CompTIA CNX-001 Exam Practice Questions to Pass CompTIA CloudNetX Exam

Question 1

A company has a 40Gbps network that uses a network tap to inspect the traffic using an IDS. The IDS usually performs normally except when the servers are downloading patches from their local update repository 10.10.10.139 using HTTPS. During the patch windows, the IDS cannot handle the extra load and drops a significant number of packets. Which of the following would allow a network engineer to prevent this issue without compromising the network visibility?

AConfiguring the IDS to ignore traffic from 10.10.10.139

BUsing PF_RING offload to filter out 'host 10.10.10.139 and port 443'

CAdding a 'dst host 10.10.10.139' BPF on the tap

DScheduling a cron job to stop the IDS service during the patch window

Answer : C

By applying a Berkeley Packet Filter to drop only the HTTPS patchrepo traffic before it reaches the IDS, you relieve the processing burden during patch windows while preserving full visibility for all other flows. This avoids reconfiguring the IDS itself or losing visibility across the rest of the network.

Question 2

A network architect must ensure only certain departments can access specific resources while on premises. Those same users cannot be allowed to access those resources once they have left campus. Which of the following would ensure access is provided according to these requirements?

AEnabling MFA for only those users within the departments needing access

BConfiguring geofencing with the IPs of the resources

CConfiguring UEBA to monitor all access to those resources during non-business hours

DImplementing a PKI-based authentication system to ensure access

Answer : B

By defining an IP-based geofence around the on-premises network addresses where those resources reside, you ensure that only users connecting from inside the campus IP ranges can reach them. As soon as the same users leave that network (and thus fall outside the geofenced IP block), access is automatically denied.

Question 3

A network administrator recently deployed new Wi-Fi 6E access points in an office and enabled 6GHz coverage. Users report that when they are connected to the new 6GHz SSID, the performance is worse than the 5GHz SSID. The network administrator suspects that there is a source of 6GHz interference in the office. Using the troubleshooting methodology, which of the following actions should the network administrator do next?

ATest to see if the changes have improved network performance.

BUse a spectrum analyzer and check the 6GHz spectrum.

CDocument the list of channels that are experiencing interference.

DChange the channels being used by the 6GHz radios in the APs.

Answer : B

Before making configuration changes, you should verify and pinpoint the suspected interference source by analyzing the 6 GHz band. A spectrum analyzer will reveal any non-Wi-Fi transmissions or overlapping noise that's degrading performance, allowing you to target your remediation effectively.

Question 4

A customer asks a MSP to propose a ZTA design for its globally distributed remote workforce. Given the following requirements:

Authentication should be provided through the customer's SAML identity provider.

Access should not be allowed from countries where the business does not operate.

Secondary authentication should be added to the workflow to allow for passkeys.

Changes to the user's device posture and hygiene should require reauthentication into the network.

Access to the network should only be allowed to originate from corporate-owned devices.

Which of the following solutions should the MSP recommend to meet the requirements?

AEnforce certificate-based authentication.
Permit unauthenticated remote connectivity only from corporate IP addresses.
Enable geofencing.
Use cookie-based session tokens that do not expire for remembering user log-ins.
Increase RADIUS server timeouts.

BEnforce posture assessment only during the initial network log-on.
Implement RADIUS for SSO.
Restrict access from all non-U.S. IP addresses.
Configure a BYOD access policy.
Disable auditing for remote access.

CChain the existing identity provider to a new SAML.
Require the use of time-based one-time passcode hardware tokens.
Enable debug logging on the VPN clients by default.
Disconnect users from the network only if their IP address changes.

DConfigure geolocation settings to block certain IP addresses.
Enforce MFA.
Federate the solution via SSO.
Enable continuous access policies on the WireGuard tunnel.
Create a trusted endpoints policy.

Answer : D

Federate the solution via SSO ensures authentication is handled by the customer's SAML identity provider.

Enforce MFA supports secondary authentication with passkeys.

Configure geolocation settings to block certain IP addresses prevents access from unauthorized countries.

Enable continuous access policies on the WireGuard tunnel forces re-authentication whenever device posture or hygiene changes.

Create a trusted endpoints policy restricts access to corporate-owned devices only.

Question 5

A network architect is working on a physical network design template for a small education institution's satellite campus that is not yet built. The new campus location will consist of two small buildings with classrooms, one screening room with audiovisual equipment, and 200 seats for students. Which of the following enterprise network designs should the architect suggest?

AHybrid

BDual-layer

CThree-tier

DCollapsed core

Answer : D

In a small satellite campus with limited buildings and user density, a collapsed-core (two-tier) design combines the core and distribution layers into a single set of switches. This minimizes hardware, simplifies management, and still provides the necessary segmentation and resiliency for the classrooms, screening room, and student seating areas.

Question 6

A network architect needs to build a new data center for a large company that has business units that process retail financial transactions. Which of the following information should the architect request from the company?

ARegulatory requirements

BStatement of work

CBusiness case study

DInternal reference architecture

Answer : A

Before designing a facility that will handle retail financial transactions, you need to understand all applicable compliance and security mandates (e.g. PCI DSS, SOX, GDPR). Those regulatory requirements will drive your choices around physical security, network segmentation, encryption, logging, redundancy, and operational controls, ensuring the data center meets its legal and industry-specific obligations.

Question 7

A company is expanding its network and needs to ensure improved stability and reliability. The proposed solution must fulfill the following requirements:

Detection and prevention of network loops

Automatic configuration of ports

Standard protocol (not proprietary)

Which of the following protocols is the most appropriate?

ASTP

BSIP

CRTSP

DBGP

Answer : A

The Spanning Tree Protocol (IEEE 802.1D) is a non-proprietary standard that automatically detects Layer 2 loops and dynamically places redundant switch ports into a blocking or forwarding state, ensuring loop prevention and automatic port configuration.

CompTIA CloudNetX Certification Exam CNX-001 Practice Questions