350-401 Security Practice Question
A network engineer is configuring control plane policing (CoPP) on a Cisco IOS XE router that peers BGP with two service providers and is managed over SSH from a jump host. After applying a new policy-map, the engineer notices that BGP sessions remain up but SSH logins intermittently time out during traffic spikes. Which action should the engineer take to resolve the SSH timeouts while preserving the CoPP protection model?
⚠ Common exam trap
The trap here is treating CoPP as an all-or-nothing filter and removing it, rather than recognizing that unclassified management traffic is the real cause of the timeouts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a class-map matching TCP port 22 traffic and attach it to the policy-map with an appropriate rate and conform/exceed actions.
CoPP works by classifying punted control-plane traffic into classes and applying per-class policers. If SSH is not explicitly matched, it is handled by class-default, which is often policed conservatively. Creating a dedicated class matching TCP port 22 with an adequate rate and a conform action of transmit ensures interactive management traffic survives bursts while BGP and other protocols stay protected.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add a class-map matching TCP port 22 traffic and attach it to the policy-map with an appropriate rate and conform/exceed actions.
Why this is correct
SSH traffic must be explicitly classified so CoPP can rate-limit it separately instead of letting it fall into a default or catch-all class that may be policed aggressively. Adding a TCP port 22 class with a suitable rate and transmit action preserves protection while guaranteeing management access. This is the standard CoPP design practice for management protocols.
- ✗
Remove the service-policy from the control plane and rely on QoS on the data plane instead.
Why it's wrong here
Removing CoPP eliminates protection against control-plane floods and CPU exhaustion, which defeats the purpose of the deployment. Data-plane QoS does not police traffic punted to the route processor, so it cannot substitute. This option trades away the security posture rather than fixing the classification gap that causes SSH drops.
- ✗
Increase the BGP class rate and move the SSH class into the BGP class-map.
Why it's wrong here
Merging SSH into the BGP class couples unrelated protocols and lets BGP bursts consume the bandwidth reserved for management access. The problem is a missing or misclassified SSH class, not insufficient BGP bandwidth. This approach also makes future troubleshooting harder because two very different traffic types share one policer.
- ✗
Configure an ACL that permits only the jump host's IP and apply it as the match for the class-default class.
Why it's wrong here
Filtering by source in class-default affects all unmatched traffic patterns and does not give SSH its own guaranteed rate. The jump host's SSH would still be policed by whatever action class-default uses, so timeouts persist under load. Access control is useful, but it does not replace explicit protocol classification in CoPP.
Visual reference
Go deeper
Related to this question
Learn chapter
Network Access Control and AAA
Key term
Control Plane Protection
Control Plane Protection (CoPP) is a security feature on Cisco routers and switches that filters traffic destined to the device's control plane to prevent attacks and ensure stability.
Key term
Control Plane Policing
Control Plane Policing is a Cisco security feature that protects a router or switch by rate-limiting the traffic that the device's processor must handle, preventing it from being overwhelmed.
About these practice questions
This 350-401 question is part of Courseiva's 1,923-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.