nerdexam
Cisco

300-410 · Question #77

Refer to the exhibit: R1#show policy-map control-plane Control Plane Class-map: NMS (match-all) 500461 packets, 24038351 bytes 5 minute offered rate 1390000 bps, drop rate 0 bps police: cir 50000…

The correct answer is D. Separate the NMS class map in multiple class maps based on the specific protocols with appropriate CoPP actions. The NMS class map in Control Plane Policing (CoPP) is dropping a significant amount of NMS traffic because its Committed Information Rate (CIR) is set too low for the observed traffic volume.

Infrastructure Security

Question

Refer to the exhibit: R1#show policy-map control-plane Control Plane Class-map: NMS (match-all) 500461 packets, 24038351 bytes 5 minute offered rate 1390000 bps, drop rate 0 bps police: cir 50000 bps, bc 5000 bytes conformed 50444 packets, 24031001 bytes; actions: transmit exceeded 990012 packets, 94030134 bytes; actions drop conformed 4000 bps, exceed 0 bps R1# Which action resolves this issue?

Options

  • ARemove the exceed-rate command in the class map
  • BRemove the class map NMS from being part of control plane policing.
  • CConfigure the CIR rate to a lower value that accommodates all the NMS tools
  • DSeparate the NMS class map in multiple class maps based on the specific protocols with appropriate CoPP actions

How the community answered

(67 responses)
  • A
    15% (10)
  • B
    3% (2)
  • C
    7% (5)
  • D
    75% (50)

Why each option

The NMS class map in Control Plane Policing (CoPP) is dropping a significant amount of NMS traffic because its Committed Information Rate (CIR) is set too low for the observed traffic volume.

ARemove the exceed-rate command in the class map

Removing an implied 'exceed-rate' action (which leads to drops) without adjusting the CIR would either allow all traffic or requires a specific configuration not typically found as a single command in this context, and doesn't address the underlying issue of insufficient bandwidth allocation.

BRemove the class map NMS from being part of control plane policing.

Removing the class map from CoPP would disable protection for NMS traffic entirely, potentially exposing the control plane to denial-of-service attacks, which is not a resolution to a rate-limiting issue.

CConfigure the CIR rate to a lower value that accommodates all the NMS tools

Configuring the CIR to a lower value would further restrict the allowed traffic and exacerbate the dropping issue, as the current CIR is already too low for the offered NMS traffic.

DSeparate the NMS class map in multiple class maps based on the specific protocols with appropriate CoPP actionsCorrect

By separating NMS tools into multiple class maps based on specific protocols, an administrator can apply distinct and appropriate policing actions with adequate CIRs for each type of management traffic, preventing drops for critical NMS operations while maintaining control plane protection. This allows for more granular and effective management of diverse control plane traffic compared to a single broad policy.

Concept tested: Control Plane Policing (CoPP) configuration

Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_copp/configuration/xe-16/sec-data-copp-xe-16-book/sec-copp-policer-data-plane.html

Topics

#Control Plane Policing (CoPP)#QoS Policing#Network Device Security#Class-map

Community Discussion

No community discussion yet for this question.

Full 300-410 Practice