(Mar-2026) Get professional help from our CNX-001 Dumps PDF
Give You Free Regular Updates on CNX-001 Exam Questions
CompTIA CNX-001 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
NEW QUESTION # 44
A network architect is working on a new network design to better support remote and on-campus workers.
Traffic needs to be decrypted for inspection in the cloud but is not required to go through the company's data center. Which of the following technologies best meets these requirements?
- A. Network access control system
- B. Intrusion prevention system
- C. Secure web gateway
- D. Transit gateway
- E. Virtual private network
Answer: C
Explanation:
A cloud-delivered Secure Web Gateway can terminate and decrypt user HTTPS sessions directly in the cloud for policy enforcement and inspection without hair-pinning traffic back through the data center.
NEW QUESTION # 45
A network security engineer must secure a web application running on virtual machines in a public cloud. The virtual machines are behind an application load balancer. Which of the following technologies should the engineer use to secure the virtual machines? (Choose two.)
- A. IDS
- B. SIEM
- C. WAF
- D. CDN
- E. NSG
- F. DLP
Answer: C,E
Explanation:
WAF: Protects the web application by inspecting incoming HTTP/HTTPS requests at the load balancer, blocking SQL injection, XSS, and other common web attacks.
NSG: Enforces network-layer controls on the VMs' subnets or interfaces, allowing only approved ports and IP ranges to reach the application servers.
NEW QUESTION # 46
As part of a project to modernize a sports stadium and improve the customer service experience for fans, the stadium owners want to implement a new wireless system. Currently, all tickets are electronic and managed by the stadium mobile application. The new solution is required to allow location tracking precision within 5ft (1.5m) of fans to deliver the following services:
* Emergency/security assistance
* Mobile food order
* Event special effects
* Raffle winner location displayed on the giant stadium screen
Which of the following technologies enables location tracking?
- A. IoT
- B. NFC
- C. BLE
- D. SSID
Answer: C
Explanation:
BLE (Bluetooth Low Energy) is a wireless personal area network (WPAN) technology designed for applications that require lower energy consumption and reduced cost while maintaining a communication range similar to classic Bluetooth. BLE supportslocation tracking with an accuracy range typically between 1 to 2 meters (approximately 3 to 6 feet), making it ideal for applications that demandfine-grained location services, such as stadium services requiring real-time user proximity data.
According to theCompTIA CloudNetX CNX-001 Official Objectives, under theNetwork Architecture domain, specifically in the subdomain:
"Wireless Technologies: Identify capabilities of BLE, NFC, RFID, and IoT devices within a network environment,"it is outlined that:
* "BLE enables proximity-based services and real-time indoor location tracking with high accuracy when used with beacon infrastructure."
* "BLE beacons can be deployed throughout a physical space, transmitting signals received by mobile applications to determine a user's location within a few feet."
* "BLE is widely adopted for use cases including indoor navigation, asset tracking, and personalized user engagement, making it a critical technology for modern high-density venues such as stadiums." In comparison:
* SSIDmerely identifies a wireless network and has no location tracking function.
* NFCrequires close contact (under 4 cm), and is not suitable for continuous or broad-range tracking.
* IoTis an overarching category that includes connected devices and sensors; however, IoT is not a standalone location tracking technology. It may include BLE as a component, butBLE specifically provides the precise location tracking functionality.
These distinctions are explicitly addressed in theCompTIA CloudNetX CNX-001 Study Guide, under the section:
* "Emerging Network Technologies and Architectures", where BLE is described as a key enabling technology for context-aware and location-based services in enterprise and public environments.
NEW QUESTION # 47
A network engineer is setting up guest access on a Wi-Fi network. After a recent network analysis, the engineer discovered that a user could access the guest network and attack the corporate network, since the networks share the same VLAN. Which of the following should the engineer do to prevent an attack like this one from happening?
- A. Configure Layer 2 client isolation for the wireless network.
- B. Set up a strong password on the guest wireless network.
- C. Set up a captive portal so all guest users have to register before gaining access to the wireless network.
- D. Set up a MAC filtering rule and add the MAC addresses of all corporate devices to the allow list.
Answer: A
Explanation:
By enabling client isolation at Layer 2, guest clients can still reach the Internet but cannot directly communicate with any other device on that VLAN, including your corporate endpoints, stopping lateral attacks without needing MAC whitelists or overly complex captive-portal setups.
NEW QUESTION # 48
A network administrator receives a ticket from one of the company's offices about video calls that work normally for one minute and then get very choppy. The network administrator pings the video server from that site to ensure that it is reachable:
Which of the following ismostlikely the cause of the video call issue?
- A. Throughput
- B. Latency
- C. Jitter
- D. Loss
Answer: C
Explanation:
The wildly varying ping response times (from 11 ms up to 849 ms) indicate high packet-delay variation, which causes the video stream to become choppy after a short period. That fluctuation in latency is known as jitter.
NEW QUESTION # 49
A network administrator must connect a remote building at a manufacturing plant to the main building via a wireless connection. Which of the following should the administrator choose to get thegreatestpossible range from the wireless connection? (Choose two.)
- A. Patch antenna
- B. Omnidirectional antenna
- C. Built-in antenna
- D. 5GHz
- E. 6GHz
- F. 2.4GHz
Answer: A,F
Explanation:
2.4 GHz: The lower-frequency 2.4 GHz band propagates farther and better penetrates obstacles than 5 GHz or
6 GHz, giving you greater link distance.
Patch antenna: A directional (patch) antenna focuses RF energy into a narrow beam, maximizing gain and range between two fixed points - the best for a long-haul wireless link.
NEW QUESTION # 50
A cloud engineer is planning to build VMs in a public cloud environment for a cloud migration. A cloud security policy restricts access to the console for new VM builds. The engineer wants to replicate the settings for each of the VMs to ensure the network settings are preconfigured. Which of the following is the best deployment method?
- A. IaC template
- B. API script
- C. Custom SDK
- D. CLI command
Answer: A
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
Infrastructure as Code (IaC) templates (e.g., Terraform, CloudFormation, ARM templates) allow for automated and repeatable VM deployments with preconfigured settings, includingnetworking, without requiring console access. This approach ensures consistency, security, and compliance.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Infrastructure as Code and Cloud Automation":
"IaC enables declarative definition of cloud resources, supporting automated deployments that comply with organizational security and configuration policies." Other options:
* B. SDKs require more complex coding and are less standardized.
* C. API scripts are procedural and require manual management.
* D. CLI is suitable for one-time use but not for repeatable deployments at scale.
NEW QUESTION # 51
An administrator logged in to a cloud account on a shared machine but forgot to log out after the session ended. Which of the following types of security threats does this action pose?
- A. IP spoofing
- B. On-path attack
- C. Privilege escalation
- D. Zero-day
Answer: C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
Failing to log out of a privileged session on a shared device leaves that session accessible to the next user, potentially granting unauthorized access to administrative functions. This scenario aligns with privilege escalation, where an individual gains access to higher-level permissions than they are authorized to have.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Access Control and Security Threats":
"Privilege escalation occurs when a user gains elevated access rights, often due to misconfigurations or negligence, such as unattended administrative sessions." Other options:
* A. IP spoofing involves falsifying source IP addresses.
* B. Zero-day refers to unknown software vulnerabilities.
* C. On-path attacks involve intercepting traffic, not session misuse on local devices.
NEW QUESTION # 52
A network architect needs to design a new network to connect multiple private data centers. The network must:
* Provide privacy for all traffic between locations
* Use preexisting internet connections
* Use intelligent steering of application traffic over the best path
Which of the following best meets these requirements?
- A. ExpressRoute
- B. SD-WAN
- C. MPLS connections
- D. Site-to-site VPN
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
SD-WAN (Software-Defined Wide Area Network) enables private, encrypted connections over public internet links and supports policy-based routing for application-aware traffic steering. It offers centralized management, redundancy, and automatic path selection - all aligned with the stated requirements.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Software-Defined Networking and WAN Optimization":
"SD-WAN uses secure tunnels over the public internet, supports dynamic path selection, and provides application-aware routing, making it ideal for multi-site enterprise connectivity without dedicated links." Other options:
* A. MPLS requires dedicated circuits and is costly.
* C. Site-to-site VPN provides security but lacks intelligent traffic steering.
* D. ExpressRoute is a private connection to Azure, not suited for general internet-based multi-site connectivity.
NEW QUESTION # 53
A network engineer at an e-commerce organization must improve the following dashboard due to a performance issue on the website:
(Refer to the image: Website performance monitoring dashboard showing metrics like network usage, CPU usage, memory usage, and disk usage over time.)
Which of the following is the most useful information to add to the dashboard for the operations team?
- A. 404 errors
- B. Concurrent users
- C. Number of orders
- D. Number of active incidents
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
While resource usage metrics (CPU, memory, disk, network) are important, the missing context here is user demand. Adding "Concurrent users" helps correlate resource utilization spikes with actual user load. For performance monitoring in web applications, concurrent sessions provide crucial insight into whether performance issues are demand-related.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Performance Monitoring and User Metrics":
"Monitoring user load metrics such as concurrent users provides insight into performance degradation and capacity planning. These are critical for identifying thresholds and auto-scaling requirements." Other options:
* A. 404 errors indicate broken links but don't explain performance issues.
* C. Number of orders tracks business activity, not system strain.
* D. Active incidents belong in an ITSM system, not real-time performance monitoring.
NEW QUESTION # 54
A network administrator is configuring firewall rules to lock down the network from outside attacks. Which of the following should the administrator configure to create the most strict set of rules?
- A. URL filtering
- B. Allow List
- C. File blocking
- D. Network security group
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
An Allow List (also known as Whitelisting) is the most restrictive firewall rule approach. It blocks all traffic by default and only permits explicitly defined trusted IPs, URLs, or applications. This minimizes the attack surface and ensures that only known, safe traffic is allowed into the network.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Firewall and Security Rule Configuration":
"Whitelisting or Allow Listing enforces a default-deny security posture by permitting only specified trusted sources. This approach offers the highest level of control and reduces exposure to unknown threats." Other options:
* A. URL filtering restricts content access but is not as strict as allow lists.
* B. File blocking targets malicious payloads but doesn't limit traffic sources.
* C. Network Security Groups (NSGs) are effective but broader in scope; they use allow/deny rules but may not be as tightly controlled as explicit allow lists.
NEW QUESTION # 55
A network administrator receives a ticket from one of the company's offices about video calls that work normally for one minute and then get very choppy. The network administrator pings the video server from that site to ensure that it is reachable:
(Ping output shows responses with varying latency times, including spikes: 11ms, 672ms, 849ms, 92ms, etc.)
Which of the following is most likely the cause of the video call issue?
- A. Throughput
- B. Latency
- C. Jitter
- D. Loss
Answer: C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
Jitter refers to the variation in packet delay during transmission. In the ping output shown, the response times fluctuate significantly (11ms, 672ms, 849ms, 34ms), indicating inconsistent network performance. Such variation leads to a poor experience in real-time applications likevideo calls. High jitter causes packets to arrive out of order, resulting in stuttering or choppy audio/video.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Troubleshooting Real-Time Network Services":
"Jitter is the deviation in packet arrival times and directly affects real-time communications such as VoIP and video conferencing. Consistent latency is tolerable; inconsistent latency (jitter) is disruptive." Other options:
* A. Throughput refers to bandwidth and would cause consistent slowness.
* C. Latency alone, if stable, is acceptable; it's the inconsistency here that causes issues.
* D. Loss would be indicated by missing packets; the ping results show replies to all packets.
NEW QUESTION # 56
Security policy states that all inbound traffic to the environment needs to be restricted, but all external outbound traffic is allowed within the hybrid cloud environment. A new application server was recently set up in the cloud. Which of the following would most likely need to be configured so that the server has the appropriate access set up? (Choose two.)
- A. Network security group
- B. Firewall
- C. Screened subnet
- D. IPS
- E. Application gateway
- F. Port security
Answer: A,B
Explanation:
A perimeter firewall enforces the organization's "deny inbound by default, allow all outbound" policy at the edge of the cloud environment, while an Azure-style NSG applies the same rule set at the VM/subnet level.
Together they ensure no inbound connections slip through and that outbound traffic remains unrestricted.
NEW QUESTION # 57
An administrator must ensure that credit card numbers are not contained in any outside messaging or file transfers from the organization. Which of the following controls meets this requirement?
- A. Data loss prevention
- B. Encryption in transit
- C. Egress filtering
- D. Intrusion detection system
Answer: A
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
Data Loss Prevention (DLP) solutions scan messages and file transfers for sensitive data patterns, such as credit card numbers or social security numbers. DLP can block, log, or alert when such information is detected attempting to leave the organization.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Data Protection and Compliance Controls":
"DLP systems identify and restrict the transmission of sensitive data such as credit card numbers, enforcing organizational data handling policies." Other options:
* A. IDS detects threats but doesn't enforce data content policies.
* B. Egress filtering restricts destinations but not content.
* D. Encryption protects data in transit, not its content compliance.
NEW QUESTION # 58
A cloud architect must recommend an architecture approach for a new medical application that requires the lowest downtime possible. Which of the following is the best application deployment strategy given the high- availability requirement?
- A. Two different availability zones (per region) using an active-passive topology in two different regions
- B. Four different availability zones using an active-passive topology in a single region
- C. Four different availability zones using an active-active topology in a single region
- D. Two different availability zones (per region) using an active-active topology in two different regions
Answer: D
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
Using an active-active deployment across two regions with at least two Availability Zones (AZs) each provides the highest level of fault tolerance and geographic redundancy. This ensures continuity even if an entire region or multiple zones become unavailable. In regulated sectors such as healthcare, this meets strict availability and disaster recovery requirements.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "High Availability and Multi- Region Design":
"Active-active configurations across multiple regions and availability zones maximize uptime and ensure failover in the event of localized or regional failures." Other options:
* B. Active-passive introduces delays in failover.
* C. Active-active in one region offers no geographic redundancy.
* D. Active-passive in two regions is slower and less efficient during failover.
NEW QUESTION # 59
A company is experiencing multiple switch failures. The network analyst discovers the following:
* Network recovery time is unacceptable and occurs after the shutdown of some switches.
* Some loops were detected in the network.
* No broadcast storm was detected.
Which of the following is the most cost-effective solution?
- A. Implement STP.
- B. Implement tagging.
- C. Add a new Layer 3 switch.
- D. Add multiple VLANs.
Answer: A
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
Spanning Tree Protocol (STP) is a Layer 2 protocol that prevents loop conditions in redundant switch topologies. It automatically disables redundant links in a controlled way, allowing one active path at a time.
When a switch fails, STP recalculates and activates an alternate path. In this case, loops are detected, but no broadcast storms occurred, indicating that STP is not in place or not configured properly. Implementing STP is a low-cost and effective solution to resolve these issues.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Switching Technologies and Loop Prevention":
"STP prevents switching loops by dynamically identifying and disabling redundant paths. When a link failure occurs, STP re-converges to restore network connectivity."
"STP is an essential protocol in redundant Layer 2 topologies to avoid broadcast and loop issues." Other options:
* A. A Layer 3 switch adds routing functionality but does not prevent Layer 2 loops.
* B. VLANs segment broadcast domains but do not inherently prevent physical loops.
* D. Tagging (e.g., VLAN tagging) helps with segmentation but not with loop prevention.
NEW QUESTION # 60
A network architect is working on a physical network design template for a small education institution's satellite campus that is not yet built. The new campus location will consist of two small buildings with classrooms, one screening room with audiovisual equipment, and 200 seats for students. Which of the following enterprise network designs should the architect suggest?
- A. Collapsed core
- B. Dual-layer
- C. Three-tier
- D. Hybrid
Answer: A
Explanation:
In a small satellite campus with limited buildings and user density, a collapsed-core (two-tier) design combines the core and distribution layers into a single set of switches. This minimizes hardware, simplifies management, and still provides the necessary segmentation and resiliency for the classrooms, screening room, and student seating areas.
NEW QUESTION # 61
A user reports an issue connecting to a database server. The front-end application for this database is hosted on the company's web server. The network engineer has changed the network subnet that the company servers are located on along with the IP addresses of the servers. These are the new configurations:
New subnet for the servers is 10.10.10.64/27
Web server IP address is 10.10.10.101
Database server IP is 10.10.10.93
Which of the following ismostlikely causing the user's issue?
- A. The database server firewall is blocking the port to the database.
- B. The web application server is not forwarding the requests.
- C. The web server does not have the correct network configuration.
- D. The DNS server is not resolving properly.
Answer: C
Explanation:
With a /27 mask on 10.10.10.64/27, valid host addresses run from 10.10.10.65 through 10.10.10.94. The database server's IP (10.10.10.93) is in that range, but the web server's IP (10.10.10.101) falls outside it-so it's mis-configured and cannot reach the database.
NEW QUESTION # 62
A network architect needs to build a new data center for a large company that has business units that process retail financial transactions. Which of the following information should the architect request from the company?
- A. Statement of work
- B. Business case study
- C. Internal reference architecture
- D. Regulatory requirements
Answer: D
Explanation:
Before designing a facility that will handle retail financial transactions, you need to understand all applicable compliance and security mandates (e.g. PCI DSS, SOX, GDPR). Those regulatory requirements will drive your choices around physical security, network segmentation, encryption, logging, redundancy, and operational controls, ensuring the data center meets its legal and industry-specific obligations.
NEW QUESTION # 63
A customer asks a MSP to propose a ZTA design for its globally distributed remote workforce. Given the following requirements:
Authentication should be provided through the customer's SAML identity provider.
Access should not be allowed from countries where the business does not operate.
Secondary authentication should be added to the workflow to allow for passkeys.
Changes to the user's device posture and hygiene should require reauthentication into the network.
Access to the network should only be allowed to originate from corporate-owned devices.
Which of the following solutions should the MSP recommend to meet the requirements?
- A. Configure geolocation settings to block certain IP addresses.
Enforce MFA.
Federate the solution via SSO.
Enable continuous access policies on the WireGuard tunnel.
Create a trusted endpoints policy. - B. Enforce certificate-based authentication.
Permit unauthenticated remote connectivity only from corporate IP addresses.
Enable geofencing.
Use cookie-based session tokens that do not expire for remembering user log-ins.
Increase RADIUS server timeouts. - C. Enforce posture assessment only during the initial network log-on.
Implement RADIUS for SSO.
Restrict access from all non-U.S. IP addresses.
Configure a BYOD access policy.
Disable auditing for remote access. - D. Chain the existing identity provider to a new SAML.
Require the use of time-based one-time passcode hardware tokens.
Enable debug logging on the VPN clients by default.
Disconnect users from the network only if their IP address changes.
Answer: A
Explanation:
Federate the solution via SSO ensures authentication is handled by the customer's SAML identity provider.
Enforce MFA supports secondary authentication with passkeys.
Configure geolocation settings to block certain IP addresses prevents access from unauthorized countries.
Enable continuous access policies on the WireGuard tunnel forces re-authentication whenever device posture or hygiene changes.
Create a trusted endpoints policy restricts access to corporate-owned devices only.
NEW QUESTION # 64
A network architect needs to design a new network to connect multiple private data centers. The network must:
Provide privacy for all traffic between locations.
Use preexisting internet connections.
Use intelligent steering of application traffic over the best path.
Which of the following best meets these requirements?
- A. ExpressRoute
- B. SD-WAN
- C. MPLS connections
- D. Site-to-site VPN
Answer: B
Explanation:
By running encrypted tunnels over your existing Internet links and dynamically steering traffic across the optimal path, an SD-WAN solution delivers privacy and performance intelligence without requiring new private circuits.
NEW QUESTION # 65
......
Achieve the CNX-001 Exam Best Results with Help from CompTIA Certified Experts: https://prep4sure.vcedumps.com/CNX-001-examcollection.html
