easyMultiple Choice
300-410 Practice Question: A router has a CoPP policy that includes a…
A router has a CoPP policy that includes a class-map matching all traffic from a specific source IP address (the management station) and polices it to 100000 bps. The engineer notices that SNMP polls from the management station are timing out. The SNMP traffic uses UDP port 161. The engineer checks the CoPP statistics and sees that the class for the management station has dropped packets. What is the most likely cause?
⚠ Common exam trap
Cisco often tests the misconception that CoPP drops are always due to incorrect classification or CPU issues, but the trap here is that the engineer sees drops in the correct class, so the root cause is simply that the police rate is insufficient for the actual traffic load.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The CoPP police rate of 100000 bps is too low for the SNMP traffic from the management station.
The CoPP policy polices traffic from the management station to 100,000 bps. SNMP polls typically consist of multiple small UDP packets (e.g., get-request, get-response), but the aggregate rate of these polls can exceed 100 kbps if the polling interval is aggressive or multiple OIDs are queried. The dropped packets in the CoPP class statistics confirm that the policer is throttling the SNMP traffic, causing timeouts. Therefore, the police rate is too low for the actual SNMP traffic volume.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The CoPP police rate of 100000 bps is too low for the SNMP traffic from the management station.
Why this is correct
SNMP polling generates bursts of GET/GETNEXT requests and responses; 100000 bps is insufficient for the management station's polling volume, so the policer drops packets and polls time out. The dropped-packet counter confirms the rate limit is the constraint.
- ✗
The SNMP community string is incorrect on the management station.
Why it's wrong here
A wrong community string would cause authentication failures, not CoPP drops; the class statistics prove packets are being discarded by the policer. It is tempting because community mismatches commonly break SNMP polling, and would be correct if the router logged authentication traps instead of policy drops.
- ✗
The CoPP class-map is matching the wrong source IP address.
Why it's wrong here
The class is matching the management station correctly, since its traffic is being policed and dropped; a wrong source IP would leave that class empty. It is tempting because an incorrect match statement is a common CoPP misconfiguration, and would be correct if the class counters stayed at zero.
- ✗
The SNMP agent on the router is not responding due to high CPU.
Why it's wrong here
CoPP statistics already show the management class dropping packets, so the timeouts trace to policing, not agent CPU. High CPU would be the answer only if SNMP were being dropped before reaching CoPP, or if no policer drops appeared in the class statistics.
Quick reference
IPv4 Address Class Summary
| Class | First Octet Range | Default Mask | Networks | Hosts per Network |
|---|---|---|---|---|
| A | 1–126 | /8 (255.0.0.0) | 126 | 16,777,214 |
| B | 128–191 | /16 (255.255.0.0) | 16,384 | 65,534 |
| C | 192–223 | /24 (255.255.255.0) | 2,097,152 | 254 |
| D | 224–239 | N/A | Multicast groups | — |
| E | 240–255 | N/A | Reserved / experimental | — |
127.x.x.x is reserved for loopback. Modern networks use CIDR (classless) rather than classful addressing.
Go deeper
Related to this question
About these practice questions
One of 1,401 original 300-410 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.