ACLs and CoPP practice questions

A network engineer is troubleshooting an issue where SSH access to a Cisco router from a specific management subnet (10.10.10.0/24) is intermittently failing. The router has a CoPP policy applied to the control plane. The engineer checks the CoPP statistics and sees that packets from the management subnet are being dropped by the control-plane service-policy. Which configuration change should the engineer make to allow SSH from the management subnet while still protecting the control plane?

Trap 1: Remove the deny statement from the CoPP ACL to allow all traffic.

Incorrect because removing the deny statement would allow all traffic to the control plane, defeating the purpose of CoPP.

Trap 2: Increase the police rate for the CoPP class that matches SSH…

Incorrect because the issue is not rate limiting; the traffic is being dropped by an ACL deny, not policed.

Trap 3: Remove the CoPP policy from the control plane and rely on interface…

Incorrect because removing CoPP leaves the control plane vulnerable to attacks; interface ACLs alone may not provide sufficient protection.

A
Modify the CoPP ACL to include a permit statement for TCP port 22 from 10.10.10.0/24 before the deny statement.
Correct because this allows SSH traffic from the management subnet to be classified and permitted by the CoPP policy, preventing drops.
B
Remove the deny statement from the CoPP ACL to allow all traffic.
Why wrong: Incorrect because removing the deny statement would allow all traffic to the control plane, defeating the purpose of CoPP.
C
Increase the police rate for the CoPP class that matches SSH traffic.
Why wrong: Incorrect because the issue is not rate limiting; the traffic is being dropped by an ACL deny, not policed.
D
Remove the CoPP policy from the control plane and rely on interface ACLs.
Why wrong: Incorrect because removing CoPP leaves the control plane vulnerable to attacks; interface ACLs alone may not provide sufficient protection.

Question 2mediummultiple choice

An enterprise network uses a Cisco Catalyst 9300 switch as a distribution layer device. The network team notices that ICMP echo requests from a monitoring server (192.168.1.100) to the switch's management IP are being dropped intermittently. The switch has a CoPP policy that includes a class-map matching ICMP traffic. The engineer checks the CoPP statistics and sees that ICMP packets from the monitoring server are being dropped by the policy. What is the most likely cause of this issue?

Trap 1: An ACL applied to the management interface is blocking ICMP from…

Incorrect because the CoPP statistics show drops due to the policy, not an interface ACL.

Trap 2: The monitoring server is sending ICMP packets with a TTL of 1,…

Incorrect because TTL=1 would cause packets to be dropped before reaching the switch, not due to CoPP.

Trap 3: The switch's CPU is overloaded, causing CoPP to drop all packets.

Incorrect because CoPP drops are based on policy, not CPU load; CPU overload might cause other issues but not CoPP drops specifically.

A
The CoPP policy is policing ICMP traffic to a rate that is too low for the monitoring server's traffic.
Correct because CoPP polices traffic to the control plane; if the rate is too low, legitimate ICMP packets may be dropped.
B
An ACL applied to the management interface is blocking ICMP from the monitoring server.
Why wrong: Incorrect because the CoPP statistics show drops due to the policy, not an interface ACL.
C
The monitoring server is sending ICMP packets with a TTL of 1, causing them to be dropped.
Why wrong: Incorrect because TTL=1 would cause packets to be dropped before reaching the switch, not due to CoPP.
D
The switch's CPU is overloaded, causing CoPP to drop all packets.
Why wrong: Incorrect because CoPP drops are based on policy, not CPU load; CPU overload might cause other issues but not CoPP drops specifically.

Open the full BGP breakdown →

Question 3hardmultiple choice

A network engineer is configuring CoPP on a Cisco ASR 1000 router to protect the control plane from excessive traffic. The engineer wants to allow BGP traffic from a specific peer (10.0.0.1) while rate-limiting all other BGP traffic. The engineer creates an ACL that permits TCP port 179 from host 10.0.0.1 and denies all other BGP traffic. The CoPP class-map matches this ACL. However, after applying the policy, BGP sessions from other peers are still being established. What is the most likely reason?

Trap 1: The ACL is applied in the wrong order; the deny statement should be…

Incorrect because ACL order is evaluated sequentially; a permit before deny would permit the specific peer, but the deny for others would still be processed.

Trap 2: BGP uses UDP port 179, not TCP, so the ACL does not match BGP…

Incorrect because BGP uses TCP port 179.

Trap 3: CoPP does not affect BGP sessions because they are established…

Incorrect because CoPP applies to all control plane traffic, including BGP, regardless of when the session was established.

A
The ACL denies all other BGP traffic, so CoPP does not match it, and it falls through to the default class, which permits it.
Correct because CoPP only applies to traffic matched by the class-map; if the ACL denies traffic, it is not matched, and the default class (often permit) allows it.
B
The ACL is applied in the wrong order; the deny statement should be before the permit statement.
Why wrong: Incorrect because ACL order is evaluated sequentially; a permit before deny would permit the specific peer, but the deny for others would still be processed.
C
BGP uses UDP port 179, not TCP, so the ACL does not match BGP traffic.
Why wrong: Incorrect because BGP uses TCP port 179.
D
CoPP does not affect BGP sessions because they are established before the policy is applied.
Why wrong: Incorrect because CoPP applies to all control plane traffic, including BGP, regardless of when the session was established.

Open the full VLAN trunking answer →

Question 4easymultiple choice

A network engineer is troubleshooting a connectivity issue between two VLANs on a Cisco Catalyst 3850 switch. The switch has an ACL applied to VLAN 10 that permits traffic from VLAN 20 to VLAN 10, but denies all other traffic. Hosts in VLAN 20 can ping hosts in VLAN 10, but not vice versa. The engineer checks the ACL and finds that it is applied inbound on VLAN 10. What is the most likely cause of the issue?

Trap 1: The ACL is applied outbound on VLAN 10, so it filters traffic…

Incorrect because the scenario states the ACL is applied inbound.

Trap 2: The ACL is applied to the SVI for VLAN 10, but the hosts are in…

Incorrect because ACLs applied to SVIs filter traffic to/from the VLAN.

Trap 3: The ACL is blocking ICMP echo replies from VLAN 10 to VLAN 20.

Incorrect because the ACL permits traffic from VLAN 20 to VLAN 10, but does not affect traffic from VLAN 10 to VLAN 20.

A
The ACL is applied inbound on VLAN 10, so it only filters traffic entering VLAN 10, not traffic leaving VLAN 10.
Correct because inbound ACLs filter traffic entering the interface; traffic from VLAN 10 to VLAN 20 is leaving VLAN 10 and is not filtered.
B
The ACL is applied outbound on VLAN 10, so it filters traffic leaving VLAN 10, preventing replies.
Why wrong: Incorrect because the scenario states the ACL is applied inbound.
C
The ACL is applied to the SVI for VLAN 10, but the hosts are in VLAN 10, so the ACL does not apply.
Why wrong: Incorrect because ACLs applied to SVIs filter traffic to/from the VLAN.
D
The ACL is blocking ICMP echo replies from VLAN 10 to VLAN 20.
Why wrong: Incorrect because the ACL permits traffic from VLAN 20 to VLAN 10, but does not affect traffic from VLAN 10 to VLAN 20.

Question 5hardmultiple choice

A network engineer is configuring CoPP on a Cisco Nexus 9000 switch to protect the control plane from a potential DoS attack. The engineer creates a class-map that matches traffic with a specific DSCP value (AF41) and applies a police rate of 10 Mbps. After applying the policy, the engineer notices that legitimate traffic with DSCP AF41 is being dropped even though the traffic rate is only 5 Mbps. What is the most likely cause?

Trap 1: The police rate is too low, and the traffic is being dropped due to…

Incorrect because the traffic rate is 5 Mbps, which is below the 10 Mbps police rate.

Trap 2: The DSCP value AF41 is not supported on Nexus switches.

Incorrect because DSCP AF41 is supported on Nexus switches.

Trap 3: The CoPP policy is applied to the wrong queue, causing all traffic…

Incorrect because CoPP policies are applied to the control plane, not queues.

A
The CoPP policy has a conform-action of drop, which drops all traffic matching the class.
Correct because if the conform-action is set to drop, all traffic in that class is dropped, even if it is within the police rate.
B
The police rate is too low, and the traffic is being dropped due to exceeding the rate.
Why wrong: Incorrect because the traffic rate is 5 Mbps, which is below the 10 Mbps police rate.
C
The DSCP value AF41 is not supported on Nexus switches.
Why wrong: Incorrect because DSCP AF41 is supported on Nexus switches.
D
The CoPP policy is applied to the wrong queue, causing all traffic to be dropped.
Why wrong: Incorrect because CoPP policies are applied to the control plane, not queues.

Question 6mediummultiple choice

A network engineer is troubleshooting an issue where a Cisco router is not responding to SNMP polls from a network management station (NMS) at 192.168.1.50. The router has a CoPP policy that includes a class-map matching SNMP traffic (UDP port 161). The engineer checks the CoPP statistics and sees that SNMP packets from the NMS are being dropped. The engineer wants to allow SNMP from the NMS while still protecting the control plane. Which configuration change should the engineer make?

Trap 1: Increase the police rate for the CoPP class that matches SNMP…

Incorrect because the issue is not rate limiting; the traffic is being dropped by an ACL deny.

Trap 2: Remove the CoPP policy from the control plane and rely on interface…

Incorrect because removing CoPP leaves the control plane vulnerable.

Trap 3: Change the SNMP port on the router to a non-standard port to avoid…

Incorrect because this would require changes on the NMS and may not resolve the issue if the CoPP policy is not updated.

A
Modify the CoPP ACL to include a permit statement for UDP port 161 from host 192.168.1.50 before the deny statement.
Correct because this allows SNMP traffic from the NMS to be classified and permitted by the CoPP policy.
B
Increase the police rate for the CoPP class that matches SNMP traffic.
Why wrong: Incorrect because the issue is not rate limiting; the traffic is being dropped by an ACL deny.
C
Remove the CoPP policy from the control plane and rely on interface ACLs.
Why wrong: Incorrect because removing CoPP leaves the control plane vulnerable.
D
Change the SNMP port on the router to a non-standard port to avoid the CoPP policy.
Why wrong: Incorrect because this would require changes on the NMS and may not resolve the issue if the CoPP policy is not updated.

Question 7easymultiple choice

A network engineer is configuring ACLs on a Cisco router to filter traffic between two subnets. The engineer wants to allow HTTP traffic from subnet 10.1.1.0/24 to subnet 10.2.2.0/24, but deny all other traffic. The engineer applies an ACL inbound on the interface connected to subnet 10.1.1.0/24. The ACL has a permit statement for TCP port 80 from 10.1.1.0/24 to 10.2.2.0/24, followed by a deny ip any any. However, hosts in subnet 10.1.1.0/24 can still ping hosts in subnet 10.2.2.0/24. What is the most likely reason?

Trap 1: The ACL is missing a deny statement for ICMP, so ICMP traffic is…

Incorrect because ACLs have an implicit deny at the end, so ICMP would be denied.

Trap 2: The ACL permits HTTP, but ping uses ICMP, which is not HTTP, so…

Incorrect because this would not explain why ping is allowed; it should be denied.

Trap 3: The ACL is applied to the wrong interface; it should be applied to…

Incorrect because applying the ACL to the interface connected to 10.1.1.0/24 is correct for filtering traffic from that subnet.

A
The ACL is applied outbound on the interface, not inbound, so it filters traffic leaving the interface, not entering.
Correct because if the ACL is applied outbound, it filters traffic leaving the interface; ping traffic from 10.1.1.0/24 to 10.2.2.0/24 would be leaving the interface, but the ACL permits only HTTP, so ping should be denied. However, if the ACL is applied outbound, the deny ip any any would block ping, so this might not be the issue. Actually, the most likely reason is that the ACL is applied outbound, but the scenario says inbound, so the engineer might have misapplied it.
B
The ACL is missing a deny statement for ICMP, so ICMP traffic is implicitly permitted.
Why wrong: Incorrect because ACLs have an implicit deny at the end, so ICMP would be denied.
C
The ACL permits HTTP, but ping uses ICMP, which is not HTTP, so ping should be denied.
Why wrong: Incorrect because this would not explain why ping is allowed; it should be denied.
D
The ACL is applied to the wrong interface; it should be applied to the interface connected to subnet 10.2.2.0/24.
Why wrong: Incorrect because applying the ACL to the interface connected to 10.1.1.0/24 is correct for filtering traffic from that subnet.

Question 8hardmultiple choice

A network engineer is configuring CoPP on a Cisco router to protect the control plane from excessive traffic. The engineer creates a class-map that matches traffic with a specific ACL that permits TCP port 22 (SSH) from a management subnet (192.168.1.0/24) and denies all other traffic. The CoPP policy applies a police rate of 1 Mbps to this class. After applying the policy, the engineer notices that SSH sessions from the management subnet are being dropped intermittently. The engineer checks the CoPP statistics and sees that the traffic rate is 500 kbps. What is the most likely cause?

Trap 1: The police rate is too low, and the traffic is being dropped due to…

Incorrect because the traffic rate is 500 kbps, which is below the 1 Mbps police rate.

Trap 2: The ACL is denying SSH traffic from the management subnet.

Incorrect because the ACL permits SSH from the management subnet.

Trap 3: The CoPP policy is applied to the wrong interface, so it is not…

Incorrect because CoPP is applied to the control plane, not an interface.

A
The CoPP policy has a conform-action of drop, which drops all traffic matching the class.
Correct because if the conform-action is set to drop, all traffic in that class is dropped, even if it is within the police rate.
B
The police rate is too low, and the traffic is being dropped due to exceeding the rate.
Why wrong: Incorrect because the traffic rate is 500 kbps, which is below the 1 Mbps police rate.
C
The ACL is denying SSH traffic from the management subnet.
Why wrong: Incorrect because the ACL permits SSH from the management subnet.
D
The CoPP policy is applied to the wrong interface, so it is not affecting SSH traffic.
Why wrong: Incorrect because CoPP is applied to the control plane, not an interface.

Open the full VLAN trunking answer →

Question 9easymultiple choice

A network engineer is troubleshooting an issue where a Cisco router is not forwarding traffic between two VLANs. The router has an ACL applied to the subinterface for VLAN 100 that permits traffic from VLAN 200 to VLAN 100, but denies all other traffic. Hosts in VLAN 200 can ping hosts in VLAN 100, but hosts in VLAN 100 cannot ping hosts in VLAN 200. The engineer checks the ACL and finds that it is applied inbound on the subinterface for VLAN 100. What is the most likely cause of the issue?

Trap 1: The ACL is applied outbound on VLAN 100, so it filters traffic…

Incorrect because the scenario states the ACL is applied inbound.

Trap 2: The ACL is applied to the wrong subinterface; it should be applied…

Incorrect because applying the ACL to VLAN 100 is correct for filtering traffic to that VLAN.

Trap 3: The ACL is blocking ICMP echo replies from VLAN 100 to VLAN 200.

Incorrect because the ACL permits traffic from VLAN 200 to VLAN 100, but does not affect traffic from VLAN 100 to VLAN 200.

A
The ACL is applied inbound on VLAN 100, so it only filters traffic entering VLAN 100, not traffic leaving VLAN 100.
Correct because inbound ACLs filter traffic entering the interface; traffic from VLAN 100 to VLAN 200 is leaving VLAN 100 and is not filtered.
B
The ACL is applied outbound on VLAN 100, so it filters traffic leaving VLAN 100, preventing replies.
Why wrong: Incorrect because the scenario states the ACL is applied inbound.
C
The ACL is applied to the wrong subinterface; it should be applied to the subinterface for VLAN 200.
Why wrong: Incorrect because applying the ACL to VLAN 100 is correct for filtering traffic to that VLAN.
D
The ACL is blocking ICMP echo replies from VLAN 100 to VLAN 200.
Why wrong: Incorrect because the ACL permits traffic from VLAN 200 to VLAN 100, but does not affect traffic from VLAN 100 to VLAN 200.

Question 10mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show access-lists

Extended IP access list 101

10 permit tcp host 10.1.1.1 host 192.168.1.100 eq 80 (4 matches)
    
20 deny tcp any host 192.168.1.100 eq 80 (12 matches)
    
30 permit ip any any (8 matches)

Based on this output, what can be concluded?

Trap 1: All HTTP traffic to 192.168.1.100 is denied.

The first entry permits HTTP from 10.1.1.1, so not all HTTP is denied.

Trap 2: All traffic from 10.1.1.1 to 192.168.1.100 is permitted.

Only HTTP (port 80) is permitted; other traffic from 10.1.1.1 to 192.168.1.100 would match the final permit, but the ACL does not specifically permit all traffic from that source.

Trap 3: The ACL is applied inbound on an interface.

The output does not indicate the direction or interface where the ACL is applied.

A
HTTP traffic from 10.1.1.1 to 192.168.1.100 is permitted, but all other HTTP traffic to that host is denied.
The first entry permits HTTP from 10.1.1.1 to 192.168.1.100, and the second denies all other HTTP to that host. The third entry permits all other traffic, but it does not override the deny for HTTP because ACLs are processed top-down until a match is found.
B
All HTTP traffic to 192.168.1.100 is denied.
Why wrong: The first entry permits HTTP from 10.1.1.1, so not all HTTP is denied.
C
All traffic from 10.1.1.1 to 192.168.1.100 is permitted.
Why wrong: Only HTTP (port 80) is permitted; other traffic from 10.1.1.1 to 192.168.1.100 would match the final permit, but the ACL does not specifically permit all traffic from that source.
D
The ACL is applied inbound on an interface.
Why wrong: The output does not indicate the direction or interface where the ACL is applied.

Question 11hardmultiple choice

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-POLICY

Class-map: ICMP-CLASS (match-all) 10 packets, 1000 bytes 5 minute offered rate 0 bps Match: access-group name ICMP-ACL police: cir 8000 bps, bc 1500 bytes, be 1500 bytes conformed 10 packets, 1000 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop

Class-map: SSH-CLASS (match-all) 5 packets, 500 bytes 5 minute offered rate 0 bps Match: access-group name SSH-ACL police: cir 16000 bps, bc 3000 bytes, be 3000 bytes conformed 5 packets, 500 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop

Class-map: class-default (match-any) 20 packets, 2000 bytes 5 minute offered rate 0 bps Match: any police: cir 64000 bps, bc 8000 bytes, be 8000 bytes conformed 20 packets, 2000 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop

Based on this output, what can be concluded?

Trap 1: SSH traffic to the control plane is being dropped because it…

The SSH class shows 5 conformed packets and 0 exceeded/dropped, so no drops.

Trap 2: The control-plane policy is applied in the output direction.

The output shows 'input' in the service-policy line, so it is applied inbound.

Trap 3: All traffic to the control plane is rate-limited to 64 kbps.

The class-default has a CIR of 64 kbps, but specific classes like ICMP and SSH have their own lower limits.

A
ICMP traffic to the control plane is rate-limited to 8 kbps, and all packets so far have been within the conform rate.
The police command shows a CIR of 8000 bps for ICMP, and the conformed count equals the total packets, meaning no packets exceeded the rate.
B
SSH traffic to the control plane is being dropped because it exceeds the CIR.
Why wrong: The SSH class shows 5 conformed packets and 0 exceeded/dropped, so no drops.
C
The control-plane policy is applied in the output direction.
Why wrong: The output shows 'input' in the service-policy line, so it is applied inbound.
D
All traffic to the control plane is rate-limited to 64 kbps.
Why wrong: The class-default has a CIR of 64 kbps, but specific classes like ICMP and SSH have their own lower limits.

Question 12mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show ip interface GigabitEthernet0/0 | include access list

Inbound access list is 101 Outbound access list is not set

R1# show access-lists 101

Extended IP access list 101

10 permit tcp 192.168.1.0 0.0.0.255 any eq 80 (100 matches)
    
20 deny tcp any any eq 80 (50 matches)
    
30 permit ip any any (200 matches)

Based on this output, what can be concluded?

Trap 1: All HTTP traffic is permitted.

Entry 20 denies HTTP from sources not in 192.168.1.0/24.

Trap 2: The ACL is applied outbound on the interface.

The output clearly states 'Inbound access list is 101'.

Trap 3: The ACL permits all traffic from 192.168.1.0/24.

It only permits HTTP (port 80) from that subnet, not all traffic.

A
HTTP traffic from sources outside 192.168.1.0/24 is denied.
Entry 20 denies all HTTP traffic not matching entry 10, so any HTTP from other subnets is denied.
B
All HTTP traffic is permitted.
Why wrong: Entry 20 denies HTTP from sources not in 192.168.1.0/24.
C
The ACL is applied outbound on the interface.
Why wrong: The output clearly states 'Inbound access list is 101'.
D
The ACL permits all traffic from 192.168.1.0/24.
Why wrong: It only permits HTTP (port 80) from that subnet, not all traffic.

Question 13mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show ip access-lists

Extended IP access list 120

10 permit tcp 10.0.0.0 0.255.255.255 any eq 22 (5 matches)
    
20 permit tcp 172.16.0.0 0.0.255.255 any eq 22 (3 matches)
    
30 deny tcp any any eq 22 (2 matches)
    
40 permit ip any any (10 matches)

Based on this output, what can be concluded?

Trap 1: SSH access from 10.0.0.0/8 is denied.

Entry 10 permits SSH from 10.0.0.0/8.

Trap 2: All SSH traffic is permitted.

Entry 30 denies SSH from sources not in the permitted ranges.

Trap 3: The ACL has an implicit deny at the end.

Entry 40 permits all IP traffic, so there is no implicit deny for non-SSH traffic.

A
SSH access from 192.168.1.0/24 would be denied.
Entry 30 denies SSH from any source not matching entries 10 or 20, so 192.168.1.0/24 would be denied.
B
SSH access from 10.0.0.0/8 is denied.
Why wrong: Entry 10 permits SSH from 10.0.0.0/8.
C
All SSH traffic is permitted.
Why wrong: Entry 30 denies SSH from sources not in the permitted ranges.
D
The ACL has an implicit deny at the end.
Why wrong: Entry 40 permits all IP traffic, so there is no implicit deny for non-SSH traffic.

Question 14mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show access-lists 130

Extended IP access list 130

10 permit icmp host 10.1.1.1 any echo (8 matches)
    
20 permit icmp host 10.1.1.1 any echo-reply (5 matches)
    
30 deny icmp any any (3 matches)
    
40 permit ip any any (12 matches)

Based on this output, what can be concluded?

Trap 1: All ICMP traffic is permitted.

Only ICMP from 10.1.1.1 is permitted; other ICMP is denied.

Trap 2: The ACL permits all traffic from 10.1.1.1.

It only permits ICMP echo and echo-reply from that host, not all traffic.

Trap 3: The ACL is applied inbound on an interface.

The output does not indicate the direction or interface.

A
ICMP packets from sources other than 10.1.1.1 are denied.
Entry 30 denies all ICMP not matching entries 10 or 20, so any ICMP from other sources is denied.
B
All ICMP traffic is permitted.
Why wrong: Only ICMP from 10.1.1.1 is permitted; other ICMP is denied.
C
The ACL permits all traffic from 10.1.1.1.
Why wrong: It only permits ICMP echo and echo-reply from that host, not all traffic.
D
The ACL is applied inbound on an interface.
Why wrong: The output does not indicate the direction or interface.

Question 15hardmultiple choice

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-POLICY

Class-map: MGMT-CLASS (match-all) 100 packets, 5000 bytes 5 minute offered rate 1000 bps Match: access-group name MGMT-ACL police: cir 32000 bps, bc 4000 bytes, be 4000 bytes conformed 80 packets, 4000 bytes; actions: transmit exceeded 15 packets, 750 bytes; actions: drop violated 5 packets, 250 bytes; actions: drop

Class-map: class-default (match-any) 200 packets, 10000 bytes 5 minute offered rate 2000 bps Match: any police: cir 64000 bps, bc 8000 bytes, be 8000 bytes conformed 200 packets, 10000 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop

Based on this output, what can be concluded?

Trap 1: All management traffic is being transmitted without drops.

20 packets were dropped, so not all are transmitted.

Trap 2: The policer is configured in the output direction.

The service-policy is input, so it is inbound.

Trap 3: The class-default is dropping packets.

The class-default shows all 200 packets conformed, so no drops.

A
Management traffic to the control plane is being policed, and some packets are being dropped because they exceed the configured rate.
The policer shows 80 conformed and 20 exceeded/violated packets, meaning 20 packets were dropped due to exceeding the CIR.
B
All management traffic is being transmitted without drops.
Why wrong: 20 packets were dropped, so not all are transmitted.
C
The policer is configured in the output direction.
Why wrong: The service-policy is input, so it is inbound.
D
The class-default is dropping packets.
Why wrong: The class-default shows all 200 packets conformed, so no drops.

Question 16mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show ip interface GigabitEthernet0/1 | include access list

Inbound access list is not set Outbound access list is 140

R1# show access-lists 140

Extended IP access list 140

10 permit tcp 192.168.1.0 0.0.0.255 any eq 443 (25 matches)
    
20 deny tcp any any eq 443 (10 matches)
    
30 permit ip any any (50 matches)

Based on this output, what can be concluded?

Trap 1: All HTTPS traffic is permitted outbound.

Entry 20 denies HTTPS from sources not in 192.168.1.0/24.

Trap 2: The ACL is applied inbound on the interface.

The output shows 'Outbound access list is 140'.

Trap 3: The ACL permits all traffic from 192.168.1.0/24.

It only permits HTTPS from that subnet, not all traffic.

A
HTTPS traffic from sources outside 192.168.1.0/24 is denied when exiting the interface.
Entry 20 denies HTTPS from any source not matching entry 10, so HTTPS from other subnets is denied outbound.
B
All HTTPS traffic is permitted outbound.
Why wrong: Entry 20 denies HTTPS from sources not in 192.168.1.0/24.
C
The ACL is applied inbound on the interface.
Why wrong: The output shows 'Outbound access list is 140'.
D
The ACL permits all traffic from 192.168.1.0/24.
Why wrong: It only permits HTTPS from that subnet, not all traffic.

Question 17hardmultiple choice

A network engineer runs the following command on Router R1:

R1# show ip access-lists

Extended IP access list 150

10 permit tcp 10.0.0.0 0.255.255.255 any eq 23 (2 matches)
    
20 deny tcp any any eq 23 (8 matches)
    
30 permit tcp 172.16.0.0 0.0.255.255 any eq 22 (4 matches)
    
40 deny tcp any any eq 22 (1 match)
    
50 permit ip any any (15 matches)

Based on this output, what can be concluded?

Trap 1: Telnet from 10.0.0.0/8 is denied.

Entry 10 permits Telnet from 10.0.0.0/8.

Trap 2: SSH from 172.16.0.0/16 is denied.

Entry 30 permits SSH from 172.16.0.0/16.

Trap 3: All traffic is permitted.

Telnet and SSH from unauthorized sources are denied.

A
Telnet from 192.168.1.0/24 would be denied, and SSH from 10.0.0.0/8 would be denied.
Telnet from 192.168.1.0/24 matches entry 20 (deny), and SSH from 10.0.0.0/8 does not match entry 30 (which permits only from 172.16.0.0/16), so it matches entry 40 (deny).
B
Telnet from 10.0.0.0/8 is denied.
Why wrong: Entry 10 permits Telnet from 10.0.0.0/8.
C
SSH from 172.16.0.0/16 is denied.
Why wrong: Entry 30 permits SSH from 172.16.0.0/16.
D
All traffic is permitted.
Why wrong: Telnet and SSH from unauthorized sources are denied.

Open the full BGP breakdown →

Question 18hardmultiple choice

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-POLICY

Class-map: BGP-CLASS (match-all) 50 packets, 2500 bytes 5 minute offered rate 500 bps Match: access-group name BGP-ACL police: cir 64000 bps, bc 8000 bytes, be 8000 bytes conformed 50 packets, 2500 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop

Class-map: SNMP-CLASS (match-all) 200 packets, 10000 bytes 5 minute offered rate 2000 bps Match: access-group name SNMP-ACL police: cir 16000 bps, bc 2000 bytes, be 2000 bytes conformed 150 packets, 7500 bytes; actions: transmit exceeded 40 packets, 2000 bytes; actions: drop violated 10 packets, 500 bytes; actions: drop

Class-map: class-default (match-any) 100 packets, 5000 bytes 5 minute offered rate 1000 bps Match: any police: cir 32000 bps, bc 4000 bytes, be 4000 bytes conformed 100 packets, 5000 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop

Based on this output, what can be concluded?

Trap 1: BGP traffic is being dropped because it exceeds the CIR.

BGP shows all 50 packets conformed, so no drops.

Trap 2: All traffic to the control plane is being dropped.

Only SNMP traffic is being partially dropped; BGP and class-default have no drops.

Trap 3: The control-plane policy is applied in the output direction.

The service-policy is input, so it is inbound.

A
SNMP traffic to the control plane is experiencing drops due to exceeding its policer rate, while BGP traffic is within its rate.
The SNMP class shows 150 conformed and 50 dropped (exceeded+violated), while BGP shows all 50 conformed.
B
BGP traffic is being dropped because it exceeds the CIR.
Why wrong: BGP shows all 50 packets conformed, so no drops.
C
All traffic to the control plane is being dropped.
Why wrong: Only SNMP traffic is being partially dropped; BGP and class-default have no drops.
D
The control-plane policy is applied in the output direction.
Why wrong: The service-policy is input, so it is inbound.

Question 19mediummultiple choice

Examine the following configuration snippet:

interface GigabitEthernet0/1
 ip access-group FILTER_IN in

ip access-list extended FILTER_IN
 deny   icmp any any echo
 permit ip any any

What is the effect of this configuration?

Trap 1: It blocks all ICMP traffic inbound on GigabitEthernet0/1.

The ACL only denies ICMP Echo (type 8), not all ICMP types.

Trap 2: It blocks all inbound traffic on GigabitEthernet0/1.

The permit ip any any allows all other traffic after denying ICMP Echo.

Trap 3: It blocks outbound ICMP Echo requests on GigabitEthernet0/1.

The access-group is applied inbound, so it filters incoming traffic only.

A
It blocks all ICMP traffic inbound on GigabitEthernet0/1.
Why wrong: The ACL only denies ICMP Echo (type 8), not all ICMP types.
B
It blocks inbound ICMP Echo requests on GigabitEthernet0/1.
The deny statement matches ICMP Echo (ping request) and the permit statement allows all other traffic.
C
It blocks all inbound traffic on GigabitEthernet0/1.
Why wrong: The permit ip any any allows all other traffic after denying ICMP Echo.
D
It blocks outbound ICMP Echo requests on GigabitEthernet0/1.
Why wrong: The access-group is applied inbound, so it filters incoming traffic only.

Question 20mediummultiple choice

Consider the following configuration:

ip access-list extended BLOCK_TELNET
 deny tcp any any eq 23
 permit ip any any

interface GigabitEthernet0/2
 ip access-group BLOCK_TELNET out

Which statement is true?

Trap 1: Telnet traffic entering GigabitEthernet0/2 is blocked.

The ACL is applied outbound, so it filters outgoing traffic, not incoming.

Trap 2: All outbound traffic is blocked.

Only Telnet is denied; the permit ip any any allows all other traffic.

Trap 3: The ACL is incorrectly applied; only named ACLs can be applied…

Named ACLs can be applied inbound or outbound; the configuration is valid.

A
Telnet traffic entering GigabitEthernet0/2 is blocked.
Why wrong: The ACL is applied outbound, so it filters outgoing traffic, not incoming.
B
Telnet traffic leaving GigabitEthernet0/2 is blocked.
The outbound ACL denies TCP port 23 (Telnet) on egress.
C
All outbound traffic is blocked.
Why wrong: Only Telnet is denied; the permit ip any any allows all other traffic.
D
The ACL is incorrectly applied; only named ACLs can be applied outbound.
Why wrong: Named ACLs can be applied inbound or outbound; the configuration is valid.