mediumMultiple Choice
300-410 Practice Question: Examine this CoPP configuration: ip access-list…
Examine this CoPP configuration:
ip access-list extended PROTECT-ACL permit tcp any any eq 22 permit tcp any any eq
23
permit tcp any any eq 179
! class-map match-all PROTECT-CLASS match access-group name PROTECT-ACL ! policy-map PROTECT-POLICY
class PROTECT-CLASS
police 16000 conform-action transmit exceed-action drop
class class-default
police 64000 conform-action transmit exceed-action drop ! control-plane service-policy input PROTECT-POLICY
What will happen to SSH traffic that exceeds 16000 bps?
⚠ Common exam trap
Cisco often tests the misconception that CoPP can prioritize or remark traffic instead of simply dropping it, leading candidates to choose 'lower priority' or 'still accepted' options, but the exceed-action explicitly defines the fate of excess traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SSH traffic exceeding 16000 bps is dropped.
The CoPP policy applies a police rate of 16000 bps to the PROTECT-CLASS class, which matches SSH traffic via the ACL. When SSH traffic exceeds this rate, the exceed-action is configured to drop, so any SSH packets beyond 16000 bps are discarded. This is standard CoPP behavior: the policer enforces the rate limit regardless of the protocol's importance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
SSH traffic exceeding 16000 bps is dropped.
Why this is correct
SSH matches PROTECT-CLASS, whose police action drops traffic exceeding 16000 bps, satisfying the stem's rate constraint. The class-default policer is irrelevant here because match-all classification places SSH in PROTECT-CLASS first, so excess SSH packets are discarded rather than falling through to the 64000 bps default.
- ✗
SSH traffic exceeding 16000 bps is still accepted because SSH is critical.
Why it's wrong here
CoPP polices traffic by rate, not by protocol importance, so SSH exceeding 16000 bps hits exceed-action drop like any other matched flow. Treating SSH as inherently exempt is tempting because it is management-critical, but criticality would instead justify a higher committed rate in the police statement, not automatic acceptance.
- ✗
SSH traffic is not affected because the ACL uses 'permit' and the class-map uses 'match-all'.
Why it's wrong here
The ACL's permit entries only select which packets the class-map matches; policing then applies the 16000 bps rate regardless, dropping excess SSH. The permit keyword is often mistaken for an exemption from policy actions, but it merely defines classification membership, not treatment.
- ✗
SSH traffic exceeding 16000 bps is sent with a lower priority.
Why it's wrong here
Exceed-action drop discards packets above 16000 bps; no priority or marking mechanism exists in this policy, so excess SSH is dropped, not deprioritised. It is tempting to assume policing implies queuing treatment, but CoPP police only transmits or drops.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,401 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.