a shape average policy on the egress interface of the WAN edge router, setting the CIR and burst parameters to match the provider contract.
'shape average' on the egress interface allows the router to buffer excess traffic and transmit it at the contracted CIR, while the burst parameters (Bc and Be) enable short-term bursts above CIR to accommodate real-time traffic spikes without drops. This prevents the provider's policer from discarding packets, as the shaper ensures the outbound traffic rate stays within the agreed contract limits.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Apply a shape average policy on the egress interface of the WAN edge router, setting the CIR and burst parameters to match the provider contract.
Why this is correct
Shape average on the egress interface uses a token bucket to constrain the long-term average traffic rate to the CIR while permitting short bursts up to the configured Bc (and optionally Be). Unlike a policer, the shaper queues excess packets so they are transmitted later, which smooths traffic sent toward the provider and prevents the provider's ingress policer from seeing micro-bursts that trigger tail drops. Matching the CIR and burst parameters to the provider contract ensures the shaped output stays within the contracted traffic profile, making this the only option that actively enforces the committed rate while preserving burst absorption.
- ✗
Use a policer on the ingress interface to drop traffic exceeding the CIR.
Why it's wrong here
Ingress policing (e.g., `police` in Cisco IOS) measures traffic and either drops or re-marks packets that exceed the configured rate, but it does not queue excess traffic. Since the goal is to keep traffic within the provider's CIR without causing drops, a policer on the ingress interface is inappropriate—it would discard legitimate bursts instead of buffering them. Policing on ingress might protect the router itself, but it does not address outbound shaping to the provider, so it fails to meet the requirement.
- ✗
Configure a shaper on the provider's device instead of the customer router.
Why it's wrong here
Managing the provider's device is not possible because it lies outside the customer's administrative control; service-provider equipment is configured by the provider, and the customer cannot install or tune a shaper on it. Even if the provider offers shaping as a managed service, the customer cannot rely on such an implementation here—the correct practice is to shape on the customer edge router, specifically on the egress interface facing the provider. This is the only location where the customer can guarantee the shaping policy matches the contract, since it is under their direct control.
- ✗
Set the interface bandwidth to the CIR and rely on FIFO queuing.
Why it's wrong here
The `bandwidth` command simply sets a metric value for routing protocols and influences queueing calculations—it does not rate-limit, buffer, or pace actual traffic. FIFO queueing without a shaper means bursts are transmitted as fast as the physical interface allows, so traffic can exceed the CIR and be dropped by the provider's policer. Even if the interface's `bandwidth` equals the CIR, the router does not use that value to enforce a rate, which is why shaping is necessary for contract compliance.
About these practice questions
This 350-401 question is part of Courseiva's 1,923-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.