CompTIA CloudNetX CNX-001 Sample Questions & Practice Test

CompTIA CloudNetX (CNX-001) is an advanced vendor-neutral route for candidates who already understand cloud operations and need to reason through architecture, networking, security, automation, and operational control across hybrid and multi-cloud environments.

CloudNetX launched as a newer CompTIA Xpert Series cloud-networking route, so current preparation should focus on hybrid connectivity, segmentation, resilience, governance, and troubleshooting judgment. Use this page to try original IT Mastery sample questions and confirm whether CNX-001 is the route you want to hear about.

What these questions test

• designing resilient hybrid and multi-cloud connectivity
• selecting controls for identity, segmentation, encryption, logging, and governance
• diagnosing routing, latency, failover, and automation issues
• balancing performance, cost, availability, and compliance constraints

CNX-001 exam snapshot

Before scheduling, verify the current CNX-001 objectives, delivery rules, and exam facts with CompTIA. This page is independent practice support and does not claim affiliation with CompTIA.

Sample Exam Questions

Question 1

Topic: hybrid connectivity

A company connects two cloud providers and an on-premises data center. Latency-sensitive traffic must use private links when healthy, but fail over to encrypted internet paths if a private circuit fails. What design choice best supports this requirement?

• A. One static route with no health checking
• B. Dynamic routing with monitored preferred paths and encrypted backup connectivity
• C. Public internet routing only
• D. Manual DNS changes after every outage

Best answer: B

Explanation: Advanced cloud-network designs need deterministic primary paths and tested failover behavior. Dynamic routing with health-aware preference and encrypted backup links supports resilience without relying on manual intervention.

Question 2

Topic: segmentation

An application has web, application, database, and administrative tiers spread across cloud accounts. Which control best limits blast radius?

• A. Flat routing between all subnets
• B. Shared administrator credentials across tiers
• C. Public database endpoints for simpler testing
• D. Tier-based segmentation with least-privilege security policies

Best answer: D

Explanation: Segmentation reduces lateral movement and limits exposure. Security policies should reflect tier boundaries and permit only required flows.

Question 3

Topic: observability

After a new transit routing change, users report intermittent timeouts. Which evidence should be collected first?

• A. Flow logs, route tables, path health, and recent configuration changes
• B. A screenshot of the corporate logo
• C. Only CPU utilization from one server
• D. A list of unrelated open tickets

Best answer: A

Explanation: Network troubleshooting should begin with path, policy, and change evidence. Flow logs and route state help isolate whether traffic is dropped, misrouted, or delayed.

Question 4

Topic: encryption

A workload exchanges sensitive data between cloud regions. The security requirement is confidentiality in transit and documented key-management ownership. What should the architect specify?

• A. Plain HTTP between private addresses
• B. No logging because encryption exists
• C. Encrypted transport and a defined key-management model
• D. One shared key stored in a ticket

Best answer: C

Explanation: Encryption in transit protects confidentiality, but the operational model also needs ownership for keys, rotation, access, and auditability.

Question 5

Topic: cost control

A cloud network uses several NAT gateways and cross-region traffic paths. Monthly costs spike after a new analytics workload launches. What should be reviewed?

• A. Only the number of users with email accounts
• B. Data-transfer paths, NAT processing volume, region placement, and egress patterns
• C. The spelling of subnet names
• D. Whether all logs can be deleted

Best answer: B

Explanation: Network cost often comes from transfer, egress, NAT processing, and cross-region movement. Architecture review should identify avoidable traffic paths before changing capacity blindly.

Question 6

Topic: automation

A team manually creates firewall rules during every release, and several incidents were caused by inconsistent rule names. What is the best improvement?

• A. Keep manual changes but schedule them earlier
• B. Give every engineer unrestricted console access
• C. Stop documenting network changes
• D. Move network policy to reviewed infrastructure-as-code with testing and change history

Best answer: D

Explanation: Infrastructure-as-code can make policy repeatable, reviewed, testable, and traceable. It reduces drift when paired with change control and validation.

Question 7

Topic: resilience

A private connection to a critical cloud environment is highly available inside one facility, but the facility itself is a single point of failure. What is the main concern?

• A. Device redundancy alone does not remove site-level risk
• B. The connection is too secure
• C. The workload has too many backups
• D. The DNS zone name is too short

Best answer: A

Explanation: Resilience must be evaluated at multiple layers: device, circuit, facility, region, provider, and operational process. A redundant device pair in one site still leaves site-level concentration risk.

Question 8

Topic: identity

An operations team wants one emergency account for all cloud environments. What is the safer pattern?

• A. Shared permanent credentials with no logging
• B. Passwords stored in a public wiki
• C. Federated access, role-based permissions, break-glass controls, and audited use
• D. One administrator account used by every tool

Best answer: C

Explanation: Cross-cloud operations should use identity federation, least privilege, emergency access controls, and audit trails. Shared permanent credentials weaken accountability.

Question 9

Topic: governance

A business unit deploys a new cloud environment outside approved guardrails. Which control helps prevent repeat drift?

• A. No standards because cloud is flexible
• B. Clear landing-zone standards, policy-as-code, tagging rules, and exception workflow
• C. Manual reminders only
• D. Disabling all monitoring

Best answer: B

Explanation: Governance should be built into the environment through standards, automated policy checks, tagging, and documented exceptions rather than relying only on after-the-fact review.

Question 10

Topic: troubleshooting

An application can resolve a service name but cannot connect to the endpoint. Which layer should be checked next?

• A. Only the user interface theme
• B. Payroll approval status
• C. The vendor’s marketing page
• D. Network path, security policy, endpoint health, and service listener configuration

Best answer: D

Explanation: DNS resolution proves name lookup, not end-to-end reachability. The next checks are routing, policy, endpoint status, and whether the service is actually listening.

Question 11

Topic: data residency

A regulated workload must keep specific records in one jurisdiction. What should the architecture include?

• A. Region controls, data-flow review, backup-location controls, and monitoring for unauthorized replication
• B. Random region placement for lower latency
• C. Uncontrolled cross-region replication
• D. Public sharing links for audit files

Best answer: A

Explanation: Residency requirements apply to primary data, backups, logs, replication, and operational access. Architecture should define and monitor where regulated data can move.

Question 12

Topic: incident response

A suspected route-table change exposed an internal service to an untrusted network. What is the best first response?

• A. Delete all logs immediately
• B. Wait for the next billing cycle
• C. Contain the exposure, preserve evidence, review access logs, and follow the incident process
• D. Rename the service

Best answer: C

Explanation: The first priorities are containment and evidence preservation. A cloud-network incident should follow the incident-response process, including log review and change investigation.

CloudNetX architecture workflow map

    flowchart LR
	    A["Business and compliance need"] --> B["Hybrid connectivity design"]
	    B --> C["Segmentation and identity controls"]
	    C --> D["Resilience and failover"]
	    D --> E["Observability and cost review"]
	    E --> F["Troubleshoot, tune, and document"]

Use the map when a CNX-001 item asks what to prioritize. Strong answers balance connectivity, security, resilience, cost, and operational evidence instead of choosing the most complex network option by default.

Quick Cheat Sheet

Mini Glossary

• Hybrid connectivity: Network connectivity between on-premises environments and one or more cloud providers.
• Transit routing: A routing pattern that centralizes connectivity through a hub, gateway, or transit service.
• Landing zone: A standardized cloud environment with account, network, identity, logging, and policy guardrails.
• Flow log: Network metadata that helps show whether traffic was accepted, rejected, or routed unexpectedly.
• Blast radius: The amount of damage or exposure caused by a failure, misconfiguration, or compromise.

CompTIA CloudNetX CNX-001 practice update

Use this page to review CNX-001 sample questions and use the Notify me form for updates. The related pages below help you compare adjacent IT Mastery cloud, network, and automation practice options before choosing what to study next.

Use these live IT Mastery pages now

Practice options

• Current status: Sample questions
• IT Mastery coverage for this exam: under review
• Best use right now: confirm the CNX-001 advanced cloud-networking lane here, then practise with Cloud+, Network+, Security+, and Terraform where useful
• Update form: use the Notify me form near the top of this page if CloudNetX is your actual target exam

Official source

• CompTIA CloudNetX

What to open next

• Need cloud practice now? Open Cloud+ CV0-004 .
• Need network foundations now? Open Network+ N10-009 .
• Need the CompTIA hub? Open CompTIA .