This 350-501 practice question tests your understanding of automation and quality of service. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Which TWO conditions cause a router to drop packets when a police action is configured?
exceed action is drop
When a packet exceeds the rate, it can be dropped if configured.
conform action is drop
Why wrong: Conform action is normally transmit, not drop.
no bandwidth is reserved
Why wrong: Bandwidth reservation is for scheduling, not policing.
violate action is drop
The violate action is used for dual-rate policing and can also drop.
queue is full
Why wrong: Queue fullness causes tail drop, not policing.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
exceed action is drop
When a police action is configured, the router uses a token bucket model to meter traffic. If traffic exceeds the committed information rate (CIR) and burst size, it falls into the 'exceed' or 'violate' category depending on the configured conform and exceed burst parameters. The 'drop' action for exceed or violate conditions explicitly instructs the router to discard those packets, enforcing traffic shaping or policing at the hardware or software level.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
exceed action is drop
Why this is correct
When a packet exceeds the rate, it can be dropped if configured.
Related concept
Read the scenario before looking for a memorised answer.
conform action is drop
Why it's wrong here
Conform action is normally transmit, not drop.
no bandwidth is reserved
Why it's wrong here
Bandwidth reservation is for scheduling, not policing.
violate action is drop
Why this is correct
The violate action is used for dual-rate policing and can also drop.
Related concept
Read the scenario before looking for a memorised answer.
queue is full
Why it's wrong here
Queue fullness causes tail drop, not policing.
Common exam traps
Cisco often tests the distinction between 'exceed' and 'violate' actions in policing, where candidates mistakenly think only 'violate' can drop packets, but 'exceed' can also be configured to drop, and both are valid conditions for packet loss.
Detailed technical explanation
In Cisco IOS, policing uses a dual-token bucket (conform and exceed buckets) as defined in RFC 2697 (Single Rate Three Color Marker) or RFC 2698 (Two Rate Three Color Marker). The 'violate' action is triggered when both the conform and exceed buckets are exhausted, representing the third color (red). The 'exceed' action is triggered when the conform bucket is empty but the exceed bucket still has tokens. Configuring 'drop' for either exceed or violate ensures that out-of-profile packets are discarded immediately, which is common in strict rate-limiting scenarios like CIR enforcement on a service provider edge.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
A practitioner preparing for the 350-501 exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
What to study next
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Automation and Quality of Service — study guide chapter
Learn the concepts, then practise the questions
Automation and Quality of Service practice questions
Targeted practice on this topic area only
All 350-501 questions
500 questions across all exam domains
Cisco SPCOR / CCNP Service Provider Core 350-501 study guide
Full concept coverage aligned to exam objectives
350-501 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise 350-501 questions linked to Architecture.
Practise 350-501 questions linked to Networking.
Practise 350-501 questions linked to MPLS and Segment Routing.
Practise 350-501 questions linked to Automation and Quality of Service.
Practise 350-501 questions linked to Services.
Practise 350-501 questions linked to Automation and Assurance.
Practise 350-501 questions linked to 350-501 fundamentals.
Practise 350-501 questions linked to 350-501 scenario.
Practise 350-501 questions linked to 350-501 troubleshooting.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Automation and Quality of Service — This question tests Automation and Quality of Service — Read the scenario before looking for a memorised answer..
The correct answer is: exceed action is drop — When a police action is configured, the router uses a token bucket model to meter traffic. If traffic exceeds the committed information rate (CIR) and burst size, it falls into the 'exceed' or 'violate' category depending on the configured conform and exceed burst parameters. The 'drop' action for exceed or violate conditions explicitly instructs the router to discard those packets, enforcing traffic shaping or policing at the hardware or software level.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 25, 2026
This 350-501 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-501 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.