350-601 Security Practice Question
A network administrator is configuring copp (Control Plane Policing) on a Cisco Nexus 9300 to protect the control plane from high-rate traffic. After applying the policy, the switch becomes unresponsive to SSH sessions, but ICMP still works. What is the most likely misconfiguration?
⚠ Common exam trap
Cisco often tests the nuance that CoPP policy-maps have an implicit 'permit' default unless a 'class class-default' with a drop action is explicitly configured, leading candidates to incorrectly assume a default drop is the cause when the real issue is a misclassification in the class-map.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
In the class-map for SSH, the 'match' statement is incorrectly configured, causing SSH traffic to fall under a drop class.
If the class-map for SSH traffic uses an incorrect match statement (e.g., matching on the wrong protocol or port), SSH packets will not be classified into the intended permit class. Instead, they fall through to a default drop class in the policy-map, causing SSH sessions to fail while ICMP (which may be matched by a different class or the default permit action) still works. CoPP relies on precise class-map matching; a misconfiguration here directly explains the selective loss of SSH access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The control plane rate limit is set too low because the switch has many interfaces.
Why it's wrong here
Interface count does not affect control plane rate limit relative to CoPP.
- ✗
CoPP is not supported on the Nexus 9300 platform.
Why it's wrong here
CoPP is supported on Nexus 9300.
- ✗
The default action of the policy-map is to drop traffic not explicitly matched.
Why it's wrong here
Actually, the default action is to allow, but if no class matches, traffic might be dropped if a default class is used.
- ✓
In the class-map for SSH, the 'match' statement is incorrectly configured, causing SSH traffic to fall under a drop class.
Why this is correct
If SSH traffic is not matched or falls into a drop class, SSH would be blocked.
Go deeper
Related to this question
About these practice questions
One of 984 original 350-601 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-601 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-601 exam.