Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5
mediumDrag & DropObjective-mapped
350-401 Practice Question: Drag and drop the steps of QoS pre-classify for…
Drag and drop the steps of QoS pre-classify for encrypted VPN traffic into the correct order, from first to last.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure crypto map with QoS pre-classify
First, the crypto map is configured with QoS pre-classify (A) to enable the feature. Next, the service-policy is applied to the tunnel interface (B) to enforce QoS. When a packet arrives, the original packet enters the router before encryption (C). Classification and policing are performed based on the original marking (E). Afterwards, the original DSCP is copied to the encrypted packet header (D) to preserve QoS markings. This sequence ensures correct QoS treatment for VPN traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure crypto map with QoS pre-classify
Why this is correct
Configuring crypto map with QoS pre-classify is the last step, enabling the feature for the VPN tunnel.
- ✓
Apply service-policy to tunnel interface
Why this is correct
Applying the service-policy to the tunnel interface is done after encryption and marking, to enforce QoS on the encrypted traffic.
- ✓
Original packet enters router before encryption
Why this is correct
The original packet must enter the router first, before any classification or encryption occurs.
- ✓
Copy original DSCP to encrypted packet header
Why this is correct
Copying the original DSCP to the encrypted packet header preserves the QoS marking for the outer packet.
- ✓
Classify and police based on original marking
Why this is correct
Classification and policing happen immediately after the packet enters, based on the original markings before encryption.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,175 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.