Exam 300-410 topic 1 question 160 discussion

A is correct

A is correct

a better fitting answer would be “access-list 101 permit tcp any any eq 23” in order to police all telnet traffic, which is what the questions asks. Otherwise, all traffic is being policed here.

permit ip any any eq 23 would be nice to have

This is a stupid question because the "permit ip any any" is going to police all traffic except for two particular hosts Telnet traffic. It will not do as desired. Still, A is best answer.

The given answer is correct.

packets that match a deny rule are excluded from that class and cascade to the next class (if one exists) for classification. Therefore, if we don’t want to CoPP traffic from 10.1.1.1/32 and 172.16.1.1/32, we must “deny” them in the ACL.

What’s missing here is the definition of ACL 101. A. no access-list 101 access-list 101 deny tcp host 10.1.1.1 any eq 23 access-list 101 deny tcp host 172.16.1.1 any eq 23 access-list 101 permit ip any any This syntax flushes any previous ACL 101 statement denies any Telnet traffic from 10.1.1.1/32 and 172.16.1.1/32 permits any other IP traffic Correct answer. B. control-plane no service-policy input PM-CoPP ! interface Ethernet 0/0 service-policy input PM-CoPP Wrong answer. C. no access-list 101 access-list 101 deny tcp host 10.1.1.1 any eq 23 access-list 101 deny tcp host 172.16.1.1 any eq 23 access-list 101 permit ip any any ! Interface E 0/0 service-policy input PM-CoPP CoPP policy PM-COPP is already assigned to the control plane context. Wrong answer. D. control-plane no service-policy input PM-CoPP service-policy input PM-CoPP Wrong answer.

A is the correct answer. reference : https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-0SY/configuration/guide/15_0_sy_swcg/control_plane_policing_copp.pdf Page 8. This example shows how to allow full access for Telnet to the switch from a host in a specific subnet and police the rest of the subnet: Router(config)# access-list 121 deny tcp host 10.86.183.3 any eq telnet Router(config)# access-list 121 permit tcp 10.86.183.0 0.0.0.255 any eq telnet