hardMultiple ChoiceObjective-mapped
CoPP Rate-Limiting Class-Default
A network engineer configures Control Plane Policing (CoPP) on a router with a policy-map that applies a rate-limit of 10000 pps to the class-default class. After applying the policy, the router's CPU utilization spikes and OSPF neighbors go down. What is the most likely explanation?
Quick Answer
The answer is that OSPF packets are matched by class-default and rate-limited, causing hello packets to be dropped. This occurs because Control Plane Policing (CoPP) applies a policy-map to the control plane, and the class-default class catches all traffic not explicitly classified into a higher-priority class. When you apply a rate-limit of 10000 pps to class-default, OSPF hello packets—which are not matched by a dedicated class—fall into this default bucket and are subjected to the rate limit. If the limit is too low, hellos are dropped, breaking neighbor adjacencies and triggering CPU spikes from route recalculation. On the Cisco CCNP ENARSI 300-410 exam, this scenario tests your understanding of CoPP class matching order and the critical need to explicitly classify routing protocol traffic. A common trap is assuming class-default only affects low-priority traffic; in reality, it catches everything not explicitly matched. Memory tip: “Default drops daemons”—if you don’t explicitly protect routing protocols in a CoPP class, the default class will drop them.
⚠ Common exam trap
Cisco often tests the misconception that class-default is safe to rate-limit aggressively, but the trap here is that critical routing protocol packets (like OSPF hellos) are implicitly matched by class-default unless explicitly classified into a higher-priority class, causing them to be dropped and breaking adjacencies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
OSPF packets are matched by class-default and rate-limited, causing hello packets to be dropped.
CoPP applies the policy-map to the control plane, and the class-default class matches all traffic not explicitly classified by other classes. By rate-limiting class-default to 10000 pps, OSPF hello packets (which are not explicitly matched in a higher-priority class) are subjected to the rate limit. If the rate limit is too low, OSPF hellos are dropped, causing neighbor adjacencies to fail and triggering CPU spikes due to route recalculation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
OSPF packets are matched by class-default and rate-limited, causing hello packets to be dropped.
Why this is correct
Without an explicit class for OSPF, it falls into class-default and is subject to the rate-limit, which can drop hellos.
- ✗
The rate-limit is in bps, not pps, so it is too low.
Why it's wrong here
The configuration says pps, so it is in packets per second.
- ✗
The policy-map is applied to the wrong interface; it should be applied to the management interface.
Why it's wrong here
CoPP is applied to the control plane, not interfaces.
- ✗
The router has an ACL that blocks OSPF packets before CoPP processes them.
Why it's wrong here
ACL on interfaces would affect data plane, not control plane.
Visual reference
Quick reference
Routing Protocol Comparison
| Protocol | Metric | Max Hops | Algorithm | Type |
|---|---|---|---|---|
| RIP v2 | Hop count | 15 | Bellman-Ford | Distance vector |
| OSPF | Cost (bandwidth) | Unlimited | Dijkstra (SPF) | Link state |
| EIGRP | Composite metric | Unlimited | DUAL | Hybrid |
| IS-IS | Cost | Unlimited | Dijkstra | Link state |
| BGP | Policy / attributes | Unlimited | Path vector | Path vector |
RIP's 15-hop limit makes it unsuitable for large networks. OSPF and EIGRP dominate modern enterprise deployments.
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,966-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 300-410
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. CoPP is rate-limiting legitimate routing traffic. Router R1 has: class-map match-any ROUTING, match protocol bgp, match protocol ospf, policy-map COPP, class ROUTING, police 10000 conform-action transmit exceed-action drop. BGP sessions flap. What is the root cause?
hard- A.The class-map should match only BGP, not OSPF.
- ✓ B.The police rate is too low, causing drops of BGP packets.
- C.CoPP should be applied to the control plane, not the data plane.
- D.BGP sessions flap due to MTU mismatch, not CoPP.
Why B: B is correct because the police rate of 10,000 bps (10 kbps) is too low for BGP traffic. BGP uses TCP port 179 and can generate bursts of packets during keepalive and update exchanges; if the policer drops BGP packets, the TCP session times out and flaps. The class-map correctly matches both BGP and OSPF, but the rate limit is insufficient for the combined control-plane traffic.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.