The answer is that SSH traffic is starved because it is not classified and falls into class-default, which may not get enough bandwidth. This occurs because the QoS policy explicitly matches only VOIP and critical data in higher-priority class maps, leaving SSH to be handled by the default class. The class-default in this scenario uses fair-queue, which provides no bandwidth guarantee; when higher-priority classes consume most of the link, class-default traffic like SSH can be completely starved, causing session timeouts or severe packet loss. On the Cisco CyberOps Associate 200-201 exam, this tests your understanding of how QoS traffic classification and prioritization interact with security policies—specifically that unclassified traffic is vulnerable to starvation. A common trap is assuming fair-queue protects all traffic equally, but it only distributes leftover bandwidth among flows in the same class. Memory tip: “If it’s not mapped, it gets starved.”
200-201 Security Policies and Procedures Practice Question
This 200-201 practice question tests your understanding of security policies and procedures. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
Refer to the exhibit.
policy-map QOS_POLICY
class VOIP
priority percent 30
class CRITICAL_DATA
bandwidth remaining percent 50
class class-default
fair-queue
Refer to the exhibit. A security policy requires that network traffic be classified and prioritized to ensure critical applications get bandwidth. A network engineer implements this QoS policy. However, after deployment, a security scanner reports that SSH traffic is starved. Which of the following is the most likely cause?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Refer to the exhibit.
policy-map QOS_POLICY
class VOIP
priority percent 30
class CRITICAL_DATA
bandwidth remaining percent 50
class class-default
fair-queue
A
The priority percent for VOIP is too high.
Why wrong: A 30% priority is reasonable and directly starves only if excessive; but SSH starves because it's not classified.
B
The fair-queue algorithm does not work with this policy.
Why wrong: Fair-queue works in class-default; it is not the cause.
C
The critical data class includes SSH traffic.
Why wrong: If SSH were in CRITICAL_DATA, it would get bandwidth; but it's not.
D
SSH traffic is not classified and falls into class-default, which may not get enough bandwidth.
Since SSH is not in a priority class, it competes with other default traffic.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SSH traffic is not classified and falls into class-default, which may not get enough bandwidth.
Option D is correct because SSH traffic is not explicitly matched by any class map in the policy, so it falls into the class-default. The class-default in this policy uses fair-queue, which does not guarantee a minimum bandwidth; if higher-priority classes (like VOIP and critical data) consume most of the link, class-default can be starved. This results in SSH sessions timing out or experiencing severe packet loss.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
The priority percent for VOIP is too high.
Why it's wrong here
A 30% priority is reasonable and directly starves only if excessive; but SSH starves because it's not classified.
✗
The fair-queue algorithm does not work with this policy.
Why it's wrong here
Fair-queue works in class-default; it is not the cause.
✗
The critical data class includes SSH traffic.
Why it's wrong here
If SSH were in CRITICAL_DATA, it would get bandwidth; but it's not.
✓
SSH traffic is not classified and falls into class-default, which may not get enough bandwidth.
Why this is correct
Since SSH is not in a priority class, it competes with other default traffic.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the misconception that traffic not explicitly classified will still get fair treatment, when in reality class-default can be starved if higher-priority classes consume all bandwidth, especially when priority is used without proper policing or shaping.
Detailed technical explanation
How to think about this question
In Cisco IOS QoS, the class-default uses fair-queue by default when no bandwidth statement is configured, but fair-queue only provides equal sharing among flows within that class—it does not reserve any bandwidth. If the sum of priority and bandwidth allocations in other classes exceeds 100% (or if priority traffic bursts consume all available bandwidth), class-default traffic can be starved. A common best practice is to explicitly classify and reserve bandwidth for management traffic like SSH (e.g., using a class with bandwidth remaining percent) to ensure connectivity during congestion.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A practitioner preparing for the 200-201 exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Security Policies and Procedures — This question tests Security Policies and Procedures — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: SSH traffic is not classified and falls into class-default, which may not get enough bandwidth. — Option D is correct because SSH traffic is not explicitly matched by any class map in the policy, so it falls into the class-default. The class-default in this policy uses fair-queue, which does not guarantee a minimum bandwidth; if higher-priority classes (like VOIP and critical data) consume most of the link, class-default can be starved. This results in SSH sessions timing out or experiencing severe packet loss.
What should I do if I get this 200-201 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.