The answer is the CoPP policy is rate-limiting SSH traffic to 8 kbps, causing drops during peak hours. Control Plane Policing (CoPP) protects the router’s control plane by applying a policer to traffic matching the MANAGEMENT class, which here includes SSH destined for the management interface. With a committed information rate (CIR) of only 8000 bps and a burst of 1500 bytes, any SSH traffic exceeding this low threshold—common during peak hours—is dropped by the exceed-action drop, leading to intermittent access failures. On the CCNP ENARSI 300-410 exam, this scenario tests your ability to distinguish CoPP rate-limiting from ACL or routing misconfigurations; a common trap is to blame the access-class on the VTY lines, but that ACL permits the source subnet correctly. Remember the memory tip: “CoPP cops the control plane—if SSH stutters, check the police rate, not the ACL gate.”
300-410 Device Access Control Practice Question
This 300-410 practice question tests your understanding of device access control. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A network administrator notices that SSH access to router R1 from a management station 10.10.10.10 is failing intermittently. R1 has the following configuration: access-list 100 permit tcp 10.10.10.0 0.0.0.255 host 192.168.1.1 eq 22, line vty 0 4 access-class 100 in, and control-plane host control-plane security copp policy-map COPP class MANAGEMENT police cir 8000 bc 1500 conform-action transmit exceed-action drop. The management station is on a different subnet than the management interface. The failure occurs during peak hours. What is the root cause?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The CoPP policy is rate-limiting SSH traffic to 8 kbps, and during peak hours, the traffic exceeds this rate, causing drops.
The CoPP policy-map COPP class MANAGEMENT applies a police rate of 8000 bps (8 kbps) with a burst of 1500 bytes to SSH traffic destined for the control plane. During peak hours, the SSH traffic from the management station exceeds this rate, causing packets to be dropped by the exceed-action drop. This intermittent failure aligns with the rate-limiting behavior of CoPP, not with access-list or routing issues.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
The access-class on the VTY lines is incorrectly configured, blocking SSH traffic from the management station.
Why it's wrong here
The ACL permits the traffic, so access-class is not the issue.
✓
The CoPP policy is rate-limiting SSH traffic to 8 kbps, and during peak hours, the traffic exceeds this rate, causing drops.
Why this is correct
The police command limits SSH traffic, and exceed-action drop causes intermittent failures when the rate is exceeded.
Related concept
Read the scenario before looking for a memorised answer.
✗
The management station is not reachable due to a routing issue.
Why it's wrong here
The failure is intermittent and related to peak hours, not a persistent routing issue.
✗
The SSH server on R1 has a maximum session limit that is being reached.
Why it's wrong here
Session limits would cause persistent failures, not intermittent ones.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the interaction between CoPP and VTY access-class, where candidates mistakenly think the access-class is the issue, but the real culprit is CoPP rate-limiting the control plane traffic before it reaches the VTY lines.
Detailed technical explanation
How to think about this question
CoPP (Control Plane Policing) uses a MQC (Modular QoS CLI) policy-map applied to the control-plane host subinterface, which polices all traffic destined to the router's CPU. The police command with cir 8000 and bc 1500 uses a token bucket algorithm: tokens are added at 8000 bps, and the bucket holds up to 1500 bytes. SSH packets that arrive when the bucket is empty are dropped (exceed-action drop). During peak hours, higher traffic volume causes the bucket to deplete faster, leading to intermittent drops. The access-class on VTY lines is applied after CoPP, so CoPP drops occur before the VTY access check.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security administrator must allow nursing staff to reach a patient records server while blocking access from the guest Wi-Fi VLAN. After applying an extended ACL, traffic is still blocked from nursing workstations. The ACL was applied outbound instead of inbound on the wrong interface. Questions like this test ACL direction and placement rules.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this 300-410 question in full detail.
Device Access Control — This question tests Device Access Control — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: The CoPP policy is rate-limiting SSH traffic to 8 kbps, and during peak hours, the traffic exceeds this rate, causing drops. — The CoPP policy-map COPP class MANAGEMENT applies a police rate of 8000 bps (8 kbps) with a burst of 1500 bytes to SSH traffic destined for the control plane. During peak hours, the SSH traffic from the management station exceeds this rate, causing packets to be dropped by the exceed-action drop. This intermittent failure aligns with the rate-limiting behavior of CoPP, not with access-list or routing issues.
What should I do if I get this 300-410 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.