How should I use these Control Plane Policing (CoPP) practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Control Plane Policing (CoPP) questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Control Plane Policing (CoPP) domain.

300-410 · topic practice

Control Plane Policing (CoPP) practice questions

Practise Cisco CCNP ENARSI 300-410 Control Plane Policing (CoPP) practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Control Plane Policing (CoPP)

Practice 10 questions Browse domain →

What the exam tests

What to know about Control Plane Policing (CoPP)

QoS questions usually test traffic classification (DSCP/CoS), queuing strategies, policing vs shaping and where each mechanism is applied.

DSCP and CoS marking and trust boundaries.

Queuing mechanisms: FIFO, WFQ, CBWFQ, LLQ.

Policing (drops excess) vs shaping (delays excess).

Where QoS is applied: ingress, egress, LAN, WAN.

Watch out for

Common Control Plane Policing (CoPP) exam traps

▸Policing drops traffic; shaping buffers it — they solve different problems.
▸DSCP EF (46) is for voice; AF classes are for data tiers.
▸QoS must be configured end-to-end to be effective.
▸CoS values are Layer 2; DSCP is Layer 3.

Practice set

Control Plane Policing (CoPP) questions

20 questions · select your answer, then reveal the explanation

Question 1hardmultiple choice

Open the full BGP breakdown →

A network engineer notices that BGP sessions between two directly connected routers are flapping every few minutes. The routers are running IOS-XE 17.3 and have CoPP enabled. The engineer checks the CoPP policy and sees a class-map matching BGP packets with a police rate of 8000 bps. The BGP session uses MD5 authentication and the routers exchange a full BGP table with 500,000 prefixes. What is the most likely cause of the BGP session flapping?

Trap 1: The BGP MD5 authentication is causing excessive CPU utilization,…

MD5 authentication adds CPU overhead but does not cause CoPP drops if the police rate is adequate. The issue is the police rate being too low.

Trap 2: The CoPP class-map is not matching BGP packets correctly because it…

While possible, the scenario states the class-map matches BGP packets, and the symptom is directly related to the police rate being too low.

Trap 3: The BGP hold timer is set too low, causing the session to reset…

The hold timer default is 180 seconds; session flapping every few minutes suggests CoPP drops are the cause, not the hold timer.

Study all Control Plane Policing (CoPP) common traps →

A
The BGP MD5 authentication is causing excessive CPU utilization, triggering CoPP drops.
Why wrong: MD5 authentication adds CPU overhead but does not cause CoPP drops if the police rate is adequate. The issue is the police rate being too low.
B
The CoPP police rate of 8000 bps is too low for the BGP keepalive and update traffic, causing packet drops.
BGP with 500,000 prefixes generates significant update traffic, and 8000 bps is insufficient, leading to dropped packets and session flapping.
C
The CoPP class-map is not matching BGP packets correctly because it uses a wrong access-list.
Why wrong: While possible, the scenario states the class-map matches BGP packets, and the symptom is directly related to the police rate being too low.
D
The BGP hold timer is set too low, causing the session to reset before CoPP drops are noticed.
Why wrong: The hold timer default is 180 seconds; session flapping every few minutes suggests CoPP drops are the cause, not the hold timer.

Full breakdown with real-world context →

Question 2mediummultiple choice

Study the full ACL explanation →

A router experiences high CPU utilization due to SSH login attempts from an external attacker. The network engineer implements a CoPP policy to rate-limit SSH traffic to 10000 bps. After applying the policy, the engineer notices that legitimate SSH sessions from the management network are also being dropped intermittently. The CoPP policy uses a class-map that matches TCP port 22 traffic. What should the engineer do to fix this issue?

Trap 1: Increase the police rate for the SSH class to 100000 bps to allow…

This would allow the attacker's traffic as well, defeating the purpose of CoPP and potentially still causing high CPU.

Trap 2: Modify the class-map to match only SSH traffic from the attacker's…

The goal is to block the attacker, not match them. The engineer should match legitimate sources and police the attacker separately.

Trap 3: Remove the CoPP policy and implement an ACL on the interface to…

This is a valid alternative but does not fix the CoPP issue; the question asks what to do to fix the issue with the current CoPP policy.

Study all Control Plane Policing (CoPP) common traps →

A
Increase the police rate for the SSH class to 100000 bps to allow all SSH traffic.
Why wrong: This would allow the attacker's traffic as well, defeating the purpose of CoPP and potentially still causing high CPU.
B
Modify the class-map to match only SSH traffic from the attacker's source IP addresses using an access-list.
Why wrong: The goal is to block the attacker, not match them. The engineer should match legitimate sources and police the attacker separately.
C
Create a separate class for legitimate SSH traffic from the management network with a higher police rate, and police the attacker's traffic more aggressively.
This allows legitimate SSH sessions to pass while still protecting the control plane from the attacker.
D
Remove the CoPP policy and implement an ACL on the interface to block the attacker's IP address.
Why wrong: This is a valid alternative but does not fix the CoPP issue; the question asks what to do to fix the issue with the current CoPP policy.

Full breakdown with real-world context →

Question 3mediummultiple choice

Review the full OSPF breakdown →

An engineer applies a CoPP policy to a router to protect the control plane. The policy includes a class-map that matches all ICMP traffic and polices it to 5000 bps. After the policy is applied, the engineer notices that OSPF adjacencies are going down. The OSPF hello packets are not being received. What is the most likely cause?

Trap 1: The CoPP policy is policing OSPF packets because the class-map…

The scenario says the class-map matches ICMP traffic; OSPF uses IP protocol 89, so it should not be matched unless the class-map is misconfigured.

Trap 2: The OSPF hello packets are being rate-limited because they are ICMP…

OSPF packets are not ICMP; they are IP protocol 89.

Trap 3: The CoPP policy is applied to the wrong interface, causing OSPF…

CoPP is applied to the control plane, not interfaces. This is a common misconception.

Study all Control Plane Policing (CoPP) common traps →

A
The CoPP policy is policing OSPF packets because the class-map matches all IP traffic, not just ICMP.
Why wrong: The scenario says the class-map matches ICMP traffic; OSPF uses IP protocol 89, so it should not be matched unless the class-map is misconfigured.
B
The CoPP policy has a default class that drops all unmatched traffic, including OSPF packets.
If the CoPP policy does not explicitly permit OSPF packets, a default drop class will cause OSPF adjacencies to fail.
C
The OSPF hello packets are being rate-limited because they are ICMP packets.
Why wrong: OSPF packets are not ICMP; they are IP protocol 89.
D
The CoPP policy is applied to the wrong interface, causing OSPF packets to be dropped.
Why wrong: CoPP is applied to the control plane, not interfaces. This is a common misconception.

Full breakdown with real-world context →

Question 4mediummultiple choice

Study the full EIGRP explanation →

A router running EIGRP has a CoPP policy that includes a class-map matching EIGRP packets with a police rate of 2000 bps. The network engineer notices that EIGRP neighbor adjacencies are flapping. The EIGRP network has 100 routes. The engineer checks the CoPP statistics and sees that the EIGRP class has dropped 500 packets in the last hour. What is the most likely root cause?

Trap 1: The EIGRP hello interval is set too low, causing excessive hello…

The hello interval default is 5 seconds; even if set lower, the police rate should be adjusted accordingly, but the root cause is the police rate being too low.

Trap 2: The EIGRP authentication is causing larger packets that exceed the…

EIGRP authentication adds a small overhead but not enough to cause significant drops with 2000 bps.

Trap 3: The CoPP class-map is matching EIGRP packets incorrectly, causing…

The statistics show drops in the EIGRP class, so the class is matching correctly.

Study all Control Plane Policing (CoPP) common traps →

A
The EIGRP hello interval is set too low, causing excessive hello packets that exceed the police rate.
Why wrong: The hello interval default is 5 seconds; even if set lower, the police rate should be adjusted accordingly, but the root cause is the police rate being too low.
B
The CoPP police rate of 2000 bps is insufficient for EIGRP hello and update traffic, causing packet drops.
EIGRP packets, though small, can be dropped if the police rate is too low, leading to adjacency flapping.
C
The EIGRP authentication is causing larger packets that exceed the police rate.
Why wrong: EIGRP authentication adds a small overhead but not enough to cause significant drops with 2000 bps.
D
The CoPP class-map is matching EIGRP packets incorrectly, causing them to be dropped by a default class.
Why wrong: The statistics show drops in the EIGRP class, so the class is matching correctly.

Full breakdown with real-world context →

Question 5hardmultiple choice

Study the full ACL explanation →

A network engineer configures CoPP on a router to limit PIM-SM control plane traffic. The policy includes a class-map matching PIM packets and polices them to 10000 bps. After the policy is applied, the engineer notices that multicast traffic is not being forwarded correctly, and PIM neighbors are not forming. The router is a PIM-SM rendezvous point (RP). What is the most likely issue?

Trap 1: The CoPP class-map is not matching PIM packets because it uses the…

PIM uses IP protocol 103; if the class-map matches correctly, this is not the issue.

Trap 2: The PIM hello interval is set too high, causing the router to miss…

A higher hello interval would reduce traffic, not cause drops.

Trap 3: The CoPP policy is applied to the wrong control plane, such as the…

CoPP is applied per control plane (IPv4 or IPv6), but the scenario implies IPv4 PIM.

Study all Control Plane Policing (CoPP) common traps →

A
The CoPP policy is dropping PIM register messages because the police rate is too low for the burst of register traffic.
PIM register messages can be large and bursty, and a police rate of 10000 bps may not be sufficient, causing drops and preventing RP functionality.
B
The CoPP class-map is not matching PIM packets because it uses the wrong protocol number.
Why wrong: PIM uses IP protocol 103; if the class-map matches correctly, this is not the issue.
C
The PIM hello interval is set too high, causing the router to miss hello packets from neighbors.
Why wrong: A higher hello interval would reduce traffic, not cause drops.
D
The CoPP policy is applied to the wrong control plane, such as the IPv6 control plane.
Why wrong: CoPP is applied per control plane (IPv4 or IPv6), but the scenario implies IPv4 PIM.

Full breakdown with real-world context →

Question 6mediummultiple choice

Study the full ACL explanation →

A router has a CoPP policy that includes a class-map matching all TCP traffic with a police rate of 5000 bps. The engineer notices that Telnet sessions to the router are timing out, but SSH sessions work fine. The router is configured to accept both Telnet and SSH. What is the most likely cause?

Trap 1: The SSH traffic is encrypted, so it uses less bandwidth than Telnet.

SSH encryption adds overhead, so SSH actually uses slightly more bandwidth than Telnet.

Trap 2: The Telnet server on the router is not responding due to a…

The scenario states both are configured, and the issue is related to CoPP.

Trap 3: The CoPP policy is rate-limiting TCP traffic to 5000 bps, which is…

Both use TCP, and 5000 bps should be sufficient for interactive sessions; the difference is likely due to separate classes.

Study all Control Plane Policing (CoPP) common traps →

A
The CoPP policy has a separate class for Telnet with a lower police rate or a drop action.
If Telnet is in a different class with a lower rate or drop, it would explain why Telnet fails while SSH works.
B
The SSH traffic is encrypted, so it uses less bandwidth than Telnet.
Why wrong: SSH encryption adds overhead, so SSH actually uses slightly more bandwidth than Telnet.
C
The Telnet server on the router is not responding due to a configuration error.
Why wrong: The scenario states both are configured, and the issue is related to CoPP.
D
The CoPP policy is rate-limiting TCP traffic to 5000 bps, which is enough for SSH but not for Telnet.
Why wrong: Both use TCP, and 5000 bps should be sufficient for interactive sessions; the difference is likely due to separate classes.

Full breakdown with real-world context →

Question 7easymultiple choice

Study the full ACL explanation →

An engineer applies a CoPP policy to a router to protect the control plane from a DDoS attack. The policy includes a class-map matching UDP traffic to port 123 (NTP) and polices it to 1000 bps. After the policy is applied, the engineer notices that the router's clock is not synchronizing with its NTP server. The NTP server is reachable via ping. What is the most likely cause?

Trap 1: The NTP server is not responding because of the DDoS attack.

The scenario says the NTP server is reachable via ping, so it is responding.

Trap 2: The CoPP class-map is not matching NTP packets because it uses the…

The scenario states it matches port 123, so it should match.

Trap 3: The router's NTP configuration has a wrong server IP address.

The scenario does not indicate a configuration error; the issue is CoPP-related.

Study all Control Plane Policing (CoPP) common traps →

A
The CoPP policy is dropping NTP packets because the police rate is too low.
NTP packets are small, but if the police rate is too low, they can be dropped, causing synchronization failure.
B
The NTP server is not responding because of the DDoS attack.
Why wrong: The scenario says the NTP server is reachable via ping, so it is responding.
C
The CoPP class-map is not matching NTP packets because it uses the wrong port number.
Why wrong: The scenario states it matches port 123, so it should match.
D
The router's NTP configuration has a wrong server IP address.
Why wrong: The scenario does not indicate a configuration error; the issue is CoPP-related.

Full breakdown with real-world context →

Question 8easymultiple choice

Study the full ACL explanation →

A router has a CoPP policy that includes a class-map matching all traffic from a specific source IP address (the management station) and polices it to 100000 bps. The engineer notices that SNMP polls from the management station are timing out. The SNMP traffic uses UDP port 161. The engineer checks the CoPP statistics and sees that the class for the management station has dropped packets. What is the most likely cause?

Trap 1: The SNMP community string is incorrect on the management station.

This would cause authentication failures, not CoPP drops.

Trap 2: The CoPP class-map is matching the wrong source IP address.

The statistics show drops in that class, so it is matching correctly.

Trap 3: The SNMP agent on the router is not responding due to high CPU.

The drops are in CoPP, not due to high CPU.

Study all Control Plane Policing (CoPP) common traps →

A
The CoPP police rate of 100000 bps is too low for the SNMP traffic from the management station.
SNMP polls can be bursty, and 100000 bps may not be sufficient, leading to drops and timeouts.
B
The SNMP community string is incorrect on the management station.
Why wrong: This would cause authentication failures, not CoPP drops.
C
The CoPP class-map is matching the wrong source IP address.
Why wrong: The statistics show drops in that class, so it is matching correctly.
D
The SNMP agent on the router is not responding due to high CPU.
Why wrong: The drops are in CoPP, not due to high CPU.

Full breakdown with real-world context →

Question 9mediummultiple choice

Study the full ACL explanation →

A network engineer configures CoPP on a router to limit ICMP traffic to 5000 bps. After the policy is applied, the engineer notices that the router is not responding to ping requests from a remote network. However, the router can ping other devices successfully. The engineer checks the CoPP statistics and sees that the ICMP class has dropped packets. What is the most likely root cause?

Trap 1: The CoPP policy is dropping outgoing ICMP echo replies because the…

CoPP applies to incoming traffic to the control plane, not outgoing traffic.

Trap 2: The router's interface ACL is blocking incoming ICMP traffic.

The scenario does not mention an ACL; CoPP is the likely cause.

Trap 3: The router's ICMP rate-limit feature is enabled globally.

ICMP rate-limit is a separate feature; the scenario focuses on CoPP.

Study all Control Plane Policing (CoPP) common traps →

A
The CoPP policy is dropping incoming ICMP echo requests because the police rate is too low.
Incoming ICMP packets are policed by CoPP, and if the rate is exceeded, they are dropped, preventing the router from responding.
B
The CoPP policy is dropping outgoing ICMP echo replies because the police rate applies to both directions.
Why wrong: CoPP applies to incoming traffic to the control plane, not outgoing traffic.
C
The router's interface ACL is blocking incoming ICMP traffic.
Why wrong: The scenario does not mention an ACL; CoPP is the likely cause.
D
The router's ICMP rate-limit feature is enabled globally.
Why wrong: ICMP rate-limit is a separate feature; the scenario focuses on CoPP.

Full breakdown with real-world context →

Question 10mediummultiple choice

Study the full ACL explanation →

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-IN

Class-map: CoPP-ICMP (match-all) 0 packets, 0 bytes 5 minute offered rate 0000 bps, drop rate 0000 bps Match: access-group 100 police: cir 8000 bps, bc 1500 bytes, be 1500 bytes conformed 0 packets, 0 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop

Class-map: CoPP-SSH (match-all) 0 packets, 0 bytes 5 minute offered rate 0000 bps, drop rate 0000 bps Match: access-group 110 police: cir 16000 bps, bc 3000 bytes, be 3000 bytes conformed 0 packets, 0 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop

Class-map: class-default (match-any) 1250 packets, 75000 bytes 5 minute offered rate 1000 bps, drop rate 0000 bps Match: any

Based on this output, which statement is correct?

Trap 1: The CoPP policy is dropping all ICMP packets to the control plane.

The CoPP-ICMP class shows 0 packets, so no ICMP traffic has been classified or dropped.

Trap 2: The CoPP policy is rate-limiting SSH traffic to 16000 bps.

The CoPP-SSH class shows 0 packets, so no SSH traffic has been processed.

Trap 3: The CoPP policy is applied to the output direction.

The output shows 'Service-policy input: CoPP-IN', indicating it is applied to the input direction.

Study all Control Plane Policing (CoPP) common traps →

A
The CoPP policy is dropping all ICMP packets to the control plane.
Why wrong: The CoPP-ICMP class shows 0 packets, so no ICMP traffic has been classified or dropped.
B
The CoPP policy is not matching any packets for the CoPP-ICMP and CoPP-SSH classes.
The packet counters for both classes are zero, indicating no traffic matched these classes.
C
The CoPP policy is rate-limiting SSH traffic to 16000 bps.
Why wrong: The CoPP-SSH class shows 0 packets, so no SSH traffic has been processed.
D
The CoPP policy is applied to the output direction.
Why wrong: The output shows 'Service-policy input: CoPP-IN', indicating it is applied to the input direction.

Full breakdown with real-world context →

Question 11hardmultiple choice

Study the full ACL explanation →

A network engineer runs the following command on Router R1:

R1# show access-lists 100

Extended IP access list 100

10 permit icmp any any echo
    
20 permit icmp any any echo-reply
    
30 permit icmp any any time-exceeded
    
40 permit icmp any any unreachable

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-IN

Based on this output, what is the most likely problem?

Trap 1: The class-map uses 'match-all' instead of 'match-any'.

With a single match criterion, 'match-all' and 'match-any' behave the same.

Trap 2: The police rate is too low and is dropping all packets.

The counters show 0 packets, so no packets have been classified to be dropped.

Trap 3: The policy-map is applied to the wrong direction.

The policy is applied to input, which is correct for CoPP.

Study all Control Plane Policing (CoPP) common traps →

A
The class-map uses 'match-all' instead of 'match-any'.
Why wrong: With a single match criterion, 'match-all' and 'match-any' behave the same.
B
The access-list does not include all ICMP types that may be sent to the control plane.
The access-list only matches specific ICMP types, potentially missing others like router advertisement or parameter problem.
C
The police rate is too low and is dropping all packets.
Why wrong: The counters show 0 packets, so no packets have been classified to be dropped.
D
The policy-map is applied to the wrong direction.
Why wrong: The policy is applied to input, which is correct for CoPP.

Full breakdown with real-world context →

Question 12mediummultiple choice

Open the full BGP breakdown →

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-IN

Class-map: CoPP-BGP (match-all) 500 packets, 30000 bytes 5 minute offered rate 1000 bps, drop rate 500 bps Match: access-group 120 police: cir 8000 bps, bc 1500 bytes, be 1500 bytes conformed 300 packets, 18000 bytes; actions: transmit exceeded 100 packets, 6000 bytes; actions: drop violated 100 packets, 6000 bytes; actions: drop

Based on this output, which statement is correct?

Trap 1: All BGP packets are being transmitted without any drops.

The output shows exceeded and violated packets being dropped.

Trap 2: The police rate is set to 16000 bps.

The CIR is 8000 bps.

Trap 3: The class-default is matching BGP traffic.

BGP traffic is matched by the CoPP-BGP class.

Study all Control Plane Policing (CoPP) common traps →

A
All BGP packets are being transmitted without any drops.
Why wrong: The output shows exceeded and violated packets being dropped.
B
BGP traffic is being rate-limited and some packets are being dropped.
The police counters show packets are being dropped due to exceeding the CIR.
C
The police rate is set to 16000 bps.
Why wrong: The CIR is 8000 bps.
D
The class-default is matching BGP traffic.
Why wrong: BGP traffic is matched by the CoPP-BGP class.

Full breakdown with real-world context →

Question 13hardmultiple choice

Study the full ACL explanation →

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-IN

Class-map: CoPP-SNMP (match-all) 0 packets, 0 bytes 5 minute offered rate 0000 bps, drop rate 0000 bps Match: access-group 130 police: cir 32000 bps, bc 6000 bytes, be 6000 bytes conformed 0 packets, 0 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop

R1# show access-lists 130

Extended IP access list 130

10 permit udp any any eq snmp
    
20 permit udp any any eq snmptrap

Based on this output, what is the most likely reason that no packets are matching the CoPP-SNMP class?

Trap 1: The access-list does not include the correct SNMP port numbers.

Ports 161 and 162 are correct for SNMP.

Trap 2: The police rate is too low and is dropping all packets before…

The counters show 0 packets, so no packets have been classified.

Trap 3: The class-map is using 'match-all' instead of 'match-any'.

With a single match criterion, both are equivalent.

Study all Control Plane Policing (CoPP) common traps →

A
The access-list does not include the correct SNMP port numbers.
Why wrong: Ports 161 and 162 are correct for SNMP.
B
The SNMP traffic is being sent from the router itself, which is not processed through the input control plane policy.
Traffic originated by the router (e.g., SNMP traps) is not subject to input CoPP.
C
The police rate is too low and is dropping all packets before counting.
Why wrong: The counters show 0 packets, so no packets have been classified.
D
The class-map is using 'match-all' instead of 'match-any'.
Why wrong: With a single match criterion, both are equivalent.

Full breakdown with real-world context →

Question 14easymultiple choice

Review the full OSPF breakdown →

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-IN

Class-map: CoPP-OSPF (match-all) 1000 packets, 60000 bytes 5 minute offered rate 2000 bps, drop rate 0000 bps Match: access-group 140 police: cir 64000 bps, bc 12000 bytes, be 12000 bytes conformed 1000 packets, 60000 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop

Based on this output, which statement is correct?

Trap 1: OSPF packets are being dropped due to exceeding the police rate.

The exceeded and violated counters are zero.

Trap 2: The police rate is set to 32000 bps.

The CIR is 64000 bps.

Trap 3: The class-default is matching OSPF traffic.

OSPF traffic is matched by the CoPP-OSPF class.

Study all Control Plane Policing (CoPP) common traps →

A
OSPF packets are being dropped due to exceeding the police rate.
Why wrong: The exceeded and violated counters are zero.
B
OSPF traffic is being transmitted without any drops.
All packets are conforming and being transmitted.
C
The police rate is set to 32000 bps.
Why wrong: The CIR is 64000 bps.
D
The class-default is matching OSPF traffic.
Why wrong: OSPF traffic is matched by the CoPP-OSPF class.

Full breakdown with real-world context →

Question 15mediummultiple choice

Study the full ACL explanation →

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-IN

Class-map: CoPP-DEFAULT (match-any) 5000 packets, 300000 bytes 5 minute offered rate 4000 bps, drop rate 2000 bps Match: any police: cir 32000 bps, bc 6000 bytes, be 6000 bytes conformed 3000 packets, 180000 bytes; actions: transmit exceeded 1000 packets, 60000 bytes; actions: drop violated 1000 packets, 60000 bytes; actions: drop

Based on this output, what is the most likely impact on the router?

Trap 1: All control plane traffic is being transmitted without issues.

The drop rate is 2000 bps, indicating packet loss.

Trap 2: The police rate is set to 64000 bps.

The CIR is 32000 bps.

Trap 3: Only ICMP traffic is being dropped.

The class-default matches any traffic, not just ICMP.

Study all Control Plane Policing (CoPP) common traps →

A
All control plane traffic is being transmitted without issues.
Why wrong: The drop rate is 2000 bps, indicating packet loss.
B
Some control plane traffic is being dropped, which could cause routing protocol instability.
Dropped packets in the class-default can affect critical control plane traffic.
C
The police rate is set to 64000 bps.
Why wrong: The CIR is 32000 bps.
D
Only ICMP traffic is being dropped.
Why wrong: The class-default matches any traffic, not just ICMP.

Full breakdown with real-world context →

Question 16mediummultiple choice

Study the full EIGRP explanation →

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-IN

Class-map: CoPP-EIGRP (match-all) 200 packets, 12000 bytes 5 minute offered rate 1000 bps, drop rate 0000 bps Match: access-group 150 police: cir 16000 bps, bc 3000 bytes, be 3000 bytes conformed 200 packets, 12000 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop

R1# show ip eigrp neighbors

EIGRP-IPv4 neighbors for process 100 H Address Interface Hold Uptime SRTT RTO Q Seq (sec) (ms) Cnt Num 0 10.1.1.2 Gi0/0 13 00:10:00 1 200 0 5

Based on this output, which statement is correct?

Trap 1: EIGRP packets are being dropped, causing neighbor flapping.

The drop counters are zero and the neighbor is up.

Trap 2: The police rate is set to 8000 bps.

The CIR is 16000 bps.

Trap 3: The EIGRP neighbor is not established.

The show command shows an established neighbor.

Study all Control Plane Policing (CoPP) common traps →

A
EIGRP packets are being dropped, causing neighbor flapping.
Why wrong: The drop counters are zero and the neighbor is up.
B
EIGRP traffic is being rate-limited but no packets are dropped.
All packets are conforming and transmitted.
C
The police rate is set to 8000 bps.
Why wrong: The CIR is 16000 bps.
D
The EIGRP neighbor is not established.
Why wrong: The show command shows an established neighbor.

Full breakdown with real-world context →

Question 17hardmultiple choice

Open the full BGP breakdown →

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-IN

Class-map: CoPP-BGP (match-all) 0 packets, 0 bytes 5 minute offered rate 0000 bps, drop rate 0000 bps Match: access-group 120 police: cir 32000 bps, bc 6000 bytes, be 6000 bytes conformed 0 packets, 0 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop

R1# show ip bgp summary

BGP router identifier 1.1.1.1, local AS number 100 BGP table version is 1, main routing table version 1

Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
10.1.1.2        4          200      10      10        1    0    0 00:05:00        5

Based on this output, what is the most likely problem?

Trap 1: The BGP session is down.

The BGP summary shows the neighbor is up with state established.

Trap 2: The police rate is too low and is dropping all BGP packets.

The counters show 0 packets, so no packets have been classified.

Trap 3: The policy-map is applied to the output direction.

The output shows input direction.

Study all Control Plane Policing (CoPP) common traps →

A
The BGP session is down.
Why wrong: The BGP summary shows the neighbor is up with state established.
B
The access-list 120 is not matching BGP traffic, so it is falling into class-default.
The zero packet count indicates the class is not matching, but BGP is working, so traffic is matched by class-default.
C
The police rate is too low and is dropping all BGP packets.
Why wrong: The counters show 0 packets, so no packets have been classified.
D
The policy-map is applied to the output direction.
Why wrong: The output shows input direction.

Full breakdown with real-world context →

Question 18mediummultiple choice

Study the full ACL explanation →

A network engineer runs the following command on Router R1:

R1# show policy-map control-plane

Control Plane

Service-policy input: CoPP-IN

Class-map: CoPP-ICMP (match-all) 100 packets, 6000 bytes 5 minute offered rate 500 bps, drop rate 500 bps Match: access-group 100 police: cir 8000 bps, bc 1500 bytes, be 1500 bytes conformed 50 packets, 3000 bytes; actions: transmit exceeded 25 packets, 1500 bytes; actions: drop violated 25 packets, 1500 bytes; actions: drop

Based on this output, what is the most likely impact on the router?

Trap 1: All ICMP packets are being transmitted without drops.

The drop rate is 500 bps, indicating packet loss.

Trap 2: The police rate is set to 16000 bps.

The CIR is 8000 bps.

Trap 3: The class-default is matching ICMP traffic.

ICMP traffic is matched by the CoPP-ICMP class.

Study all Control Plane Policing (CoPP) common traps →

A
All ICMP packets are being transmitted without drops.
Why wrong: The drop rate is 500 bps, indicating packet loss.
B
ICMP traffic is being rate-limited, causing some ping requests to fail.
Dropped ICMP packets can result in ping loss.
C
The police rate is set to 16000 bps.
Why wrong: The CIR is 8000 bps.
D
The class-default is matching ICMP traffic.
Why wrong: ICMP traffic is matched by the CoPP-ICMP class.

Full breakdown with real-world context →

Question 19mediummultiple choice

Study the full ACL explanation →

Examine the following CoPP configuration on a Cisco IOS-XE router:

!--- ACL to match traffic

access-list 100 permit tcp any any eq 22
access-list 
100 permit tcp any any eq 23
access-list 
100 permit icmp any any echo

! !--- Class-map class-map match-all COPP-MGMT match access-group 100 ! !--- Policy-map policy-map COPP-POLICY

class COPP-MGMT

police 8000 conform-action transmit exceed-action drop

class class-default

police 64000 conform-action transmit exceed-action drop ! !--- Apply to control-plane control-plane service-policy input COPP-POLICY

What is the effect of this configuration?

Trap 1: Only SSH and Telnet are rate-limited to 8000 bps; ICMP echo is not…

Incorrect. The ACL includes ICMP echo, so it is also matched by class COPP-MGMT.

Trap 2: All control-plane traffic is rate-limited to 64000 bps, because the…

Incorrect. The COPP-MGMT class is matched first and applies its own policer. Class-default only applies to traffic not matching any explicit class.

Trap 3: The configuration is invalid because the class-map must be named…

Incorrect. The class-map name 'COPP-MGMT' is valid and properly referenced in the policy-map.

Study all Control Plane Policing (CoPP) common traps →

A
SSH, Telnet, and ICMP echo packets are rate-limited to 8000 bps; all other control-plane traffic is rate-limited to 64000 bps.
Correct. The class COPP-MGMT matches the ACL traffic and applies a 8000 bps policer. The class-default applies a 64000 bps policer to all other traffic.
B
Only SSH and Telnet are rate-limited to 8000 bps; ICMP echo is not affected because it is matched by a different class.
Why wrong: Incorrect. The ACL includes ICMP echo, so it is also matched by class COPP-MGMT.
C
All control-plane traffic is rate-limited to 64000 bps, because the class-default overrides the COPP-MGMT class.
Why wrong: Incorrect. The COPP-MGMT class is matched first and applies its own policer. Class-default only applies to traffic not matching any explicit class.
D
The configuration is invalid because the class-map must be named 'COPP-CLASS' to be used in the policy-map.
Why wrong: Incorrect. The class-map name 'COPP-MGMT' is valid and properly referenced in the policy-map.

Full breakdown with real-world context →

Question 20mediummultiple choice

Review the full OSPF breakdown →

Consider the following CoPP configuration:

class-map match-any COPP-ROUTING match protocol ospf match protocol eigrp match protocol bgp ! policy-map COPP-POLICY

class COPP-ROUTING

police 32000 conform-action transmit exceed-action drop

class class-default

police 64000 conform-action transmit exceed-action drop ! control-plane service-policy input COPP-POLICY

What is a potential issue with this configuration?

Trap 1: The class-map uses match-any instead of match-all, which will cause…

Incorrect. Both match-any and match-all are valid; match-any is actually appropriate here if multiple protocols should be matched individually.

Trap 2: The police rate of 32000 bps is too low for routing protocol…

Incorrect. While the rate might be low, the primary issue is the use of match protocol.

Trap 3: The policy-map must be applied to the control-plane with the…

Incorrect. CoPP can be applied as input or output; input is correct for policing incoming control-plane traffic.

Study all Control Plane Policing (CoPP) common traps →

A
The class-map uses match-any instead of match-all, which will cause incorrect matching.
Why wrong: Incorrect. Both match-any and match-all are valid; match-any is actually appropriate here if multiple protocols should be matched individually.
B
The police rate of 32000 bps is too low for routing protocol traffic and may cause adjacency drops.
Why wrong: Incorrect. While the rate might be low, the primary issue is the use of match protocol.
C
The 'match protocol' command is not supported in CoPP class-maps; only ACLs or DSCP/IP precedence can be used.
Correct. CoPP only supports match access-group, match ip dscp, or match ip precedence. match protocol is not allowed.
D
The policy-map must be applied to the control-plane with the 'output' keyword instead of 'input'.
Why wrong: Incorrect. CoPP can be applied as input or output; input is correct for policing incoming control-plane traffic.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Control Plane Policing (CoPP) sessions

Start a Control Plane Policing (CoPP) only practice session

Every question in these sessions is drawn from the Control Plane Policing (CoPP) domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Control Plane Policing (CoPP) questions →Mixed 300-410 session

Frequently asked questions

What does the 300-410 exam test about Control Plane Policing (CoPP)?: QoS questions usually test traffic classification (DSCP/CoS), queuing strategies, policing vs shaping and where each mechanism is applied.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Control Plane Policing (CoPP) questions in a focused session?: Yes — the session launcher on this page draws every question from the Control Plane Policing (CoPP) domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other 300-410 topics?: Use the topic links above to move to related areas, or go back to the 300-410 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the 300-410 exam covers. They are not copied from any real exam or dump site.

Control Plane Policing (CoPP) only

10 questions 20 questions 30 questions 50 questions

Mixed 300-410 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All 300-410 questions Control Plane Policing (CoPP) domain overview 300-410 exam guide

Exam traps to avoid

▸Policing drops traffic; shaping buffers it — they solve different problems.
▸DSCP EF (46) is for voice; AF classes are for data tiers.
▸QoS must be configured end-to-end to be effective.
▸CoS values are Layer 2; DSCP is Layer 3.

Control Plane Policing (CoPP) practice questions

What to know about Control Plane Policing (CoPP)

Common Control Plane Policing (CoPP) exam traps

Control Plane Policing (CoPP) questions

A router has a CoPP policy that includes a class-map matching all TCP traffic with a police rate of 5000 bps. The engineer notices that Telnet sessions to the router are timing out, but SSH sessions work fine. The router is configured to accept both Telnet and SSH. What is the most likely cause?

Track your progress over time

Start a Control Plane Policing (CoPP) only practice session

Related 300-410 topic practice pages

Layer 3 Technologies practice questions

EIGRP Troubleshooting practice questions

OSPF Troubleshooting (v2/v3) practice questions

BGP Troubleshooting practice questions

Route Redistribution practice questions

Policy-Based Routing (PBR) practice questions

VRF-Lite practice questions

Route Maps and Route Filtering practice questions

Administrative Distance practice questions

Route Summarization practice questions

Bidirectional Forwarding Detection (BFD) practice questions

VPN Technologies practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid