Dumps Moneyack Guarantee - CNX-001 Dumps UpTo 50% Off
Updated Dec-2025 Pass CNX-001 Exam - Real Practice Test Questions
NEW QUESTION # 50
An architect needs to deploy a new payroll application on a cloud host. End users' access to the application will be based on the end users' role. In addition, the host mustbe deployed on the 192.168.77.32/30 subnet.
Which of the following Zero Trust elements are being implemented in this design? (Choose two.)
- A. WAF
- B. MFA
- C. CASB
- D. Device trust
- E. Least privilege
- F. Microsegmentation
Answer: E,F
Explanation:
Least privilege: Granting users access to the payroll app strictly according to their roles enforces the principle of least privilege.
Microsegmentation: Placing the host in its own 192.168.77.32/30 subnet isolates it from other workloads, achieving microsegmentation.
NEW QUESTION # 51
A network security engineer must secure a web application running on virtual machines in a public cloud. The virtual machines are behind an application load balancer. Which of the following technologies should the engineer use to secure the virtual machines? (Choose two.)
- A. CDN
- B. IDS
- C. SIEM
- D. WAF
- E. DLP
- F. NSG
Answer: D,F
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
WAF (Web Application Firewall) protects web applications by inspecting HTTP/S traffic to and from the application. It filters, monitors, and blocks malicious traffic and exploits targeting web application vulnerabilities. WAFs are deployed at the edge, often in conjunction with load balancers, and are ideal for mitigating threats like SQL injection, cross-site scripting, and protocol violations.
NSG (Network Security Group) is a native security feature offered by many cloud providers (such as Azure), functioning similarly to a firewall. NSGs control inbound and outbound traffic at the virtual network interface, subnet, or VM level, allowing engineers to define allowed or denied traffic rules.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide under "Cloud Workload Protection & Security Tools":
"WAFs are critical for protecting web-facing applications in public cloud environments."
"Network Security Groups (NSGs) are used to enforce access policies on cloud-based virtual networks, providing filtering and segmentation at the instance or subnet level."
NEW QUESTION # 52
A network administrator receives a ticket from one of the company's offices about video calls that work normally for one minute and then get very choppy. The network administrator pings the video server from that site to ensure that it is reachable:
Which of the following ismostlikely the cause of the video call issue?
- A. Latency
- B. Jitter
- C. Throughput
- D. Loss
Answer: B
Explanation:
The wildly varying ping response times (from 11 ms up to 849 ms) indicate high packet-delay variation, which causes the video stream to become choppy after a short period. That fluctuation in latency is known as jitter.
NEW QUESTION # 53
An organization with an on-premises data center is adopting additional cloud-based solutions. The organization wants to keep communication secure between remote employees' devices and workloads. Which of the following ZTA features best achieves this goal?
- A. Principle of least privilege
- B. Secure service edge
- C. Identity as the perimeter
- D. Cloud access security broker
Answer: C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
"Identity as the perimeter" is a core principle of Zero Trust Architecture (ZTA). Rather than relying on traditional network-based perimeters, access is granted based on user identity and device posture. This is essential for remote users accessing cloud workloads, ensuring secure authentication regardless of physical location.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Zero Trust and Identity- Centric Security":
"Zero Trust shifts the trust boundary from the network to the user and device identity. 'Identity as the perimeter' ensures only verified users and devices are granted access to resources." Other options:
* A. Secure service edge (SSE) is a broad cloud security model, but not a specific ZTA principle.
* B. CASBs monitor cloud app usage, not core access authentication.
* C. Principle of least privilege is a supporting concept, but not the primary perimeter defense mechanism.
NEW QUESTION # 54
A network administrator must connect a remote building at a manufacturing plant to the main building via a wireless connection. Which of the following should the administrator choose to get the greatest possible range from the wireless connection? (Choose two.)
- A. 5GHz
- B. 2.4GHz
- C. Omnidirectional antenna
- D. 6GHz
- E. Built-in antenna
- F. Patch antenna
Answer: B,F
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
2.4GHz has longer range and better wall penetration than higher frequencies like 5GHz or 6GHz.A patch antenna (a type of directional antenna) focuses the signal in one direction, greatly improving range and reliability over long distances between buildings.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Wireless Deployment and Antenna Selection":
"2.4GHz offers extended range over 5GHz. Directional antennas such as patch antennas concentrate signals toward a target, improving distance communication." Other options:
* B & C. Higher frequencies provide faster speeds but shorter range.
* D. Omnidirectional antennas spread signal in all directions, not ideal for point-to-point.
* F. Built-in antennas are generally low gain and insufficient for building-to-building links.
NEW QUESTION # 55
An organization with an on-premises data center is adopting additional cloud-based solutions. The organization wants to keep communication secure between remote employees' devices and workloads. Which of the following ZTA featuresbestachieves this goal?
- A. Principle of least privilege
- B. Secure service edge
- C. Identity as the perimeter
- D. Cloud access security broker
Answer: C
Explanation:
Shifting to "identity as the perimeter" means that each remote user and device's identity (and context) becomes the basis for granting secure, encrypted access directly to workloads, regardless of the underlying network, ensuring communications are authenticated and authorized per-session.
NEW QUESTION # 56
Throughout the day, a sales team experiences videoconference performance issues when the accounting department runs reports. Which of the following is the best solution?
- A. Running the accounting department's reports outside of business hours
- B. ConfiguringQoS on the corporate network switches
- C. Increasing the throughput on the network by purchasing high-end switches
- D. Using a load balancer to split the video traffic evenly
Answer: B
Explanation:
By implementing Quality of Service rules, you can prioritize videoconference packets over the bulk data transfers generated by accounting reports, ensuring consistent call quality without disrupting either department's workflows.
NEW QUESTION # 57
A cafe uses a tablet-based point-of-sale system. Customers are complaining that their food is taking too long to arrive. During an investigation, the following is noticed:
Every kitchen printer did not print the orders.
Payments are processing correctly.
The cloud-based system has record of the orders.
This issue occurred when the cafe was busy.
Which of the following is the best way to mitigate this issue?
- A. Assigning the kitchen printers static IP addresses
- B. Updating the application
- C. Upgrading the kitchen printers' wireless dongles
- D. Adding an access point exclusively for the kitchen
Answer: D
Explanation:
By dedicating a separate Wi-Fi access point to the printers, you isolate their traffic from the customer-facing tablets. This prevents congestion during busy periods, ensuring orders reliably print even when the main network is under heavy load.
NEW QUESTION # 58
A network engineer is establishing a wireless network for handheld inventory scanners in a manufacturing company's warehouse. The engineer needs an authentication mechanism for these scanners that uses the Wi-Fi network and works with the company's Active Directory. The business requires that the solution authenticate the users and authorize the scanners. Which of the following provides the best solution for authentication and authorization?
- A. PKI
- B. LDAP
- C. TACACS+
- D. RADIUS
Answer: D
Explanation:
Using a RADIUS server with 802.1X on the Wi-Fi infrastructure allows the scanners (and their users) to be authenticated against Active Directory and mapped to the correct authorization policies. TACACS+ is geared toward device management, LDAP alone doesn't handle the Wi-Fi 802.1X handshake, and PKI by itself wouldn't provide the user-to-device authorization flow needed. RADIUS gives you both authentication and authorization tied into AD.
NEW QUESTION # 59
A network engineer is setting up guest access on a Wi-Fi network. After a recent network analysis, the engineer discovered that a user could access the guest network and attack the corporate network, since the networks share the same VLAN. Which of the following should the engineer do to prevent an attack like this one from happening?
- A. Configure Layer 2 client isolation for the wireless network.
- B. Set up a strong password on the guest wireless network.
- C. Set up a captive portal so all guest users have to register before gaining access to the wireless network.
- D. Set up a MAC filtering rule and add the MAC addresses of all corporate devices to the allow list.
Answer: A
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
Layer 2 client isolation ensures that devices connected to the same wireless network (such as a guest SSID) cannot communicate with each other or other VLANs. This prevents guest users from scanning or attacking internal devices. It's a fundamental security control for guest Wi-Fi access.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Wireless Network Segmentation and Security":
"Client isolation prevents peer-to-peer attacks over Wi-Fi by ensuring wireless clients cannot communicate with one another, a necessary control on shared guest networks." Other options:
* B. MAC filtering is easy to spoof and hard to manage at scale.
* C. Strong passwords improve access control but don't isolate guest traffic.
* D. Captive portals add a registration layer but don't address VLAN or broadcast isolation.
NEW QUESTION # 60
An administrator must ensure that credit card numbers are not contained in any outside messaging or file transfers from the organization. Which of the following controls meets this requirement?
- A. Encryption in transit
- B. Intrusion detection system
- C. Egress filtering
- D. Data loss prevention
Answer: D
Explanation:
Data Loss Prevention solutions inspect outbound communications and file transfers for sensitive data patterns, such as credit card numbers, and block or quarantine any messages that contain them, ensuring that no payment card details leave the organization.
NEW QUESTION # 61
A network architect needs to design a solution to ensure every cloud environment network is built to the same baseline. The solution must meet the following requirements:
* Use automated deployment.
* Easily update multiple environments.
* Share code with a community of practice.
Which of the following are the best solutions? (Choose two.)
- A. Automated image deployment
- B. Deployment runbooks
- C. CI/CD pipelines
- D. Public code repository
- E. Deployment guides
- F. Private code repository
Answer: C,D
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
A: CI/CD pipelines - Continuous Integration and Continuous Deployment (CI/CD) pipelines allow automated and repeatable deployments of infrastructure and application code. This ensures consistency across environments and supports rapid, reliable updates to multiple environments simultaneously.
B: Public code repository - A public repository (e.g., GitHub, GitLab public projects) allows sharing code with the broader community of practice, enabling collaboration, peer review, and reuse. It supports version control and standardized deployment scripts (e.g., Terraform, Ansible).
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Infrastructure as Code and Automation Pipelines":
"CI/CD pipelines enable automated, consistent deployments across environments, reducing manual configuration errors."
"Public repositories facilitate code sharing and collaboration, supporting standardized infrastructure templates." Other options:
* C. Deployment runbooks are static and not inherently automated.
* D. Private repositories restrict sharing, conflicting with the requirement to share code.
* E. Image deployment refers to server builds, not full network configuration.
* F. Deployment guides are manual documents, not automation tools.
NEW QUESTION # 62
A customer asks a MSP to propose a ZTA (Zero Trust Architecture) design for its globally distributed remote workforce. Given the following requirements:
* Authentication should be provided through the customer's SAML identity provider.
* Access should not be allowed from countries where the business does not operate.
* Secondary authentication should be added to the workflow to allow for passkeys.
* Changes to the user's device posture and hygiene should require reauthentication into the network.
* Access to the network should only be allowed to originate from corporate-owned devices.
Which of the following solutions should the MSP recommend to meet the requirements?
- A. Enforce certificate-based authentication.
Permit unauthenticated remote connectivity only from corporate IP addresses.
Enable geofencing.
Use cookie-based session tokens that do not expire for remembering user log-ins.
Increase RADIUS server timeouts. - B. Enforce posture assessment only during the initial network log-on.
Implement RADIUS for SSO.
Restrict access from all non-U.S. IP addresses.
Configure a BYOD access policy.
Disable auditing for remote access. - C. Chain the existing identity provider to a new SAML.
Require the use of time-based one-time passcode hardware tokens.
Enable debug logging on the VPN clients by default.
Disconnect users from the network only if their IP address changes. - D. Configure geolocation settings to block certain IP addresses.
Enforce MFA.
Federate the solution via SSO.
Enable continuous access policies on the WireGuard tunnel.
Create a trusted endpoints policy.
Answer: D
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
D includes all the key elements of Zero Trust:
* MFA (Multi-Factor Authentication) supports secondary passkey-based authentication.
* Geolocation settings enforce geo-restrictions.
* SSO federation allows use of an existing SAML identity provider.
* Continuous access policies support dynamic reauthentication based on changes in posture.
* Trusted endpoint policies ensure only corporate-owned, compliant devices are allowed to connect.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Zero Trust Architecture and Identity Management":
"ZTA enforces continuous access policies that monitor session state, posture, and user behavior."
"Federated identity with SSO and posture-based trust evaluation are core ZTA components."
"Geo-restrictions and trusted endpoint policies limit exposure and enforce device compliance." Other options:
* A uses static session tokens and disables timely expiration, violating Zero Trust principles.
* B allows BYOD and disables auditing, which conflicts with compliance and monitoring.
NEW QUESTION # 63
A company is experiencing multiple switch failures. The network analyst discovers the following:
* Network recovery time is unacceptable and occurs after the shutdown of some switches.
* Some loops were detected in the network.
* No broadcast storm was detected.
Which of the following is the most cost-effective solution?
- A. Implement tagging.
- B. Add multiple VLANs.
- C. Implement STP.
- D. Add a new Layer 3 switch.
Answer: C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
Spanning Tree Protocol (STP) is a Layer 2 protocol that prevents loop conditions in redundant switch topologies. It automatically disables redundant links in a controlled way, allowing one active path at a time.
When a switch fails, STP recalculates and activates an alternate path. In this case, loops are detected, but no broadcast storms occurred, indicating that STP is not in place or not configured properly. Implementing STP is a low-cost and effective solution to resolve these issues.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Switching Technologies and Loop Prevention":
"STP prevents switching loops by dynamically identifying and disabling redundant paths. When a link failure occurs, STP re-converges to restore network connectivity."
"STP is an essential protocol in redundant Layer 2 topologies to avoid broadcast and loop issues." Other options:
* A. A Layer 3 switch adds routing functionality but does not prevent Layer 2 loops.
* B. VLANs segment broadcast domains but do not inherently prevent physical loops.
* D. Tagging (e.g., VLAN tagging) helps with segmentation but not with loop prevention.
NEW QUESTION # 64
A network security administrator needs to set up a solution to:
Gather all data from log files in a single location.
Correlate the data to generate alerts.
Which of the following should the administrator implement?
- A. SIEM
- B. Event log monitoring
- C. Log management
- D. Syslog
Answer: A
Explanation:
A Security Information and Event Management system centralizes log collection from disparate sources and applies correlation rules to generate actionable alerts.
NEW QUESTION # 65
An outage occurred after a software upgrade on core switching. A network administrator thinks that the firmware installed had a bug. Which of the following should the network administrator do next?
- A. Test the theory to determine cause.
- B. Establish a plan of action to resolve the issue.
- C. Implement the solution.
- D. Document lessons learned.
Answer: A
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
According to the structured troubleshooting methodology outlined in the CNX-001 objectives, once a potential root cause is identified (in this case, a suspected firmware bug), the next step is to test the theory to confirm the cause before taking action. This helps prevent misdiagnosis and unnecessary configuration changes.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Structured Troubleshooting Methodology":
"After identifying symptoms and forming a theory of probable cause, the next step is to test the theory to verify it is the actual cause of the problem." Other options:
* A. Establishing a plan of action comes after confirming the cause.
* C. Documenting lessons learned is the final step.
* D. Implementing the solution should only occur after the issue is confirmed.
NEW QUESTION # 66
An outage occurred after a software upgrade on core switching. A network administrator thinks that the firmware installed had a bug. Which of the following should the network administrator do next?
- A. Test the theory to determine cause.
- B. Establish a plan of action to resolve the issue.
- C. Implement the solution.
- D. Document lessons learned.
Answer: A
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
According to the structured troubleshooting methodology outlined in the CNX-001 objectives, once a potential root cause is identified (in this case, a suspected firmware bug), the next step is to test the theory to confirm the cause before taking action. This helps prevent misdiagnosis and unnecessary configuration changes.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Structured Troubleshooting Methodology":
"After identifying symptoms and forming a theory of probable cause, the next step is to test the theory to verify it is the actual cause of the problem." Other options:
* A. Establishing a plan of action comes after confirming the cause.
* C. Documenting lessons learned is the final step.
* D. Implementing the solution should only occur after the issue is confirmed.
NEW QUESTION # 67
An administrator logged in to a cloud account on a shared machine but forgot to log out after the session ended. Which of the following types of security threats does this action pose?
- A. IP spoofing
- B. On-path attack
- C. Privilege escalation
- D. Zero-day
Answer: B
Explanation:
By leaving an active session open on a shared machine, an attacker with access to that machine can intercept or hijack the administrator's session tokens or credentials - classic on-path behavior - allowing them to impersonate the admin without needing elevated exploits.
NEW QUESTION # 68
An organization wants to evaluate network behavior with a network monitoring tool that is not inline. The organization will use the logs for further correlation and analysis of potential threats. Which of the following is the best solution?
- A. NetFlow to feed into the SIEM
- B. Syslog to a common dashboard used in the NOC
- C. SNMP trap with log analytics
- D. SSL decryption of network packets with preconfigured alerts
Answer: A
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
NetFlow provides flow-level metadata about IP traffic without requiring inline deployment. It summarizes who is talking to whom, for how long, and how much data was exchanged. It's ideal for behavior monitoring and threat detection when sent to a SIEM for correlation and analysis.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "NetFlow and Network Telemetry":
"NetFlow provides visibility into traffic patterns, which can be used for anomaly detection and security analysis when integrated with SIEM platforms." Other options:
* A. Syslog shows event-level data, but not network behavior.
* B. SNMP traps monitor device status, not traffic behavior.
* C. SSL decryption is complex and requires inline positioning.
NEW QUESTION # 69
A network administrator is troubleshooting an outage at a remote site. The administrator examines the logs and determines that one of the internet links at the site appears to be down. After the service provider confirms this information, the administrator fails over traffic to the backup link. Which of the following should the administrator do next?
- A. Establish a plan of action.
- B. Document the lessons learned.
- C. Verify full system functionality.
- D. Identify the problem.
Answer: C
Explanation:
After implementing the failover solution, you should confirm that all services and network paths are fully restored and operating correctly before closing the ticket.
NEW QUESTION # 70
A company is experiencing numerous network issues and decides to expand its support team. The new junior employees will need to be onboarded in the shortest time possible and be able to troubleshoot issues with minimal assistance. Which of the following should the company create to achieve this goal?
- A. Clearly documented runbooks for networking issues and knowledge base articles
- B. A mentor program for guiding each junior employee until they are familiar with the networking infrastructure
- C. Statement of work documenting what each junior employee should do when troubleshooting
- D. Physical and logical network diagrams of the entire networking infrastructure
Answer: A
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
Runbooks and knowledge base articles provide step-by-step instructions for resolving common issues, helping new employees quickly become productive with minimal supervision. These documents can be updated as new issues arise and serve as a foundational training and operational resource.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Operational Documentation and Knowledge Transfer":
"Runbooks contain standardized procedures for handling recurring operational tasks. Knowledge base articles enable consistent troubleshooting and resolution with minimal oversight." Other options:
* A. A Statement of Work (SOW) is used for defining project deliverables, not training.
* C. Network diagrams are useful for understanding architecture, but not for operational procedures.
* D. A mentor program can help, but it doesn't scale or provide immediate troubleshooting steps.
NEW QUESTION # 71
A partner is migrating a client from on premises to a hybrid cloud. Given the following project status information, the initial project timeline estimates need to be revised:
Which of the following documents needs to be revised tobestreflect the current status of the project?
- A. SOW
- B. SLA
- C. BIA
- D. WBS
Answer: D
Explanation:
The Work Breakdown Structure is where each project phase and its duration are documented in detail. Since the estimated timelines for discovery, design, implementation, and knowledge transfer have all slipped, you update the WBS to reflect the new, actual phase durations.
NEW QUESTION # 72
A network administrator needs to resolve connectivity issues in a hybrid cloud setup. Workstations and VMs are not able to access Application A. Workstations are able to access Server B.
INSTRUCTIONS
Click on workstations, VMs, firewalls, and NSGs to troubleshoot and gather information. Type help in the terminal to view a list of available commands.
Select the appropriate device(s) requiring remediation and identify the associated issue(s).
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Answer:
Explanation:
See explanation below.
Explanation:
Firewalls # VPN tunnel down
The IPsec tunnel between on-prem Firewall 1 and cloud Firewall 2 (ipip0/ipip2) is down, so no traffic can traverse to the cloud.
Application NSG # Misconfigured rule
There's a "block" rule for 10.3.9.0/24 # 192.2.1.0/24, preventing legitimate on-prem clients from reaching Application A.
NEW QUESTION # 73
Server A (10.2.3.9) needs to access Server B (10.2.2.7) within the cloud environment since theyare segmented into different network sections. All external inbound traffic must be blocked to those servers. Which of the following need to be configured to appropriately secure the cloud network? (Choose two.)
- A. Network security group rule: deny 0.0.0.0/0 to 10.2.0.0/16
- B. Firewall rule: deny 10.2.0.0/16 to 0.0.0.0/0
- C. Firewall rule: allow 10.2.0.0/16 to 0.0.0.0/0
- D. Network security group rule: allow 10.2.3.9 to 10.2.2.7
- E. Network security group rule: deny 10.2.0.0/16 to 0.0.0.0/0
- F. Network security group rule: allow 10.2.0.0/16 to 0.0.0.0/0
Answer: A,D
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
A: An explicit allow rule in the Network Security Group (NSG) permitting Server A (10.2.3.9) to communicate with Server B (10.2.2.7) ensures intra-cloud communication between segments.
C: A deny rule that blocks any inbound access from external sources (0.0.0.0/0 # internal range 10.2.0.0/16) effectively prevents unsolicited inbound traffic from the public internet, securing the internal servers.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Cloud Security Groups and Firewall Policies":
"NSGs should be configured with least privilege principles. Allow intra-subnet or intra-application communication while explicitly denying unsolicited internet traffic."
"Ingress and egress filtering policies should block all traffic by default and permit only what's required." Other options:
* B. Incorrect - this allows internal range to internet, which is not requested.
* D & E. Apply to outbound policies, not relevant to the need to block inbound external access.
* F. Incorrect - this denies internal resources from going outbound, not inbound protection.
NEW QUESTION # 74
......
Download Free CompTIA CNX-001 Real Exam Questions: https://pass4sure.guidetorrent.com/CNX-001-dumps-questions.html