300-410 Infrastructure Security Practice Question
A network administrator is implementing Control Plane Policing (CoPP) on a Cisco IOS router to protect the route processor from excessive traffic. The administrator wants to rate-limit ICMP echo requests destined to the router itself to 64 kbps, while allowing all other traffic to the control plane without restriction. Which configuration snippet correctly achieves this?
⚠ Common exam trap
The trap here is assuming that class-default must always have a policer; in CoPP, if no policer is configured for class-default, traffic in that class is not rate-limited.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
class-map match-any ICMP match access-group name ICMP_ACL ! policy-map COPP class ICMP police 64000 class class-default ! control-plane service-policy input COPP
The correct configuration creates a class map matching ICMP traffic via an ACL, a policy map that polices that class to 64 kbps, and leaves the class-default without a policer. Applying the policy map to the control-plane in the input direction enforces the rate limit on ICMP traffic destined to the router while allowing all other control plane traffic unrestricted.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
class-map match-any ICMP match access-group name ICMP_ACL ! policy-map COPP class ICMP police 64000 class class-default police 8000 ! control-plane service-policy input COPP
Why it's wrong here
This configuration applies a policer to the class-default class, which would rate-limit all other control plane traffic to 8 kbps, contradicting the requirement to allow all other traffic without restriction. The ICMP class is correctly policed, but the default class should not have a policer if unrestricted traffic is desired.
- ✗
class-map match-any ICMP match access-group name ICMP_ACL ! policy-map COPP class ICMP police 64000 class class-default police 8000000 ! control-plane service-policy input COPP
Why it's wrong here
This configuration sets a high policer (8 Mbps) on the class-default, which still imposes a rate limit on other traffic. The requirement is to allow all other traffic without restriction, so no policer should be applied to the default class.
- ✗
class-map match-any ICMP match access-group name ICMP_ACL ! policy-map COPP class ICMP police 64000 conform-action transmit exceed-action drop class class-default police 64000 ! control-plane service-policy output COPP
Why it's wrong here
This configuration applies the service policy in the output direction on the control-plane, which is not valid; CoPP uses the input direction. Additionally, it polices the default class to 64 kbps, which would restrict other traffic, contrary to the requirement.
- ✓
class-map match-any ICMP match access-group name ICMP_ACL ! policy-map COPP class ICMP police 64000 class class-default ! control-plane service-policy input COPP
Why this is correct
This configuration correctly applies a 64 kbps policer to ICMP traffic matching the ACL, while the class-default has no policer, allowing all other control plane traffic to pass without restriction. The control-plane service-policy applies the policy map to the control plane interface.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,401 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.