Which description is not a feature of CoPP?
- uses MQC for configuration
- rate-limits access to the control plane
- easily managed compared with infrastructure ACLs
- applies to a virtual interface tied to the control plane
- permits or denies access to the data plane
Explanation: Control Plane Policing (CoPP) is a security feature specifically designed to protect a device’s route processor (CPU) from being overwhelmed by traffic directed at the device itself. Based on the sources, its features include:
- MQC Configuration: CoPP utilizes the Modular QoS CLI (MQC) framework, which involves defining class maps to categorize traffic and policy maps to define actions.
- Rate-Limiting: It allows administrators to rate-limit or filter traffic to prevent low-priority or malicious floods from exhausting system resources.
- Virtual Interface Application: The policy is applied to the control plane virtual interface in the inbound direction rather than on physical interfaces.
- Management Advantage: CoPP is easier to manage than infrastructure ACLs because it is applied once to the control plane entity, whereas traditional ACLs must be applied to every individual physical interface, which can be an "onerous task".
The statement that CoPP permits or denies access to the data plane is incorrect because CoPP only manages traffic destined for the control plane; data plane packets (user-generated traffic forwarded to other end-stations) are handled in the "fast path" and are not the target of CoPP policies.
Related exam: Modules 14 – 16: Checkpoint Exam: Network Security Answers (CCNP ENCOR v9)
