How Does CoPP Handle ACL Match Results?

Control Plane Protection (CoPP)

Refer to the exhibit. Which result is achieved by the CoPP configuration? -

Traffic that matches entry 10 of ACL 100 is always dropped.
Class-default is dropped.
Traffic that matches entry 10 of ACL 100 is always allowed with a limited CIR.
Traffic that matches entry 10 of ACL 100 is always allowed. Source Reference Answer

Community Votes

79%

21%

79% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The question traps candidates who apply traditional firewall logic, whereas CoPP fundamentally treats all ACL matches as classification tags for subsequent policing actions.

This question tests the fundamental difference between ACL filtering and CoPP traffic classification. Candidates must recognize that CoPP uses ACLs solely to identify traffic for policing, meaning both permit and deny entries allow traffic to proceed to the rate limiter.

Candidates frequently choose A or C, incorrectly assuming ACL deny statements drop packets in CoPP or over-focusing on the CIR value. They miss the core concept that CoPP ACLs never filter traffic; they only route it to the policer.

Community Discussion (10 comments)

Mistwalker 👍 13 Selected: D

D is correct. In the context of CoPP, ACLs are not used to permit or deny traffic, only identify it for policing. Traffic "denied" by the ACL will simply not be considered in the Class Map, i.e. not policed. Ref: https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/copp.html This example shows how to allow full access for Telnet to the switch from a host in a specific subnet and police the rest of the subnet: Router(config)# access-list 121 deny tcp host 10.86.183.3 any eq telnet Router(config)# access-list 121 permit tcp 10.86.183.0 0.0.0.255 any eq telnet

dspdassanayake 👍 1 Selected: D

This example shows how to allow full access for Telnet to the switch from a host in a specific subnet and police the rest of the subnet: Router(config)# access-list 121 deny tcp host 10.86.183.3 any eq telnet Router(config)# access-list 121 permit tcp 10.86.183.0 0.0.0.255 any eq telnet Source : https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/copp.pdf

AbdullahMohammad251 👍 1 Selected: D

Traffic denied by ACL 100 will match the default class "class-default" and will be permitted.

AbdullahMohammad251 👍 1 Selected: C

A class map is referencing the ACL, the ACL is being used to match traffic, not to filter traffic. All traffic that matches access-list 100 entries (permit, or deny statements) will be policed by class map telnet_Copp. Traffic that matches entry 10 of ACL 100 will be allowed if it doesn't exceed a given rate (8000 bps.) Traffic that exceeds this rate will be dropped "exceeded drop"

chiacche 👍 1 Selected: D

Traffic that matches ACL 100 Article 10 is allowed to pass. Even though there is a rate limit, these traffic are still allowed.

CCIEPASS99 👍 2

I think A. telnet_copp matches 33 packets, entry 10 20 30 =33packets. so 10 and 30 allows drop, they have no chance to be policed by CoPP, 20 always allowed. 40 allowed with a limited CIR.

[Removed] 👍 1 Selected: C

people who choosed D, don't you see the cir 8000 ?! C is correct

RickAO76 👍 3 Selected: C

Looks to me to be C The CoPP configuration applies a rate limit to Telnet traffic match ACL 100, allowing it to be transmitted, but with a limited CIR of 8000. (Committed Information Rate)

Claudiu1 👍 2 Selected: D

teems5uk 👍 4 Selected: A

A. Traffic that matches entry 10 of ACL 100 is always dropped. Correct. The access-list 100 denies traffic from host 10.0.0.5 to any destination on port 22. The CoPP configuration polices this traffic with a CIR and drops the packets exceeding the limit.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

CoPP Classification vs. Standard Filtering

In traditional networking, an ACL acts as a filter: permit allows traffic, and deny drops it. However, Control Plane Policing (CoPP) operates differently. When you configure a class-map to match an ACL, Cisco IOS uses the ACL strictly for traffic classification, not filtering. Every packet that matches any entry in the referenced ACL—whether the statement is permit or deny—is captured by the class-map and handed off to the policy-map's policer.

Why Option D is Correct

Traffic matching entry 10 of ACL 100 is successfully classified into the CoPP class-map. Because CoPP ACLs do not discard packets, the traffic is allowed to pass through the classification stage and enter the policing engine. While the policer may drop packets that exceed the configured Committed Information Rate (CIR), the ACL itself never blocks them. The exam prioritizes this classification-over-filtering principle, making D the most accurate reflection of the architectural behavior.

Why Other Options Fail

Option A incorrectly applies standard ACL filtering logic, assuming a deny statement in the ACL would drop the traffic before policing.
Option B misattributes the behavior to class-default, which only catches traffic that fails to match any explicitly defined class maps.
Option C focuses heavily on the CIR limitation, but the phrasing obscures the primary learning objective. The exam tests whether you know the ACL doesn't drop the traffic, not the specifics of rate-limiting mechanics.

As noted by the community, candidates who grasp that "ACLs in CoPP are used to identify traffic for policing, not to permit or deny" consistently select D. This aligns with Cisco's official design guides, which emphasize that CoPP prevents control-plane exhaustion by rate-limiting, not by blocking, targeted traffic.

Official Reference

Exam Strategy

When reviewing CoPP questions, immediately identify whether the ACL is being used for filtering or classification. Remember that in Control Plane Protection, every ACL entry serves only to categorize traffic for the policer; never assume an ACL 'deny' statement will drop packets in this context. Focus on the policy-map's policing action rather than the ACL's permit/deny keywords.

Related Analysis

Practice All 350-401 Questions

Access 218 questions with complete answers and detailed explanations.

View Full 350-401 Practice Test →

← Back to 350-401 Study Guide