mediumMultiple Choice
300-410 Practice Question: Runs the following command on Router R1: R1# show…
A network engineer runs the following command on Router R1:
R1# show policy-map control-plane
Control Plane
Service-policy input: CoPP-IN
Class-map: CoPP-ICMP (match-all) 0 packets, 0 bytes 5 minute offered rate 0000 bps, drop rate 0000 bps Match: access-group 100 police: cir 8000 bps, bc 1500 bytes, be 1500 bytes conformed 0 packets, 0 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop
Class-map: CoPP-SSH (match-all) 0 packets, 0 bytes 5 minute offered rate 0000 bps, drop rate 0000 bps Match: access-group 110 police: cir 16000 bps, bc 3000 bytes, be 3000 bytes conformed 0 packets, 0 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop
Class-map: class-default (match-any) 1250 packets, 75000 bytes 5 minute offered rate 1000 bps, drop rate 0000 bps Match: any
Based on this output, which statement is correct?
⚠ Common exam trap
Cisco often tests the distinction between a configured policy and an active policy; candidates see police parameters and assume traffic is being policed, but the zero packet counters reveal that no classification is occurring, so the policy is effectively idle.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The CoPP policy is not matching any packets for the CoPP-ICMP and CoPP-SSH classes.
The output shows that the CoPP-ICMP and CoPP-SSH class-maps have zero packets matched (0 packets, 0 bytes), indicating that no traffic has been classified into these classes. This means the policy is not matching any ICMP or SSH packets, likely because the access-lists (100 and 110) are not correctly defined or applied, or the traffic is not reaching the control plane. Option B correctly identifies this lack of matching.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The CoPP policy is dropping all ICMP packets to the control plane.
Why it's wrong here
ICMP counters read 0 packets and 0 bytes with zero drop rate, so nothing has matched access-group 100 at all; the policy cannot be dropping traffic it never classified. It is tempting because the exceeded and violated actions are drop, which would discard ICMP once the 8000 bps CIR is breached — but only if packets actually arrived.
- ✓
The CoPP policy is not matching any packets for the CoPP-ICMP and CoPP-SSH classes.
Why this is correct
Both CoPP-ICMP and CoPP-SSH report 0 packets and 0 bytes, while class-default shows 1250 packets. The policers therefore never matched traffic, confirming the access-group match criteria for those two classes are not hitting any packets.
- ✗
The CoPP policy is rate-limiting SSH traffic to 16000 bps.
Why it's wrong here
The 16000 bps CIR is the configured committed rate for the CoPP-SSH class, not proof that SSH is being limited: 0 packets and 0 bytes show no SSH traffic has hit the policer. It is tempting because police cir defines the rate-limit threshold, which would govern SSH once access-group 110 matched live traffic.
- ✗
The CoPP policy is applied to the output direction.
Why it's wrong here
The header shows Service-policy input: CoPP-IN, so the policy inspects ingress control-plane traffic; output direction is not configured here. It is tempting because CoPP can be attached in the output direction on some platforms, but this router's configuration and counters reflect inbound policing only.
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,401-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.