Question 471 of 1,958
hardMultiple ChoiceObjective-mapped
CoPP ACL Classification and Default Class Behaviour
A network engineer is configuring CoPP on a Cisco ASR 1000 router to protect the control plane from excessive traffic. The engineer wants to allow BGP traffic from a specific peer (10.0.0.1) while rate-limiting all other BGP traffic. The engineer creates an ACL that permits TCP port 179 from host 10.0.0.1 and denies all other BGP traffic. The CoPP class-map matches this ACL. However, after applying the policy, BGP sessions from other peers are still being established. What is the most likely reason?
Quick Answer
The answer is that the ACL denies all other BGP traffic, so CoPP does not match it, and it falls through to the default class, which permits it. This occurs because CoPP ACL classification works by matching only permitted entries in the access list; a deny entry does not drop traffic but instead causes the packet to skip that class-map and be evaluated by the default class. In the ENCOR 350-401 exam, this scenario tests your understanding that CoPP class-maps use permit statements to select traffic for policing, while any traffic not explicitly permitted is handled by the default class, which typically allows all traffic unless explicitly configured otherwise. A common trap is assuming that a deny in the ACL will drop the traffic, but CoPP ACLs are for classification only—actual policing is done by the policy-map’s action. Remember the memory tip: “Deny in CoPP is just a skip, not a drop.”
⚠ Common exam trap
Cisco often tests the misconception that a deny statement in an ACL used with CoPP will drop traffic, when in reality it only prevents the traffic from being matched by that class, allowing it to fall through to the default class which typically permits everything.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ACL denies all other BGP traffic, so CoPP does not match it, and it falls through to the default class, which permits it.
The ACL is designed to match BGP traffic from host 10.0.0.1 (permit) and deny all other BGP traffic. However, CoPP class-maps match traffic based on permit statements in the ACL; a deny statement in the ACL causes the traffic to not be matched by that class. As a result, BGP traffic from other peers is not classified into the rate-limiting class and falls through to the default class, which typically permits all traffic. This explains why BGP sessions from other peers are still being established.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The ACL denies all other BGP traffic, so CoPP does not match it, and it falls through to the default class, which permits it.
Why this is correct
Correct because CoPP only applies to traffic matched by the class-map; if the ACL denies traffic, it is not matched, and the default class (often permit) allows it.
- ✗
The ACL is applied in the wrong order; the deny statement should be before the permit statement.
Why it's wrong here
Incorrect because ACL order is evaluated sequentially; a permit before deny would permit the specific peer, but the deny for others would still be processed.
- ✗
BGP uses UDP port 179, not TCP, so the ACL does not match BGP traffic.
Why it's wrong here
Incorrect because BGP uses TCP port 179.
- ✗
CoPP does not affect BGP sessions because they are established before the policy is applied.
Why it's wrong here
Incorrect because CoPP applies to all control plane traffic, including BGP, regardless of when the session was established.
Visual reference
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 350-401
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network engineer is troubleshooting an issue where SSH access to a Cisco router from a specific management subnet (10.10.10.0/24) is intermittently failing. The router has a CoPP policy applied to the control plane. The engineer checks the CoPP statistics and sees that packets from the management subnet are being dropped by the control-plane service-policy. Which configuration change should the engineer make to allow SSH from the management subnet while still protecting the control plane?
medium- ✓ A.Modify the CoPP ACL to include a permit statement for TCP port 22 from 10.10.10.0/24 before the deny statement.
- B.Remove the deny statement from the CoPP ACL to allow all traffic.
- C.Increase the police rate for the CoPP class that matches SSH traffic.
- D.Remove the CoPP policy from the control plane and rely on interface ACLs.
Why A: The CoPP policy is dropping SSH packets from the management subnet due to a deny statement in the ACL that matches before any permit for SSH. By adding a permit statement for TCP port 22 from 10.10.10.0/24 before the deny statement, the router will classify SSH traffic into a class that can be policed (or permitted) appropriately, allowing SSH access while still protecting the control plane from other unwanted traffic.
Last reviewed: Jul 4, 2026
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.