350-601 Security Practice Question
A data center engineer is troubleshooting high CPU utilization on a Cisco Nexus 9000 switch. The engineer suspects a distributed denial-of-service (DDoS) attack targeting the switch. To mitigate the attack, the engineer configures a Control Plane Policing (CoPP) policy that drops all ICMP packets destined to the switch. The policy is applied to the control-plane using the 'service-policy input COPP' command. After applying the policy, the switch CPU utilization remains high, and ICMP traffic is still reaching the switch. The engineer verifies that the CoPP policy is applied and that the class-map matches ICMP. The policy-map has the correct police and drop actions. No other CoPP policies are applied. What is the most likely cause of the issue?
⚠ Common exam trap
Cisco often tests the distinction between control-plane policing (CoPP) and management-plane protection, leading candidates to forget that the management interface operates in a separate VRF and is not subject to CoPP policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The attack traffic is entering through the management interface, which is not affected by CoPP.
The management interface (mgmt0) on Cisco Nexus 9000 switches operates in a separate management VRF and is not subject to Control Plane Policing (CoPP) policies applied to the default control-plane. CoPP only polices traffic that ingresses through data-plane interfaces (e.g., Ethernet, port-channel). If the DDoS attack is arriving via the management interface, the CoPP policy will not filter it, leaving CPU utilization high. This is a common oversight when troubleshooting control-plane protection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The switch requires a reload for the CoPP policy to take effect.
Why it's wrong here
CoPP policies take effect immediately; no reload is needed.
- ✓
The attack traffic is entering through the management interface, which is not affected by CoPP.
Why this is correct
Management interfaces have separate control plane contexts; CoPP policies do not apply unless specifically configured for the management VRF.
- ✗
The CoPP policy must be applied to the management VRF as well.
Why it's wrong here
CoPP applies to the default VRF control plane; management VRF requires separate configuration, but this is not the most likely cause as the policy should still affect other interfaces.
- ✗
The class-map uses 'match protocol icmp' but the traffic uses a different protocol.
Why it's wrong here
The engineer already verified the class-map matches ICMP correctly.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-601 question from scratch — 984 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-601 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-601 exam.