hardMultiple Choice
350-401 Practice Question: Runs the following command on Router R1: R1# show…
A network engineer runs the following command on Router R1:
R1# show policy-map control-plane
Control Plane
Service-policy input: CoPP-POLICY
Class-map: ICMP-CLASS (match-all) 10 packets, 1000 bytes 5 minute offered rate 0 bps Match: access-group name ICMP-ACL police: cir 8000 bps, bc 1500 bytes, be 1500 bytes conformed 10 packets, 1000 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop
Class-map: SSH-CLASS (match-all) 5 packets, 500 bytes 5 minute offered rate 0 bps Match: access-group name SSH-ACL police: cir 16000 bps, bc 3000 bytes, be 3000 bytes conformed 5 packets, 500 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop
Class-map: class-default (match-any) 20 packets, 2000 bytes 5 minute offered rate 0 bps Match: any police: cir 64000 bps, bc 8000 bytes, be 8000 bytes conformed 20 packets, 2000 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop
Based on this output, what can be concluded?
⚠ Common exam trap
Cisco often tests the misconception that the class-default police rate applies to all traffic, but in CoPP, each class-map has its own independent police rate, and only traffic not matching explicit classes falls into class-default.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ICMP traffic to the control plane is rate-limited to 8 kbps, and all packets so far have been within the conform rate.
The output shows that for the ICMP-CLASS, the police command sets a CIR of 8000 bps (8 kbps). The counters show 10 packets conformed and 0 packets exceeded or violated, meaning all ICMP traffic to the control plane has been within the conform rate and transmitted. This directly confirms that ICMP traffic is rate-limited to 8 kbps and has not yet exceeded that limit.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
ICMP traffic to the control plane is rate-limited to 8 kbps, and all packets so far have been within the conform rate.
Why this is correct
The output for the ICMP class shows a police CIR of 8000 bps, and the conformed counter equals the total packet count while the exceeded/dropped counter is zero. This means every ICMP packet destined to the control plane was measured as within the committed information rate and was marked conform, so the packets were transmitted normally rather than rate-limited further. The correct statement identifies both the configured rate and the observed behavior: rate-limited to 8 kbps, but with no actual drops because traffic never exceeded the conform burst. This is supported by the 'police' configuration and the accumulated conformed/exceeded statistics in the control-plane policy output.
- ✗
SSH traffic to the control plane is being dropped because it exceeds the CIR.
Why it's wrong here
Although the SSH class is policed with a CIR, the accumulated statistics show 5 conformed packets and 0 exceeded packets, so no SSH packet has violated the committed rate. The 'exceeded' and 'dropped' counters being zero directly disproves the claim that SSH traffic is being dropped; a drop would require the exceed counter to increment and the exceed-action to apply. The misstatement confuses the presence of a police command with the actual observed result, and the output gives no evidence of SSH packets exceeding CIR. Therefore this option is incorrect because the data shows SSH is currently within rate, not being dropped.
- ✗
The control-plane policy is applied in the output direction.
Why it's wrong here
The control-plane policy is shown in the service-policy output as applied 'input,' meaning the MQC policy is evaluated on packets entering the control plane from data-plane forwarding paths. An 'output' policy would instead be attached with the keyword 'output' and would shape or police traffic after control-plane processing, which is not the standard CoPP application in IOS/IOS-XE. The direction matters because ingress CoPP classifies and polices packets before they reach the CPU of the route processor, preventing oversubscription of control-plane resources. Since the command output explicitly includes 'input,' the statement that the policy is applied in the output direction is false.
- ✗
All traffic to the control plane is rate-limited to 64 kbps.
Why it's wrong here
The 64 kbps CIR visible in the output belongs to the class-default policy, and it applies only to traffic that does not match any user-defined class in the control-plane policy. ICMP and SSH are separately classified and each has its own police rate, so their traffic is governed by those per-class CIRs, not by class-default. Therefore saying 'all traffic is rate-limited to 64 kbps' is an overgeneralization; classes with explicit policy definitions take precedence and may have lower or different limits. The correct reading is that 64 kbps is the default ceiling for unmatched traffic, while matched classes are constrained by their own concrete CIR values.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,923 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.