Quick Answer
The answer is that BGP sessions may flap due to dropped keepalives. This is correct because CoPP (Control Plane Policing) operates on control plane traffic, not data plane traffic, and BGP keepalives are control plane packets essential for maintaining neighbor adjacency. When a CoPP policy rate-limits or drops these keepalives, the router fails to refresh the BGP session timer, causing the session to time out and flap. On the ENCOR 350-401 exam, this question tests your understanding of what constitutes control plane versus data plane traffic—a common trap is confusing BGP keepalives with data plane forwarding. Remember that SSH management and SNMP monitoring are also control plane, but the question specifically highlights BGP instability because keepalives are time-sensitive. A useful memory tip: “Keepalives keep the conversation alive; if CoPP chokes them, BGP goes silent.”
This 350-401 practice question tests your understanding of security. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A network engineer applies the above CoPP policy on a router. The router has BGP peers, SSH management, and SNMP monitoring. After applying this policy, which traffic will be affected?
BGP sessions may flap due to dropped keepalives.
BGP keepalives are matched and subject to the policer.
Data plane traffic will be dropped.
Why wrong: CoPP only applies to control-plane.
Only SSH sessions will be rate-limited.
Why wrong: SSH is matched but so are others.
SNMP and SSH will be unaffected because they are explicitly permitted.
Why wrong: Permitted traffic is still rate-limited.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
BGP sessions may flap due to dropped keepalives.
The CoPP policy applies to control plane traffic, not data plane traffic. BGP keepalives are control plane packets; if the policy drops or rate-limits them, BGP sessions may time out and flap. The correct answer is A because BGP keepalives are essential for maintaining neighbor adjacency, and dropping them directly causes session instability.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
BGP sessions may flap due to dropped keepalives.
Why this is correct
BGP keepalives are matched and subject to the policer.
Related concept
Read the scenario before looking for a memorised answer.
Data plane traffic will be dropped.
Why it's wrong here
CoPP only applies to control-plane.
Only SSH sessions will be rate-limited.
Why it's wrong here
SSH is matched but so are others.
SNMP and SSH will be unaffected because they are explicitly permitted.
Why it's wrong here
Permitted traffic is still rate-limited.
Common exam traps
Cisco often tests the misconception that CoPP affects data plane traffic or that only management protocols like SSH are impacted, when in fact control plane policing targets all control plane packets, including routing protocol keepalives.
Detailed technical explanation
CoPP uses MQC (Modular QoS CLI) to classify control plane packets into classes and apply actions like drop, permit, or police. BGP keepalives are sent every 60 seconds by default (RFC 4271) and are classified as control plane traffic; if the police rate is set too low or the class map drops them, the hold timer (default 180 seconds) expires, causing the BGP session to reset. In real-world scenarios, misconfigured CoPP can silently disrupt routing protocols while leaving management traffic like SSH functional, leading to hard-to-diagnose network instability.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
A network engineer at a university connects two campus buildings via a fibre link. Both routers run OSPF, but no adjacency forms — even though both routers can ping each other. The engineer finds one router is in area 0 and the other in area 1. OSPF adjacency requires matching area numbers, hello/dead timers, and network type. IP reachability alone is not enough.
What to study next
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Security — study guide chapter
Learn the concepts, then practise the questions
Security practice questions
Targeted practice on this topic area only
All 350-401 questions
2,015 questions across all exam domains
ENCOR 350-401 study guide
Full concept coverage aligned to exam objectives
350-401 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise 350-401 questions linked to Architecture.
Practise 350-401 questions linked to Enterprise Network Design.
Practise 350-401 questions linked to SD-Access Architecture.
Practise 350-401 questions linked to SD-WAN Architecture.
Practise 350-401 questions linked to QoS Architecture.
Practise 350-401 questions linked to Virtualization.
Practise 350-401 questions linked to Network Function Virtualization.
Practise 350-401 questions linked to Virtual Machines and Hypervisors.
Practise 350-401 questions linked to VRF and Path Isolation.
Practise 350-401 questions linked to Infrastructure.
Practise 350-401 questions linked to OSPF.
Practise 350-401 questions linked to BGP.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Security — This question tests Security — Read the scenario before looking for a memorised answer..
The correct answer is: BGP sessions may flap due to dropped keepalives. — The CoPP policy applies to control plane traffic, not data plane traffic. BGP keepalives are control plane packets; if the policy drops or rate-limits them, BGP sessions may time out and flap. The correct answer is A because BGP keepalives are essential for maintaining neighbor adjacency, and dropping them directly causes session instability.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.