Updated Nov-2025 Exam Materials for You to Prepare & Pass CNX-001 Exam.
Pass Your CNX-001 Exam at the First Try with 100% Real Exam
CompTIA CNX-001 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
NEW QUESTION # 34
A network administrator is configuring firewall rules to lock down the network from outside attacks. Which of the following should the administrator configure to create the most strict set of rules?
- A. Allow List
- B. Network security group
- C. URL filtering
- D. File blocking
Answer: A
Explanation:
By explicitly permitting only known, approved traffic and blocking everything else by default, an allow-list policy enforces the strictest firewall posture.
NEW QUESTION # 35
A network architect is designing a solution to place network core equipment in a rack inside a data center.
This equipment is crucial to the enterprise and must be as secure as possible to minimize the chance that anyone could connect directly to the network core. The current security setup is:
* In a locked building that requires sign in with a guard and identification check.
* In a locked data center accessible by a proximity badge and fingerprint scanner.
* In a locked cabinet that requires the security guard to call the Chief Information Security Officer (CISO) to get permission to provide the key.
Which of the following additional measures should the architect recommend to make this equipment more secure?
- A. Require anyone entering the data center for any reason to undergo a background check.
- B. Set up a video surveillance system that has cameras focused on the cabinet.
- C. Have the CISO accompany any network engineer that needs to do work in this cabinet.
- D. Make all engineers with access to the data center sign a statement of work.
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
Adding video surveillance that is focused on the cabinet enhances physical security by providing monitoring, deterrence, and forensic evidence in case of unauthorized access. Video surveillance complements existing layered access controls and is a recognized best practice for protecting high-value network assets.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Physical Security Controls":
"Video surveillance provides 24/7 monitoring and records of physical access to critical infrastructure, supporting audit and incident investigation processes." Other options:
* A. A statement of work is administrative and does not enhance physical security.
* C. CISO accompaniment is impractical and not scalable.
* D. Background checks are useful but are generally a prerequisite and not a real-time security control.
NEW QUESTION # 36
A network administrator needs to resolve connectivity issues in a hybrid cloud setup. Workstations and VMs are not able to access Application A. Workstations are able to access Server B.
INSTRUCTIONS
Click on workstations, VMs, firewalls, and NSGs to troubleshoot and gather information. Type help in the terminal to view a list of available commands.
Select the appropriate device(s) requiring remediation and identify the associated issue(s).
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Answer:
Explanation:
See explanation below.
Explanation:
Firewalls # VPN tunnel down
The IPsec tunnel between on-prem Firewall 1 and cloud Firewall 2 (ipip0/ipip2) is down, so no traffic can traverse to the cloud.
Application NSG # Misconfigured rule
There's a "block" rule for 10.3.9.0/24 # 192.2.1.0/24, preventing legitimate on-prem clients from reaching Application A.
NEW QUESTION # 37
A SaaS company's new service currently is being provided through four servers. The company's end users are having connection issues, which is affecting about 25% of the connections. Which of the following is most likely the root cause of this issue?
- A. The service is using round-robin load balancing through a DNS server with one server down.
- B. The service is using a least-connection load-balancing method with one server down.
- C. The service is using weighted load balancing with 40% of the traffic on server A, 20% on server B,
20% on server C, and server D is down. - D. Load balancing is configured with a health check in front of these servers, and one of these servers is unavailable.
Answer: A
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
Round-robin DNS is a simplistic form of load balancing that does not perform health checks. If one of the four servers is down, DNS will still resolve its IP to 25% of users, resulting in failed connections. This matches the symptom of 25% failure rate - 1 out of 4.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Load Balancing Techniques and Availability":
"Round-robin DNS distributes requests without regard for health status. Without external health checks, failed servers will continue to receive traffic, leading to partial service disruptions." Other options:
* B. The percentages do not align with a 25% failure rate.
* C. Least-connection algorithms usually have integrated health checks.
* D. If health checks are active, the load balancer would not forward requests to a failed server.
NEW QUESTION # 38
A company has a 40Gbps network that uses a network tap to inspect the traffic using an IDS. The IDS usually performs normally except when the servers are downloading patches from their local update repository
10.10.10.139 using HTTPS. During the patch windows, the IDS cannothandle the extra load and drops a significant number of packets. Which of the following would allow a network engineer to prevent this issue without compromising the network visibility?
- A. Using PF_RING offload to filter out "host 10.10.10.139 and port 443"
- B. Scheduling a cron job to stop the IDS service during the patch window
- C. Adding a "dst host 10.10.10.139" BPF on the tap
- D. Configuring the IDS to ignore traffic from 10.10.10.139
Answer: A
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
PF_RING is a high-performance packet capture and filtering framework that allows IDS systems to handle large volumes of traffic efficiently. By offloading and filtering out traffic that is known and trusted (such as HTTPS traffic from a patch server), the IDS can focus on analyzing critical traffic and reduce dropped packets.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Traffic Filtering and IDS Performance Optimization":
"Advanced filtering solutions like PF_RING allow offloading of known trusted traffic, reducing processing overhead on IDS systems and improving visibility into meaningful events." Other options:
* A. Directly configuring the IDS to ignore traffic may bypass too much, affecting visibility.
* C. BPF filters on the tap itself may interfere with other systems using the tap.
* D. Disabling the IDS temporarily removes all visibility - a poor security practice.
NEW QUESTION # 39
After a company migrated all services to the cloud, the security auditor discovers many users have administrator roles on different services. The company needs a solution that:
Protects the services on the cloud.
Limits access to administrative roles.
Creates a policy to approve requests for administrative roles on critical services within a limited time.
Forces password rotation for administrative roles.
Audits usage of administrative roles.
Which of the following is the best way to meet the company's requirements?
- A. Conditional access
- B. Privileged access management
- C. Access control list
- D. Session-based token
Answer: B
Explanation:
A Privileged Access Management (PAM) solution provides just-in-time elevation to administrative roles, enforces approval workflows with time-bound access, requires credential rotation, and offers comprehensive auditing of all privileged sessions, fully meeting the company's requirements.
NEW QUESTION # 40
A security architect needs to increase the security controls around computer hardware installations. The requirements are:
Auditable access logs to computer rooms
Alerts for unauthorized access attempts
Remote visibility to the inside of computer rooms
Which of the following controls best meet these requirements? (Choose two.)
- A. Video surveillance
- B. Automated lighting
- C. Locks and keys
- D. Motion sensors
- E. NFC access cards
- F. Security patrols
Answer: A,E
Explanation:
Video surveillance provides continuous, remote visibility into computer rooms and can be integrated with analytics to generate alerts on unauthorized presence.
NFC access cards enforce controlled entry with a system that logs every card swipe and issues alerts on failed or out-of-hours attempts, giving you auditable access records and immediate notifications of any suspicious activity.
NEW QUESTION # 41
A company has a 40Gbps network that uses a network tap to inspect the traffic using an IDS. The IDS usually performs normally except when the servers are downloading patches from their local update repository
10.10.10.139 using HTTPS. During the patch windows, the IDS cannot handle the extra load and drops a significant number of packets. Which of the following would allow a network engineer to prevent this issue without compromising the network visibility?
- A. Using PF_RING offload to filter out "host 10.10.10.139 and port 443"
- B. Scheduling a cron job to stop the IDS service during the patch window
- C. Configuring the IDS to ignore traffic from 10.10.10.139
- D. Adding a "dst host 10.10.10.139" BPF on the tap
Answer: D
Explanation:
By applying a Berkeley Packet Filter to drop only the HTTPS patch#repo traffic before it reaches the IDS, you relieve the processing burden during patch windows while preserving full visibility for all other flows.
This avoids reconfiguring the IDS itself or losing visibility across the rest of the network.
NEW QUESTION # 42
An application is hosted on a three-node cluster in which each server has identical compute and network performance specifications. A fourth node is scheduled to be added to the cluster with three times the performance as any one of the preexisting nodes. The network architect wants to ensure that the new node gets the same approximate number of requests as all of the others combined. Which of the following load- balancing methodologies should the network architect recommend?
- A. Round-robin
- B. Load-based
- C. Weighted
- D. Least connections
Answer: C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
Weighted load balancing allows distribution of traffic based on server capacity or assignedweights. In this case, the new node should receive a weight of 3, and each of the three older nodes a weight of 1. This ensures the new node handles the same total number of requests as the other three combined (3:1:1:1).
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Load Balancing Algorithms and Traffic Distribution":
"Weighted load balancing accounts for node capacity, distributing requests proportionally according to performance capability or administrator-defined weights." Other options:
* A. Round-robin sends traffic equally to all servers regardless of capacity.
* B. Load-based requires dynamic performance measurement and is more complex.
* C. Least connections may work in certain cases, but doesn't guarantee proportional traffic split based on server performance.
NEW QUESTION # 43
Which of the following helps the security of the network design to align with industry best practices?
- A. Licensing agreement
- B. Memorandum of understanding
- C. Reference architectures
- D. Service-level agreement
Answer: C
Explanation:
Reference architectures provide standardized, vendor-agnostic blueprints that incorporate industry best practices for security, ensuring your network design aligns with proven frameworks.
NEW QUESTION # 44
A partner is migrating a client from on premises to a hybrid cloud. Given the following project status information, the initial project timeline estimates need to be revised:
Which of the following documents needs to be revised tobestreflect the current status of the project?
- A. SLA
- B. WBS
- C. SOW
- D. BIA
Answer: B
Explanation:
The Work Breakdown Structure is where each project phase and its duration are documented in detail. Since the estimated timelines for discovery, design, implementation, and knowledge transfer have all slipped, you update the WBS to reflect the new, actual phase durations.
NEW QUESTION # 45
A network architect needs to build a new data center for a large company that has business units that process retail financial transactions. Which of the following information should the architect request from the company?
- A. Business case study
- B. Regulatory requirements
- C. Statement of work
- D. Internal reference architecture
Answer: B
Explanation:
Before designing a facility that will handle retail financial transactions, you need to understand all applicable compliance and security mandates (e.g. PCI DSS, SOX, GDPR). Those regulatory requirements will drive your choices around physical security, network segmentation, encryption, logging, redundancy, and operational controls, ensuring the data center meets its legal and industry-specific obligations.
NEW QUESTION # 46
A network architect is creating a network topology for a global SD-WAN deployment. The business has offices in Asia, Europe, and the United States and makes use of data centers in theUnited States and Europe.
Most traffic between sites must have the lowest latency possible. Which of the following topologies best meets this requirement?
- A. Hub-and-spoke
- B. Mesh
- C. Spine-and-leaf
- D. Star
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
A mesh topology allows every site to connect directly to every other site, enabling the shortest and lowest- latency path between locations. This is ideal for SD-WAN deployments that must minimize latency for inter- site communication globally. In contrast, hub-and-spoke models force all traffic through a central hub, increasing latency.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "WAN Technologies and Topologies":
"Mesh topologies offer direct connectivity between all participating sites, reducing latency and avoiding single points of failure. They are optimal for SD-WAN deployments requiring performance and resilience." Other options:
* A. Star topology routes all traffic through a central node, introducing latency.
* B. Spine-and-leaf is used in data center architectures, not global WANs.
* D. Hub-and-spoke centralizes routing and increases latency between remote sites.
A full-mesh SD-WAN topology allows each site to establish direct overlays with every other site, minimizing the number of hops and avoiding backhauling through a central hub, thereby delivering the lowest latency paths between Asia, Europe, and the US.
NEW QUESTION # 47
A company is experiencing Wi-Fi performance issues. Three Wi-Fi networks are available, each running on the 2.4 GHz band and on the same channel. Connecting to each Wi-Fi network yields slow performance.
Which of the following channels should the networks be configured to?
- A. Channel 3, Channel 5, and Channel 10
- B. Channel 1, Channel 2. and Channel 3
- C. Channel 2. Channel 4, and Channel 9
- D. Channel 1, Channel 6, and Channel 11
Answer: D
Explanation:
These are the three non-overlapping channels in the 2.4 GHz band, eliminating co-channel and adjacent- channel interference for optimal Wi-Fi performance.
NEW QUESTION # 48
A network security engineer must secure a web application running on virtual machines in a public cloud. The virtual machines are behind an application load balancer. Which of the following technologies should the engineer use to secure the virtual machines? (Choose two.)
- A. NSG
- B. SIEM
- C. CDN
- D. WAF
- E. DLP
- F. IDS
Answer: A,D
Explanation:
WAF: Protects the web application by inspecting incoming HTTP/HTTPS requests at the load balancer, blocking SQL injection, XSS, and other common web attacks.
NSG: Enforces network-layer controls on the VMs' subnets or interfaces, allowing only approved ports and IP ranges to reach the application servers.
NEW QUESTION # 49
Security policy states that all inbound traffic to the environment needs to be restricted, but all external outbound traffic is allowed within the hybrid cloud environment. A new application server was recently set up in the cloud. Which of the following would most likely need to be configured so that the server has the appropriate access set up? (Choose two.)
- A. IPS
- B. Port security
- C. Screened subnet
- D. Application gateway
- E. Firewall
- F. Network security group
Answer: E,F
Explanation:
A perimeter firewall enforces the organization's "deny inbound by default, allow all outbound" policy at the edge of the cloud environment, while an Azure-style NSG applies the same rule set at the VM/subnet level.
Together they ensure no inbound connections slip through and that outbound traffic remains unrestricted.
NEW QUESTION # 50
A developer reports errors when trying to access a web application. The developer uses Postman to troubleshoot and receives the following error:
* HTTP Status: 403 Forbidden
* Headers include authentication-related variables such as access_key, signature, salt, and timestamp
* The request is a GET request to a payment methods API
Which of the following is the cause of the issue?
- A. Incorrect HTTP redirection
- B. Too restrictive NGFW rule
- C. Lack of user authentication
- D. Requested element not found
Answer: C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
A 403 Forbidden error indicates that the request was understood by the server but is refusing to fulfill it due to insufficient authorization. The developer is attempting to call a protected API that requires valid credentials such as an access key and signature (often used in HMAC-based APIs), but the values appear as Postman variables (e.g., {{rapyd_access_key}}), which suggests they were not replaced with actual credentials.
This typically means that the request lacks proper authentication or authorization headers, or the keys
/signature are incorrect or missing. The presence of access_key, signature, salt, and timestamp in the request implies the API requires authentication, but the variables were not resolved or valid.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "API Security and Authentication":
"A 403 error typically results from failed authentication or lack of proper authorization. Developers must ensure that tokens or signatures are valid, not missing, and properly injected." Other options:
* A. 404 is the code for a missing resource, not 403.
* C. A firewall rule would block the request entirely (e.g., no response or a 0 status), not result in a 403 from the server.
* D. HTTP redirection issues typically result in 3xx codes, not 403.
NEW QUESTION # 51
A cloud architect needs to change the network configuration at a company that uses GitOps to document and implement network changes. The Git repository uses main as the default branch, and the main branch is protected. Which of the following should the architect do after cloning the repository?
- A. Use the main branch to make and commit the changes back to the remote repository.
- B. Rebase the remote main branch after making the changes to implement.
- C. Create a new branch for the change, then create a pull request including the changes.
- D. Check out the development branch, then perform and commit the changes back to the remote repository.
Answer: C
Explanation:
Because main is protected, you must make your network-configuration edits on a separate feature branch and submit them via a pull request. This preserves the integrity of the protected branch and aligns with GitOps best practices for change review and automated deployment.
NEW QUESTION # 52
Which of the following helps the security of the network design to align with industry best practices?
- A. Licensing agreement
- B. Memorandum of understanding
- C. Reference architectures
- D. Service-level agreement
Answer: C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
Reference architectures are pre-defined templates or blueprints provided by vendors, standardsbodies, or industry alliances (e.g., NIST, CIS, vendor frameworks) that define recommended practices for secure and reliable infrastructure design. They help ensure alignment with compliance, security controls, and industry- recognized configurations.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Architecture Standards and Security Best Practices":
"Reference architectures guide the implementation of secure, scalable, and compliant infrastructure. They embody industry best practices and reduce misconfiguration risks in cloud and hybrid environments." Other options:
* B. Licensing agreements pertain to software usage rights, not security alignment.
* C. SLAs define service expectations, not design standards.
* D. MOUs are informal agreements between parties, not technical or security frameworks.
NEW QUESTION # 53
A network architect is choosing design options for a new SD-WAN installation that has the following requirements:
* All network traffic from the cloud must pass through inspection devices in a dedicated data center.
* Ensure redundancy.
* Centralize egress traffic.
Which of the following network topologies best meets these requirements?
- A. Partial mesh
- B. Point-to-point
- C. Star
- D. Hub-and-spoke
Answer: D
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
The Hub-and-Spoke topology is ideal for SD-WAN environments where traffic from branch offices or cloud workloads must route through a central location (the hub) for inspection, monitoring, or security enforcement.
This structure centralizes egress and allows for redundant spoke paths via the hub. It also simplifies control and enforces compliance policies.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "SD-WAN Topologies and Cloud Egress Strategies":
"In a hub-and-spoke topology, spokes (remote offices or cloud nodes) connect through a central hub, allowing for centralized egress, traffic inspection, and simplified routing." Other options:
* A. Point-to-point doesn't scale and lacks centralized control.
* C. Star topology is similar to hub-and-spoke but is more rigid and less suited for SD-WAN scalability.
* D. Partial mesh allows direct spoke-to-spoke communication, bypassing centralized inspection.
NEW QUESTION # 54
A cafe uses a tablet-based point-of-sale system. Customers are complaining that their food is taking too long to arrive. During an investigation, the following is noticed:
* Every kitchen printer did not print the orders
* Payments are processing correctly
* The cloud-based system has record of the orders
* This issue occurred when the cafe was busy
Which of the following is the best way to mitigate this issue?
- A. Updating the application
- B. Upgrading the kitchen printers' wireless dongles
- C. Adding an access point exclusively for the kitchen
- D. Assigning the kitchen printers static IP addresses
Answer: C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
Since payments are working and orders are being recorded in the cloud, the issue likely lies in the local wireless network between the tablets and the kitchen printers. If the issue only occurs during high usage periods, it's likely a congestion or signal quality issue. Adding a dedicated access point for the kitchen can isolate printer traffic and improve reliability.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Wireless Performance and Interference Management":
"Segmenting traffic or deploying dedicated APs for mission-critical devices can reduce contention and ensure reliability in congested wireless environments." Other options:
* A. App updates won't fix wireless interference.
* C. Dongle upgrades may help but don't isolate the traffic.
* D. Static IPs help with addressing, not with wireless reliability.
NEW QUESTION # 55
An architecture team needs to unify all logging and performance monitoring used by global applications across the enterprise to perform decision-making analytics. Which of the following technologies is the best way to fulfill this purpose?
- A. CIEM
- B. Content delivery network
- C. Data lake
- D. Relational database
Answer: C
Explanation:
A data lake provides a scalable, centralized repository that can ingest and store massive volumes of structured and unstructured data, including logs and performance metrics, from across your global applications. By keeping raw data in its native format, you can run batch and real-time analytics, machine learning, and business-intelligence workloads on one unified platform, making it ideal for enterprise-wide decision-making.
NEW QUESTION # 56
A network architect needs to design a new network to connect multiple private data centers. The network must:
* Provide privacy for all traffic between locations
* Use preexisting internet connections
* Use intelligent steering of application traffic over the best path
Which of the following best meets these requirements?
- A. SD-WAN
- B. MPLS connections
- C. Site-to-site VPN
- D. ExpressRoute
Answer: A
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
SD-WAN (Software-Defined Wide Area Network) enables private, encrypted connections over public internet links and supports policy-based routing for application-aware traffic steering. It offers centralized management, redundancy, and automatic path selection - all aligned with the stated requirements.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Software-Defined Networking and WAN Optimization":
"SD-WAN uses secure tunnels over the public internet, supports dynamic path selection, and provides application-aware routing, making it ideal for multi-site enterprise connectivity without dedicated links." Other options:
* A. MPLS requires dedicated circuits and is costly.
* C. Site-to-site VPN provides security but lacks intelligent traffic steering.
* D. ExpressRoute is a private connection to Azure, not suited for general internet-based multi-site connectivity.
NEW QUESTION # 57
......
Updated CNX-001 Certification Exam Sample Questions: https://examcollection.bootcamppdf.com/CNX-001-exam-actual-tests.html