hardMultiple ChoiceObjective-mapped
300-410 Practice Question: Applies a CoPP (Control Plane Policing) policy to…
A network engineer applies a CoPP (Control Plane Policing) policy to a router running VRF-Lite. The policy includes a class that matches SSH traffic and polices it to 1 Mbps. After applying the policy, the engineer cannot SSH into the router from any VRF. Which is the most likely explanation?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The CoPP policy has an explicit 'deny' in the class-default, which drops all traffic not matched by other classes.
CoPP policies are applied to the control plane and affect all traffic destined to the router, regardless of VRF. However, CoPP uses the global routing table for classification. If the SSH traffic is sourced from a VRF, the CoPP policy may not match it correctly because the class-map might be using 'match protocol' or 'match access-group' that is evaluated in the global context. Additionally, the default class (class-default) often has a police action that drops traffic if not explicitly allowed. A common edge case is that the engineer forgot to include a 'class-default' action to permit traffic, causing all unmatched traffic to be dropped.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The CoPP policy has an explicit 'deny' in the class-default, which drops all traffic not matched by other classes.
Why this is correct
If class-default has a 'police' or 'drop' action, all unmatched traffic (including SSH) is dropped. The engineer should have added a 'class class-default' with 'police' or 'permit'.
- ✗
The SSH traffic is being policed to 1 Mbps, but the traffic rate is below that, so it should be allowed.
Why it's wrong here
If the traffic is below the police rate, it should be allowed. The issue is not the police rate but the classification.
- ✗
The CoPP policy is applied to the control plane of the VRF, not the global control plane, so it does not affect SSH traffic.
Why it's wrong here
CoPP is applied globally to the control plane, not per-VRF. There is no per-VRF CoPP.
- ✗
The SSH traffic is being matched by a different class that has a 'drop' action, such as a class for ICMP.
Why it's wrong here
This is possible but less likely than the default class issue. The question states the policy includes a class for SSH, so it should match.
Go deeper
Related to this question
Learn chapter
Introduction to ENARSI Exam and Network Fundamentals
Key term
MPLS Layer 3 VPN
A technology that uses Multiprotocol Label Switching to create secure, scalable virtual private networks that connect multiple sites at the network layer, where the service provider manages routing between customer sites.
Key term
Control Plane Policing
Control Plane Policing is a Cisco security feature that protects a router or switch by rate-limiting the traffic that the device's processor must handle, preventing it from being overwhelmed.
About these practice questions
This 300-410 question is part of Courseiva's 1,966-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.