PASS CNX-001 exam with CompTIA Real Exam Questions - 100% Valid!
Actual CNX-001 Exam Recently Updated Questions with Free Demo
NEW QUESTION # 25
A network load balancer is not correctly validating a client TLS certificate. The network architect needs to validate the certificate installed on the load balancer before progressing. Which of the following commands should the architect use to confirm whether the private key and certificate match?
- A. openssl-rsa -noout -modulus -in cert.crt | openssl md5
openssl-verify -noout -modulus -in privkey.txt | openssl md5 - B. openssl x509 -noout -modulus -in cert.crt | openssl md5
openssl rsa -noout -modulus -in privkey.txt | openssl md5 - C. openssl-list -noout -modulus -in cert.crt | openssl md5
openssl rsa -noout -modulus -in privkey.txt | openssl md5 - D. openssl req -in certificate.csr -verify
openssl-verify -noout -modulus -in privkey.txt | openssl md5
Answer: B
Explanation:
If the MD5 hashes match, the certificate and private key correspond correctly.
NEW QUESTION # 26
A security architect needs to increase the security controls around computer hardware installations. The requirements are:
Auditable access logs to computer rooms
Alerts for unauthorized access attempts
Remote visibility to the inside of computer rooms
Which of the following controls best meet these requirements? (Choose two.)
- A. NFC access cards
- B. Motion sensors
- C. Video surveillance
- D. Locks and keys
- E. Automated lighting
- F. Security patrols
Answer: A,C
Explanation:
Video surveillance provides continuous, remote visibility into computer rooms and can be integrated with analytics to generate alerts on unauthorized presence.
NFC access cards enforce controlled entry with a system that logs every card swipe and issues alerts on failed or out-of-hours attempts, giving you auditable access records and immediate notifications of any suspicious activity.
NEW QUESTION # 27
A network engineer adds a large group of servers to a screened subnet and configures them to use IPv6 only.
The servers need to seamlessly communicate with IPv4 serverson the internal networks. Which of the following actions is the best way to achieve this goal?
- A. Add IPv6 to the network cards on the internal servers so they can communicate with the screened subnet.
- B. Set up a bridge between the screened subnet and internal networks to handle the conversion.
- C. Change the servers in the screened subnet from IPv6 addresses to IPv4 addresses.
- D. Implement NAT64 on the router between the screened subnet and the internal network.
Answer: D
Explanation:
NAT64 provides automatic protocol translation between IPv6-only clients and IPv4-only servers at the router, letting your new IPv6-only servers communicate seamlessly with existing IPv4 resources without changing their addresses.
NEW QUESTION # 28
Server A (10.2.3.9) needs to access Server B (10.2.2.7) within the cloud environment since they are segmented into different network sections. All external inbound traffic must be blocked to those servers.
Which of the following need to be configured to appropriately secure the cloud network? (Choose two.)
- A. Network security group rule:
deny 0.0.0.0/0 to 10.2.0.0/16 - B. Network security group rule:
allow 10.2.3.9 to 10.2.2.7 - C. Network security group rule:
deny 10.2.0.0/16 to 0.0.0.0/0 - D. Firewall rule:
deny 10.2.0.0/16 to 0.0.0.0/0 - E. Firewall rule:
allow 10.2.0.0/16 to 0.0.0.0/0 - F. Network security group rule:
allow 10.2.0.0/16 to 0.0.0.0/0
Answer: A,B
Explanation:
Network security group rule: allow 10.2.3.9 to 10.2.2.7
Explicitly permits Server A's IP to reach Server B.
Network security group rule: deny 0.0.0.0/0 to 10.2.0.0/16
Blocks all inbound traffic from any external source into the 10.2.0.0/16 address space, ensuring no external access.
NEW QUESTION # 29
A network administrator receives a ticket from one of the company's offices about video calls that work normally for one minute and then get very choppy. The network administrator pings the video server from that site to ensure that it is reachable:
(Ping output shows responses with varying latency times, including spikes: 11ms, 672ms, 849ms, 92ms, etc.)
Which of the following is most likely the cause of the video call issue?
- A. Jitter
- B. Latency
- C. Throughput
- D. Loss
Answer: A
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
Jitter refers to the variation in packet delay during transmission. In the ping output shown, the response times fluctuate significantly (11ms, 672ms, 849ms, 34ms), indicating inconsistent network performance. Such variation leads to a poor experience in real-time applications likevideo calls. High jitter causes packets to arrive out of order, resulting in stuttering or choppy audio/video.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Troubleshooting Real-Time Network Services":
"Jitter is the deviation in packet arrival times and directly affects real-time communications such as VoIP and video conferencing. Consistent latency is tolerable; inconsistent latency (jitter) is disruptive." Other options:
* A. Throughput refers to bandwidth and would cause consistent slowness.
* C. Latency alone, if stable, is acceptable; it's the inconsistency here that causes issues.
* D. Loss would be indicated by missing packets; the ping results show replies to all packets.
NEW QUESTION # 30
A network engineer is working on securing the environment in the screened subnet. Before penetration testing, the engineer would like to run a scan on the servers to identify the OS, application versions, and open ports. Which of the following commands should the engineer use to obtain the information?
- A. hping3 -1 10.10.10.x -rand-dest -I eth0
- B. nmap -A 10.10.10.0/28
- C. tcpdump -ni eth0 src net 10.10.10.0/28
- D. nc -v -n 10.10.10.x 1-1000
Answer: B
Explanation:
The -A flag enables aggressive scanning, which combines OS detection, version detection, script scanning, and traceroute to give you detailed information on hosts in the 10.10.10.0/28 range.
NEW QUESTION # 31
A company's IT department is expected to grow from 100 to 200 employees, and the sales department is expected to grow from 1,000 to a maximum of 2,000 employees. Each employee owns a single laptop with a single IP allocated. The network architect wants to deploy network segmentation using the IP range 10.0.0.0
/8. Which of the following is the best solution?
- A. Allocate 10.1.0.0/22 to the IT department. Allocate 10.2.0.0/15 to the sales department.
- B. Allocate 10.1.0.0/16 to the IT department. Allocate 10.2.1.0/24 to the sales department.
- C. Allocate 10.1.0.0/16 to the IT department. Allocate 10.2.1.0/25 to the sales department.
- D. Allocate 10.1.0.0/30 to the IT department. Allocate 10.2.0.0/16 to the sales department.
Answer: A
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
To accommodate 200 devices in IT and 2,000 devices in Sales, subnetting must allow for appropriate address allocation:
* /22 provides 1,024 addresses # sufficient for IT (200 users)
* /15 provides 65,536 addresses # more than sufficient for Sales (2,000 users) Option C ensures both departments are placed in separate, appropriately sized segments within the private
10.0.0.0/8 range.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "IP Addressing and Subnetting":
"Proper subnetting ensures sufficient host addresses and supports future growth. Network segmentation improves manageability and security." Other options:
* A. /30 provides only 2 usable IPs - insufficient for IT.
* B & D: /24 and /25 do not support 2,000 users in Sales.
* B & D also misallocate resources inefficiently.
NEW QUESTION # 32
A company is experiencing numerous network issues and decides to expand its support team. The new junior employees will need to be onboarded in the shortest time possible and be able to troubleshoot issues with minimal assistance. Which of the following should the company create to achieve this goal?
- A. Physical and logical network diagrams of the entire networking infrastructure
- B. Clearly documented runbooks for networking issues and knowledge base articles
- C. A mentor program for guiding each junior employee until they are familiar with the networking infrastructure
- D. Statement of work documenting what each junior employee should do when troubleshooting
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
Runbooks and knowledge base articles provide step-by-step instructions for resolving common issues, helping new employees quickly become productive with minimal supervision. These documents can be updated as new issues arise and serve as a foundational training and operational resource.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Operational Documentation and Knowledge Transfer":
"Runbooks contain standardized procedures for handling recurring operational tasks. Knowledge base articles enable consistent troubleshooting and resolution with minimal oversight." Other options:
* A. A Statement of Work (SOW) is used for defining project deliverables, not training.
* C. Network diagrams are useful for understanding architecture, but not for operational procedures.
* D. A mentor program can help, but it doesn't scale or provide immediate troubleshooting steps.
NEW QUESTION # 33
An organization has centralized logging capability at the on-premises data center and wants a solution that can consolidate logging from deployed cloud workloads. The organization would like to automate the detection and alerting mechanism. Which of the following best meets the requirements?
- A. Syslog
- B. SIEM
- C. Data lake
- D. IDS/IPS
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
A SIEM (Security Information and Event Management) system aggregates logs from various sources, including cloud environments, and provides real-time analytics, threat detection, and automated alerting. It integrates with cloud workloads via agents or APIs and enables centralized visibility and response capabilities.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Security Monitoring and Event Correlation":
"SIEM solutions consolidate logs from multiple environments, including cloud and on-premises, providing automated detection, alerting, and correlation of security events."
"A SIEM supports compliance and improves incident response through real-time monitoring." Other options:
* A. IDS/IPS are used for intrusion detection/prevention but do not provide log consolidation or alert correlation.
* C. Data lakes store large volumes of data but lack real-time alerting without additional tools.
* D. Syslog is a protocol for log transport, not a detection and alerting mechanism.
NEW QUESTION # 34
A company hosts a cloud-based e-commerce application and only wants the application accessed from certain locations. The network team configures a cloud firewall with WAF enabled, but users can access the application globally. Which of the following should the network team do?
- A. Implement a CDN.
- B. Configure a NAT gateway.
- C. Reconfigure WAF rules.
- D. Configure geo-restriction.
Answer: D
Explanation:
Geo-restriction lets you block or allow traffic based on the requester's geographic region, preventing access from locations you haven't authorized.
NEW QUESTION # 35
A network architect is designing an expansion solution for the branch office network and requires the following business outcomes:
Maximize cost savings with reduced administration overhead
Easily expand connectivity to the cloud
Use cloud-based services to the branch offices
Which of the following should the architect do to best meet the requirements?
- A. Design point-to-site branch connectivity for offices to headquarters; deploy ExpressRoute and/or DirectConnect between headquarters and the cloud; use headquarters connectivity to connect to the cloud provider.
- B. Design an MPLS architecture for the branch offices and site-to-site VPN between headquarters and branch offices; use site-to-site connectivity to the cloud provider.
- C. Design a dark fiber solution for headquarters and branch offices' connectivity; deploy point-to-site VPN between headquarters and the cloud provider; use the headquarters connectivity to the cloud provider.
- D. Design a SD-WAN solution to integrate with the cloud provider; use SD-WAN to connect branch offices to the cloud provider.
Answer: D
Explanation:
By deploying SD-WAN you centrally manage and orchestrate all branch connections, minimizing administration overhead, while establishing direct, optimized tunnels into the cloud provider for low-latency, scalable access to cloud services.
NEW QUESTION # 36
A network architect must design a new branch network that meets the following requirements:
* No single point of failure
* Clients cannot be impacted by changes to the underlying medium
* Clients must be able to communicate directly to preserve bandwidth
Which of the following network topologies should the architect use?
- A. Mesh
- B. Spine-and-leaf
- C. Star
- D. Hub-and-spoke
Answer: A
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
A Mesh topology provides multiple redundant paths between all nodes, ensuring there is no single point of failure. Clients can communicate directly with each other without passing through a central hub, reducing bottlenecks and preserving bandwidth. Mesh networks are fault tolerant and resilient to changes in the underlying medium, making them ideal for distributed environments requiring high availability.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "WAN and LAN Topologies":
"In a mesh topology, every device is connected to every other device. This design offers fault tolerance and allows for direct communication paths between endpoints, maximizing bandwidth efficiency and eliminating single points of failure." Other options:
* A. Hub-and-spoke introduces a central point of failure and may limit bandwidth.
* C. Spine-and-leaf is ideal for data centers but not typically used for branch office designs.
* D. Star topology relies on a central switch and has a single point of failure.
NEW QUESTION # 37
A network engineer is establishing a wireless network for handheld inventory scanners in a manufacturing company's warehouse. The engineer needs an authentication mechanism for these scanners that uses the Wi-Fi network and works with the company's Active Directory. The business requires that the solution authenticate the users and authorize the scanners. Which of the following provides the best solution for authentication and authorization?
- A. LDAP
- B. TACACS+
- C. PKI
- D. RADIUS
Answer: D
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
RADIUS (Remote Authentication Dial-In User Service) is the best-fit protocol for this requirement. It supports both authentication and authorization and is widely used in Wi-Fi network environments for client device authentication using credentials stored in centralized directories such as Active Directory.
RADIUS integrates seamlessly with enterprise authentication sources and supports EAP (Extensible Authentication Protocol), making it compatible with Wi-Fi-based client devices. It also allows for role-based access control, enabling policy enforcement specific to device types (e.g., inventory scanners).
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - "Authentication and Authorization Technologies":
"RADIUS provides centralized authentication, authorization, and accounting (AAA) services and is commonly used for securing wireless access in conjunction with Active Directory."
"Organizations use RADIUS to manage Wi-Fi authentication for user devices and enforce security policies during access attempts." Using a RADIUS server with 802.1X on the Wi-Fi infrastructure allows the scanners (and their users) to be authenticated against Active Directory and mapped to the correct authorization policies. TACACS+ is geared toward device management, LDAP alone doesn't handle the Wi-Fi 802.1X handshake, and PKI by itself wouldn't provide the user-to-device authorization flow needed. RADIUS gives you both authentication and authorization tied into AD.
NEW QUESTION # 38
Which of the following helps the security of the network design to align with industry best practices?
- A. Service-level agreement
- B. Licensing agreement
- C. Reference architectures
- D. Memorandum of understanding
Answer: C
Explanation:
Reference architectures provide standardized, vendor-agnostic blueprints that incorporate industry best practices for security, ensuring your network design aligns with proven frameworks.
NEW QUESTION # 39
A network engineer is working on securing the environment in the screened subnet. Before penetration testing, the engineer would like to run a scan on the servers to identify the OS, application versions, and open ports. Which of the following commands should the engineer use to obtain the information?
- A. hping3 -1 10.10.10.x -rand-dest -I eth0
- B. nmap -A 10.10.10.0/28
- C. tcpdump -ni eth0 src net 10.10.10.0/28
- D. nc -v -n 10.10.10.x 1-1000
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
nmap -A performs aggressive scanning, which includes OS detection, version detection, script scanning, and traceroute - exactly what is required in this case. It's the most effective and commonly used tool for comprehensive network reconnaissance prior to security testing.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Security Scanning and Reconnaissance Tools":
"Nmap supports comprehensive scanning options, including OS fingerprinting, service version detection, and port scanning, enabling detailed pre-penetration testing assessments." Other options:
* A. tcpdump is for packet capture, not scanning.
* C. nc (netcat) is a port scanning tool, but it lacks OS/app detection.
* D. hping3 is a packet generator, not suitable for full-service scanning.
NEW QUESTION # 40
An outage occurred after a software upgrade on core switching. A network administrator thinks that the firmware installed had a bug. Which of the following should the network administrator do next?
- A. Implement the solution.
- B. Establish a plan of action to resolve the issue.
- C. Document lessons learned.
- D. Test the theory to determine cause.
Answer: D
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
According to the structured troubleshooting methodology outlined in the CNX-001 objectives, once a potential root cause is identified (in this case, a suspected firmware bug), the next step is to test the theory to confirm the cause before taking action. This helps prevent misdiagnosis and unnecessary configuration changes.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Structured Troubleshooting Methodology":
"After identifying symptoms and forming a theory of probable cause, the next step is to test the theory to verify it is the actual cause of the problem." Other options:
* A. Establishing a plan of action comes after confirming the cause.
* C. Documenting lessons learned is the final step.
* D. Implementing the solution should only occur after the issue is confirmed.
NEW QUESTION # 41
A partner is migrating a client from on premises to a hybrid cloud. Given the following project status information, the initial project timeline estimates need to be revised:
Which of the following documents needs to be revised tobestreflect the current status of the project?
- A. SOW
- B. BIA
- C. SLA
- D. WBS
Answer: D
Explanation:
The Work Breakdown Structure is where each project phase and its duration are documented in detail. Since the estimated timelines for discovery, design, implementation, and knowledge transfer have all slipped, you update the WBS to reflect the new, actual phase durations.
NEW QUESTION # 42
A cloud network engineer needs to enable network flow analysis in the VPC so headers and payload of captured data can be inspected. Which of the following should the engineer use for this task?
- A. Network flows
- B. Traffic mirroring
- C. Application monitoring
- D. Syslog service
Answer: B
Explanation:
VPC Traffic Mirroring lets you capture copies of inbound and outbound network traffic, full packet headers and payload, and send them to appliances or analysis tools for deep inspection, which goes beyond the metadata provided by standard flow logs.
NEW QUESTION # 43
A company just launched a cloud-based application. Some users are reporting the application will not load. A cloud engineer investigates the issues and reports the following:
* Not all users are experiencing the issue.
* The application infrastructure is optimal.
* Users experiencing the issue belong to the company's remote sales team.
Which of the following is most likely misconfigured?
- A. Application load balancers
- B. Geolocation rules
- C. Ports and protocols
- D. IP addressing
Answer: B
Explanation:
Since only the remote sales team is affected and the infrastructure and network settings are correct, it's most likely that your geolocation or geo-restriction policies are blockingtraffic from the regions where those users are located. Correcting those rules to allow their locations should restore access without impacting other users.
NEW QUESTION # 44
A network administrator is troubleshooting an outage at a remote site. The administrator examines the logs and determines that one of the internet links at the site appears to be down. After the service provider confirms this information, the administrator fails over traffic to the backup link. Which of the following should the administrator do next?
- A. Identify the problem.
- B. Establish a plan of action.
- C. Document the lessons learned.
- D. Verify full system functionality.
Answer: D
Explanation:
After implementing the failover solution, you should confirm that all services and network paths are fully restored and operating correctly before closing the ticket.
NEW QUESTION # 45
A cafe uses a tablet-based point-of-sale system. Customers are complaining that their food is taking too long to arrive. During an investigation, the following is noticed:
Every kitchen printer did not print the orders.
Payments are processing correctly.
The cloud-based system has record of the orders.
This issue occurred when the cafe was busy.
Which of the following is the best way to mitigate this issue?
- A. Updating the application
- B. Upgrading the kitchen printers' wireless dongles
- C. Adding an access point exclusively for the kitchen
- D. Assigning the kitchen printers static IP addresses
Answer: C
Explanation:
By dedicating a separate Wi-Fi access point to the printers, you isolate their traffic from the customer-facing tablets. This prevents congestion during busy periods, ensuring orders reliably print even when the main network is under heavy load.
NEW QUESTION # 46
......
CompTIA CNX-001 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
CNX-001 Free Sample Questions to Practice One Year Update: https://examtorrent.braindumpsit.com/CNX-001-latest-dumps.html