On the nexus 7000 platform, you have to be aware of a few things.
For bridged traffic, COS is used for ingress queue selection et preserve for egress queue selection. If trafic originate from an access ports (not a trunk), COS value will be 0.
For routed traffc, COS is used for ingress queue selection. DSCP will rewrite COS using the 3 most significant bits of DSCP and the new COS will be used for egress queue selection.
If you want to change the default behavior and not trust the traffic, you have to write a policy-map that rewrite the DSCP value to 0 of all trafic and apply it inbound on the physical interface. This will force the 7000 to re-write COS for bridged traffic also and egress queue selection will use the new COS