Which configuration restricts the amount of SSH traffic that a router accepts to 100 kbps? A. B. C. D.

Question

Exhibits

Options

• Aclass-map match-all CoPP_SSH match access-group name CoPP_SSH ! policy-map CoPP_SSH class CoPP_SSH police cir 100000 exceed-action drop ! ! interface GigabitEthernet0/1 ip address 209.165.200.225 255.255.255.0 ip access-group EGRESS out service-policy input CoPP_SSH ! ip access-list extended CoPP_SSH permit tcp any any eq 22
• Bclass-map match-all CoPP_SSH match access-group name CoPP_SSH ! policy-map CoPP_SSH class CoPP_SSH police cir 100000 exceed-action drop ! ! interface GigabitEthernet0/1 ip address 209.165.200.225 255.255.255.0 ip access-group EGRESS out service-policy input CoPP_SSH ! ip access-list extended CoPP_SSH deny tcp any any eq 22
• Cclass-map match-all CoPP_SSH match access-group name CoPP_SSH ! policy-map CoPP_SSH class CoPP_SSH police cir 100000 exceed-action drop ! ! control-plane service-policy input CoPP_SSH ! ip access-list extended CoPP_SSH permit tcp any any eq 22
• Dclass-map match-all CoPP_SSH match access-group name CoPP_SSH ! policy-map CoPP_SSH class CoPP_SSH police cir 100000 exceed-action drop ! ! control-plane transit service-policy input CoPP_SSH ! ip access-list extended CoPP_SSH permit tcp any any eq 22

• A
  13% (4)
• B
  6% (2)
• C
  59% (19)
• D
  22% (7)

Explanation

Option C is correct because Control Plane Policing (CoPP) must be applied to the 'control-plane' (host) subinterface, not a physical interface, to protect the router's CPU from excessive traffic destined for the router itself (such as SSH management traffic). The ACL correctly uses 'permit tcp any any eq 22' to match SSH traffic, and the policy-map polices it at 100 kbps (100,000 bps CIR) with an exceed-action of drop.

No community discussion yet for this question.