Prepare Important Exam with CNX-001 Exam Dumps(2026)
Pass Exam Questions Efficiently With CNX-001 Questions
NEW QUESTION # 32
An organization's Chief Technical Officer is concerned that changes to the network using IaC are causing unscheduled outages. Which of the following best mitigates this risk?
- A. Forking the code repository before making changes
- B. Enforcing code review of the change by the author
- C. Adding review/approval steps to the CI/CD pipelines
- D. Making code changes to the master branch
Answer: C
Explanation:
Introducing mandatory review and approval gates in your deployment pipelines ensures that every Infrastructure-as-Code change is peer-reviewed, tested, and explicitly signed off before going live, reducing the chance of unvetted code causing unexpected outages.
NEW QUESTION # 33
A network architect must design a new branch network that meets the following requirements:
*No single point of failure
*Clients cannot be impacted by changes to the underlying medium
*Clients must be able to communicate directly to preserve bandwidth
Which of the following network topologies should the architect use?
- A. Mesh
- B. Hub-and-spoke
- C. Spine-and-leaf
- D. Star
Answer: A
Explanation:
A full-mesh topology gives every node redundant paths to every other node, eliminating any single point of failure, and lets clients communicate directly over the optimal link without depending on an intermediate hub or core.
NEW QUESTION # 34
A network engineer is setting up guest access on a Wi-Fi network. After a recent network analysis, the engineer discovered that a user could access the guest network and attack the corporate network, since the networks share the same VLAN. Which of the following should the engineer do to prevent an attack like this one from happening?
- A. Set up a strong password on the guest wireless network.
- B. Set up a captive portal so all guest users have to register before gaining access to the wireless network.
- C. Set up a MAC filtering rule and add the MAC addresses of all corporate devices to the allow list.
- D. Configure Layer 2 client isolation for the wireless network.
Answer: D
Explanation:
By enabling client isolation at Layer 2, guest clients can still reach the Internet but cannot directly communicate with any other device on that VLAN, including your corporate endpoints, stopping lateral attacks without needing MAC whitelists or overly complex captive-portal setups.
NEW QUESTION # 35
A network architect needs to build a new data center for a large company that has business units that process retail financial transactions. Which of the following information should the architect request from the company?
- A. Regulatory requirements
- B. Internal reference architecture
- C. Business case study
- D. Statement of work
Answer: A
Explanation:
Before designing a facility that will handle retail financial transactions, you need to understand all applicable compliance and security mandates (e.g. PCI DSS, SOX, GDPR). Those regulatory requirements will drive your choices around physical security, network segmentation, encryption, logging, redundancy, and operational controls, ensuring the data center meets its legal and industry-specific obligations.
NEW QUESTION # 36
A network architect is working on a physical network design template for a small education institution's satellite campus that is not yet built. The new campus location will consist of two small buildings with classrooms, one screening room with audiovisual equipment, and 200 seats for students. Which of the following enterprise network designs should the architect suggest?
- A. Hybrid
- B. Collapsed core
- C. Dual-layer
- D. Three-tier
Answer: B
Explanation:
In a small satellite campus with limited buildings and user density, a collapsed-core (two-tier) design combines the core and distribution layers into a single set of switches. This minimizes hardware, simplifies management, and still provides the necessary segmentation and resiliency for the classrooms, screening room, and student seating areas.
NEW QUESTION # 37
A network administrator must connect a remote building at a manufacturing plant to the main building via a wireless connection. Which of the following should the administrator choose to get the greatest possible range from the wireless connection? (Choose two.)
- A. Patch antenna
- B. Built-in antenna
- C. 2.4GHz
- D. Omnidirectional antenna
- E. 6GHz
- F. 5GHz
Answer: A,C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
2.4GHz has longer range and better wall penetration than higher frequencies like 5GHz or 6GHz.A patch antenna (a type of directional antenna) focuses the signal in one direction, greatly improving range and reliability over long distances between buildings.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Wireless Deployment and Antenna Selection":
"2.4GHz offers extended range over 5GHz. Directional antennas such as patch antennas concentrate signals toward a target, improving distance communication." Other options:
* B & C. Higher frequencies provide faster speeds but shorter range.
* D. Omnidirectional antennas spread signal in all directions, not ideal for point-to-point.
* F. Built-in antennas are generally low gain and insufficient for building-to-building links.
NEW QUESTION # 38
A company is expanding its network and needs to ensure improved stability and reliability. The proposed solution must fulfill the following requirements:
* Detection and prevention of network loops
* Automatic configuration of ports
* Standard protocol (not proprietary)
Which of the following protocols is the most appropriate?
- A. RTSP
- B. BGP
- C. STP
- D. SIP
Answer: C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
STP (Spanning Tree Protocol) is a Layer 2 standard protocol that prevents switching loops in Ethernet networks by creating a loop-free logical topology. It can automatically block and unblock redundant paths based on network changes, ensuring reliability and avoiding broadcast storms.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Ethernet Loop Prevention and Switching Protocols":
"STP is a standard Layer 2 protocol used to detect and prevent network loops, enhancing network stability in switched topologies." Other options:
* B. SIP is a signaling protocol used in VoIP.
* C. RTSP is for media streaming control.
* D. BGP is a routing protocol, not for Layer 2 loop prevention.
NEW QUESTION # 39
New devices were deployed on a network and need to be hardened.
INSTRUCTIONS
Use the drop-down menus to define the appliance-hardening techniques that provide themostsecure solution.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Answer:
Explanation:
Explanation:
C:\Users\Waqas Shahid\Desktop\Mudassir\Untitled.jpg
NEW QUESTION # 40
A network architect needs to design a solution to ensure every cloud environment network is built to the same baseline. The solution must meet the following requirements:
* Use automated deployment.
* Easily update multiple environments.
* Share code with a community of practice.
Which of the following are the best solutions? (Choose two.)
- A. CI/CD pipelines
- B. Private code repository
- C. Deployment guides
- D. Public code repository
- E. Automated image deployment
- F. Deployment runbooks
Answer: A,D
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
A: CI/CD pipelines - Continuous Integration and Continuous Deployment (CI/CD) pipelines allow automated and repeatable deployments of infrastructure and application code. This ensures consistency across environments and supports rapid, reliable updates to multiple environments simultaneously.
B: Public code repository - A public repository (e.g., GitHub, GitLab public projects) allows sharing code with the broader community of practice, enabling collaboration, peer review, and reuse. It supports version control and standardized deployment scripts (e.g., Terraform, Ansible).
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Infrastructure as Code and Automation Pipelines":
"CI/CD pipelines enable automated, consistent deployments across environments, reducing manual configuration errors."
"Public repositories facilitate code sharing and collaboration, supporting standardized infrastructure templates." Other options:
* C. Deployment runbooks are static and not inherently automated.
* D. Private repositories restrict sharing, conflicting with the requirement to share code.
* E. Image deployment refers to server builds, not full network configuration.
* F. Deployment guides are manual documents, not automation tools.
NEW QUESTION # 41
A company is replacing reserved public IP addresses with dynamic IP addresses. The network architect creates a list of assets with some dependencies to these reserved IPs:
Which of the following issues may begin to affect cloud assets after the replacement is made?
- A. IP spoofing
- B. IP exhaustion
- C. IP reuse
- D. IP asymmetric routing
Answer: C
Explanation:
Once you switch those public IPs from reserved (static) to dynamic, the cloud provider can reassign them to other tenants as soon as you deallocate. That "reuse" can lead to unexpected conflicts and broken security rules (for example your NSG allow lists still pointing to the old IPs might suddenly open traffic to an unrelated resource).
NEW QUESTION # 42
A company is replacing reserved public IP addresses with dynamic IP addresses. The network architect creates a list of assets with some dependencies to these reserved IPs:
(Refer to image: Reserved IPs are in use by NSGs, VMs, load balancers, and one is unallocated.) Which of the following issues may begin to affect cloud assets after the replacement is made?
- A. IP spoofing
- B. IP exhaustion
- C. IP reuse
- D. IP asymmetric routing
Answer: C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
Replacing reserved IPs with dynamic ones can lead to IP reuse issues. Dynamic public IPs can be reallocated to other customers once released. If DNS entries or firewall rules still refer to the original IP, this can lead to data leakage or incorrect routing. Also, some services (e.g., NSGs, load balancers) may require persistent IPs.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Public IP Management in Cloud Environments":
"Dynamic public IPs are subject to reuse after release. Services that rely on IP persistence, such as security groups or load balancers, may encounter unexpected behavior or security risks if replaced with dynamically assigned IPs." Other options:
* A. Asymmetric routing involves traffic leaving and returning via different paths.
* B. IP spoofing is a malicious attack, not related to address reassignment.
* C. IP exhaustion relates to resource limits, not dynamic reuse.
NEW QUESTION # 43
Server A (10.2.3.9) needs to access Server B (10.2.2.7) within the cloud environment since theyare segmented into different network sections. All external inbound traffic must be blocked to those servers. Which of the following need to be configured to appropriately secure the cloud network? (Choose two.)
- A. Firewall rule: allow 10.2.0.0/16 to 0.0.0.0/0
- B. Network security group rule: allow 10.2.0.0/16 to 0.0.0.0/0
- C. Firewall rule: deny 10.2.0.0/16 to 0.0.0.0/0
- D. Network security group rule: deny 0.0.0.0/0 to 10.2.0.0/16
- E. Network security group rule: allow 10.2.3.9 to 10.2.2.7
- F. Network security group rule: deny 10.2.0.0/16 to 0.0.0.0/0
Answer: D,E
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
A: An explicit allow rule in the Network Security Group (NSG) permitting Server A (10.2.3.9) to communicate with Server B (10.2.2.7) ensures intra-cloud communication between segments.
C: A deny rule that blocks any inbound access from external sources (0.0.0.0/0 # internal range 10.2.0.0/16) effectively prevents unsolicited inbound traffic from the public internet, securing the internal servers.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Cloud Security Groups and Firewall Policies":
"NSGs should be configured with least privilege principles. Allow intra-subnet or intra-application communication while explicitly denying unsolicited internet traffic."
"Ingress and egress filtering policies should block all traffic by default and permit only what's required." Other options:
* B. Incorrect - this allows internal range to internet, which is not requested.
* D & E. Apply to outbound policies, not relevant to the need to block inbound external access.
* F. Incorrect - this denies internal resources from going outbound, not inbound protection.
NEW QUESTION # 44
A customer asks a MSP to propose a ZTA (Zero Trust Architecture) design for its globally distributed remote workforce. Given the following requirements:
* Authentication should be provided through the customer's SAML identity provider.
* Access should not be allowed from countries where the business does not operate.
* Secondary authentication should be added to the workflow to allow for passkeys.
* Changes to the user's device posture and hygiene should require reauthentication into the network.
* Access to the network should only be allowed to originate from corporate-owned devices.
Which of the following solutions should the MSP recommend to meet the requirements?
- A. Chain the existing identity provider to a new SAML.
Require the use of time-based one-time passcode hardware tokens.
Enable debug logging on the VPN clients by default.
Disconnect users from the network only if their IP address changes. - B. Enforce certificate-based authentication.
Permit unauthenticated remote connectivity only from corporate IP addresses.
Enable geofencing.
Use cookie-based session tokens that do not expire for remembering user log-ins.
Increase RADIUS server timeouts. - C. Enforce posture assessment only during the initial network log-on.
Implement RADIUS for SSO.
Restrict access from all non-U.S. IP addresses.
Configure a BYOD access policy.
Disable auditing for remote access. - D. Configure geolocation settings to block certain IP addresses.
Enforce MFA.
Federate the solution via SSO.
Enable continuous access policies on the WireGuard tunnel.
Create a trusted endpoints policy.
Answer: D
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
D includes all the key elements of Zero Trust:
* MFA (Multi-Factor Authentication) supports secondary passkey-based authentication.
* Geolocation settings enforce geo-restrictions.
* SSO federation allows use of an existing SAML identity provider.
* Continuous access policies support dynamic reauthentication based on changes in posture.
* Trusted endpoint policies ensure only corporate-owned, compliant devices are allowed to connect.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Zero Trust Architecture and Identity Management":
"ZTA enforces continuous access policies that monitor session state, posture, and user behavior."
"Federated identity with SSO and posture-based trust evaluation are core ZTA components."
"Geo-restrictions and trusted endpoint policies limit exposure and enforce device compliance." Other options:
* A uses static session tokens and disables timely expiration, violating Zero Trust principles.
* B allows BYOD and disables auditing, which conflicts with compliance and monitoring.
NEW QUESTION # 45
A company has a 40Gbps network that uses a network tap to inspect the traffic using an IDS. The IDS usually performs normally except when the servers are downloading patches from their local update repository
10.10.10.139 using HTTPS. During the patch windows, the IDS cannothandle the extra load and drops a significant number of packets. Which of the following would allow a network engineer to prevent this issue without compromising the network visibility?
- A. Scheduling a cron job to stop the IDS service during the patch window
- B. Configuring the IDS to ignore traffic from 10.10.10.139
- C. Adding a "dst host 10.10.10.139" BPF on the tap
- D. Using PF_RING offload to filter out "host 10.10.10.139 and port 443"
Answer: D
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
PF_RING is a high-performance packet capture and filtering framework that allows IDS systems to handle large volumes of traffic efficiently. By offloading and filtering out traffic that is known and trusted (such as HTTPS traffic from a patch server), the IDS can focus on analyzing critical traffic and reduce dropped packets.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Traffic Filtering and IDS Performance Optimization":
"Advanced filtering solutions like PF_RING allow offloading of known trusted traffic, reducing processing overhead on IDS systems and improving visibility into meaningful events." Other options:
* A. Directly configuring the IDS to ignore traffic may bypass too much, affecting visibility.
* C. BPF filters on the tap itself may interfere with other systems using the tap.
* D. Disabling the IDS temporarily removes all visibility - a poor security practice.
NEW QUESTION # 46
An administrator must ensure that credit card numbers are not contained in any outside messaging or file transfers from the organization. Which of the following controls meets this requirement?
- A. Data loss prevention
- B. Egress filtering
- C. Encryption in transit
- D. Intrusion detection system
Answer: A
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
Data Loss Prevention (DLP) solutions scan messages and file transfers for sensitive data patterns, such as credit card numbers or social security numbers. DLP can block, log, or alert when such information is detected attempting to leave the organization.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Data Protection and Compliance Controls":
"DLP systems identify and restrict the transmission of sensitive data such as credit card numbers, enforcing organizational data handling policies." Other options:
* A. IDS detects threats but doesn't enforce data content policies.
* B. Egress filtering restricts destinations but not content.
* D. Encryption protects data in transit, not its content compliance.
NEW QUESTION # 47
An architecture team needs to unify all logging and performance monitoring used by global applications across the enterprise to perform decision-making analytics. Which of the following technologies is the best way to fulfill this purpose?
- A. Data lake
- B. CIEM
- C. Relational database
- D. Content delivery network
Answer: A
Explanation:
A data lake provides a scalable, centralized repository that can ingest and store massive volumes of structured and unstructured data, including logs and performance metrics, from across your global applications. By keeping raw data in its native format, you can run batch and real-time analytics, machine learning, and business-intelligence workloads on one unified platform, making it ideal for enterprise-wide decision-making.
NEW QUESTION # 48
An administrator needs to add a device to the allow list in order to bypass user authentication of an AAA system. The administrator uses MAC filtering and needs to discover the device's MAC address to accomplish this task. The device receives an IP address from DHCP, but the IP address changes daily. Which of the following commands should the administrator run on the device to locate its MAC address?
- A. ipconfig /all
- B. nslookup
- C. arp -a
- D. netstat -an
Answer: A
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
ipconfig /all on a Windows machine displays detailed network configuration, including the MACaddress (referred to as "Physical Address") of the device's network adapter. This is the most direct and accurate method for obtaining the MAC address of the device you are operating.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Device Identification and MAC Filtering":
"MAC addresses can be identified locally using interface configuration tools such as ipconfig /all on Windows or ifconfig/ip on Linux." Other options:
* B. netstat shows open network connections, not MAC addresses.
* C. arp -a shows MAC addresses of other devices in the ARP cache, not the local system.
* D. nslookup queries DNS records and doesn't display MAC information.
NEW QUESTION # 49
A network architect is choosing design options for a new SD-WAN installation that has the following requirements:
* All network traffic from the cloud must pass through inspection devices in a dedicated data center.
* Ensure redundancy.
* Centralize egress traffic.
Which of the following network topologies best meets these requirements?
- A. Point-to-point
- B. Partial mesh
- C. Hub-and-spoke
- D. Star
Answer: C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
The Hub-and-Spoke topology is ideal for SD-WAN environments where traffic from branch offices or cloud workloads must route through a central location (the hub) for inspection, monitoring, or security enforcement.
This structure centralizes egress and allows for redundant spoke paths via the hub. It also simplifies control and enforces compliance policies.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "SD-WAN Topologies and Cloud Egress Strategies":
"In a hub-and-spoke topology, spokes (remote offices or cloud nodes) connect through a central hub, allowing for centralized egress, traffic inspection, and simplified routing." Other options:
* A. Point-to-point doesn't scale and lacks centralized control.
* C. Star topology is similar to hub-and-spoke but is more rigid and less suited for SD-WAN scalability.
* D. Partial mesh allows direct spoke-to-spoke communication, bypassing centralized inspection.
NEW QUESTION # 50
......
CompTIA CNX-001 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
CNX-001 Questions - Truly Beneficial For Your CompTIA Exam: https://www.lead2passexam.com/CompTIA/valid-CNX-001-exam-dumps.html
Download CompTIA CNX-001 Sample Questions: https://drive.google.com/open?id=1zB9KnneoVQajo0J0x_1LT5tQ7b9NapXG