A museums and culture department sees SNMP and SSH floods driving high CPU on civic core routers while transit forwarding still matters. Which feature most directly rate-limits abusive traffic to the route processor?
Select an answer to reveal the explanation.
Short Explanation
CoPP is the bouncer for the router’s brain—SNMP and SSH floods get rate-limited before they pin the CPU. Data-plane forwarding can keep working while the control plane stays protected.
Full Explanation
Control Plane Policing applies MQC-style classify-and-police policy to traffic destined for the route processor, protecting CPU from floods of management and control protocols such as SNMP and SSH. For a museums-and-culture civic core, CoPP is the feature that most directly rate-limits abusive traffic to the control/management plane while transit forwarding can continue.
Port security sticky MAC on core routed ports addresses MAC limits on L2 access, not RP flood policing. IP Source Guard on the Internet peering edge only filters spoofed sources using bindings—it is not CoPP for SNMP/SSH to the RP. Private VLAN community maps for management VRF hosts solve L2 isolation, not control-plane rate limiting.
Exam caveat: CoPP protects the route processor; access-layer anti-spoofing and PVLAN are different layers of defense.
Operational check: deploy CoPP classes for SNMP/SSH/etc., police abusive rates, verify transit forwarding during a controlled management flood, and tune to avoid dropping legitimate ops traffic for museum routers. For civic operations, record the chosen control and the rejected alternatives in the change record so future on-call engineers understand which failure modes were avoided for citizen-facing services.