Given successful pings to all interfaces (including loopbacks), normal data traffic, intermittent SNMP, and slow/disconnecting SSH, which command should you run first to troubleshoot?

The show policy-map control-plane command is the most relevant first step because it inspects the control plane policing (CoPP) configuration. Intermittent SNMP and slow/disconnecting SSH, while data traffic and pings are normal, strongly suggest that the router's control plane is being overwhelmed or rate-limited. CoPP protects the router's CPU from excessive traffic destined for the router itself, which includes protocols like SNMP and SSH. If CoPP is misconfigured or under attack, it can drop or rate-limit these management protocols. show policy-map alone is too general and would display all policy maps, not specifically those affecting the control plane. show interface | inc drop would show drops on interfaces but wouldn't pinpoint if the drops are due to CoPP or other interface-specific issues. show ip route checks the routing table, which is unlikely to be the cause of intermittent SNMP and SSH issues when data traffic is flowing normally.