350-601 Security Practice Question
Exhibit
policy-map type control-plane COPP class ICMP police cir 1000 bps bc 1000 bytes conform transmit exceed drop class OSPF police cir 5000 bps bc 5000 bytes conform transmit exceed transmit class class-default police cir 20000 bps bc 20000 bytes conform transmit exceed transmit
Refer to the exhibit. The CoPP policy above is applied. Which traffic is most likely to be dropped?
⚠ Common exam trap
Cisco often tests the misconception that all traffic exceeding its policed rate is equally likely to be dropped, but the trap here is that the lowest policed rate (ICMP at 1000 bps) is the most restrictive and thus the most likely to be exceeded and dropped, not the higher-rate classes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ICMP traffic that exceeds 1000 bps
The CoPP policy explicitly defines a class-map for ICMP traffic with a police rate of 1000 bps. Any ICMP traffic exceeding this rate is dropped due to the 'drop' action in the police command. The other classes (OSPF and class-default) have higher rates and are not as constrained, making ICMP the most likely to be dropped when exceeded.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Both ICMP and class-default traffic that exceed their rates
Why it's wrong here
Class-default does not drop; only ICMP drops.
- ✓
ICMP traffic that exceeds 1000 bps
Why this is correct
The ICMP class drops packets that exceed the police rate.
- ✗
class-default traffic that exceeds 20000 bps
Why it's wrong here
The class-default exceed action is transmit, so no drop occurs.
- ✗
OSPF traffic that exceeds 5000 bps
Why it's wrong here
The OSPF class has an exceed action of transmit, so all OSPF packets are allowed.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 984 original 350-601 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-601 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-601 exam.