CompTIA CNX-001 CompTIA CloudNetX Exam Exam Practice Test

Firewalls → VPN tunnel down

The IPsec tunnel between on-prem Firewall 1 and cloud Firewall 2 (ipip0/ipip2) is down, so no traffic can traverse to the cloud.

Application NSG → Misconfigured rule

There’s a “block” rule for 10.3.9.0/24 → 192.2.1.0/24, preventing legitimate on-prem clients from reaching Application A.

Comprehensive and Detailed Explanation From Exact Extract:

This scenario describes a classic example of social engineering. An attacker impersonated the help desk and convinced the user to change their password, likely to one the attacker controlled. Social engineering attacks manipulate human behavior to bypass technical security measures.

Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide — under “Social Engineering Threats”:

“Social engineering involves manipulating individuals to perform actions or divulge confidential information, such as passwords, often by impersonating trusted entities like IT support.”

Other options:

A. Initialization vector relates to encryption vulnerabilities.

B. On-path (formerly man-in-the-middle) requires network interception, which is not described here.

C. Evil twin is a rogue Wi-Fi AP attack, not applicable to this VPN login context.

Comprehensive and Detailed Explanation From Exact Extract:

Traffic mirroring allows a copy of network traffic — including headers and payloads — to be sent to an analysis tool or appliance for deep packet inspection. This is essential for security analysis, network troubleshooting, and performance diagnostics in cloud environments.

Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide — under “Packet Capture and Network Flow Monitoring”:

“Traffic mirroring enables the capture of full packet data, including payloads, for forensic or performance analysis within cloud networks.”

Other options:

A. Application monitoring focuses on app-level metrics, not packet inspection.

B. Syslog is log-based, not for inspecting packets.

D. Network flows (e.g., NetFlow, VPC flow logs) provide metadata (source, destination, size) but not full packet content.

Comprehensive and Detailed Explanation From Exact Extract:

To accommodate 200 devices in IT and 2,000 devices in Sales, subnetting must allow for appropriate address allocation:

/22 provides 1,024 addresses → sufficient for IT (200 users)

/15 provides 65,536 addresses → more than sufficient for Sales (2,000 users)

Option C ensures both departments are placed in separate, appropriately sized segments within the private 10.0.0.0/8 range.

Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide — under “IP Addressing and Subnetting”:

“Proper subnetting ensures sufficient host addresses and supports future growth. Network segmentation improves manageability and security.”

Other options:

A. /30 provides only 2 usable IPs — insufficient for IT.

B & D: /24 and /25 do not support 2,000 users in Sales.

B & D also misallocate resources inefficiently.

================================================

Comprehensive and Detailed Explanation From Exact Extract:

Privileged Access Management (PAM) is the optimal solution to control, audit, and secure administrative access to systems and services. PAM enables role-based approval workflows, time-limited access, auditing, and credential rotation, fully aligning with the requirements.

Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide — under “Identity and Access Controls”:

“Privileged Access Management allows fine-grained control over administrator-level access, supports just-in-time access provisioning, password rotation, and audit logging.”

Other options:

B. Session-based tokens allow temporary access but do not enforce policies or auditing.

C. Conditional access provides policy enforcement based on context but lacks full PAM features.

D. ACLs control access to resources but don’t manage privilege workflows or audits.

Comprehensive and Detailed Explanation From Exact Extract:

Since payments are working and orders are being recorded in the cloud, the issue likely lies in the local wireless network between the tablets and the kitchen printers. If the issue only occurs during high usage periods, it’s likely a congestion or signal quality issue. Adding a dedicated access point for the kitchen can isolate printer traffic and improve reliability.

Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide — under “Wireless Performance and Interference Management”:

“Segmenting traffic or deploying dedicated APs for mission-critical devices can reduce contention and ensure reliability in congested wireless environments.”

Other options:

A. App updates won’t fix wireless interference.

C. Dongle upgrades may help but don’t isolate the traffic.

D. Static IPs help with addressing, not with wireless reliability.

Comprehensive and Detailed Explanation From Exact Extract:

RADIUS (Remote Authentication Dial-In User Service) is the best-fit protocol for this requirement. It supports both authentication and authorization and is widely used in Wi-Fi network environments for client device authentication using credentials stored in centralized directories such as Active Directory.

RADIUS integrates seamlessly with enterprise authentication sources and supports EAP (Extensible Authentication Protocol), making it compatible with Wi-Fi-based client devices. It also allows for role-based access control, enabling policy enforcement specific to device types (e.g., inventory scanners).

Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide — “Authentication and Authorization Technologies”:

“RADIUS provides centralized authentication, authorization, and accounting (AAA) services and is commonly used for securing wireless access in conjunction with Active Directory.”

“Organizations use RADIUS to manage Wi-Fi authentication for user devices and enforce security policies during access attempts.”

Using a RADIUS server with 802.1X on the Wi-Fi infrastructure allows the scanners (and their users) to be authenticated against Active Directory and mapped to the correct authorization policies. TACACS+ is geared toward device management, LDAP alone doesn’t handle the Wi-Fi 802.1X handshake, and PKI by itself wouldn’t provide the user-to-device authorization flow needed. RADIUS gives you both authentication and authorization tied into AD.

Comprehensive and Detailed Explanation From Exact Extract:

Geofencing allows enforcement of access policies based on the geographic location of the user's IP address. To comply with GDPR and control access based on user region, geofencing should be implemented to restrict or permit access to resources hosted in specific regions like Europe.

Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide — under “Data Sovereignty and Regional Access Control”:

“Geofencing enables organizations to restrict access to data or services based on geographic IP address, aiding in GDPR and other compliance frameworks.”

Other options:

A. SASE is a broader framework, not a direct access control mechanism.

B. NSGs operate at subnet/NIC level and do not interpret geolocation.

C. CDNs cache data globally but don’t control access by region directly.

================================================

Comprehensive and Detailed Explanation From Exact Extract:

A Content Delivery Network (CDN) distributes content across geographically distributed edge locations to provide faster access and higher quality to users, especially in areas with suboptimal connectivity to central data centers. By caching and serving content from edge servers near users, CDNs reduce latency and improve streaming performance globally.

Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide — under “CDN and Cloud Edge Services”:

“CDNs provide globally distributed edge nodes for content caching and delivery, ensuring low-latency, high-bandwidth access for end users regardless of their location.”

Other options:

A. Reduces quality, contrary to the stated goal.

B. DNS-based routing helps with direction but does not solve content delivery or bandwidth issues.

C. Load balancers help distribute traffic locally, but do not provide edge caching or bandwidth optimization.

Comprehensive and Detailed Explanation From Exact Extract:

Reference architectures are pre-defined templates or blueprints provided by vendors, standardsbodies, or industry alliances (e.g., NIST, CIS, vendor frameworks) that define recommended practices for secure and reliable infrastructure design. They help ensure alignment with compliance, security controls, and industry-recognized configurations.

Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide — under “Architecture Standards and Security Best Practices”:

“Reference architectures guide the implementation of secure, scalable, and compliant infrastructure. They embody industry best practices and reduce misconfiguration risks in cloud and hybrid environments.”

Other options:

B. Licensing agreements pertain to software usage rights, not security alignment.

C. SLAs define service expectations, not design standards.

D. MOUs are informal agreements between parties, not technical or security frameworks.

================================================

Comprehensive and Detailed Explanation From Exact Extract:

NetFlow provides flow-level metadata about IP traffic without requiring inline deployment. It summarizes who is talking to whom, for how long, and how much data was exchanged. It’s ideal for behavior monitoring and threat detection when sent to a SIEM for correlation and analysis.

Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide — under “NetFlow and Network Telemetry”:

“NetFlow provides visibility into traffic patterns, which can be used for anomaly detection and security analysis when integrated with SIEM platforms.”

Other options:

A. Syslog shows event-level data, but not network behavior.

B. SNMP traps monitor device status, not traffic behavior.

C. SSL decryption is complex and requires inline positioning.

================================================

Comprehensive and Detailed Explanation From Exact Extract:

With GitOps, all infrastructure changes are tracked as code and committed to version-controlled repositories. When the main branch is protected, changes should not be committed directly. Instead, best practices require that a new feature or change branch be created, followed by a pull request (PR) for peer review and approval before merging into the protected branch.

Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide — under “Infrastructure as Code and GitOps”:

“In GitOps workflows, changes are made in feature branches, reviewed via pull requests, and merged into protected branches only after validation, ensuring auditability and control over infrastructure deployments.”

Other options:

A. Direct commits to protected branches are restricted and violate GitOps practices.

C. The development branch may exist, but the question specifies main is the default, and the correct process requires a PR.

D. Rebase is for integrating histories, not submitting approved changes.

Comprehensive and Detailed Explanation From Exact Extract:

A mesh topology allows every site to connect directly to every other site, enabling the shortest and lowest-latency path between locations. This is ideal for SD-WAN deployments that must minimize latency for inter-site communication globally. In contrast, hub-and-spoke models force all traffic through a central hub, increasing latency.

Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide — under “WAN Technologies and Topologies”:

“Mesh topologies offer direct connectivity between all participating sites, reducing latency and avoiding single points of failure. They are optimal for SD-WAN deployments requiring performance and resilience.”

Other options:

A. Star topology routes all traffic through a central node, introducing latency.

B. Spine-and-leaf is used in data center architectures, not global WANs.

D. Hub-and-spoke centralizes routing and increases latency between remote sites.

A full-mesh SD-WAN topology allows each site to establish direct overlays with every other site, minimizing the number of hops and avoiding backhauling through a central hub, thereby delivering the lowest latency paths between Asia, Europe, and the US.

Comprehensive and Detailed Explanation From Exact Extract:

A mesh topology provides multiple redundant paths between nodes. It offers the highest availability and fault tolerance by allowing communication to continue even if one or more links or nodes fail. This is especially important in rural healthcare systems where reliability and access to critical services are paramount.

Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide — under “Network Topologies and Redundancy Models”:

“Mesh topologies provide optimal fault tolerance and support consistent data transmission through redundant links, ideal for mission-critical systems.”

Other options:

A. Collapsed core is cost-efficient but not fully redundant.

B. Hub-and-spoke introduces a single point of failure at the hub.

D. Star also relies on a central node and is not fault tolerant.

================================================

Comprehensive and Detailed Explanation From Exact Extract:

A. CI/CD pipelines — Continuous Integration and Continuous Deployment (CI/CD) pipelines allow automated and repeatable deployments of infrastructure and application code. This ensures consistency across environments and supports rapid, reliable updates to multiple environments simultaneously.

B. Public code repository — A public repository (e.g., GitHub, GitLab public projects) allows sharing code with the broader community of practice, enabling collaboration, peer review, and reuse. It supports version control and standardized deployment scripts (e.g., Terraform, Ansible).

Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide — under “Infrastructure as Code and Automation Pipelines”:

“CI/CD pipelines enable automated, consistent deployments across environments, reducing manual configuration errors.”

“Public repositories facilitate code sharing and collaboration, supporting standardized infrastructure templates.”

Other options:

C. Deployment runbooks are static and not inherently automated.

D. Private repositories restrict sharing, conflicting with the requirement to share code.

E. Image deployment refers to server builds, not full network configuration.

F. Deployment guides are manual documents, not automation tools.

================================================

Comprehensive and Detailed Explanation From Exact Extract:

Network flow logging (e.g., AWS VPC Flow Logs, Azure NSG Flow Logs, or GCP VPC Flow Logs) is a cloud-native feature that records metadata about network conversations, including source and destination IPs, ports, and traffic volume. It does not capture payloads but provides detailed flow-level insight without requiring agents or intrusive configuration changes, making it the most efficient and least effort solution.

Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide — under “Cloud-native Network Monitoring”:

“Network flow logging provides metadata about traffic within cloud VPCs and is used for visibility, troubleshooting, and security auditing without packet inspection.”

Other options:

B. SNMP traps monitor device health, not traffic flows.

C. QoS tagging controls traffic priority but doesn’t log flows.

D. Monitoring agents collect system-level metrics and logs, but require installation and configuration.

================================================

Comprehensive and Detailed Explanation From Exact Extract:

According to the standard CompTIA troubleshooting methodology, once the issue has been identified and a solution has been implemented (e.g., failing over traffic to the backup link), the next logical step is to verify full system functionality. This ensures that the backup path is working as intended and that services have resumed properly for the users.

Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide — under “Troubleshooting Process”:

“After implementing the solution, it is critical to verify full system functionality to ensure the resolution has addressed the problem without causing unintended consequences.”

Other options:

A. Documenting lessons learned is the final step.

B. The plan of action should have been created before the failover.

C. Identifying the problem already occurred earlier in the scenario.

================================================

Comprehensive and Detailed Explanation From Exact Extract:

D includes all the key elements of Zero Trust:

MFA (Multi-Factor Authentication) supports secondary passkey-based authentication.

Geolocation settings enforce geo-restrictions.

SSO federation allows use of an existing SAML identity provider.

Continuous access policies support dynamic reauthentication based on changes in posture.

Trusted endpoint policies ensure only corporate-owned, compliant devices are allowed to connect.

Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide — under “Zero Trust Architecture and Identity Management”:

“ZTA enforces continuous access policies that monitor session state, posture, and user behavior.”

“Federated identity with SSO and posture-based trust evaluation are core ZTA components.”

“Geo-restrictions and trusted endpoint policies limit exposure and enforce device compliance.”

Other options:

A uses static session tokens and disables timely expiration, violating Zero Trust principles.

B allows BYOD and disables auditing, which conflicts with compliance and monitoring.

Comprehensive and Detailed Explanation From Exact Extract:

The traceroute shows that the traffic successfully passes through the application development network (192.168.2.1), to the server segment gateway (192.168.1.1), and reaches the serversegment firewall (192.168.4.1). However, it times out immediately after hitting 192.168.4.1, indicating that the traffic is being dropped or filtered at that firewall.

Because other users (outside of the application development segment) are able to SSH into the database server (192.168.1.9), the issue is not with the database server itself or the core network. This points to the server segment firewall blocking traffic originating from the application development subnet (192.168.2.0/24), which is a common practice in segmented network designs unless proper access rules are defined.

Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide — under “Network Segmentation and Firewall Rules”:

“Firewalls between network segments may enforce security policies that restrict access based on source/destination IP and port. Lack of proper allow rules can result in blocked traffic even if routing is successful.”

Other options:

A. The core firewall is not in the traceroute path; it is irrelevant to this specific flow.

B. NSGs (Network Security Groups) apply to cloud workloads, but the behavior and hop-by-hop flow suggest it is a firewall-level issue, not NSG misconfiguration.

D. Bandwidth issues would typically show packet loss or high latency, not consistent timeouts at a specific hop.

Comprehensive and Detailed Explanation From Exact Extract:

Using an active-active deployment across two regions with at least two Availability Zones (AZs) each provides the highest level of fault tolerance and geographic redundancy. This ensures continuity even if an entire region or multiple zones become unavailable. In regulated sectors such as healthcare, this meets strict availability and disaster recovery requirements.

Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide — under “High Availability and Multi-Region Design”:

“Active-active configurations across multiple regions and availability zones maximize uptime and ensure failover in the event of localized or regional failures.”

Other options:

B. Active-passive introduces delays in failover.

C. Active-active in one region offers no geographic redundancy.

D. Active-passive in two regions is slower and less efficient during failover.

Comprehensive and Detailed Explanation From Exact Extract:

A Mesh topology provides multiple redundant paths between all nodes, ensuring there is no single point of failure. Clients can communicate directly with each other without passing through a central hub, reducing bottlenecks and preserving bandwidth. Mesh networks are fault tolerant and resilient to changes in the underlying medium, making them ideal for distributed environments requiring high availability.

Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide — under “WAN and LAN Topologies”:

“In a mesh topology, every device is connected to every other device. This design offers fault tolerance and allows for direct communication paths between endpoints, maximizing bandwidth efficiency and eliminating single points of failure.”

Other options:

A. Hub-and-spoke introduces a central point of failure and may limit bandwidth.

C. Spine-and-leaf is ideal for data centers but not typically used for branch office designs.

D. Star topology relies on a central switch and has a single point of failure.

================================================

Comprehensive and Detailed Explanation From Exact Extract:

When an application is moved from local deployment to a centralized cloud deployment, remote users must connect over the WAN. If the application is sensitive to delays, latency becomes a significant issue, especially across geographically distributed regions. This is a common performance concern for centralized applications serving remote offices.

Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide — under “Cloud Performance and WAN Connectivity”:

“Cloud-hosted applications accessed by remote users may suffer from latency-related performance issues. Optimization strategies may include CDN, caching, or edge deployment.”

Other options:

A. Throttling usually refers to bandwidth or rate-limiting, not general slowness.

B. Overutilization is possible, but infrastructure was said to be centralized and new.

C. Packet loss would likely cause disconnects or failures, not just slowness.

================================================

Comprehensive and Detailed Explanation From Exact Extract:

Because only the remote sales team is experiencing access issues—and the application infrastructure is confirmed to be functioning correctly—it's likely that geolocation-based access control is misconfigured. If geofencing or region-based restrictions are applied incorrectly, traffic from users outside an allowed geographic area may be denied.

Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide — under “Geolocation and Access Controls”:

“Geolocation rules filter traffic based on IP geographies. Misconfiguration can unintentionally block legitimate users who access services from disallowed locations.”

Other options:

A. Load balancers distribute traffic and would affect all users, not a specific group.

B. Port/protocol misconfiguration would affect all or specific service components, not location-based access.

C. IP addressing issues are typically network-wide, not region-specific.

================================================

Comprehensive and Detailed Explanation From Exact Extract:

SD-WAN (Software-Defined Wide Area Network) enables private, encrypted connections over public internet links and supports policy-based routing for application-aware traffic steering. It offers centralized management, redundancy, and automatic path selection — all aligned with the stated requirements.

Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide — under “Software-Defined Networking and WAN Optimization”:

“SD-WAN uses secure tunnels over the public internet, supports dynamic path selection, and provides application-aware routing, making it ideal for multi-site enterprise connectivity without dedicated links.”

Other options:

A. MPLS requires dedicated circuits and is costly.

C. Site-to-site VPN provides security but lacks intelligent traffic steering.

D. ExpressRoute is a private connection to Azure, not suited for general internet-based multi-site connectivity.

BLE (Bluetooth Low Energy) is a wireless personal area network (WPAN) technology designed for applications that require lower energy consumption and reduced cost while maintaining a communication range similar to classic Bluetooth. BLE supportslocation tracking with an accuracy range typically between 1 to 2 meters (approximately 3 to 6 feet), making it ideal for applications that demandfine-grained location services, such as stadium services requiring real-time user proximity data.

According to theCompTIA CloudNetX CNX-001 Official Objectives, under theNetwork Architecture domain, specifically in the subdomain:

"Wireless Technologies: Identify capabilities of BLE, NFC, RFID, and IoT devices within a network environment,"it is outlined that:

"BLE enables proximity-based services and real-time indoor location tracking with high accuracy when used with beacon infrastructure."

"BLE beacons can be deployed throughout a physical space, transmitting signals received by mobile applications to determine a user’s location within a few feet."

"BLE is widely adopted for use cases including indoor navigation, asset tracking, and personalized user engagement, making it a critical technology for modern high-density venues such as stadiums."

In comparison:

SSIDmerely identifies a wireless network and has no location tracking function.

NFCrequires close contact (under 4 cm), and is not suitable for continuous or broad-range tracking.

IoTis an overarching category that includes connected devices and sensors; however, IoT is not a standalone location tracking technology. It may include BLE as a component, butBLE specifically provides the precise location tracking functionality.

These distinctions are explicitly addressed in theCompTIA CloudNetX CNX-001 Study Guide, under the section:

“Emerging Network Technologies and Architectures”, where BLE is described as a key enabling technology for context-aware and location-based services in enterprise and public environments.