Troubleshooting Cisco IOS CoPP Configuration Issues
Short answer
AD Move the service policy to the control plane and refine the ACL to match only TCP ports 80 and 443.
Question
limited to 500 kbps. Any traffic that exceeds this limit must be dropped.
access-list 100 permit ip host 172.16.1.99 any
!
class-map CM-ADMIN
match access-group 100
!
policy-map PM-COPP
class CM-ADMIN
police 500000 conform-action transmit
!
interface E0/0
service-policy input PM-COPP
CoPP failed to capture the desired traffic and the CPU load is getting higher.
Which two configurations resolve the issue? (Choose two.)
Key Takeaways
CoPP policies must be applied to the 'control-plane' virtual interface, not physical interfaces, and ACLs must precisely match the intended protocols (TCP 80/443) rather than permitting all IP traffic.
Learn how to troubleshoot CoPP misconfigurations by correcting the service-policy attachment point and refining ACLs to target specific management traffic.
Common mistake: Applying the service-policy to a physical interface (e.g., GigabitEthernet0/0) instead of the control-plane, or using an overly permissive ACL that allows non-HTTP traffic through the police filter.
Expert Analysis
The question asks for two configurations that resolve why CoPP failed to capture HTTP/HTTPS traffic from 172.16.1.99 while limiting it to 500 kbps.
First, the service policy is applied incorrectly. The configuration shows interface E0/0 service-policy input PM-COPP. CoPP (Control Plane Policing) is designed to protect the router's CPU by policing packets destined for the control plane. Applying a service policy directly to a physical interface like E0/0 polices transit traffic passing through the interface, not specifically traffic bound for the CPU. To fix this, the policy must be removed from the interface and applied to the control plane using the control-plane global command or service-policy input under the control-plane interface. Option A correctly performs this migration: no service-policy input PM-COPP on the interface and control-plane service-policy input PM-COPP globally.
Second, the Access Control List (ACL) is too broad. The existing ACL access-list 100 permit ip host 172.16.1.99 any permits ALL IP traffic (including OSPF, BGP, SSH, etc.) from the administrator. This violates the requirement to limit only HTTP and HTTPS. Furthermore, the destination in the ACL should reflect traffic destined to the router (often represented as any or the router's IP, but the key is matching the source). However, the protocol and port are missing. Option D corrects the ACL to match only TCP traffic on ports 80 (HTTP) and 443 (HTTPS) from the specific host: permit tcp host 172.16.1.99 any eq 80 and eq 443. Note that while the ACL destination any might technically include transit traffic, within the context of CoPP class-maps, it typically matches packets sourced from that host destined for the router when combined with the control-plane application. More importantly, it restricts the scope to the required protocols.
Option E suggests changing the rate to 500 bps, which is incorrect as the requirement is 500 kbps. Options B and C do not address both the application point and the precise filtering requirements simultaneously.
Exam Strategy
When troubleshooting CoPP, always verify two things: 1) Is the policy attached to the control-plane interface? Physical interface attachment polices transit traffic, not CPU-bound traffic. 2) Does the class-map ACL precisely match the intended traffic? Use explicit protocol and port matches (e.g., tcp eq 80) to avoid inadvertently policing critical routing protocols or allowing excess traffic.
Frequently Asked Questions
Why can't I apply CoPP to a physical interface?
control-plane virtual interface to affect packets destined for the process.Does the default exceed-action drop packets?
conform-action transmit, the default behavior for exceed-action is drop. You do not need to explicitly state exceed-action drop unless you want a different action like transmit or signal-discard.Community Votes
67% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 24 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 24
-
rogabor81 👍 4I would say A an D as well. but should not we add an exceed-action drop at the and as well? it says that any exceeding traffic should be dropped....
-
HungarianDish_111 👍 3That seems to be missing, too. A+D, plus exceed-action drop.
-
bk989 👍 2The question is fine and A and D are the answers. We apply copp to input control plane. Applying it to an interface means COPP analyzes all traffic going through the router. Applying to control plane means COPP ananlyzes packets going to CPU. A is correct. For D: "from the administrator device located at 172.16 1.99 toward the router CPU" The ACL in D is from the source 172.16.1.99 for port 80 and port 443. D is fine.
-
Coffee_bean_master 👍 2Side note: Other traffic that may be important will get dropped if not allowed through the ACL 100. This is to include control plane traffic that is important to the router. I choose A and D for the answers.
-
Dacusai 👍 2A&D, question says choose 2. But to restrict traffic to 500 kb we need to add the exceed-action drop command in order to do real control
Show 19 more comments
-
bk989 👍 2Read the question again. The source is 172.16.1.99
-
xziomal9 👍 2The correct answer is: A D
-
Gramterre 👍 2 Answered AA&D choose two please fix
-
Noproblem22 👍 2A D are correct answer
-
SAMAKEMM 👍 2Correct answer: A & D
-
deech 👍 2 Answered AA & D are correct
-
tubirubs 👍 2 Answered AChoose two, A&D
-
Pietjeplukgeluk 👍 1 Answered AA seems OK, but D seems fully wrong as command == bits per second, so 500 is wrong. Require 500 kilobits per second it should police at a 500.000 cir. so i do not see any correct answer in D. Furthermore, the ACL is wrong as the destination of packets destined at the router will always have the router in the destination and not the source. Again, really bad question.
-
Rebeen.Ra 👍 1Correct answers: A and D. - A — Apply CoPP to the control plane. Remove the service policy from E0/0 and apply it under control-plane using control-plane service-policy input PM-COPP. - D — Correct ACL 100. Match only HTTP and HTTPS traffic from 172.16.1.99, using TCP destination ports 80 and 443.
-
Coffee_bean_master 👍 1If CoPP is changed from the interface to the CPU, then other important traffic will need to be allowed through as well or else get dropped. (BGP, EIGRP, SNMP, etc.)
-
Muste 👍 1The default policing action if you only configured conformed-action is to drop the packets that exceed the configured rate limit.
-
82d4466 👍 1 Answered APlease change correct answer to A & D, two answers requested, not just one.
-
dapardo 👍 1Agree on this, it doesnt make sense to me without the drop action.
-
ChillingAgain 👍 1A and D are correct. Please correct the answers!
-
inteldarvid 👍 1 Answered Dare two option: A and D
-
forccnp 👍 1 Answered DA&D are correct answers
-
Xerath 👍 1The answer is: A & D.
-
piojo 👍 1A and D (choose two)
-
Hack4 👍 1A AND D
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All 300-410 Questions
Access 159 questions with complete answers and detailed explanations.
View Full 300-410 Practice Test →