350-601 Security Practice Question
A Nexus 7000 switch is experiencing high CPU utilization due to control plane traffic. The engineer notices that many packets are being punted to the CPU from the data plane, particularly ARP packets. After examining the CoPP configuration, the engineer sees that the 'arp' class-map is matched in a policy-map with a police rate of 1000 pps and a conform-action of 'transmit'. The current ARP rate is 2000 pps. What is the immediate impact?
⚠ Common exam trap
Cisco often tests the implicit default action for excess traffic in CoPP policers—candidates mistakenly assume that only the conform-action matters and that all traffic is transmitted, overlooking that the exceed-action defaults to 'drop' when not explicitly configured.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Approximately half of the ARP packets are dropped, reducing CPU load but potentially causing reachability issues.
The CoPP policy is configured with a police rate of 1000 pps for ARP packets, but the current ARP rate is 2000 pps. Since the rate exceeds the policer, the conform-action 'transmit' only applies to packets within the rate; excess packets are dropped by default (drop action is implicit when no exceed-action is specified). This results in approximately half of the ARP packets being dropped, which reduces CPU load but can cause ARP resolution failures and reachability issues.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
All ARP packets are transmitted normally because the conform-action is 'transmit'.
Why it's wrong here
Only packets within the rate are transmitted; excess are dropped.
- ✓
Approximately half of the ARP packets are dropped, reducing CPU load but potentially causing reachability issues.
Why this is correct
With 2000 pps against 1000 pps limit, half are dropped.
- ✗
The switch applies an ACL to drop all ARP packets.
Why it's wrong here
CoPP uses class-maps, not ACLs directly for action.
- ✗
Packets are marked down and transmitted.
Why it's wrong here
No markdown action configured; default exceed is drop.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-601 question from scratch — 984 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-601 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-601 exam.