hardMultiple ChoiceObjective-mapped
300-410 Practice Question: Router R1 has an ACL applied to its VTY lines for…
Router R1 has an ACL applied to its VTY lines for SSH access: access-list 10 permit 10.1.1.0 0.0.0.255 line vty 0 4
access-class 10 in transport input ssh R1 also has CoPP policy: class-map match-all SSH-CLASS match access-group name SSH-ACL policy-map COPP
class SSH-CLASS
police cir 8000 bc 1500 conform-action transmit exceed-action drop R2 (10.1.1.2) shows:
R2# ssh -l admin 10.2.2.1
% Connection refused by remote host
R2# telnet 10.2.2.1
Trying 10.2.2.1 ... % Connection timed out; remote host not responding What is the root cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The CoPP policy is rate-limiting SSH traffic from R2, causing drops.
The ACL on VTY lines permits only 10.1.1.0/24, but the SSH connection from R2 (10.1.1.2) should be allowed. However, the CoPP policy is rate-limiting SSH traffic to 8000 bps. If the police rate is exceeded, packets are dropped. The SSH connection might be failing due to CoPP dropping the packets. The telnet is also failing because it is not permitted by the access-class (only SSH is allowed). The root cause is CoPP rate-limiting SSH traffic, causing drops.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The CoPP policy is rate-limiting SSH traffic from R2, causing drops.
Why this is correct
The police rate of 8000 bps is too low, causing exceed-action drop for SSH packets.
- ✗
The access-class on VTY lines blocks R2's IP address.
Why it's wrong here
R2's IP 10.1.1.2 is within the permitted range.
- ✗
SSH is not enabled on R1's VTY lines.
Why it's wrong here
'transport input ssh' is configured.
- ✗
The SSH-ACL in the class-map does not match SSH traffic.
Why it's wrong here
The class-map matches SSH traffic; the issue is rate-limiting.
Visual reference
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,966-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.