Refer to the exhibit. Which result is achieved by the CoPP configuration?

Traffic is only always dropped if an explicit `drop` action is configured for that class of traffic in the CoPP policy map, which contradicts the correct answer's premise.

`class-default` is typically given a policing or drop action to protect against unclassified traffic; however, the question specifically asks about traffic matching entry 10 of ACL 100, not `class-default`.

Traffic would be allowed with a limited CIR (Committed Information Rate) only if a `police` action with `conform-action transmit` and `exceed-action drop` (or similar) were configured for that class, which would mean it is not 'always allowed' without limitation.

In a CoPP configuration, if traffic matching entry 10 of ACL 100 is classified into a specific class and that class is configured with no explicit `drop` or `police` action, or only a `transmit` action, then this traffic will be allowed to reach the control plane without restriction. The phrase 'always allowed' implies it is not subject to rate-limiting or unconditional dropping.