350-401 · topic practice
Practise 350-401 ACL questions covering standard vs extended ACLs, top-down processing, implicit deny, inbound vs outbound placement, and troubleshooting traffic that is unexpectedly blocked or permitted.
Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.
What the exam tests
ACL questions usually test top-down rule processing, source and destination matching, protocol or port logic, and where the ACL should be applied.
Why learners struggle
ACL questions are missed when learners apply the wrong direction, overlook the implicit deny, or confuse standard ACL source-only matching with extended ACL protocol and destination matching. A single out-of-order rule or wrong interface direction makes an otherwise correct ACL fail.
Watch out for
Practice set
20 questions · select your answer, then reveal the explanation
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Trap 1: Fabric border node
The border node connects the fabric to external networks but does not enforce SGT policies at the access layer.
Trap 2: Fabric control plane node
The control plane node maintains the LISP mapping database but does not enforce SGT policies.
Trap 3: Wireless LAN controller
The WLC may assign SGTs to wireless clients, but the enforcement of SGT policies occurs at the fabric edge switch.
Fabric border node
Why wrong: The border node connects the fabric to external networks but does not enforce SGT policies at the access layer.
Fabric control plane node
Why wrong: The control plane node maintains the LISP mapping database but does not enforce SGT policies.
Fabric edge node
The fabric edge switch enforces SGT-based policies by applying SGACLs based on the SGT assigned by ISE during authentication.
Wireless LAN controller
Why wrong: The WLC may assign SGTs to wireless clients, but the enforcement of SGT policies occurs at the fabric edge switch.
Trap 1: The CoPP policy is applied to the wrong interface, affecting…
Incorrect because CoPP is applied to the control plane, not an interface.
Trap 2: The class-map should match on DSCP values instead of port numbers…
Incorrect because matching port numbers is valid; the issue is the police rate.
Trap 3: The policy-map should use the 'drop' action instead of 'police' to…
Incorrect because 'police' is the correct action; 'drop' would drop all matched traffic.
The police rate of 1 Mbps is too low for the combined SSH and SNMP traffic from the management station.
Correct because the police rate is insufficient, causing drops of legitimate control plane traffic.
The CoPP policy is applied to the wrong interface, affecting transit traffic instead of control plane traffic.
Why wrong: Incorrect because CoPP is applied to the control plane, not an interface.
The class-map should match on DSCP values instead of port numbers to be effective.
Why wrong: Incorrect because matching port numbers is valid; the issue is the police rate.
The policy-map should use the 'drop' action instead of 'police' to protect the control plane.
Why wrong: Incorrect because 'police' is the correct action; 'drop' would drop all matched traffic.
Trap 1: Fabric edge node
Edge nodes enforce intra-VN policies but are not designed for inter-VN inspection.
Trap 2: Fabric control plane node
Control plane nodes do not forward traffic and cannot enforce inspection policies.
Trap 3: Fabric WAN router
WAN routers connect to external networks but are not specialized for inter-VN policy enforcement.
Fabric border node
Border nodes can apply policy-based routing to steer inter-VN traffic to a firewall.
Fabric edge node
Why wrong: Edge nodes enforce intra-VN policies but are not designed for inter-VN inspection.
Fabric control plane node
Why wrong: Control plane nodes do not forward traffic and cannot enforce inspection policies.
Fabric WAN router
Why wrong: WAN routers connect to external networks but are not specialized for inter-VN policy enforcement.
Drag a concept onto its matching description — or click a concept then click the description.
Equivalent to ip access-list extended in IPv4
Equivalent to deny ip in IPv4 extended ACL
Equivalent to permit tcp in IPv4 extended ACL
Equivalent to sequence number in IPv4 named ACL
Equivalent to implicit deny ip in IPv4 ACL
Drag a concept onto its matching description — or click a concept then click the description.
Filters based on source IP address only
Filters based on source/destination IP, protocol, and port numbers
Allows alphanumeric naming for easier identification
Applies time-of-day restrictions to permit or deny traffic
Opens temporary holes for user authentication
Trap 1: CoPP can only be used to rate-limit traffic, not to drop it.
Incorrect because CoPP can both rate-limit and drop traffic using police actions such as 'drop' or 'transmit'.
Trap 2: CoPP is applied to all physical interfaces to protect the data…
Incorrect because CoPP is applied to the control plane, not to physical interfaces; data plane protection is handled by other mechanisms like ACLs on interfaces.
Trap 3: CoPP can only filter IPv4 traffic.
Incorrect because CoPP can filter both IPv4 and IPv6 traffic using appropriate ACLs.
CoPP uses ACLs to match traffic destined for the control plane.
Correct because CoPP relies on ACLs to classify traffic that is sent to the control plane.
CoPP is applied as a service policy on the control plane interface.
Correct because the policy map is applied to the control plane using the 'service-policy' command under 'control-plane' configuration.
CoPP can only be used to rate-limit traffic, not to drop it.
Why wrong: Incorrect because CoPP can both rate-limit and drop traffic using police actions such as 'drop' or 'transmit'.
CoPP is applied to all physical interfaces to protect the data plane.
Why wrong: Incorrect because CoPP is applied to the control plane, not to physical interfaces; data plane protection is handled by other mechanisms like ACLs on interfaces.
CoPP can only filter IPv4 traffic.
Why wrong: Incorrect because CoPP can filter both IPv4 and IPv6 traffic using appropriate ACLs.
Trap 1: ACL entries are processed from bottom to top, with the last match…
Incorrect because ACL entries are processed sequentially from top to bottom; the first match determines the action.
Trap 2: An ACL applied to an inbound interface filters traffic leaving that…
Incorrect because an inbound ACL filters traffic entering the interface; an outbound ACL filters traffic leaving the interface.
Standard ACLs can filter traffic based on source IP address only.
Correct because standard ACLs (numbered 1-99, 1300-1999) examine only the source IP address.
Extended ACLs can filter based on source and destination IP addresses, protocol, and port numbers.
Correct because extended ACLs (numbered 100-199, 2000-2699) support these additional match criteria.
An implicit deny any statement is automatically added at the end of every ACL.
Correct because all ACLs have an implicit deny any at the end, which drops any traffic not explicitly permitted.
ACL entries are processed from bottom to top, with the last match determining the action.
Why wrong: Incorrect because ACL entries are processed sequentially from top to bottom; the first match determines the action.
An ACL applied to an inbound interface filters traffic leaving that interface.
Why wrong: Incorrect because an inbound ACL filters traffic entering the interface; an outbound ACL filters traffic leaving the interface.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag a concept onto its matching description — or click a concept then click the description.
CPU overload from excessive control plane traffic
IP spoofing attacks
Rogue DHCP server
ARP cache poisoning
IP spoofing on access ports
A network engineer runs the following command on Router R1:
R1# show policy-map control-plane
Control Plane
Service-policy input: CoPP-POLICY
Class-map: BGP-CLASS (match-all) 50 packets, 2500 bytes 5 minute offered rate 500 bps Match: access-group name BGP-ACL police: cir 64000 bps, bc 8000 bytes, be 8000 bytes conformed 50 packets, 2500 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop
Class-map: SNMP-CLASS (match-all) 200 packets, 10000 bytes 5 minute offered rate 2000 bps Match: access-group name SNMP-ACL police: cir 16000 bps, bc 2000 bytes, be 2000 bytes conformed 150 packets, 7500 bytes; actions: transmit exceeded 40 packets, 2000 bytes; actions: drop violated 10 packets, 500 bytes; actions: drop
Class-map: class-default (match-any) 100 packets, 5000 bytes 5 minute offered rate 1000 bps Match: any police: cir 32000 bps, bc 4000 bytes, be 4000 bytes conformed 100 packets, 5000 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop
Based on this output, what can be concluded?
Trap 1: BGP traffic is being dropped because it exceeds the CIR.
BGP shows all 50 packets conformed, so no drops.
Trap 2: All traffic to the control plane is being dropped.
Only SNMP traffic is being partially dropped; BGP and class-default have no drops.
Trap 3: The control-plane policy is applied in the output direction.
The service-policy is input, so it is inbound.
SNMP traffic to the control plane is experiencing drops due to exceeding its policer rate, while BGP traffic is within its rate.
The SNMP class shows 150 conformed and 50 dropped (exceeded+violated), while BGP shows all 50 conformed.
BGP traffic is being dropped because it exceeds the CIR.
Why wrong: BGP shows all 50 packets conformed, so no drops.
All traffic to the control plane is being dropped.
Why wrong: Only SNMP traffic is being partially dropped; BGP and class-default have no drops.
The control-plane policy is applied in the output direction.
Why wrong: The service-policy is input, so it is inbound.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Examine the following CoPP configuration on a Cisco IOS-XE router: ``` class-map match-all CONTROL-PLANE match access-group name COPP-ACL ! policy-map COPP-POLICY
class CONTROL-PLANE
police 1000000 200000 conform-action transmit exceed-action drop ! control-plane service-policy input COPP-POLICY ``` What is the effect of this configuration?
Trap 1: All control plane traffic is rate-limited to 1 Mbps.
Incorrect. Only traffic matching the class-map (via ACL) is affected.
Trap 2: Traffic exceeding 1 Mbps is marked down but still transmitted.
Incorrect. The action is 'drop', not mark.
Trap 3: The policy-map is applied to the data plane, not the control plane.
Incorrect. The 'control-plane' section applies it to the control plane.
Traffic matching the ACL is rate-limited to 1 Mbps; traffic exceeding the rate is dropped.
Correct. The police command enforces a 1 Mbps rate with drop for excess.
All control plane traffic is rate-limited to 1 Mbps.
Why wrong: Incorrect. Only traffic matching the class-map (via ACL) is affected.
Traffic exceeding 1 Mbps is marked down but still transmitted.
Why wrong: Incorrect. The action is 'drop', not mark.
The policy-map is applied to the data plane, not the control plane.
Why wrong: Incorrect. The 'control-plane' section applies it to the control plane.
Trap 1: Increase the police rate for the CoPP class that matches SNMP…
Increasing the police rate would allow more SNMP traffic in total, but the problem is that packets from the NMS are being dropped specifically, not that the overall rate is too low. This option is tempting because raising the police rate is a standard way to reduce drops when a class-map is rate-limiting legitimate traffic, and it would be correct if the router were dropping all SNMP packets due to exceeding a configured bandwidth limit. However, the stem indicates selective dropping of only the NMS’s traffic, which requires an ACL-based permit within the class-map, not a rate adjustment.
Trap 2: Remove the CoPP policy from the control plane and rely on interface…
Incorrect because removing CoPP leaves the control plane vulnerable.
Trap 3: Change the SNMP port on the router to a non-standard port to avoid…
Incorrect because this would require changes on the NMS and may not resolve the issue if the CoPP policy is not updated.
Modify the CoPP ACL to include a permit statement for UDP port 161 from host 192.168.1.50 before the deny statement.
Correct because this allows SNMP traffic from the NMS to be classified and permitted by the CoPP policy.
Increase the police rate for the CoPP class that matches SNMP traffic.
Why wrong: Increasing the police rate would allow more SNMP traffic in total, but the problem is that packets from the NMS are being dropped specifically, not that the overall rate is too low. This option is tempting because raising the police rate is a standard way to reduce drops when a class-map is rate-limiting legitimate traffic, and it would be correct if the router were dropping all SNMP packets due to exceeding a configured bandwidth limit. However, the stem indicates selective dropping of only the NMS’s traffic, which requires an ACL-based permit within the class-map, not a rate adjustment.
Remove the CoPP policy from the control plane and rely on interface ACLs.
Why wrong: Incorrect because removing CoPP leaves the control plane vulnerable.
Change the SNMP port on the router to a non-standard port to avoid the CoPP policy.
Why wrong: Incorrect because this would require changes on the NMS and may not resolve the issue if the CoPP policy is not updated.
Trap 1: The police rate is too low, and the traffic is being dropped due to…
Incorrect because the traffic rate is 5 Mbps, which is below the 10 Mbps police rate.
Trap 2: The DSCP value AF41 is not supported on Nexus switches.
Incorrect because DSCP AF41 is supported on Nexus switches.
Trap 3: The CoPP policy is applied to the wrong queue, causing all traffic…
Incorrect because CoPP policies are applied to the control plane, not queues.
The CoPP policy has a conform-action of drop, which drops all traffic matching the class.
Correct because if the conform-action is set to drop, all traffic in that class is dropped, even if it is within the police rate.
The police rate is too low, and the traffic is being dropped due to exceeding the rate.
Why wrong: Incorrect because the traffic rate is 5 Mbps, which is below the 10 Mbps police rate.
The DSCP value AF41 is not supported on Nexus switches.
Why wrong: Incorrect because DSCP AF41 is supported on Nexus switches.
The CoPP policy is applied to the wrong queue, causing all traffic to be dropped.
Why wrong: Incorrect because CoPP policies are applied to the control plane, not queues.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Free account
Create a free account to save your results and see which topics improve across sessions.
Focused Acls And Copp sessions
Every question in these sessions is drawn from the Acls And Copp domain — nothing else.
Related practice questions
Move into related areas when this topic feels solid.
Practise 350-401 questions linked to Architecture.
Practise 350-401 questions linked to Virtualization.
Practise 350-401 questions linked to Infrastructure.
Practise 350-401 questions linked to Network Assurance.
Practise 350-401 questions linked to Security.
Practise 350-401 questions linked to Automation.
Practise eBGP/iBGP peering, path attributes, route selection and BGP troubleshooting.
Practise OSPF area types, LSA types, neighbour states and multi-area design.
Practise EIGRP DUAL, metrics, stub routing and route redistribution.
Practise VLAN configuration, trunk negotiation and inter-VLAN routing.
Practise RSTP, MSTP, port roles and STP protection features.
Practise extended ACLs, CoPP rate-limiting and control-plane protection.
A free account saves results across sessions and highlights which topics need work.
Sign up free