mediumMultiple Choice
350-401 Practice Question: Examine the CoPP configuration: class-map…
Examine the CoPP configuration:
class-map match-any COPP_SSH match access-group name SSH_ACL ! policy-map COPP_POLICY
class COPP_SSH
police 10000 conform-action transmit exceed-action drop
class class-default
police 5000 conform-action transmit exceed-action drop ! control-plane service-policy input COPP_POLICY
Which statement is true?
⚠ Common exam trap
Cisco often tests the misconception that class-default is optional or ignored when not explicitly configured, but in reality it is always present and must be considered in CoPP policies to avoid unintended drops of essential control plane traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SSH traffic is limited to 10 kbps; all other control plane traffic is limited to 5 kbps.
The CoPP policy explicitly matches SSH traffic via the COPP_SSH class and applies a police rate of 10,000 bps (10 kbps) to it. All other control plane traffic falls into class-default, which is policed at 5,000 bps (5 kbps). The 'conform-action transmit exceed-action drop' ensures that traffic exceeding these rates is dropped, so SSH is limited to 10 kbps and all other control plane traffic to 5 kbps.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
SSH traffic is limited to 10 kbps; all other control plane traffic is limited to 5 kbps.
Why this is correct
SSH class (COPP_SSH) is explicitly matched with a police rate of 10000 bps, so SSH control-plane packets conform to that 10 kbps limit. The class-default is configured with a police rate of 5000 bps, applying to all other control-plane traffic not matched by a specific class. Since CoPP uses a hierarchy where class-default catches unmatched traffic, the effective result is SSH at 10 kbps and everything else at 5 kbps.
- ✗
All control plane traffic is limited to 10 kbps.
Why it's wrong here
This misstates the policy-map, because the 10 kbps rate is applied only to the SSH class, not globally. All other traffic is classified into class-default and is limited to 5000 bps. A single police rate is per-class, not an aggregate service-policy limit, so control plane traffic as a whole does not share a single 10 kbps constraint.
- ✗
The class-default police rate is ignored because it is not explicitly matched.
Why it's wrong here
class-default is always present in a policy-map and matches all traffic that does not match any other class; it does not need an explicit ACL. The police rate for class-default is therefore enforced, not ignored, because every packet is evaluated against the class-map criteria and falls into class-default if no earlier class matches. Ignoring it would leave unmatched traffic unpoliced, which defeats the purpose of CoPP.
- ✗
The policy-map should be applied to an interface, not the control plane.
Why it's wrong here
CoPP is designed to protect the CPU from excessive traffic, so the policy-map must be attached to the control plane interface using 'control-plane' global configuration mode, not a physical or logical interface. Applying the policy to a data-plane interface would police only transit traffic and would not filter the punted or locally originated packets that the CPU handles. The control plane is the correct and only place to apply this QoS policy.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.