CompTIA CNX-001 Exam Preparation Guide and PDF Download [Q37-Q56]

ExamBoosts January 16, 2026 CNX-001 > CompTIA 0

Rate this post

CompTIA CNX-001 Exam Preparation Guide and PDF Download

Verified & Correct CNX-001 Practice Test Reliable Source Jan 16, 2026 Updated

QUESTION 37
A network architect must design a new branch network that meets the following requirements:
* No single point of failure
* Clients cannot be impacted by changes to the underlying medium
* Clients must be able to communicate directly to preserve bandwidth
Which of the following network topologies should the architect use?

Hub-and-spoke

Mesh

Spine-and-leaf

Star

Comprehensive and Detailed Explanation From Exact Extract:
A Mesh topology provides multiple redundant paths between all nodes, ensuring there is no single point of failure. Clients can communicate directly with each other without passing through a central hub, reducing bottlenecks and preserving bandwidth. Mesh networks are fault tolerant and resilient to changes in the underlying medium, making them ideal for distributed environments requiring high availability.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide – under “WAN and LAN Topologies”:
“In a mesh topology, every device is connected to every other device. This design offers fault tolerance and allows for direct communication paths between endpoints, maximizing bandwidth efficiency and eliminating single points of failure.” Other options:
* A. Hub-and-spoke introduces a central point of failure and may limit bandwidth.
* C. Spine-and-leaf is ideal for data centers but not typically used for branch office designs.
* D. Star topology relies on a central switch and has a single point of failure.

QUESTION 38
A network administrator must connect a remote building at a manufacturing plant to the main building via a wireless connection. Which of the following should the administrator choose to get the greatest possible range from the wireless connection? (Choose two.)

2.4GHz

5GHz

6GHz

Omnidirectional antenna

Patch antenna

Built-in antenna

Comprehensive and Detailed Explanation From Exact Extract:
2.4GHz has longer range and better wall penetration than higher frequencies like 5GHz or 6GHz.A patch antenna (a type of directional antenna) focuses the signal in one direction, greatly improving range and reliability over long distances between buildings.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide – under “Wireless Deployment and Antenna Selection”:
“2.4GHz offers extended range over 5GHz. Directional antennas such as patch antennas concentrate signals toward a target, improving distance communication.” Other options:
* B & C. Higher frequencies provide faster speeds but shorter range.
* D. Omnidirectional antennas spread signal in all directions, not ideal for point-to-point.
* F. Built-in antennas are generally low gain and insufficient for building-to-building links.

QUESTION 39
A company is replacing reserved public IP addresses with dynamic IP addresses. The network architect creates a list of assets with some dependencies to these reserved IPs:

Which of the following issues may begin to affect cloud assets after the replacement is made?

IP asymmetric routing

IP spoofing

IP exhaustion

IP reuse

Once you switch those public IPs from reserved (static) to dynamic, the cloud provider can reassign them to other tenants as soon as you deallocate. That “reuse” can lead to unexpected conflicts and broken security rules (for example your NSG allow lists still pointing to the old IPs might suddenly open traffic to an unrelated resource).

QUESTION 40
A company hosts its application s on the cloud and is expanding its business to Europe. The company must comply with General Data Protection Regulation to limit European customers’ access to data. The network team configures the firewall rules but finds that some customers in the United States can access data hosted in Europe. Which of the following is the best option for the network team to configure?

SASE

Network security groups

CDN

Geofencing rule

Using a geofencing (geo#restriction) policy lets you block or allow traffic based on the client’s geographic location. This ensures that only users in approved regions (e.g., the United States) can reach the European- hosted data, effectively preventing unintended European customer access without complex IP ACLs.

QUESTION 41
You are designing a campus network with a three-tier hierarchy and need to ensure secure connectivity between locations and traveling employees.
INSTRUCTIONS
Review the command output by clicking on the server, laptops, and workstations on the network.
Use the drop-down menus to determine the appropriate technology and label for each layer on the diagram.
Options may only be used once.
Click on the magnifying glass to make additional configuration changes.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

QUESTION 42
A network architect is working on a physical network design template for a small education institution’s satellite campus that is not yet built. The new campus location will consist of two small buildings with classrooms, one screening room with audiovisual equipment, and 200 seats for students. Which of the following enterprise network designs should the architect suggest?

Hybrid

Dual-layer

Three-tier

Collapsed core

Comprehensive and Detailed Explanation From Exact Extract:
A collapsed core design combines the core and distribution layers into a single tier, making it ideal for small- scale networks such as satellite campuses or branch offices. It reduces complexity, cost, and footprint while still supporting redundancy and scalability where needed.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide – under “Network Design Models”:
“For small to medium-sized deployments, a collapsed core topology reduces hardware and configuration complexity while maintaining essential functionality.” Other options:
* A. Hybrid refers to cloud/physical blends, not network topology.
* B. Dual-layer isn’t a standard enterprise architecture reference.
* C. Three-tier is overkill for small networks and adds unnecessary complexity.

QUESTION 43
A company’s IT department is expected to grow from 100 to 200 employees, and the sales department is expected to grow from 1,000 to a maximum of 2,000 employees. Each employee owns a single laptop with a single IP allocated. The network architect wants to deploy network segmentation using the IP range 10.0.0.0
/8. Which of the following is the best solution?

Allocate 10.1.0.0/30 to the IT department. Allocate 10.2.0.0/16 to the sales department.

Allocate 10.1.0.0/16 to the IT department. Allocate 10.2.1.0/24 to the sales department.

Allocate 10.1.0.0/22 to the IT department. Allocate 10.2.0.0/15 to the sales department.

Allocate 10.1.0.0/16 to the IT department. Allocate 10.2.1.0/25 to the sales department.

A /22 gives you 1,022 usable addresses, ample headroom for 200 IT laptops, while a /15 yields 32,766 addresses, covering up to 2,000 sales laptops with room to grow, all within the 10.0.0.0/8 space.

QUESTION 44
A network administrator is troubleshooting a user’s workstation that is unable to connect to the company network. The results of ipconfig and arp -a are shown. The user’s workstation:

A router on the same network shows the following output:

* Has an IP address of 10.21.12.8
* Has subnet mask 255.255.255.0
* Default gateway is 10.21.12.254
* ARP table shows 10.21.12.8 mapped to 1A-21-11-31-74-4C (a different MAC address than the local adapter)

Asynchronous routing

IP address conflict

DHCP server down

Broadcast storm

Comprehensive and Detailed Explanation From Exact Extract:
The local machine has the IP address 10.21.12.8 and the physical address 1A-21-11-33-44-5A.However, the ARP table shows that 10.21.12.8 is mapped to a different MAC address (1A-21-11-31-74-4C), meaning another device on the network is responding to ARP requests for the same IP. This is a clear sign of an IP address conflict, which would prevent the workstation from functioning properly on the network.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide – under “Troubleshooting IP Addressing Issues”:
“An IP conflict occurs when two devices on the same network are assigned the same IP address. Symptoms include connectivity loss, duplicate ARP entries, and inconsistent routing behavior.” Other options:
* A. Asynchronous routing refers to packets taking different return paths, which is unrelated to ARP inconsistencies.
* C. DHCP server issues would affect IP assignment but are not indicated here – the workstation has an IP address assigned.

QUESTION 45
A call center company provides its services through a VoIP infrastructure. Recently, the call center set up an application to manage its documents on a cloud application. The application is causing recurring audio losses for VoIP callers. The network administrator needs to fix the issue with the least expensive solution. Which of the following is the best approach?

Adding a second internet link and physically splitting voice and data networks into different routes

Configuring QoS rules at the internet router to prioritize the VoIP calls

Creating two VLANs, one for voice and the other for data

Setting up VoIP devices to use a voice codec with a higher compression rate

Prioritizing VoIP packets over the document-management traffic ensures that voice gets the necessary bandwidth and low latency even when the network is congested – all without the cost of new links or hardware.

QUESTION 46
An organization has centralized logging capability at the on-premises data center and wants a solution that can consolidate logging from deployed cloud workloads. The organization would like to automate the detection and alerting mechanism. Which of the following best meets the requirements?

IDS/IPS

SIEM

Data lake

Syslog

A Security Information and Event Management system ingests and normalizes logs from on-premises and cloud sources, applies automated correlation rules for detection, and issues alerts, exactly matching the need for centralized logging, analysis, and automated notification.

QUESTION 47
A network administrator is configuring firewall rules to lock down the network from outside attacks. Which of the following should the administrator configure to create the most strict set of rules?

URL filtering

File blocking

Network security group

Allow List

By explicitly permitting only known, approved traffic and blocking everything else by default, an allow-list policy enforces the strictest firewall posture.

QUESTION 48
A network architect is working on a new network design to better support remote and on-campus workers.
Traffic needs to be decrypted for inspection in the cloud but is not required to go through the company’s data center. Which of the following technologies best meets these requirements?

Secure web gateway

Transit gateway

Virtual private network

Intrusion prevention system

Network access control system

Comprehensive and Detailed Explanation From Exact Extract:
A Secure Web Gateway (SWG) provides cloud-based traffic filtering, URL filtering, SSL decryption, and content inspection without requiring traffic to be routed through an on-premises data center. It is ideal for both remote and hybrid users, enforcing security policies in a distributed environment.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide – under “Cloud-Based Security Solutions”:
“Secure Web Gateways allow cloud-hosted decryption and inspection of web traffic, enabling policy enforcement for remote and on-campus users without backhauling traffic to the data center.” Other options:
* B. Transit gateways connect VPCs and on-prem but don’t decrypt traffic.
* C. VPNs provide encrypted tunnels but don’t inspect traffic.
* D. IPS inspects traffic but is usually on-prem and not cloud-hosted.
* E. NAC is used for access control, not traffic inspection.

QUESTION 49
Security policy states that all inbound traffic to the environment needs to be restricted, but all external outbound traffic is allowed within the hybrid cloud environment. A new application server was recently set up in the cloud. Which of the following would most likely need to be configured so that the server has the appropriate access set up? (Choose two.)

Application gateway

IPS

Port security

Firewall

Network security group

Screened subnet

A perimeter firewall enforces the organization’s “deny inbound by default, allow all outbound” policy at the edge of the cloud environment, while an Azure-style NSG applies the same rule set at the VM/subnet level.
Together they ensure no inbound connections slip through and that outbound traffic remains unrestricted.

QUESTION 50
A company is transitioning from on premises to a hybrid environment. Due to regulatory standards, the company needs to achieve a high level of reliability and high availability for the connection between its data center and the cloud provider. Which of the following solutionsbestmeets the requirements?

Establish a Direct Connect with the cloud provider and peer to two different VPCs in the cloud network.

Establish a Direct Connect with the cloud provider and a redundant connection with a VPN over the internet.

Establish two Direct Connect connections to the cloud provider using two different suppliers.

Establish a VPN with two tunnels to a transit gateway at the cloud provider.

By provisioning two dedicated Direct Connect circuits from separate carriers (diverse physical paths and providers), you achieve a true highly available, fault-tolerant link that meets stringent reliability and regulatory requirements without relying on the public internet.

QUESTION 51
A network architect is choosing design options for a new SD-WAN installation that has the following requirements:
All network traffic from the cloud must pass through inspection devices in a dedicated data center.
Ensure redundancy.
Centralize egress traffic.
Which of the following network topologies best meets these requirements?

Point-to-point

Hub-and-spoke

Partial mesh

Star

A hub-and-spoke design sends all branch and cloud traffic into the central hub (your data center) for inspection, then back out, meeting the requirement for centralized egress and security inspection. By deploying multiple hub nodes and using dynamic path selection, you also achieve redundancy without losing the centralized control plane.

QUESTION 52
Throughout the day, a sales team experiences videoconference performance issues when the accounting department runs reports. Which of the following is the best solution?

Running the accounting department’s reports outside of business hours

Using a load balancer to split the video traffic evenly

Configuring QoS on the corporate network switches

Increasing the throughput on the network by purchasing high-end switches

Comprehensive and Detailed Explanation From Exact Extract:
Quality of Service (QoS) ensures that latency-sensitive traffic like videoconferencing is prioritized over bandwidth-heavy but delay-tolerant tasks like report generation. Implementing QoS on network switches allows the network to differentiate traffic types and ensure sufficient bandwidth for critical applications during congestion.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide – under “Traffic Prioritization and QoS”:
“QoS enables classification and prioritization of network traffic to ensure performance of mission-critical or real-time applications such as voice and video.” Other options:
* A. Scheduling tasks outside business hours is not scalable or reliable.
* B. Load balancing applies to servers, not prioritization of LAN traffic.
* D. Buying higher-end switches is costly and may not resolve contention under load.

QUESTION 53
An organization with an on-premises data center is adopting additional cloud-based solutions. The organization wants to keep communication secure between remote employees’ devices and workloads. Which of the following ZTA featuresbestachieves this goal?

Secure service edge

Cloud access security broker

Principle of least privilege

Identity as the perimeter

Shifting to “identity as the perimeter” means that each remote user and device’s identity (and context) becomes the basis for granting secure, encrypted access directly to workloads, regardless of the underlying network, ensuring communications are authenticated and authorized per-session.

QUESTION 54
A network engineer is working on securing the environment in the screened subnet. Before penetration testing, the engineer would like to run a scan on the servers to identify the OS, application versions, and open ports. Which of the following commands should the engineer use to obtain the information?

tcpdump -ni eth0 src net 10.10.10.0/28

nmap -A 10.10.10.0/28

nc -v -n 10.10.10.x 1-1000

hping3 -1 10.10.10.x -rand-dest -I eth0

The -A flag enables aggressive scanning, which combines OS detection, version detection, script scanning, and traceroute to give you detailed information on hosts in the 10.10.10.0/28 range.

QUESTION 55
A network engineer needs to implement a cloud native solution. The solution must allow the recording of network conversation metadata of the host and appliances attached to a VPC. Which of the following will accomplish these goals with the least effort?

Enabling network flow

Configuring SNMP traps

Implementing QoS network tagging

Installing a cloud monitoring agent

Enabling VPC (or equivalent) flow logs is the native, zero-agent way to capture metadata about every network conversation, source/destination IPs, ports, protocols, bytes transferred, across both hosts and managed appliances in your virtual network. It requires minimal setup (just a checkbox or API call) and scales automatically with your VPC.

QUESTION 56
After a company migrated all services to the cloud, the security auditor discovers many users have administrator roles on different services. The company needs a solution that:
* Protects the services on the cloud
* Limits access to administrative roles
* Creates a policy to approve requests for administrative roles on critical services within a limited time
* Forces password rotation for administrative roles
* Audits usage of administrative roles
Which of the following is the best way to meet the company’s requirements?

Privileged access management

Session-based token

Conditional access

Access control list

Comprehensive and Detailed Explanation From Exact Extract:
Privileged Access Management (PAM) is the optimal solution to control, audit, and secure administrative access to systems and services. PAM enables role-based approval workflows, time-limited access, auditing, and credential rotation, fully aligning with the requirements.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide – under “Identity and Access Controls”:
“Privileged Access Management allows fine-grained control over administrator-level access, supports just-in- time access provisioning, password rotation, and audit logging.” Other options:
* B. Session-based tokens allow temporary access but do not enforce policies or auditing.
* C. Conditional access provides policy enforcement based on context but lacks full PAM features.
* D. ACLs control access to resources but don’t manage privilege workflows or audits.

Loading …