Which of the following are NOT ingress matching criteria for a network policy? (Choose two)

Question

Options

• ATCP port numbers
• BLSP EXP
• CDSCP
• DSource and destination IP addresses
• EDot1p priority

• A
  89% (25)
• C
  7% (2)
• E
  4% (1)

Explanation

TCP port numbers (A) and source/destination IP addresses (D) are not ingress matching criteria for a network policy because network policies in this context refer to QoS classification policies, which operate on pre-existing traffic markings rather than flow-level identifiers. TCP ports and IP addresses belong to firewall filters or access control lists (ACLs), not QoS network policies.

The distractors are all valid QoS-based ingress matching criteria: DSCP (C) is a Layer 3 DiffServ marking in the IP header, Dot1p (E) is a Layer 2 802.1p priority bit in the Ethernet frame, and LSP EXP (B) (also called MPLS TC bits) is the QoS marking field carried in MPLS labels.

Memory tip: Think "QoS markings only" - a network/QoS policy matches on pre-stamped priority bits (DSCP, Dot1p, EXP), not on who is talking or how (IP addresses, TCP ports). If it identifies a flow, it belongs in a firewall filter; if it identifies a priority level, it belongs in a network policy.

No community discussion yet for this question.