300-410 Layer 3 Technologies Practice Question
A network engineer is implementing CoPP on a Cisco router to protect the control plane from DoS attacks. The engineer wants to rate-limit ICMP echo requests destined to the router's management IP address. Which CoPP policy component is responsible for defining the traffic classification?
⚠ Common exam trap
Many candidates confuse the role of the class map with that of the policy map, thinking the policy map defines classification when it actually defines actions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Class map
The correct answer is the class map, which defines the traffic classification by matching specific packet characteristics. In CoPP, class maps are used to identify traffic of interest, such as ICMP echo requests. The policy map then applies actions like policing to those classes. The service policy attaches the policy map to the control plane, and ACLs can be used within class maps for matching but are not the classification component themselves.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Class map
Why this is correct
The class map is used to classify traffic by matching specific criteria, such as protocol type, source/destination IP, or port numbers. In this scenario, to rate-limit ICMP echo requests, the engineer would create a class map that matches ICMP echo-request packets. Therefore, the class map is the component that defines the traffic classification for CoPP.
- ✗
Access control list (ACL)
Why it's wrong here
An ACL can be used within a class map to match traffic, but it is not the CoPP policy component itself. The ACL provides the matching criteria, but the class map is the component that organizes and defines the classification. Thus, while an ACL may be part of the classification, the class map is the correct answer for the component responsible.
- ✗
Policy map
Why it's wrong here
The policy map associates class maps with actions, such as policing or dropping. While it is essential for applying the rate limit, it does not define the traffic classification itself. The classification is defined in the class map, which the policy map references. Thus, the policy map is not the component responsible for classification.
- ✗
Service policy
Why it's wrong here
The service policy is the attachment of a policy map to an interface or control plane. It activates the policy but does not define the classification. The classification is contained within the class map. Therefore, the service policy is not the correct component for defining traffic classification.
Quick reference
IPv4 Address Class Summary
| Class | First Octet Range | Default Mask | Networks | Hosts per Network |
|---|---|---|---|---|
| A | 1–126 | /8 (255.0.0.0) | 126 | 16,777,214 |
| B | 128–191 | /16 (255.255.0.0) | 16,384 | 65,534 |
| C | 192–223 | /24 (255.255.255.0) | 2,097,152 | 254 |
| D | 224–239 | N/A | Multicast groups | — |
| E | 240–255 | N/A | Reserved / experimental | — |
127.x.x.x is reserved for loopback. Modern networks use CIDR (classless) rather than classful addressing.
Go deeper
Related to this question
About these practice questions
One of 1,401 original 300-410 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.