hardMultiple Choice
CoPP ACL Classification and Default Class Behaviour
A network engineer is configuring CoPP on a Cisco ASR 1000 router to protect the control plane from excessive traffic. The engineer wants to allow BGP traffic from a specific peer (10.0.0.1) while rate-limiting all other BGP traffic. The engineer creates an ACL that permits TCP port 179 from host 10.0.0.1 and denies all other BGP traffic. The CoPP class-map matches this ACL. However, after applying the policy, BGP sessions from other peers are still being established. What is the most likely reason?
Quick Answer
The answer is that the ACL denies all other BGP traffic, so CoPP does not match it, and it falls through to the default class, which permits it. This occurs because CoPP ACL classification works by matching only permitted entries in the access list; a deny entry does not drop traffic but instead causes the packet to skip that class-map and be evaluated by the default class. In the ENCOR 350-401 exam, this scenario tests your understanding that CoPP class-maps use permit statements to select traffic for policing, while any traffic not explicitly permitted is handled by the default class, which typically allows all traffic unless explicitly configured otherwise. A common trap is assuming that a deny in the ACL will drop the traffic, but CoPP ACLs are for classification only—actual policing is done by the policy-map’s action. Remember the memory tip: “Deny in CoPP is just a skip, not a drop.”
⚠ Common exam trap
Cisco often tests the misconception that a deny statement in an ACL used with CoPP will drop traffic, when in reality it only prevents the traffic from being matched by that class, allowing it to fall through to the default class which typically permits everything.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ACL denies all other BGP traffic, so CoPP does not match it, and it falls through to the default class, which permits it.
The ACL is designed to match BGP traffic from host 10.0.0.1 (permit) and deny all other BGP traffic. However, CoPP class-maps match traffic based on permit statements in the ACL; a deny statement in the ACL causes the traffic to not be matched by that class. As a result, BGP traffic from other peers is not classified into the rate-limiting class and falls through to the default class, which typically permits all traffic. This explains why BGP sessions from other peers are still being established.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The ACL denies all other BGP traffic, so CoPP does not match it, and it falls through to the default class, which permits it.
Why this is correct
CoPP class-maps only act on traffic the ACL permits; denied traffic matches no class and falls to the default class, which typically permits it. So other BGP peers are not rate-limited, explaining why their sessions still establish.
- ✗
The ACL is applied in the wrong order; the deny statement should be before the permit statement.
Why it's wrong here
ACLs evaluate top-down, so ordering is already correct; a deny after a permit for other traffic is fine. The real cause is that CoPP polices matched traffic rather than dropping unmatched BGP, so other peers still establish. Tempting because ACL order errors are common, but here the class-map simply does not match them.
- ✗
BGP uses UDP port 179, not TCP, so the ACL does not match BGP traffic.
Why it's wrong here
BGP does run over TCP port 179, so the ACL would match; the real issue lies in how CoPP handles unmatched or denied traffic. The option tempts because UDP is used by protocols such as RIP and SNMP, but BGP's transport is definitively TCP.
- ✗
CoPP does not affect BGP sessions because they are established before the policy is applied.
Why it's wrong here
CoPP applies to control-plane traffic continuously, including new TCP/179 packets for session establishment, so existing sessions are not exempt. The actual cause is that unmatched BGP traffic is not policed by the class-map. Tempting because sessions predate the policy, but CoPP still governs their ongoing packets.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 350-401
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network engineer is troubleshooting an issue where SSH access to a Cisco router from a specific management subnet (10.10.10.0/24) is intermittently failing. The router has a CoPP policy applied to the control plane. The engineer checks the CoPP statistics and sees that packets from the management subnet are being dropped by the control-plane service-policy. Which configuration change should the engineer make to allow SSH from the management subnet while still protecting the control plane?
medium- ✓ A.Modify the CoPP ACL to include a permit statement for TCP port 22 from 10.10.10.0/24 before the deny statement.
- B.Remove the deny statement from the CoPP ACL to allow all traffic.
- C.Increase the police rate for the CoPP class that matches SSH traffic.
- D.Remove the CoPP policy from the control plane and rely on interface ACLs.
Why A: The CoPP policy is dropping SSH packets from the management subnet due to a deny statement in the ACL that matches before any permit for SSH. By adding a permit statement for TCP port 22 from 10.10.10.0/24 before the deny statement, the router will classify SSH traffic into a class that can be policed (or permitted) appropriately, allowing SSH access while still protecting the control plane from other unwanted traffic.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.