Cisco AVC Capability: Bandwidth Enforcement on IOS

350-701 By islever Editorial Last updated

Implement access control policies, AVC, URL filtering, malware protection, and intrusion prevention using Cisco Secure Firewall (FTD)

Short answer

A Cisco AVC provides application bandwidth enforcement on Cisco IOS platforms using NBAR2 for classification and QoS integration.

Question

What is a capability of Cisco AVC?
  1. application bandwidth enforcement on Cisco IOS platforms Correct Answer
  2. interoperates by using GET VPN on tunnel interfaces
  3. traffic filtering by using a Security Intelligence policy
  4. deep packet inspection on IPsec encapsulated traffic

Key Takeaways

The question tests the distinction between visibility tools and enforcement mechanisms, with the trap being the assumption that deep packet inspection applies to encrypted traffic.

This question assesses knowledge of Cisco Application Visibility and Control (AVC) capabilities, specifically its ability to enforce application bandwidth policies on Cisco IOS platforms.

Common mistake: Candidates often select Option D because they associate AVC with deep packet inspection (DPI), failing to realize that DPI cannot effectively inspect IPsec-encrypted traffic without decryption.

Expert Analysis

Why the Answer Is Correct

Option A is correct because Cisco AVC is fundamentally built upon Network-Based Application Recognition version 2 (NBAR2). NBAR2 provides stateful deep packet inspection for unencrypted traffic, allowing administrators to classify applications and apply Quality of Service (QoS) policies, such as bandwidth limits or prioritization, directly on Cisco IOS platforms. This enables granular control over network resources based on specific application types.

Why the Other Options Are Wrong

Option B is incorrect because GET VPN is a site-to-site encryption technology used for mass key distribution and tunneling; it does not serve as an interoperability mechanism for AVC's policy enforcement. Option C is incorrect because traffic filtering via Security Intelligence (SI) relies on reputation-based blacklists/whitelists provided by Cisco Talos, which is distinct from the classification and policing functions of AVC. Option D is incorrect because AVC/NBAR2 performs deep packet inspection on clear-text traffic; it cannot inspect the payload of IPsec-encapsulated traffic unless the traffic is decrypted at the firewall/router edge first.

Community Comment Notes

Community consensus strongly supports Option A. Commenters highlight that AVC involves components like NBAR2 and Flexible NetFlow (FNF) to provide "powerful application visibility and control." One user noted that AVC helps deliver "business-intent policies across the entire network" without additional appliances. Another commenter emphasized its role in providing "deep visibility into network traffic, enabling administrators to identify and classify applications." These points align with the official capability of enforcing bandwidth and visibility on IOS devices.

Official Reference

https://www.cisco.com/c/en/us/products/routers/avc-control.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When studying Cisco AVC, focus on its reliance on NBAR2 for application classification and how this classification feeds into QoS policies for bandwidth enforcement. Remember that "Control" implies action (like policing), while "Visibility" implies monitoring, and both are core to AVC.

Frequently Asked Questions

Why can't Cisco AVC perform deep packet inspection on IPsec traffic?

AVC uses NBAR2 for stateful DPI, which requires clear-text payloads. IPsec encapsulates and encrypts traffic, preventing NBAR2 from seeing the application headers unless the traffic is decrypted at the device.

Is Security Intelligence part of Cisco AVC?

No, Security Intelligence is a separate feature set on Cisco Firewalls that uses threat intelligence feeds for filtering. AVC focuses on application recognition and QoS bandwidth management.

More 350-701 FAQ →

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. Surfside92 👍 2 Answered A
    Application Visibility and Control (AVC) is a technology that involves multiple components, including Network Based Application Recognition Version 2 (NBAR2), Flexible NetFlow (FNF), and management tools that provide powerful application visibility and control capabilities based on stateful deep packet inspection
  2. XBfoundX 👍 1 Answered A
    Now you can detect every application in your network and optimize bandwidth with application-aware policies. Cisco AVC monitors application performance and troubleshoots issues that arise. It helps you deliver business-intent policies across the entire network. And it does all this without additional appliances in a simple and powerful way.
  3. aa4a63c 👍 1 Answered A
    provides deep visibility into network traffic, enabling administrators to identify and classify applications, monitor performance, and enforce policies based on application-specific criteria
  4. Premium_Pils 👍 1 Answered A
    https://www.cisco.com/c/en/us/products/routers/avc-control.html

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What Is a Feature of an Endpoint Detection and Response Solution?

S-grade

Which Two Methods Belong in an AAA Authentication Method List?

S-grade

Preventing Unauthorized DHCP Servers on Cisco Switches

S-grade

What Is Considered a Cloud Data Breach in Cisco 350-701?

S-grade

← Back to 350-701 Study Guide