Get Prepared for Your CNX-001 Exam With Actual CompTIA Study Guide!
Pass Your Next CNX-001 Certification Exam Easily & Hassle Free
CompTIA CNX-001 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
NEW QUESTION # 41
A network administrator must connect a remote building at a manufacturing plant to the main building via a wireless connection. Which of the following should the administrator choose to get the greatest possible range from the wireless connection? (Choose two.)
- A. Built-in antenna
- B. Patch antenna
- C. 5GHz
- D. 2.4GHz
- E. Omnidirectional antenna
- F. 6GHz
Answer: B,D
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
2.4GHz has longer range and better wall penetration than higher frequencies like 5GHz or 6GHz.A patch antenna (a type of directional antenna) focuses the signal in one direction, greatly improving range and reliability over long distances between buildings.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Wireless Deployment and Antenna Selection":
"2.4GHz offers extended range over 5GHz. Directional antennas such as patch antennas concentrate signals toward a target, improving distance communication." Other options:
* B & C. Higher frequencies provide faster speeds but shorter range.
* D. Omnidirectional antennas spread signal in all directions, not ideal for point-to-point.
* F. Built-in antennas are generally low gain and insufficient for building-to-building links.
NEW QUESTION # 42
After a company migrated all services to the cloud, the security auditor discovers many users have administrator roles on different services. The company needs a solution that:
* Protects the services on the cloud
* Limits access to administrative roles
* Creates a policy to approve requests for administrative roles on critical services within a limited time
* Forces password rotation for administrative roles
* Audits usage of administrative roles
Which of the following is the best way to meet the company's requirements?
- A. Access control list
- B. Conditional access
- C. Session-based token
- D. Privileged access management
Answer: D
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
Privileged Access Management (PAM) is the optimal solution to control, audit, and secure administrative access to systems and services. PAM enables role-based approval workflows, time-limited access, auditing, and credential rotation, fully aligning with the requirements.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Identity and Access Controls":
"Privileged Access Management allows fine-grained control over administrator-level access, supports just-in- time access provisioning, password rotation, and audit logging." Other options:
* B. Session-based tokens allow temporary access but do not enforce policies or auditing.
* C. Conditional access provides policy enforcement based on context but lacks full PAM features.
* D. ACLs control access to resources but don't manage privilege workflows or audits.
NEW QUESTION # 43
An organization with an on-premises data center is adopting additional cloud-based solutions. The organization wants to keep communication secure between remote employees' devices and workloads. Which of the following ZTA features best achieves this goal?
- A. Secure service edge
- B. Cloud access security broker
- C. Identity as the perimeter
- D. Principle of least privilege
Answer: C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
"Identity as the perimeter" is a core principle of Zero Trust Architecture (ZTA). Rather than relying on traditional network-based perimeters, access is granted based on user identity and device posture. This is essential for remote users accessing cloud workloads, ensuring secure authentication regardless of physical location.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Zero Trust and Identity- Centric Security":
"Zero Trust shifts the trust boundary from the network to the user and device identity. 'Identity as the perimeter' ensures only verified users and devices are granted access to resources." Other options:
* A. Secure service edge (SSE) is a broad cloud security model, but not a specific ZTA principle.
* B. CASBs monitor cloud app usage, not core access authentication.
* C. Principle of least privilege is a supporting concept, but not the primary perimeter defense mechanism.
NEW QUESTION # 44
A company's IT department is expected to grow from 100 to 200 employees, and the sales department is expected to grow from 1,000 to a maximum of 2,000 employees. Each employee owns a single laptop with a single IP allocated. The network architect wants to deploy network segmentation using the IP range 10.0.0.0
/8. Which of the following is the best solution?
- A. Allocate 10.1.0.0/30 to the IT department. Allocate 10.2.0.0/16 to the sales department.
- B. Allocate 10.1.0.0/22 to the IT department. Allocate 10.2.0.0/15 to the sales department.
- C. Allocate 10.1.0.0/16 to the IT department. Allocate 10.2.1.0/24 to the sales department.
- D. Allocate 10.1.0.0/16 to the IT department. Allocate 10.2.1.0/25 to the sales department.
Answer: B
Explanation:
A /22 gives you 1,022 usable addresses, ample headroom for 200 IT laptops, while a /15 yields 32,766 addresses, covering up to 2,000 sales laptops with room to grow, all within the 10.0.0.0/8 space.
NEW QUESTION # 45
A network engineer needs to implement a cloud-native solution. The solution must allow the recording of network conversation metadata of the host and appliances attached to a VPC. Which of the following will accomplish these goals with the least effort?
- A. Installing a cloud monitoring agent
- B. Configuring SNMP traps
- C. Enabling network flow
- D. Implementing QoS network tagging
Answer: C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
Network flow logging (e.g., AWS VPC Flow Logs, Azure NSG Flow Logs, or GCP VPC Flow Logs) is a cloud-native feature that records metadata about network conversations, including source and destination IPs, ports, and traffic volume. It does not capture payloads but provides detailed flow-level insight without requiring agents or intrusive configuration changes, making it the most efficient and least effort solution.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Cloud-native Network Monitoring":
"Network flow logging provides metadata about traffic within cloud VPCs and is used for visibility, troubleshooting, and security auditing without packet inspection." Other options:
* B. SNMP traps monitor device health, not traffic flows.
* C. QoS tagging controls traffic priority but doesn't log flows.
* D. Monitoring agents collect system-level metrics and logs, but require installation and configuration.
NEW QUESTION # 46
A network engineer is establishing a wireless network for handheld inventory scanners in a manufacturing company's warehouse. The engineer needs an authentication mechanism for these scanners that uses the Wi-Fi network and works with the company's Active Directory. The business requires that the solution authenticate the users and authorize the scanners. Which of the following provides the best solution for authentication and authorization?
- A. PKI
- B. RADIUS
- C. LDAP
- D. TACACS+
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
RADIUS (Remote Authentication Dial-In User Service) is the best-fit protocol for this requirement. It supports both authentication and authorization and is widely used in Wi-Fi network environments for client device authentication using credentials stored in centralized directories such as Active Directory.
RADIUS integrates seamlessly with enterprise authentication sources and supports EAP (Extensible Authentication Protocol), making it compatible with Wi-Fi-based client devices. It also allows for role-based access control, enabling policy enforcement specific to device types (e.g., inventory scanners).
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - "Authentication and Authorization Technologies":
"RADIUS provides centralized authentication, authorization, and accounting (AAA) services and is commonly used for securing wireless access in conjunction with Active Directory."
"Organizations use RADIUS to manage Wi-Fi authentication for user devices and enforce security policies during access attempts." Using a RADIUS server with 802.1X on the Wi-Fi infrastructure allows the scanners (and their users) to be authenticated against Active Directory and mapped to the correct authorization policies. TACACS+ is geared toward device management, LDAP alone doesn't handle the Wi-Fi 802.1X handshake, and PKI by itself wouldn't provide the user-to-device authorization flow needed. RADIUS gives you both authentication and authorization tied into AD.
NEW QUESTION # 47
A network architect needs to build a new data center for a large company that has business units that process retail financial transactions. Which of the following information should the architect request from the company?
- A. Statement of work
- B. Internal reference architecture
- C. Regulatory requirements
- D. Business case study
Answer: C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
When building infrastructure for business units that process financial transactions (such as in the retail or banking sector), the architect must first understand all relevant compliance and regulatory requirements.
These may include PCI DSS, SOX, or GDPR, depending on the nature of the data and jurisdiction. These regulations influence design decisions regarding encryption, segmentation, data retention, and logging.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Compliance and Regulatory Considerations":
"Regulatory requirements such as PCI DSS, HIPAA, and others dictate the security controls, logging, data protection, and architectural design of infrastructure handling sensitive or financial data." Other options:
* B. Statement of Work defines project scope, but doesn't include legal/compliance mandates.
* C. Business case studies illustrate value or ROI, not security or compliance needs.
* D. Internal reference architectures may help with standards but are based on already defined requirements.
NEW QUESTION # 48
An application is hosted on a three-node cluster in which each server has identical compute and network performance specifications. A fourth node is scheduled to be added to the cluster with three times the performance as any one of the preexisting nodes. The network architect wants to ensure that the new node gets the same approximate number of requests as all of the others combined. Which of the following load- balancing methodologies should the network architect recommend?
- A. Weighted
- B. Least connections
- C. Load-based
- D. Round-robin
Answer: A
Explanation:
Assign each of the three original nodes a weight of 1 and the new high-performance node a weight of 3. With weighted balancing, the new node will receive 3 / (1 + 1 + 1 + 3) = 50% of traffic - equal to the combined load on the other three.
NEW QUESTION # 49
A cloud engineer is planning to build VMs in a public cloud environment for a cloud migration. A cloud security policy restricts access to the console for new VM builds. The engineer wants to replicate the settings for each of the VMs to ensure the network settings are preconfigured. Which of the following is the best deployment method?
- A. CLI command
- B. IaC template
- C. API script
- D. Custom SDK
Answer: B
Explanation:
Using an Infrastructure-as-Code template lets you define and version all VM configurations, including network settings, in code that's automatically applied during deployment, eliminating the need for console changes and ensuring consistency across each build.
NEW QUESTION # 50
A company provides an API that runs on the public cloud for its customers. A fixed number of VMs host the APIs. During peak hours, the company notices a spike in usage that results in network communication speeds slowing down for all customers. The management team has decided that access for all customers should be fair and accessible at all times. Which of the following is the most cost-effective way to address this issue?
- A. Increase the number of VMs running APIs.
- B. Enable throttling on APIs.
- C. Increase the MTU on the VMs.
- D. Use an allow list for customers using APIs.
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
API throttling limits the number of requests a user or system can make in a given time frame. This ensures that no single customer overwhelms the service, maintaining fair access and stability for all users during peak usage periods. It is cost-effective as it avoids unnecessary resource scaling.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "API Management and Traffic Control":
"Throttling allows for controlled usage of APIs, preventing service degradation and ensuring equitable access during high traffic periods." Other options:
* A. Allow lists control access, not traffic volume.
* B. Increasing VMs increases cost and may not scale linearly.
* D. MTU settings affect packet size but not API-level fairness or traffic spikes.
NEW QUESTION # 51
A call center company provides its services through a VoIP infrastructure. Recently, the call center set up an application to manage its documents on a cloud application. The application is causing recurring audio losses for VoIP callers. The network administrator needs to fix the issue with the least expensive solution. Which of the following is the best approach?
- A. Creating two VLANs, one for voice and the other for data
- B. Setting up VoIP devices to use a voice codec with a higher compression rate
- C. Configuring QoS rules at the internet router to prioritize the VoIP calls
- D. Adding a second internet link and physically splitting voice and data networks into different routes
Answer: C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
Quality of Service (QoS) rules at the internet router can prioritize VoIP traffic over other data, such as cloud document access. VoIP is sensitive to latency and jitter, and configuring QoS ensures that voice packets are prioritized during congestion. This is the most cost-effective solution that doesn't require additional infrastructure.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Traffic Management and Prioritization":
"QoS policies are essential for ensuring that latency-sensitive traffic, such as VoIP, is prioritized over other types of data, particularly in bandwidth-limited scenarios." Other options:
* A. Adding a second internet link is effective but not cost-efficient.
* C. VLANs provide segmentation but don't guarantee bandwidth prioritization.
* D. Changing the codec may reduce bandwidth usage, but doesn't address prioritization directly.
NEW QUESTION # 52
A cloud network engineer needs to enable network flow analysis in the VPC so headers and payload of captured data can be inspected. Which of the following should the engineer use for this task?
- A. Application monitoring
- B. Syslog service
- C. Traffic mirroring
- D. Network flows
Answer: C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
Traffic mirroring allows a copy of network traffic - including headers and payloads - to be sent to an analysis tool or appliance for deep packet inspection. This is essential for security analysis, network troubleshooting, and performance diagnostics in cloud environments.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Packet Capture and Network Flow Monitoring":
"Traffic mirroring enables the capture of full packet data, including payloads, for forensic or performance analysis within cloud networks." Other options:
* A. Application monitoring focuses on app-level metrics, not packet inspection.
* B. Syslog is log-based, not for inspecting packets.
* D. Network flows (e.g., NetFlow, VPC flow logs) provide metadata (source, destination, size) but not full packet content.
NEW QUESTION # 53
An organization with an on-premises data center is adopting additional cloud-based solutions. The organization wants to keep communication secure between remote employees' devices and workloads. Which of the following ZTA featuresbestachieves this goal?
- A. Secure service edge
- B. Cloud access security broker
- C. Identity as the perimeter
- D. Principle of least privilege
Answer: C
Explanation:
Shifting to "identity as the perimeter" means that each remote user and device's identity (and context) becomes the basis for granting secure, encrypted access directly to workloads, regardless of the underlying network, ensuring communications are authenticated and authorized per-session.
NEW QUESTION # 54
A SaaS company's new service currently is being provided through four servers. The company's end users are having connection issues, which is affecting about 25% of the connections. Which of the following ismostlikely the root cause of this issue?
- A. Load balancing is configured with a health check in front of these servers, and one of these servers is unavailable.
- B. The service is using weighted load balancing with 40% of the traffic on server A, 20% on server B,
20% on server C, and server D is down. - C. The service is using a least-connection load-balancing method with one server down.
- D. The service is using round-robin load balancing through a DNS server with one server down.
Answer: D
Explanation:
With simple round-robin DNS distributing 25% of requests to each of four servers, a single server outage directly causes exactly 25% of connections to fail, matching the reported impact.
NEW QUESTION # 55
A network architect is designing a new network for a rural hospital system. Given the following requirements:
* Highly available
* Consistent data transmission
* Resilient to simultaneous failures
Which of the following topologies should the architect use?
- A. Mesh
- B. Collapsed core
- C. Hub-and-spoke
- D. Star
Answer: A
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
A mesh topology provides multiple redundant paths between nodes. It offers the highest availability and fault tolerance by allowing communication to continue even if one or more links or nodes fail. This is especially important in rural healthcare systems where reliability and access to critical services are paramount.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Network Topologies and Redundancy Models":
"Mesh topologies provide optimal fault tolerance and support consistent data transmission through redundant links, ideal for mission-critical systems." Other options:
* A. Collapsed core is cost-efficient but not fully redundant.
* B. Hub-and-spoke introduces a single point of failure at the hub.
* D. Star also relies on a central node and is not fault tolerant.
NEW QUESTION # 56
Throughout the day, a sales team experiences videoconference performance issues when the accounting department runs reports. Which of the following is the best solution?
- A. Increasing the throughput on the network by purchasing high-end switches
- B. Configuring QoS on the corporate network switches
- C. Running the accounting department's reports outside of business hours
- D. Using a load balancer to split the video traffic evenly
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
Quality of Service (QoS) ensures that latency-sensitive traffic like videoconferencing is prioritized over bandwidth-heavy but delay-tolerant tasks like report generation. Implementing QoS on network switches allows the network to differentiate traffic types and ensure sufficient bandwidth for critical applications during congestion.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Traffic Prioritization and QoS":
"QoS enables classification and prioritization of network traffic to ensure performance of mission-critical or real-time applications such as voice and video." Other options:
* A. Scheduling tasks outside business hours is not scalable or reliable.
* B. Load balancing applies to servers, not prioritization of LAN traffic.
* D. Buying higher-end switches is costly and may not resolve contention under load.
NEW QUESTION # 57
An outage occurred after a software upgrade on core switching. A network administrator thinks that the firmware installed had a bug. Which of the following should the network administrator do next?
- A. Document lessons learned.
- B. Establish a plan of action to resolve the issue.
- C. Test the theory to determine cause.
- D. Implement the solution.
Answer: C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
According to the structured troubleshooting methodology outlined in the CNX-001 objectives, once a potential root cause is identified (in this case, a suspected firmware bug), the next step is to test the theory to confirm the cause before taking action. This helps prevent misdiagnosis and unnecessary configuration changes.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Structured Troubleshooting Methodology":
"After identifying symptoms and forming a theory of probable cause, the next step is to test the theory to verify it is the actual cause of the problem." Other options:
* A. Establishing a plan of action comes after confirming the cause.
* C. Documenting lessons learned is the final step.
* D. Implementing the solution should only occur after the issue is confirmed.
NEW QUESTION # 58
A customer asks a MSP to propose a ZTA (Zero Trust Architecture) design for its globally distributed remote workforce. Given the following requirements:
* Authentication should be provided through the customer's SAML identity provider.
* Access should not be allowed from countries where the business does not operate.
* Secondary authentication should be added to the workflow to allow for passkeys.
* Changes to the user's device posture and hygiene should require reauthentication into the network.
* Access to the network should only be allowed to originate from corporate-owned devices.
Which of the following solutions should the MSP recommend to meet the requirements?
- A. Enforce posture assessment only during the initial network log-on.
Implement RADIUS for SSO.
Restrict access from all non-U.S. IP addresses.
Configure a BYOD access policy.
Disable auditing for remote access. - B. Chain the existing identity provider to a new SAML.
Require the use of time-based one-time passcode hardware tokens.
Enable debug logging on the VPN clients by default.
Disconnect users from the network only if their IP address changes. - C. Configure geolocation settings to block certain IP addresses.
Enforce MFA.
Federate the solution via SSO.
Enable continuous access policies on the WireGuard tunnel.
Create a trusted endpoints policy. - D. Enforce certificate-based authentication.
Permit unauthenticated remote connectivity only from corporate IP addresses.
Enable geofencing.
Use cookie-based session tokens that do not expire for remembering user log-ins.
Increase RADIUS server timeouts.
Answer: C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
D includes all the key elements of Zero Trust:
* MFA (Multi-Factor Authentication) supports secondary passkey-based authentication.
* Geolocation settings enforce geo-restrictions.
* SSO federation allows use of an existing SAML identity provider.
* Continuous access policies support dynamic reauthentication based on changes in posture.
* Trusted endpoint policies ensure only corporate-owned, compliant devices are allowed to connect.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Zero Trust Architecture and Identity Management":
"ZTA enforces continuous access policies that monitor session state, posture, and user behavior."
"Federated identity with SSO and posture-based trust evaluation are core ZTA components."
"Geo-restrictions and trusted endpoint policies limit exposure and enforce device compliance." Other options:
* A uses static session tokens and disables timely expiration, violating Zero Trust principles.
* B allows BYOD and disables auditing, which conflicts with compliance and monitoring.
NEW QUESTION # 59
A network security administrator needs to set up a solution to:
* Gather all data from log files in a single location.
* Correlate the data to generate alerts.
Which of the following should the administrator implement?
- A. Event log monitoring
- B. Syslog
- C. SIEM
- D. Log management
Answer: C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
A SIEM (Security Information and Event Management) solution ingests log data from multiple sources, correlates events, detects anomalies, and generates alerts based on predefined or dynamic rules. This makes SIEM the ideal solution for centralized logging and real-time threat detection.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Security Monitoring and Log Correlation":
"SIEM platforms aggregate, normalize, and analyze logs from diverse sources, providing real-time alerts and incident response support." Other options:
* A. Syslog is a transport protocol - it doesn't correlate or alert.
* B. Event log monitoring is limited to individual systems.
* C. Log management stores logs but doesn't perform analysis or alerting.
NEW QUESTION # 60
......
Ace CNX-001 Certification with 86 Actual Questions: https://testking.vcetorrent.com/CNX-001-valid-vce-torrent.html