Cisco CCNP Enterprise 350-401 ENCOR ACLs and Control Plane Policing Practice Test

 

Topic 16 covers acls and control plane policing for the Cisco Certified Specialist – Enterprise Core certification. These original practice questions apply the verified 350-401 objectives to practical decisions and troubleshooting. Select one answer unless a fixed number is requested. For broader preparation, visit the Cisco 350-401 ENCOR Exam Dumps page. Each option includes an explanation of the relevant behavior and scenario constraints.

Question 1

An IPv4 extended ACL must match exactly subnet 10.20.32.0/20. Which source address and wildcard pair represents that subnet?

10. 10.20.32.0 255.255.240.0
11. 10.20.32.0 0.0.31.255
12. 10.20.32.0 0.0.7.255
13. 10.20.32.0 0.0.15.255
14. 10.20.32.0 0.0.0.20

Correct Answer: D

 

Correct Answer

Answer D is correct because /20 has mask 255.255.240.0, so the inverse wildcard is 0.0.15.255.

Incorrect Answers

Answer A is incorrect because that is a subnet mask, not an IOS wildcard mask in this ACL field.

Answer B is incorrect because that wildcard corresponds to a /19-sized block. It does not satisfy the stem’s governing point: Convert an IPv4 subnet mask to an ACL wildcard by inverting the mask bits.

Answer C is incorrect because that matches a /21-sized block. It does not satisfy the stem’s governing point: Convert an IPv4 subnet mask to an ACL wildcard by inverting the mask bits.

Answer E is incorrect because wildcards are bit masks, not prefix-length values. It does not satisfy the stem’s governing point: Convert an IPv4 subnet mask to an ACL wildcard by inverting the mask bits.

 

Question 2

An ACL is evaluated top to bottom:
`10 permit tcp 10.0.0.0 0.255.255.255 any eq 443`
`20 deny ip 10.10.0.0 0.0.255.255 any`
`30 permit ip any any`
A packet is TCP from 10.10.5.5 to 192.0.2.20 destination port 443. What happens?

1. It is permitted by sequence 10 before sequence 20 is considered.
2. The ACL compares all matches and uses the last one.
3. It is denied by sequence 20 because the /16 is more specific.
4. It is denied by the implicit deny.
5. It is permitted only by sequence 30.

Correct Answer: A

 

Correct Answer

Answer A is correct because the source matches 10.0.0.0/8 and the destination TCP port is 443, so the first matching ACE terminates evaluation.

Incorrect Answers

Answer B is incorrect because IOS ACLs use first-match semantics. It does not satisfy the stem’s governing point: Ordered ACLs use the first matching ACE; specificity does not override an earlier match.

Answer C is incorrect because ACLs use configured order, not longest-prefix selection among ACEs.

Answer D is incorrect because a prior explicit permit matches. It does not satisfy the stem’s governing point: Ordered ACLs use the first matching ACE; specificity does not override an earlier match.

Answer E is incorrect because sequence 10 already matches first. It does not satisfy the stem’s governing point: Ordered ACLs use the first matching ACE; specificity does not override an earlier match.

 

Question 3

An inbound ACL contains only `permit tcp 192.0.2.0 0.0.0.255 any eq 22`. A UDP DNS packet from 192.0.2.10 to 198.51.100.53 does not match the explicit line. With no later ACE, what happens?

1. It is converted to TCP.
2. It is permitted because the source subnet matches.
3. Implicit deny blocks the UDP packet.
4. It is logged and permitted automatically.
5. It bypasses the ACL because UDP is not listed.

Correct Answer: C

 

Correct Answer

Answer C is correct because packets not explicitly permitted by any ACE are denied.

Incorrect Answers

Answer A is incorrect because ACLs filter; they do not change transport protocols.

Answer B is incorrect because the ACE also requires TCP destination port 22.

Answer D is incorrect because logging is optional and does not reverse the implicit deny.

Answer E is incorrect because unmatched IP traffic reaches the implicit deny. It does not satisfy the stem’s governing point: Remember the implicit deny after the final ACE when evaluating unmatched traffic.

 

Question 4

Consider `permit tcp any eq 1024 host 198.51.100.20 eq 443`. Which packet characteristic is constrained to port 1024?

1. Both source and destination ports.
2. The TCP source port.
3. The source IP address.
4. The IP protocol number.
5. The TCP destination port.

Correct Answer: B

 

Correct Answer

Answer B is correct because the first port operator follows the source address and therefore matches the source port.

Incorrect Answers

Answer A is incorrect because different operators constrain each side separately. It does not satisfy the stem’s governing point: In an extended ACL, a port operator after the source address constrains source port; one after destination constrains destination port.

Answer C is incorrect because the source IP is `any`; the 1024 value is a port match.

Answer D is incorrect because `tcp` already selects the transport protocol. It does not satisfy the stem’s governing point: In an extended ACL, a port operator after the source address constrains source port; one after destination constrains destination port.

Answer E is incorrect because the destination operator is the later `eq 443`.

 

Question 5

An ACE uses the TCP `established` keyword to permit return traffic. An engineer claims it performs full stateful session tracking. What is the correct limitation?

1. It tests TCP ACK/RST flags, not full state.
2. It verifies the three-way handshake from both endpoints in state memory.
3. It encrypts established TCP payloads.
4. It automatically opens dynamic return holes for all protocols.
5. It works only for UDP.

Correct Answer: A

 

Correct Answer

Answer A is correct because the keyword is a flag-based ACL test, not a stateful firewall session engine.

Incorrect Answers

Answer B is incorrect because that overstates its capability. It does not satisfy the stem’s governing point: Do not equate TCP flag matching in an ACL with a stateful firewall that tracks full connection state.

Answer C is incorrect because ACL matching does not provide encryption. It does not satisfy the stem’s governing point: Do not equate TCP flag matching in an ACL with a stateful firewall that tracks full connection state.

Answer D is incorrect because it does not implement generic stateful inspection. It does not satisfy the stem’s governing point: Do not equate TCP flag matching in an ACL with a stateful firewall that tracks full connection state.

Answer E is incorrect because the keyword is specifically associated with TCP. It does not satisfy the stem’s governing point: Do not equate TCP flag matching in an ACL with a stateful firewall that tracks full connection state.

 

Question 6

An ACL is applied inbound on Gi1/0/1. A packet physically enters the router through Gi1/0/1 and would later exit Gi1/0/2. At which point is the ACL evaluated?

2. Only after it exits Gi1/0/2.
3. After the return packet arrives.
4. Gi1/0/1 inbound evaluates it on entry.
5. Only for packets generated by the router.
6. Only when a VTY login occurs.

Correct Answer: C

 

Correct Answer

Answer C is correct because inbound ACL direction is relative to traffic entering the configured interface.

Incorrect Answers

Answer A is incorrect because that would describe an outbound ACL on Gi1/0/2.

Answer B is incorrect because the current packet is evaluated on its configured direction.

Answer D is incorrect because interface ACLs commonly filter transit traffic. It does not satisfy the stem’s governing point: Interface ACL direction is relative to the configured interface: inbound sees packets arriving on it; outbound sees packets leaving it.

Answer E is incorrect because VTY access-class is a different use of ACLs.

 

Question 7

A standard ACL blocks source subnet 10.10.0.0/16. The same router serves many destinations, but only traffic from that source toward one remote site should be blocked. Where is a standard source-only ACL generally safer to place?

1. Place it near the destination path.
2. Inside the NetFlow exporter.
3. On the console line.
4. On the NTP server.
5. As close to the source as possible on every interface.

Correct Answer: A

 

Correct Answer

Answer A is correct because standard ACLs cannot select destination, so downstream placement can limit collateral scope.

Incorrect Answers

Answer B is incorrect because flow export is not packet enforcement. It does not satisfy the stem’s governing point: Because standard IPv4 ACLs match source only, placement near the intended destination can avoid overblocking unrelated paths.

Answer C is incorrect because line access filtering does not implement the transit requirement.

Answer D is incorrect because time services are unrelated. It does not satisfy the stem’s governing point: Because standard IPv4 ACLs match source only, placement near the intended destination can avoid overblocking unrelated paths.

Answer E is incorrect because that could block the source from all destinations.

 

Question 8

An extended ACL blocks TCP/443 from one client subnet to one server subnet and should affect no other destinations. Both source and destination are explicitly matched. Where is the conventional placement to minimize unwanted traffic crossing the network?

1. In the SNMP view.
2. On VTY lines because TCP/443 is a management protocol.
3. Only at the destination server host, never on a router.
4. On every interface in both directions.
5. Place the extended ACL near the source.

Correct Answer: E

 

Correct Answer

Answer E is correct because extended ACLs can identify both endpoints/application, so early filtering can reduce needless transit.

Incorrect Answers

Answer A is incorrect because SNMP views do not filter transit TCP sessions.

Answer B is incorrect because HTTPS transit filtering is not VTY CLI access control.

Answer C is incorrect because routers/switches can apply extended ACLs. It does not satisfy the stem’s governing point: Extended ACLs are often placed near the source because their specific match limits collateral effects while dropping unwanted traffic early.

Answer D is incorrect because duplicating filters broadly can cause unintended effects. It does not satisfy the stem’s governing point: Extended ACLs are often placed near the source because their specific match limits collateral effects while dropping unwanted traffic early.

 

Question 9

An engineer wants to restrict which management workstations may SSH to the router itself. They instead apply an interface ACL on one user-facing routed interface. Why may this be the wrong control point?

1. SSH ignores all ACLs.
2. VTY lines carry transit user traffic.
3. Interface ACLs cannot match TCP/22.
4. The router must use RSPAN to filter SSH.
5. Use VTY access controls for administrative line access.

Correct Answer: E

 

Correct Answer

Answer E is correct because line access and routed-interface filtering have different scopes.

Incorrect Answers

Answer A is incorrect because SSH traffic can be filtered, but the scope is the issue.

Answer B is incorrect because VTY lines are for terminal sessions to the device.

Answer C is incorrect because extended ACLs can match TCP ports. It does not satisfy the stem’s governing point: Choose VTY/management access controls when the requirement is administrative login to the device rather than transit filtering on one interface.

Answer D is incorrect because mirroring does not enforce access. It does not satisfy the stem’s governing point: Choose VTY/management access controls when the requirement is administrative login to the device rather than transit filtering on one interface.

 

Question 10

A stateful application works outbound through an ACL but return TCP packets are dropped by a separate inbound ACL on the opposite interface. Which design mistake is most likely?

1. The switch needs a multicast RP.
2. Return traffic needs its own stateless ACL permit.
3. Return traffic always bypasses inbound ACLs.
4. TCP replies must use the same source/destination ports as the request without reversal.
5. The outbound permit automatically creates state in every ACL.

Correct Answer: B

 

Correct Answer

Answer B is correct because stateless interface ACLs require each direction to be permitted by the applicable rules.

Incorrect Answers

Answer A is incorrect because multicast is unrelated. It does not satisfy the stem’s governing point: Stateless ACL design must account for the return packet tuple and direction separately.

Answer C is incorrect because it is evaluated when entering an interface with an inbound ACL.

Answer D is incorrect because client/server source/destination port roles reverse on return traffic.

Answer E is incorrect because ordinary ACLs do not create universal stateful return entries.

 

Question 11

An ACL currently has `10 deny ip 10.20.0.0 0.0.255.255 any` followed by `20 permit ip any any`. A new requirement must permit 10.20.5.0/24 to server 192.0.2.50 while preserving the broader deny. What must happen?

10. Insert the narrow permit before sequence 10.
11. Append the permit after sequence 20.
12. Use a later deny to reverse the first deny.
13. Change the server route metric.
14. Replace the broad deny with `permit any`.

Correct Answer: A

 

Correct Answer

Answer A is correct because first-match logic requires the exception to precede the general deny.

Incorrect Answers

Answer B is incorrect because the traffic would already match the deny at sequence 10.

Answer C is incorrect because later entries are never evaluated after a match.

Answer D is incorrect because routing does not override ACL order. It does not satisfy the stem’s governing point: Place narrow exceptions before broader deny entries in an ordered ACL.

Answer E is incorrect because that removes the original security requirement. It does not satisfy the stem’s governing point: Place narrow exceptions before broader deny entries in an ordered ACL.

 

Question 12

A management subnet must reach a router on TCP/22, but all other TCP connection attempts to the router management address should be denied while ICMP from the monitoring subnet remains allowed. What ACL design principle is necessary?

1. Permit all IP first and add denials afterward.
2. Use only the implicit deny and no permits.
3. Put every rule after `deny ip any any`.
4. Permit required SSH/ICMP before the broader denies.
5. Use one standard ACL because destination port matching is unnecessary.

Correct Answer: D

 

Correct Answer

Answer D is correct because required management flows need specific exceptions before more general blocks.

Incorrect Answers

Answer A is incorrect because a top permit-all would shadow all later denies.

Answer B is incorrect because that would block the required management traffic. It does not satisfy the stem’s governing point: Construct ACLs from specific required permits and deliberate broader restrictions, respecting first-match order.

Answer C is incorrect because those entries would never match. It does not satisfy the stem’s governing point: Construct ACLs from specific required permits and deliberate broader restrictions, respecting first-match order.

Answer E is incorrect because the requirement distinguishes TCP/22 and ICMP. It does not satisfy the stem’s governing point: Construct ACLs from specific required permits and deliberate broader restrictions, respecting first-match order.

 

Question 13

An IPv6 ACL must permit HTTPS from prefix `2001:db8:10::/64` to host `2001:db8:20::50`. Which address notation belongs in an IPv6 ACL?

1. Use only decimal AS numbers.
2. Replace `/64` with `0.0.0.255`.
3. Convert both IPv6 addresses to IPv4 wildcard masks.
4. Use the IPv6 prefix directly and the destination host address.
5. Use MAC address masks because IPv6 cannot be filtered by prefix.

Correct Answer: D

 

Correct Answer

Answer D is correct because IPv6 ACL syntax uses IPv6 prefixes rather than IPv4 wildcard masks.

Incorrect Answers

Answer A is incorrect because BGP AS numbers are unrelated. It does not satisfy the stem’s governing point: IPv6 ACLs match IPv6 prefixes/hosts using IPv6 syntax rather than IPv4 wildcard masks.

Answer B is incorrect because that is an IPv4 wildcard and invalid conceptually for the IPv6 prefix.

Answer C is incorrect because IPv4 wildcard notation is not used for IPv6 address matching.

Answer E is incorrect because IPv6 ACLs can match IPv6 prefixes. It does not satisfy the stem’s governing point: IPv6 ACLs match IPv6 prefixes/hosts using IPv6 syntax rather than IPv4 wildcard masks.

 

Question 14

An IPv6 security policy is tightened to allow only selected application traffic. After deployment, neighbor discovery on the local segment breaks. What design lesson is relevant?

1. Increase BGP local preference.
2. Block all ICMPv6 because IPv6 never needs it.
3. Preserve required ICMPv6 neighbor-discovery traffic.
4. Replace IPv6 ACLs with IPv4 ACLs.
5. Enable Telnet to restore neighbor discovery.

Correct Answer: C

 

Correct Answer

Answer C is correct because IPv6 relies on ICMPv6 functions for fundamental local operations, so blanket filtering can break connectivity.

Incorrect Answers

Answer A is incorrect because routing policy does not repair blocked local ICMPv6 discovery.

Answer B is incorrect because that is incorrect and can disrupt neighbor discovery and other functions.

Answer D is incorrect because IPv4 filters do not match IPv6 traffic. It does not satisfy the stem’s governing point: Restrictive IPv6 ACLs must account for required ICMPv6 control functions rather than treating all ICMPv6 as disposable.

Answer E is incorrect because remote CLI transport is unrelated. It does not satisfy the stem’s governing point: Restrictive IPv6 ACLs must account for required ICMPv6 control functions rather than treating all ICMPv6 as disposable.

 

Question 15

A named ACL has sequence 10 permit management subnet, sequence 20 deny a broad corporate subnet, and sequence 30 permit any. A new /28 exception inside the denied corporate range must be allowed without rebuilding the list. What is the best change?

1. Change the interface IP address.
2. Insert a new permit with a sequence number between 10 and 20.
3. Delete all sequence numbers.
4. Append the permit at sequence 40.
5. Change sequence 30 to deny.

Correct Answer: B

 

Correct Answer

Answer B is correct because sequence numbering supports insertion before the broader deny.

Incorrect Answers

Answer A is incorrect because addressing is unrelated to ACL ordering. It does not satisfy the stem’s governing point: ACL sequence numbers let you insert an exception at the required first-match position.

Answer C is incorrect because that removes the ordering tool rather than using it.

Answer D is incorrect because the broad deny at 20 would match first.

Answer E is incorrect because that affects unrelated traffic and does not create the needed exception.

 

Question 16

An ACL has two permit entries that could both match a flow, but the first entry counter increases while the second remains zero during testing. What does this indicate?

1. The first matching ACE shadows later matches.
2. The second entry is more specific and therefore secretly wins.
3. Both entries process each packet and only one counter is displayed.
4. The counters prove the interface has no traffic.
5. The ACL must be outbound.

Correct Answer: A

 

Correct Answer

Answer A is correct because ACL processing stops at the first match. This directly matches the stem’s governing point: ACL hit counters help identify which first-match entry is actually handling a tested flow.

Incorrect Answers

Answer B is incorrect because ACLs do not perform longest-match selection. It does not satisfy the stem’s governing point: ACL hit counters help identify which first-match entry is actually handling a tested flow.

Answer C is incorrect because a packet is not processed by every later matching ACE.

Answer D is incorrect because the first counter is increasing. It does not satisfy the stem’s governing point: ACL hit counters help identify which first-match entry is actually handling a tested flow.

Answer E is incorrect because counter behavior alone does not establish direction. It does not satisfy the stem’s governing point: ACL hit counters help identify which first-match entry is actually handling a tested flow.

 

Question 17

After adding `permit tcp 10.0.0.0 0.255.255.255 any eq 443` at sequence 5, a later sequence 50 deny for one risky 10.10.0.0/16 subnet stops receiving hits for HTTPS traffic. Why?

1. ACLs automatically disable later denies after any configuration change.
2. Sequence 50 is too high to be valid.
3. HTTPS cannot be denied by ACL.
4. The earlier broad HTTPS permit now shadows the later deny for matching 10.10.x.x traffic.
5. The deny requires an SNMP poll to activate.

Correct Answer: D

 

Correct Answer

Answer D is correct because first-match order means the broad permit consumes the packets before sequence 50.

Incorrect Answers

Answer A is incorrect because only matching/order explains this case. It does not satisfy the stem’s governing point: After ACL changes, review for newly shadowed entries created by broader earlier ACEs.

Answer B is incorrect because higher sequence numbers are valid; they simply evaluate later.

Answer C is incorrect because TCP/443 can be matched. It does not satisfy the stem’s governing point: After ACL changes, review for newly shadowed entries created by broader earlier ACEs.

Answer E is incorrect because no such activation is required. It does not satisfy the stem’s governing point: After ACL changes, review for newly shadowed entries created by broader earlier ACEs.

 

Question 18

A client packet is permitted by every ACL counter along the forward path, but the application still fails. A return-path traceroute from the server has no route to the client subnet. What should be concluded?

1. ACL evidence does not show a denial; the missing return route is a separate forwarding problem that explains the failed bidirectional session.
2. Disable all ACL logging.
3. Move the ACL to VTY lines.
4. Add duplicate permit statements until the application works.
5. The ACL must still be the cause because applications cannot fail from routing.

Correct Answer: A

 

Correct Answer

Answer A is correct because successful forward filtering and absent return route are distinct.

Incorrect Answers

Answer B is incorrect because logging state does not create the return route.

Answer C is incorrect because that changes scope and does not solve routing.

Answer D is incorrect because there is no evidence additional permits are needed.

Answer E is incorrect because routing is fundamental to return traffic. It does not satisfy the stem’s governing point: Separate ACL denial evidence from routing failures; a permitted forward path does not guarantee return reachability.

 

Question 19

An ACL is intended to block host 192.0.2.10, but the ACE mistakenly references 192.0.20.10. Counters on the deny remain zero while the real host passes. What is the most direct issue?

1. Implicit deny is permitting the host.
2. The ACE matches the wrong address due to an address-entry error.
3. The device needs a higher CoPP rate.
4. The ACL can match host addresses only with wildcards.
5. The flow is encrypted so ACLs cannot see IP addresses.

Correct Answer: B

 

Correct Answer

Answer B is correct because the configured value does not represent the host being tested.

Incorrect Answers

Answer A is incorrect because implicit deny never permits. It does not satisfy the stem’s governing point: Verify literal address/prefix representation in an ACE when expected hit counters remain zero.

Answer C is incorrect because CoPP is unrelated to this transit ACL address mismatch.

Answer D is incorrect because `host` or equivalent exact masks can match a host.

Answer E is incorrect because ordinary IP ACLs still see outer IP headers.

 

Question 20

ACL `WEB` is:
`10 permit tcp 10.1.0.0 0.0.255.255 192.0.2.0 0.0.0.255 eq 443`
`20 deny ip any any`
Packet: source 10.1.20.30:51000, destination 192.0.2.44:443, TCP SYN. What is the result?

443. Denied because source port is not 443.
444. Permitted by sequence 10.
445. Denied because SYN is not ACK.
446. Denied by sequence 20 because it is more general.
447. Permitted only if source is exactly 10.1.0.0.

Correct Answer: B

 

Correct Answer

Answer B is correct because source is within 10.1.0.0/16, destination within 192.0.2.0/24, protocol TCP and destination port 443.

Incorrect Answers

Answer A is incorrect because the `eq 443` follows destination and therefore matches destination port.

Answer C is incorrect because the ACE does not require `established` or a specific flag.

Answer D is incorrect because sequence 10 matches first. It does not satisfy the stem’s governing point: Evaluate an ACL against the complete packet tuple and the position of source/destination port operators.

Answer E is incorrect because the wildcard matches the whole /16. It does not satisfy the stem’s governing point: Evaluate an ACL against the complete packet tuple and the position of source/destination port operators.

 

Question 21

A router forwards a high-rate transit flow through its ASIC/data plane. The packets are not destined to the router and do not require CPU exception processing. Which statement about CoPP is most accurate?

1. All transit traffic must first be processed by the CPU.
2. CoPP automatically rate-limits every transit flow on every interface.
3. CoPP replaces interface QoS entirely.
4. CoPP encrypts transit packets.
5. CoPP is primarily designed to protect traffic punted/destined to the control plane, not to police every ordinary transit packet.

Correct Answer: E

 

Correct Answer

Answer E is correct because control-plane policing protects CPU-facing traffic; data-plane QoS handles ordinary transit congestion/rates.

Incorrect Answers

Answer A is incorrect because modern forwarding normally handles ordinary transit in the data plane.

Answer B is incorrect because that overstates control-plane scope. It does not satisfy the stem’s governing point: CoPP protects CPU/control-plane traffic; do not confuse it with general transit-interface QoS.

Answer C is incorrect because the mechanisms protect different processing domains. It does not satisfy the stem’s governing point: CoPP protects CPU/control-plane traffic; do not confuse it with general transit-interface QoS.

Answer D is incorrect because policing is not encryption. It does not satisfy the stem’s governing point: CoPP protects CPU/control-plane traffic; do not confuse it with general transit-interface QoS.

 

Question 22

An OSPF adjacency is critical to the device. Under a CoPP policy, which traffic category must receive enough control-plane allowance to preserve normal adjacency behavior?

1. SPAN copies sent to an analyzer.
2. Legitimate OSPF routing-control packets punted/delivered to the routing process.
3. HTTP responses between two transit clients.
4. Bulk user file-transfer packets that remain in hardware forwarding.
5. NetFlow records sent to a collector from another host.

Correct Answer: B

 

Correct Answer

Answer B is correct because routing protocol control traffic must reach the CPU within a suitable class/policer budget.

Incorrect Answers

Answer A is incorrect because SPAN is not OSPF control traffic. It does not satisfy the stem’s governing point: CoPP policy must classify and allow legitimate routing-control traffic at rates that preserve protocol operation.

Answer C is incorrect because they are data-plane transit unless destined to the router.

Answer D is incorrect because ordinary transit data is not the routing-control class.

Answer E is incorrect because that is telemetry, not the local OSPF protocol input.

 

Question 23

A CoPP class-map uses an ACL with `permit udp host 198.51.100.10 any eq 161` as match criteria. An engineer says `permit` means CoPP automatically forwards those packets. What is wrong with that interpretation?

1. ACL permits can never be used in class maps.
2. CoPP ignores all class maps.
3. The ACL encrypts SNMP traffic.
4. Within classification, the ACL permit identifies traffic that belongs to the class; the policy action/policer then determines treatment.
5. UDP/161 is always dropped by CoPP.

Correct Answer: D

 

Correct Answer

Answer D is correct because a classification ACL match is not itself the final forwarding authorization.

Incorrect Answers

Answer A is incorrect because ACL matching is a common MQC classification mechanism.

Answer B is incorrect because MQC/classification is fundamental to generic CoPP policy. It does not satisfy the stem’s governing point: In MQC classification, an ACL permit means “match this class”; policy actions determine control-plane treatment.

Answer C is incorrect because classification does not encrypt. It does not satisfy the stem’s governing point: In MQC classification, an ACL permit means “match this class”; policy actions determine control-plane treatment.

Answer E is incorrect because treatment depends on policy/platform, not a universal rule.

 

Question 24

Measured legitimate routing-control traffic peaks at 6,000 pps during convergence, but a planned CoPP policer for that class is 1,000 pps with drops above the rate. What is the main design risk?

1. The policer can discard legitimate control traffic during normal convergence and destabilize protocols; rate selection should account for measured legitimate peaks plus safety margin/platform guidance.
2. The policer will increase routing bandwidth to 6,000 pps automatically.
3. The policer guarantees lower latency for every routing message.
4. Only transit user traffic will be affected.
5. The rate is irrelevant because CoPP has no counters.

Correct Answer: A

 

Correct Answer

Answer A is correct because CPU protection must not be tuned below required control-plane demand.

Incorrect Answers

Answer B is incorrect because policing does not create capacity. It does not satisfy the stem’s governing point: Size CoPP policers to protect the CPU while preserving legitimate control-plane bursts and protocol needs.

Answer C is incorrect because excessive drops can do the opposite. It does not satisfy the stem’s governing point: Size CoPP policers to protect the CPU while preserving legitimate control-plane bursts and protocol needs.

Answer D is incorrect because the class is routing-control traffic destined to the CPU.

Answer E is incorrect because CoPP provides policy/counter visibility. It does not satisfy the stem’s governing point: Size CoPP policers to protect the CPU while preserving legitimate control-plane bursts and protocol needs.

 

Question 25

A custom IOS XE CoPP policy-map and classes are defined correctly in configuration, but `show policy-map control-plane` shows no service policy attached. What is missing on a platform that supports attaching that policy?

1. Apply the policy to the control plane in the required input direction using the supported service-policy command.
2. Add it to the NetFlow exporter.
3. Configure an RSPAN VLAN.
4. Add a default route.
5. Apply it as a VTY login method.

Correct Answer: A

 

Correct Answer

Answer A is correct because defining a policy does not make it active until it is attached.

Incorrect Answers

Answer B is incorrect because telemetry export does not activate CoPP. It does not satisfy the stem’s governing point: CoPP policy definition and control-plane service-policy attachment are separate steps; verify the platform-specific attachment.

Answer C is incorrect because mirroring is unrelated. It does not satisfy the stem’s governing point: CoPP policy definition and control-plane service-policy attachment are separate steps; verify the platform-specific attachment.

Answer D is incorrect because routing does not attach MQC control-plane policy. It does not satisfy the stem’s governing point: CoPP policy definition and control-plane service-policy attachment are separate steps; verify the platform-specific attachment.

Answer E is incorrect because AAA line lists are unrelated. It does not satisfy the stem’s governing point: CoPP policy definition and control-plane service-policy attachment are separate steps; verify the platform-specific attachment.

 

Question 26

During an OSPF reconvergence event, several adjacencies reset. `show policy-map control-plane` shows the routing class exceed/drop counter increasing rapidly at the same time, while CPU remains moderate. What should be investigated first?

1. Whether the user VLAN has enough DHCP addresses.
2. Whether local usernames are privilege 15.
3. Whether the routing-class policer is dropping legitimate protocol traffic and whether its rate/classification fits measured convergence demand.
4. Whether HTTP server is enabled.
5. Whether the SPAN analyzer is powered on.

Correct Answer: C

 

Correct Answer

Answer C is correct because temporal CoPP drops in the routing class are direct evidence relevant to adjacency loss.

Incorrect Answers

Answer A is incorrect because unrelated to OSPF control packet drops. It does not satisfy the stem’s governing point: Correlate control-plane policer drop counters with routing-protocol symptoms before changing unrelated forwarding settings.

Answer B is incorrect because AAA does not explain routing-class CoPP drops. It does not satisfy the stem’s governing point: Correlate control-plane policer drop counters with routing-protocol symptoms before changing unrelated forwarding settings.

Answer D is incorrect because REST services are unrelated to OSPF adjacency. It does not satisfy the stem’s governing point: Correlate control-plane policer drop counters with routing-protocol symptoms before changing unrelated forwarding settings.

Answer E is incorrect because capture availability does not cause the policer drops.

 

Question 27

SNMP polls to the switch are slow. The CoPP output shows zero matches in the expected management class, but class-default counters rise with each poll. What does this suggest?

1. Class-default always means packets are permitted without policing.
2. The collector must use RSPAN.
3. The SNMP packets are not matching the intended management classifier and are falling into the default class; inspect classification criteria.
4. SNMP bypasses CoPP entirely.
5. The SNMP server needs an OSPF neighbor.

Correct Answer: C

 

Correct Answer

Answer C is correct because per-class counters identify the actual CoPP classification path.

Incorrect Answers

Answer A is incorrect because treatment depends on the policy; the key observation is misclassification.

Answer B is incorrect because mirroring is unrelated. It does not satisfy the stem’s governing point: Use CoPP per-class counters to detect legitimate management traffic landing in an unintended/default class.

Answer D is incorrect because the class-default correlation shows CPU-facing traffic is being classified.

Answer E is incorrect because routing protocol adjacency is not required specifically for SNMP classification.

 

Question 28

A CoPP policer shows 50,000 conform packets and 8,000 exceed packets during a burst. The policy action transmits conforming packets and drops exceeds. What does this evidence mean?

1. The burst exceeded the configured policer profile enough for 8,000 packets to be treated as excess and dropped.
2. The router received only 8,000 total packets.
3. All 50,000 conform packets were dropped.
4. The policer automatically raised its configured rate.
5. Exactly 8,000 packets were dropped by an interface output queue.

Correct Answer: A

 

Correct Answer

Answer A is correct because conform/exceed counters directly reflect policer treatment. This directly matches the stem’s governing point: Interpret CoPP conform/exceed counters in the context of the configured actions to quantify control-plane policing.

Incorrect Answers

Answer B is incorrect because the conform count is also part of the offered traffic.

Answer C is incorrect because the stated conform action transmits them. It does not satisfy the stem’s governing point: Interpret CoPP conform/exceed counters in the context of the configured actions to quantify control-plane policing.

Answer D is incorrect because counters do not imply dynamic rate change. It does not satisfy the stem’s governing point: Interpret CoPP conform/exceed counters in the context of the configured actions to quantify control-plane policing.

Answer E is incorrect because these are control-plane policy counters, not necessarily interface congestion.

 

Question 29

A router has no interface congestion or output drops, yet BGP sessions flap during a management flood. CoPP counters show CPU-destined traffic being heavily dropped. Which distinction matters?

1. BGP sessions are transit data and never use the CPU.
2. Control-plane congestion/policing can disrupt protocol sessions even when data-plane interface queues are healthy.
3. Healthy interfaces prove the CPU cannot be overloaded.
4. CoPP is only an interface egress queue.
5. The solution must be to increase every interface speed.

Correct Answer: B

 

Correct Answer

Answer B is correct because CPU-facing control traffic and transit/interface QoS are separate resource paths.

Incorrect Answers

Answer A is incorrect because routing protocols terminate on the control plane. It does not satisfy the stem’s governing point: Separate CPU/control-plane protection from data-plane interface congestion when interpreting protocol failures.

Answer C is incorrect because control-plane resources can fail independently. It does not satisfy the stem’s governing point: Separate CPU/control-plane protection from data-plane interface congestion when interpreting protocol failures.

Answer D is incorrect because it specifically protects the control plane. It does not satisfy the stem’s governing point: Separate CPU/control-plane protection from data-plane interface congestion when interpreting protocol failures.

Answer E is incorrect because there is no evidence interface bandwidth is the bottleneck.

 

Question 30

For one CoPP class, normal legitimate traffic is 1,500 pps, planned maintenance peaks at 3,500 pps for 20 seconds, and attack simulations begin around 20,000 pps. The current policer is 2,000 pps and causes maintenance failures. Which tuning approach is best?

1. Disable the policer permanently.
2. Set the policer to 500 pps to improve protection.
3. Raise the class policer above the validated legitimate maintenance peak with a justified margin while keeping it well below abusive levels, then retest counters/CPU.
4. Tune only the interface output queue because CoPP rates cannot change.
5. Set it above 20,000 pps so the attack never drops.

Correct Answer: C

 

Correct Answer

Answer C is correct because measured legitimate demand should drive a protected but usable rate rather than arbitrary extremes.

Incorrect Answers

Answer A is incorrect because that removes the CPU protection despite a known attack profile.

Answer B is incorrect because that worsens legitimate drops. It does not satisfy the stem’s governing point: Use measured legitimate control-plane demand and attack/resource evidence to tune CoPP rates, then validate behavior.

Answer D is incorrect because the problem is the control-plane policer, and supported platforms allow rate changes within restrictions.

Answer E is incorrect because that defeats the intended protective threshold. It does not satisfy the stem’s governing point: Use measured legitimate control-plane demand and attack/resource evidence to tune CoPP rates, then validate behavior.