350-601 Security Practice Question
A data center network uses Cisco Nexus 9000 switches running NX-OS. The operations team notices that the CPU utilization on the supervisor module spikes intermittently, causing BGP session flaps. Analysis shows that the CPU spikes coincide with traceroute probes from external networks, which generate ICMP TTL exceeded messages that are process-switched. The engineer must implement a solution to protect the control plane without affecting normal ICMP functionality. The goal is to rate-limit ICMP traffic to a maximum of 1000 packets per second with a burst of 200 bytes, while allowing other control plane traffic without restriction. Which configuration should be applied?
⚠ Common exam trap
Cisco often tests the distinction between applying a policy-map with 'service-policy input' (which is for interface QoS) versus 'service-policy type control-plane' (which is for CoPP), and the correct police syntax including the 'byte' keyword for burst size.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
class-map type control-plane match-all COPP-ICMP match protocol icmp policy-map type control-plane COPP class COPP-ICMP police 1000 pps 200 byte burst control-plane service-policy type control-plane COPP
It uses a Control Plane Policing (CoPP) policy with a class-map that matches ICMP protocol traffic in the control plane, then applies a police rate of 1000 pps with a 200-byte burst. This configuration rate-limits ICMP TTL-exceeded messages that are process-switched, protecting the supervisor CPU from spikes while allowing other control plane traffic unrestricted. The 'service-policy type control-plane' command applies the policy to the control plane, which is the proper method for NX-OS CoPP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the 'hardware rate-limiter' feature to limit ICMP globally.
Why it's wrong here
Hardware rate-limiters are less granular and not recommended for specific protocol control; CoPP is preferred.
- ✗
class-map type control-plane match-any COPP-ICMP match access-group name ICMP-ACL policy-map type control-plane COPP class COPP-ICMP police rate 1000 pps burst 200 control-plane service-policy input COPP
Why it's wrong here
Incorrect: match-any is not necessary; police rate is invalid; service-policy should be type control-plane, not input.
- ✗
Apply a QoS policy on the management interface to drop excess ICMP.
Why it's wrong here
This would affect only management interface traffic, not control plane traffic from data ports.
- ✓
class-map type control-plane match-all COPP-ICMP match protocol icmp policy-map type control-plane COPP class COPP-ICMP police 1000 pps 200 byte burst control-plane service-policy type control-plane COPP
Why this is correct
Correct syntax: using type control-plane class-map and policy-map, with police in pps and burst in bytes.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-601 question from scratch — 984 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-601 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-601 exam.