Free CNX-001: CompTIA CloudNetX Exam Questions and Answers

A network engineer at a logistics company receives complaints that a cloud-hosted warehouse application is slow in the afternoons. The engineer suspects that the 500 Mbps internet link at the main site is saturating but needs to confirm utilization over time and identify which hosts and applications are generating the traffic. Which of the following should the engineer implement? (Choose two.)

Select 2 answers.

• AA. SNMP traps configured for link-down and link-up events on the edge router
• BB. Debug-level syslog on all access switches forwarded to a central server
• CC. IPFIX flow export from the edge router to a flow collector
• DD. SNMP polling of the edge router interface octet counters at 1-minute intervals

A network architect is planning cabling for a warehouse annex. A PoE camera must be mounted 135 m (443 ft) from the nearest telecommunications room, and the camera requires 802.3at power. The cable pathway to the annex can carry fiber. Which of the following BEST meets the requirement?

• AA. Install a PoE-capable switch in a wall enclosure near the annex and connect it with a multimode fiber uplink
• BB. Run shielded Cat 6A cable directly from the telecommunications room to the camera location
• CC. Add a coupler and a passive patch panel at the 100 m point to extend the copper run
• DD. Configure the switch port for 802.3bt to raise the power budget on the 135 m copper run

Users on a campus access VLAN report browser certificate warnings when visiting internal sites. A network analyst finds that the ARP cache on several workstations maps the default gateway IP address to a MAC address that belongs to a device on a different access port. The access switches already have port security enabled with a maximum of two MAC addresses per port. Which of the following should the analyst implement to prevent this attack?

• AA. Storm control for broadcast traffic on the uplinks to distribution
• BB. Dynamic ARP inspection using the DHCP snooping binding table
• CC. Root guard on distribution switch ports facing the access layer
• DD. BPDU guard on all access ports with PortFast enabled

A network architect is planning cabling for a new distribution warehouse. The main distribution frame (MDF) is at the north end of the building. The farthest ceiling-mounted wireless access points are 145 m from the MDF by cable path and require PoE+. Which of the following is the BEST way to serve these access points?

• AA. Place a PoE+ injector at the MDF end of each of the distant cable runs
• BB. Run Cat 6A cable from the MDF patch panel directly to each distant access point
• CC. Install an IDF with a PoE+ switch near the south end, uplinked to the MDF by fiber
• DD. Use shielded Cat 7 patch cords at both ends of each of the distant cable runs

A network engineer at a call center reviews a monitoring platform that polls router interfaces with SNMP every 5 minutes. The uplink graph never exceeds 40% utilization, but agents report choppy VoIP audio for a few seconds several times an hour. Which of the following should the engineer implement to BEST identify the cause?

• AA. Streaming telemetry with one-second counters for the uplink interface
• BB. SNMP traps sent for interface link-up and link-down events on the uplink
• CC. Syslog forwarding of informational messages from the routers to a collector
• DD. NetFlow export with 1-in-1000 packet sampling on the uplink interface

Starting at 8:00 a.m., every employee is rejected when connecting to the Corp SSID, which uses 802.1X with PEAP. Wired 802.1X and the guest network are unaffected. A network engineer reviews the RADIUS log: 2026-03-04 08:12:41 Access-Request user=jlee NAS=WLC-02 SSID=Corp 2026-03-04 08:12:41 EAP-Type=PEAP TLS handshake started 2026-03-04 08:12:42 TLS alert: certificate_expired, server cert notAfter=2026-03-03 23:59:59 2026-03-04 08:12:42 Access-Reject: EAP failure Which of the following is the MOST likely cause?

• AA. The laptop's machine certificate was revoked by the issuing CA
• BB. The RADIUS server's certificate expired and must be renewed
• CC. The shared secret on the wireless controller does not match the RADIUS server
• DD. The user's directory password has expired and must be reset

A company uses several sanctioned SaaS applications, and employees also use unsanctioned file-sharing sites. The security team needs to discover which cloud applications are in use, block uploads of sensitive files to unsanctioned sites, and apply policy to the sanctioned applications through their APIs. Which of the following technologies BEST meets these requirements?

• AA. Web application firewall (WAF) in blocking mode
• BB. Network access control (NAC) with posture checks
• CC. Inline intrusion prevention system (IPS) with signatures
• DD. Cloud access security broker (CASB)

Users of a mobile app report TLS errors when calling an API behind a cloud load balancer, but desktop browsers work normally. A network engineer suspects the load balancer is not sending the intermediate certificate. Which of the following commands should the engineer use to view the certificate chain the load balancer presents?

• AA. nmap -sT -p 443 --reason -Pn api.corp.example
• BB. dig +trace +dnssec api.corp.example CNAME
• CC. openssl s_client -connect api.corp.example:443 -showcerts
• DD. curl --head --max-time 5 http://api.corp.example

A network architect is allocating address space for the finance VLAN in a new regional office. The VLAN has 450 hosts today and is expected to grow to 500 hosts over the next three years. The architect wants to leave as few unused addresses as possible while still meeting that growth. Which of the following subnets should the architect assign?

• AA. 10.8.0.0/24
• BB. 10.8.0.0/23
• CC. 10.8.0.0/22
• DD. 10.8.0.0/21

A network architect at a financial services company is connecting an on-premises data center to a public cloud VPC. The connection must meet the following requirements: * 5 Gbps of sustained throughput * Consistent latency under 10 ms * No traversal of the public internet * Encryption of all traffic in transit, per internal policy Which of the following solutions BEST meets these requirements?

• AA. SD-WAN overlay across dual broadband links with application-aware steering
• BB. Site-to-site IPsec VPN over two internet circuits from diverse providers
• CC. Dedicated private interconnect with IPsec tunnels running over the circuit
• DD. Dedicated private interconnect with the provider's default configuration