CNX-001 practice questions

Q: Is this CNX-001 practice test free?

Yes. All 15 CNX-001 practice questions on this page are free, with instant scoring and a written explanation for each answer. You do not need an account and there is no time limit.

Q: How much does the real CNX-001 exam cost?

The official price is $544. Cyber VK sells the same official CNX-001 voucher for $224.99 — a saving of $319.01. The voucher is identical to one bought direct and is emailed within minutes of payment.

Q: Are these questions the same as the real CNX-001 exam?

No. These are original practice questions written to match the published exam objectives and difficulty. They are not real exam questions — sharing or reproducing live exam content breaches every certification body's candidate agreement and can void your certification.

Q: How should I use this practice test?

Use it as a readiness check rather than a study tool. Work through the questions without notes, read the explanation for every answer including the ones you got right, and treat any domain where you miss more than a third as the area to revise before booking your exam.

Question 1

A cloud network architect needs to connect an on-premises data center to a single VPC in a public cloud provider using a dedicated, private physical link that does not traverse the public internet. Which connectivity option should be selected?

Accepted Answer

A dedicated direct connect circuit provides a private physical layer 1/2 link between the customer's on-premises equipment and the cloud provider, bypassing the public internet entirely. VPN traffic still traverses the internet, and VPC peering only joins cloud-hosted virtual networks.

Question 2

An organization is designing a hub-and-spoke topology in a public cloud. Spoke VNets must communicate with each other, but the cloud's native peering is non-transitive. Which design element resolves this requirement?

Accepted Answer

Because native peering is non-transitive, spoke-to-spoke traffic must be explicitly routed through a hub appliance using user-defined routes that override the default system routes. The other options do not create a transitive path between spokes.

Question 3

A multinational enterprise runs workloads in three cloud providers and two on-premises sites. Requirements: consistent routing policy, sub-second failover between transit paths, and the ability to apply per-application path selection based on real-time latency. Which architecture best satisfies all requirements?

Accepted Answer

An SD-WAN overlay abstracts the underlying transports and provides centralized policy plus application-aware, latency-driven path selection with rapid failover across heterogeneous providers. Static mesh and per-provider transit gateway designs cannot make real-time per-application path decisions.

Question 4

Which security control filters traffic at the individual virtual machine's network interface level rather than at the subnet boundary?

Accepted Answer

Security groups are stateful filters applied directly to instance network interfaces, while network ACLs are stateless filters applied at the subnet boundary. Route tables direct traffic and WAFs inspect layer 7 HTTP traffic.

Question 5

An administrator must ensure that traffic from private subnet instances to a cloud object storage service never leaves the provider's backbone and is not routed through a NAT gateway. Which solution should be implemented?

Accepted Answer

A private service endpoint keeps traffic to the managed service on the provider's internal network and supports endpoint policies that restrict which resources can be accessed. All other options still route traffic through gateways toward public service IPs.

Question 6

A zero trust design requires that east-west traffic between microservices be mutually authenticated and encrypted without modifying application code, while enforcing per-service authorization policy. Which implementation meets this requirement?

Accepted Answer

A service mesh injects sidecar proxies that transparently terminate and originate mTLS and evaluate identity-based authorization policies without application changes. Host-level IPSec and firewalls secure the network path but cannot enforce per-service workload identity.

Question 7

Which load balancer type operates at OSI layer 4 and forwards traffic based on protocol, source IP, and destination port without inspecting the payload?

Accepted Answer

A network load balancer makes forwarding decisions using layer 4 information such as IP addresses and TCP/UDP ports without parsing application data. Application load balancers operate at layer 7 and inspect HTTP headers and paths.

Question 8

Users report intermittent connection resets to an application behind a layer 7 load balancer. The backend health checks pass, but sessions drop after roughly 60 seconds of inactivity. What is the most likely cause?

Accepted Answer

When the load balancer's idle timeout expires before the application or client sends a keepalive, the balancer silently closes the flow and the next packet triggers a reset. Health checks would fail visibly and DNS TTL does not affect established sessions.

Question 9

A global application uses anycast IP addressing behind a provider's edge network. After a regional failure, a subset of clients continues to be blackholed even though the region is withdrawn from BGP. Which factor most likely explains the persistent failure?

Accepted Answer

Anycast failover depends on BGP withdrawal propagating through all upstreams, and route flap damping or slow convergence can cause some transit networks to keep forwarding to the failed region. DNS caching is not a factor because anycast reuses the same IP address across regions.

Question 10

Which protocol is most commonly used to exchange routing information between an on-premises edge router and a cloud provider's virtual gateway over a dedicated circuit?

Accepted Answer

Cloud providers standardize on BGP for dynamic route exchange over dedicated circuits and VPN attachments because it scales across administrative domains and supports policy attributes. OSPF, EIGRP, and RIPv2 are interior gateway protocols not offered on cloud virtual gateways.

Question 11

An organization has overlapping RFC 1918 address space between an acquired company's data center and its existing cloud VPC. Renumbering either network is not feasible in the required timeframe. Which approach allows connectivity?

Accepted Answer

Dual (twice) NAT maps each side's overlapping addresses into unique translated ranges so the two networks can address each other unambiguously without renumbering. Route preference and proxy ARP cannot disambiguate identical prefixes on both sides.

Question 12

A hybrid design advertises the same on-premises prefix to a cloud environment over both a dedicated circuit and a backup VPN. During testing, return traffic from the cloud unexpectedly prefers the VPN. Which corrective action is most appropriate?

Accepted Answer

Path selection is influenced by prefix specificity and BGP attributes, so advertising a more specific prefix over the circuit or prepending the AS path on the VPN makes the circuit preferred while retaining the VPN as backup. MTU and timer changes do not alter best-path selection.

Question 13

Which tool or data source would an engineer use first to determine whether traffic between two cloud instances was allowed or denied by a security group?

Accepted Answer

VPC flow logs record accepted and rejected traffic at the interface, subnet, or VPC level, making them the primary source for verifying whether a security group permitted a flow. DNS and load balancer logs capture different layers of activity.

Question 14

An application in a private subnet can resolve an internal hostname but cannot establish a TCP connection to it. Flow logs show outbound packets accepted and no inbound return traffic. Which cause should be investigated first?

Accepted Answer

Network ACLs are stateless, so return traffic on ephemeral ports must be explicitly allowed inbound, which matches the symptom of accepted outbound packets with no returning flow. DNS is already working and TLS failures would occur after the TCP handshake completes.

Question 15

Latency-sensitive traffic between two peered VPCs in different regions shows periodic throughput collapse. Packet captures reveal ICMP type 3 code 4 messages being generated but not reaching the sending host. What is the most likely root cause?

Accepted Answer

ICMP type 3 code 4 is the fragmentation-needed message used by path MTU discovery, and blocking it creates a black hole where large packets are silently dropped until TCP stalls. Window scaling and ECN issues would not generate fragmentation-needed messages.

CNX-001 — CompTIA CloudNetX CNX-001 Exam Voucher | CloudNetX Expert Certification Practice Test

Free Practice Test

CNX-001 practice test — common questions