mediumMultiple ChoiceObjective-mapped
300-410 Practice Question: Examine this CoPP configuration: ip access-list…
Examine this CoPP configuration:
ip access-list extended PROTECT-ACL permit tcp any any eq 22 permit tcp any any eq
23
permit tcp any any eq 179
! class-map match-all PROTECT-CLASS match access-group name PROTECT-ACL ! policy-map PROTECT-POLICY
class PROTECT-CLASS
police 16000 conform-action transmit exceed-action drop
class class-default
police 64000 conform-action transmit exceed-action drop ! control-plane service-policy input PROTECT-POLICY
What will happen to SSH traffic that exceeds 16000 bps?
⚠ Common exam trap
Cisco often tests the misconception that CoPP can prioritize or remark traffic instead of simply dropping it, leading candidates to choose 'lower priority' or 'still accepted' options, but the exceed-action explicitly defines the fate of excess traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SSH traffic exceeding 16000 bps is dropped.
The CoPP policy applies a police rate of 16000 bps to the PROTECT-CLASS class, which matches SSH traffic via the ACL. When SSH traffic exceeds this rate, the exceed-action is configured to drop, so any SSH packets beyond 16000 bps are discarded. This is standard CoPP behavior: the policer enforces the rate limit regardless of the protocol's importance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
SSH traffic exceeding 16000 bps is dropped.
Why this is correct
Correct. The exceed-action is drop, so any SSH traffic above the conform rate is dropped.
- ✗
SSH traffic exceeding 16000 bps is still accepted because SSH is critical.
Why it's wrong here
Incorrect. The policer enforces the rate; exceed-action drop means excess traffic is dropped.
- ✗
SSH traffic is not affected because the ACL uses 'permit' and the class-map uses 'match-all'.
Why it's wrong here
Incorrect. The ACL permits SSH, and the class-map matches that ACL, so SSH is subject to the policer.
- ✗
SSH traffic exceeding 16000 bps is sent with a lower priority.
Why it's wrong here
Incorrect. There is no priority queuing here; the policer drops excess traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,966 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.