mediumMultiple SelectObjective-mapped
350-401 Practice Question: Which two statements about Control Plane Policing…
Which two statements about Control Plane Policing (CoPP) are true? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CoPP uses ACLs to match traffic destined for the control plane.
CoPP uses ACLs to classify traffic destined for the control plane and applies a policy map to rate-limit or drop that traffic. It protects the control plane from excessive or malicious traffic. The service policy is applied to the control plane, not to interfaces. CoPP does not protect the data plane forwarding path; it only filters traffic that is punted to the control plane. CoPP can be applied to both IPv4 and IPv6 traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
CoPP uses ACLs to match traffic destined for the control plane.
Why this is correct
Correct because CoPP relies on ACLs to classify traffic that is sent to the control plane.
- ✓
CoPP is applied as a service policy on the control plane interface.
Why this is correct
Correct because the policy map is applied to the control plane using the 'service-policy' command under 'control-plane' configuration.
- ✗
CoPP can only be used to rate-limit traffic, not to drop it.
Why it's wrong here
Incorrect because CoPP can both rate-limit and drop traffic using police actions such as 'drop' or 'transmit'.
- ✗
CoPP is applied to all physical interfaces to protect the data plane.
Why it's wrong here
Incorrect because CoPP is applied to the control plane, not to physical interfaces; data plane protection is handled by other mechanisms like ACLs on interfaces.
- ✗
CoPP can only filter IPv4 traffic.
Why it's wrong here
Incorrect because CoPP can filter both IPv4 and IPv6 traffic using appropriate ACLs.
Visual reference
Go deeper
Related to this question
Learn chapter
BGP Fundamentals and Path Selection
Key term
Control Plane Policing
Control Plane Policing is a Cisco security feature that protects a router or switch by rate-limiting the traffic that the device's processor must handle, preventing it from being overwhelmed.
Key term
Control Plane Protection
Control Plane Protection (CoPP) is a security feature on Cisco routers and switches that filters traffic destined to the device's control plane to prevent attacks and ensure stability.
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,175 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 350-401
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which three statements about Control Plane Policing (CoPP) are true? (Choose three.)
medium- ✓ A.CoPP applies QoS policy-map logic to traffic that is destined to the control plane of the router.
- ✓ B.CoPP is configured under the 'control-plane' global configuration mode.
- ✓ C.CoPP can be applied to both IPv4 and IPv6 traffic in a single policy-map.
- D.CoPP is applied to traffic transiting the router, not to traffic originated by the router.
- E.The default action for CoPP is to permit all control-plane traffic.
Why A: Control Plane Policing (CoPP) protects the router's control plane by applying QoS policies to traffic destined to the router itself. It is configured under the 'control-plane' global configuration mode using class-maps and policy-maps. Option C is correct: CoPP can apply to both IPv4 and IPv6 traffic in a single policy-map by using multiple class-maps (one for each protocol). Option D describes data-plane ACLs, not CoPP. Option E is wrong because the default action of CoPP is to drop unmatched traffic, not permit.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.