hardMultiple ChoiceObjective-mapped
300-410 Practice Question: Runs the following command on Router R1: R1# show…
A network engineer runs the following command on Router R1:
R1# show access-lists 100
Extended IP access list 100
10 permit icmp any any echo
20 permit icmp any any echo-reply
30 permit icmp any any time-exceeded
40 permit icmp any any unreachable
R1# show policy-map control-planeControl Plane
Service-policy input: CoPP-IN
Class-map: CoPP-ICMP (match-all) 0 packets, 0 bytes 5 minute offered rate 0000 bps, drop rate 0000 bps Match: access-group 100 police: cir 8000 bps, bc 1500 bytes, be 1500 bytes conformed 0 packets, 0 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop
Based on this output, what is the most likely problem?
⚠ Common exam trap
Cisco often tests the misconception that a permit ACL in a CoPP class-map automatically allows all ICMP traffic, when in fact only the explicitly listed ICMP types are permitted, and any unlisted types are implicitly denied by the class-map and handled by the default policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The access-list does not include all ICMP types that may be sent to the control plane.
The access list 100 only permits four specific ICMP types (echo, echo-reply, time-exceeded, unreachable), but the control plane may receive many other ICMP types (e.g., parameter problem, redirect, timestamp, address mask request) that are not explicitly permitted. Since the class-map CoPP-ICMP matches all traffic that hits access-group 100, any ICMP packet with a type not listed will not match the class and will be handled by the default control-plane policy, which typically drops or polices such traffic, leading to legitimate ICMP packets being dropped.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The class-map uses 'match-all' instead of 'match-any'.
Why it's wrong here
With a single match criterion, 'match-all' and 'match-any' behave the same.
- ✓
The access-list does not include all ICMP types that may be sent to the control plane.
Why this is correct
The access-list only matches specific ICMP types, potentially missing others like router advertisement or parameter problem.
- ✗
The police rate is too low and is dropping all packets.
Why it's wrong here
The counters show 0 packets, so no packets have been classified to be dropped.
- ✗
The policy-map is applied to the wrong direction.
Why it's wrong here
The policy is applied to input, which is correct for CoPP.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,966 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.