350-401 Practice Question: Is troubleshooting an issue where a Cisco router…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Modify the CoPP ACL to include a permit statement for UDP port 161 from host 192.168.1.50 before the deny statement.

  Why this is correct

  The CoPP policy evaluates control-plane traffic using an ordered ACL; if the class-map references an ACL with a deny hit for the NMS's source, SNMP from 192.168.1.50 is not classified into the intended class and may fall through to a default drop action. Inserting a permit statement for UDP port 161 from that host before the existing deny entry ensures the class-map matches correctly, allowing the traffic to be policed under the appropriate CoPP class. This is the only option that directly fixes the selective source-based drop while preserving the security policy.

• ✗

  Increase the police rate for the CoPP class that matches SNMP traffic.

  Why it's wrong here

  Increasing the police rate would allow more SNMP traffic in total, but the problem is that packets from the NMS are being dropped specifically, not that the overall rate is too low. This option is tempting because raising the police rate is a standard way to reduce drops when a class-map is rate-limiting legitimate traffic, and it would be correct if the router were dropping all SNMP packets due to exceeding a configured bandwidth limit. However, the stem indicates selective dropping of only the NMS’s traffic, which requires an ACL-based permit within the class-map, not a rate adjustment.

• ✗

  Remove the CoPP policy from the control plane and rely on interface ACLs.

  Why it's wrong here

  Interface ACLs are applied to forwarding-plane interfaces and are designed to filter transit traffic, not to police the often CPU-punted traffic destined to the route processor. Removing CoPP and relying solely on interface ACLs exposes the control plane to packet floods, because interface ACLs typically do not filter local traffic destined to the CPU unless explicitly configured on a loopback or via control-plane filtering, and they lack CoPP's per-class rate-limiting granularity. Thus this option weakens security without resolving the NMS reachability problem.

• ✗

  Change the SNMP port on the router to a non-standard port to avoid the CoPP policy.

  Why it's wrong here

  Changing the SNMP port on the router only shifts the UDP service to a different number; the NMS would also need to be reconfigured, and the CoPP ACL may still deny the traffic if the matched entry uses a broader match (such as source-IP-based deny or a global deny for the management subnet). Even if the new port happens to avoid the current CoPP deny, this is a workaround that masks the root cause — the precedence and matching logic inside the CoPP class-map — rather than correcting it. The real issue is the ACL order, not the transport port.

Go deeper

Related to this question