CCNP Practice Question: Which two statements about policing and shaping…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Policing can be configured on both ingress and egress interfaces, while shaping is only supported on egress interfaces.

  Why this is correct

  Policing is a token-bucket-based mechanism that can be applied on both ingress and egress interfaces because it only evaluates conformance and immediately drops or re-marks excess packets without buffering. Shaping, however, must buffer nonconforming traffic in a queue and schedule it for later transmission, which requires an output interface; hence Cisco IOS only supports shaping on egress. This is why ingress rate limiting is almost always done with policing, while shaping is reserved for smoothing traffic leaving an interface.

• ✗

  Shaping uses a token bucket algorithm to meter traffic and drops packets that exceed the configured rate.

  Why it's wrong here

  Shaping indeed uses a token bucket (with committed burst and excess burst) to meter traffic, but the assertion that it drops packets that exceed the configured rate is false. In contrast to policing, shaping places exceeding packets into a shaping queue and transmits them as tokens become available, thereby smoothing the output rate. This buffering introduces delay and potential queue drops only if the buffer overflows, but the primary action is delay, not immediate discard.

• ✗

  Policing introduces variable delay because it buffers excess traffic before forwarding.

  Why it's wrong here

  This statement incorrectly attributes buffering to policing. Policing never buffers; it makes an on-the-spot forwarding decision using a token bucket and either forwards conforming packets or drops/re-marks exceeding packets. Because there is no queue involved, policing introduces no additional delay or variable jitter from queuing—unlike shaping, which intentionally buffers excess traffic and therefore adds latency. Traffic that is policed is either delivered immediately or not delivered at all.

• ✗

  Both policing and shaping can re-mark packets that conform to the configured rate.

  Why it's wrong here

  While policing can re-mark packets—for example, setting a new DSCP value for exceeding traffic or even for conforming traffic based on policy—shaping does not perform packet re-marking. Shaping's sole function is to delay packets that exceed the configured rate by buffering them, leaving the packet headers and markings unchanged. The statement is incorrect because it implies both mechanisms can re-mark, whereas re-marking is a policing feature, not a shaping feature.

• ✓

  The 'shape average' command configures shaping to use the average rate over time, while 'shape peak' allows bursts above the average.

  Why this is correct

  Correct. In Cisco IOS, 'shape average' limits the rate to the configured average, while 'shape peak' allows the rate to exceed the average up to the peak rate, which is calculated as (CIR + Be)/Tc.