350-401 Question 248
Select 4A network administrator is tasked with securing access to network devices in an enterprise environment. They decide to configure Control Plane Policing (CoPP) on a Cisco router to protect the control plane from excessive traffic and potential attacks. Which of the following actions should they take to properly configure and verify CoPP?
- A
Define a class map to classify specific types of traffic.
- B
Apply the CoPP policy directly to an interface.
- C
Create a policy map to specify actions for the classified traffic.
- D
Use the 'service-policy' command in control-plane configuration mode to apply the policy.
- E
Verify the CoPP configuration using the 'show policy-map control-plane' command.
Show answer and explanation
Correct answers: A, C, D, E
Explanation
Control Plane Policing (CoPP) is a feature used to protect the control plane of a network device from excessive traffic and potential attacks. To configure CoPP, you must define a class map to classify traffic, create a policy map to determine how that traffic is managed, and apply the policy to the control plane using the 'service-policy' command. Afterward, you can verify the configuration and its impact using commands like 'show policy-map control-plane'. CoPP is not applied directly to interfaces but rather to the control plane itself.
- A. Correct.
Correct: Defining a class map is a necessary step to classify specific types of traffic (e.g., ICMP or Telnet) that CoPP will manage.
- B. Incorrect.
Incorrect: CoPP policies are applied to the control plane, not directly to an interface.
- C. Correct.
Correct: A policy map must be created to define actions (e.g., permit, drop, or rate-limit) for the classified traffic.
- D. Correct.
Correct: The 'service-policy' command is used in control-plane configuration mode to apply the CoPP policy to the control plane.
- E. Correct.
Correct: The 'show policy-map control-plane' command is used to verify the applied CoPP configuration and its statistics.