hardMultiple SelectObjective-mapped
300-410 Practice Question: An engineer must implement CoPP to protect the…
An engineer must implement CoPP to protect the control plane of a Cisco IOS router from a DoS attack targeting SSH and SNMP. Which TWO configuration changes are required? (Choose TWO.)
⚠ Common exam trap
Cisco often tests the distinction between applying CoPP under control-plane configuration versus interface configuration, and the correct direction (input vs output) for protecting the control plane from inbound attacks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an extended ACL that matches TCP port 22 (SSH) and UDP port 161 (SNMP).
CoPP uses an extended ACL to classify traffic for the control plane. SSH uses TCP port 22 and SNMP uses UDP port 161, so an extended ACL matching these protocols and ports is required to identify the DoS attack traffic. This ACL is then referenced by a class-map to define the traffic class for the CoPP policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an extended ACL that matches TCP port 22 (SSH) and UDP port 161 (SNMP).
Why this is correct
Correct. ACLs are used to match the specific control plane traffic (SSH and SNMP) for classification.
- ✗
Apply the CoPP policy under the interface configuration mode using 'service-policy input'.
Why it's wrong here
Incorrect. CoPP is applied under the control-plane configuration, not under a physical interface.
- ✓
Configure a class-map that matches the ACL created in step A.
Why this is correct
Correct. The class-map uses the ACL to classify SSH and SNMP traffic.
- ✗
Apply the CoPP policy under the control-plane configuration using 'service-policy output'.
Why it's wrong here
Incorrect. CoPP uses 'service-policy input' because the control plane receives traffic; 'output' is not supported for CoPP.
- ✗
Use the 'police' command with 'conform-action drop' to drop all SSH and SNMP traffic.
Why it's wrong here
Incorrect. Dropping all SSH and SNMP traffic would block legitimate management access. The engineer should rate-limit or drop only excessive traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,966 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.