CNX-001 CompTIA CloudNetX free practice test

All questions and explanations

Prefer to read at your own pace? Work through each question below, then open its answer to check your reasoning. You can link directly to a question or print this reference.

1. Question 1

   Link to question

   A company requires that sensitive customer data remain stored on-premises due to regulatory mandates, but it wants to leverage cloud resources for compute-intensive analytics during peak periods. Which cloud deployment model best meets this requirement?

   1. Hybrid cloud

   2. Public cloud

   3. Private cloud

   4. Community cloud

   Show answer and explanation

   Correct answer

   • Hybrid cloud

   Hybrid cloud combines on-premises infrastructure with public cloud resources, allowing sensitive data to stay on-prem while bursting compute to the cloud. Public cloud would move all data off-prem. Private cloud is on-prem but lacks public cloud elasticity. Community cloud serves a group with shared concerns, not hybrid requirements.

2. Question 2

   Link to question

   A cloud architect needs to logically isolate network segments within a single cloud region to separate development, testing, and production environments. Each segment must be isolated at Layer 3. Which technology is most appropriate?

   1. VLANs configured on physical switches

   2. Virtual Private Cloud (VPC) with separate subnets

   3. Software-defined WAN (SD-WAN)

   4. Application-level firewall rules

   Show answer and explanation

   Correct answer

   • Virtual Private Cloud (VPC) with separate subnets

   A VPC provides Layer 3 isolation via virtual networks and subnets, ideal for separating environments within a region. VLANs (Layer 2) are less flexible in cloud. SD-WAN connects sites, not internal segments. Firewall rules are for traffic filtering, not network segmentation.

3. Question 3

   Link to question

   A web application experiences varying user session lengths. The load balancer must evenly distribute requests but avoid sending new connections to heavily loaded servers. Which load balancing algorithm is best suited?

   1. Round robin

   2. Source IP hash

   3. Least connections

   4. Weighted round robin

   Show answer and explanation

   Correct answer

   • Least connections

   Least connections sends new requests to the server with the fewest active connections, ideal for variable session lengths. Round robin ignores server load. Source IP hash causes stickiness, not balance. Weighted round robin assigns weights but still doesn't adapt to current load.

4. Question 4

   Link to question

   A network administrator notices that traffic between two cloud VMs is unexpectedly slow. The VMs are in the same VPC but different subnets. The administrator suspects the control plane is causing delay. In a software-defined networking (SDN) architecture, which component is responsible for making forwarding decisions?

   1. Data plane

   2. Management plane

   3. Application plane

   4. Control plane

   Show answer and explanation

   Correct answer

   • Control plane

   The control plane makes forwarding decisions and communicates them to the data plane. If the control plane is slow, it can affect route convergence. Data plane forwards packets based on those decisions. Management plane handles monitoring. Application plane is not standard in SDN.

5. Question 5

   Link to question

   An organization wants to allow inbound HTTP traffic to its web servers from the internet but block all unsolicited inbound traffic. The cloud firewall must inspect the state of connections. Which type of firewall rule should be used?

   1. Stateful firewall rule

   2. Stateless firewall rule

   3. Packet filtering rule

   4. Proxy-based rule

   Show answer and explanation

   Correct answer

   • Stateful firewall rule

   Stateful firewalls track connection states, allowing return traffic for established connections and blocking unsolicited. Stateless rules treat each packet independently. Packet filtering is stateless. Proxy-based rules operate at application layer.

6. Question 6

   Link to question

   Remote employees need to securely access internal corporate applications from their browsers without installing client software. Which VPN technology is most appropriate?

   1. IPsec VPN

   2. SSL/TLS VPN

   3. Site-to-site VPN

   4. MPLS VPN

   Show answer and explanation

   Correct answer

   • SSL/TLS VPN

   SSL/TLS VPN provides clientless access via web browser, ideal for remote users. IPsec VPN requires client software. Site-to-site connects networks, not individuals. MPLS is a private WAN technology.

7. Question 7

   Link to question

   A data analytics team needs to store large unstructured datasets and access them with high throughput for parallel processing. Which cloud storage type is most suitable?

   1. Object storage

   2. File storage

   3. Block storage

   4. Archive storage

   Show answer and explanation

   Correct answer

   • Block storage

   Block storage provides low-latency, high-throughput access suited for analytics workloads. Object storage is for unstructured data but with higher latency for frequent updates. File storage is good for shared files but not optimal for high throughput parallel access. Archive storage is for cold data.

8. Question 8

   Link to question

   An organization has internal applications that must resolve custom domain names (e.g., app.internal.company.com) within its cloud VPC. These names must not be publicly resolvable. Which DNS solution should be used?

   1. Public hosted zone on a third-party DNS

   2. Conditional forwarder to on-premises DNS

   3. Static hosts file on each instance

   4. Private hosted zone in the cloud DNS service

   Show answer and explanation

   Correct answer

   • Private hosted zone in the cloud DNS service

   A private hosted zone allows custom domain resolution within the VPC without public exposure. Public hosted zones make records accessible to the internet. Conditional forwarders and hosts files are less scalable and not cloud-native.

9. Question 9

   Link to question

   A critical application requires minimal data loss, with a recovery point objective (RPO) near zero. The application runs on two VMs in different availability zones. Which high availability configuration is best?

   1. Active-passive with data replication

   2. Active-active with load balancing

   3. Cold standby

   4. Pilot light

   Show answer and explanation

   Correct answer

   • Active-passive with data replication

   Active-passive with synchronous data replication can achieve near-zero RPO because changes are mirrored immediately. Active-active offers high availability but with potential latency in data consistency. Cold standby has high RPO. Pilot light also has higher RPO.

10. Question 10

    Link to question

    A company has a hybrid cloud setup with a Direct Connect circuit and a VPN backup. The on-premises network advertises routes to the cloud over BGP. During a maintenance window, the network team accidentally advertises a more specific route to a public IP range, causing cloud traffic to be blackholed. What is the most likely cause?

    1. MPLS label mismatch

    2. BGP prefix hijacking via more specific route

    3. VPC route table misconfiguration

    4. Internet gateway failure

    Show answer and explanation

    Correct answer

    • BGP prefix hijacking via more specific route

    Accidentally advertising a more specific BGP route can hijack traffic, causing it to be sent on-prem instead of to the internet (blackhole). MPLS mismatch would affect label switching, not routing. VPC route table is local. Internet gateway failure is unrelated.

11. Question 11

    Link to question

    A security team wants to implement zero-trust micro-segmentation between application tiers. They need to allow only specific traffic between VMs regardless of subnet membership. Which cloud networking feature is most appropriate?

    1. Network access control lists (NACLs)

    2. Route tables with blackhole routes

    3. Network security groups (NSGs) with application security groups

    4. Virtual private network (VPN)

    Show answer and explanation

    Correct answer

    • Network security groups (NSGs) with application security groups

    NSGs with application security groups enable micro-segmentation by grouping VMs and controlling traffic based on tags, independent of subnets. NACLs work at subnet level, not granular. Route tables direct traffic, not filter. VPN connects networks, not internal segmentation.

12. Question 12

    Link to question

    A global e-commerce platform experiences high latency for users in remote regions. The content is mostly static product images. Which solution will most effectively reduce latency without rewriting the application?

    1. Deploy compute instances in every region

    2. Implement edge computing with Lambda@Edge

    3. Enable compression on the web server

    4. Use a content delivery network (CDN)

    Show answer and explanation

    Correct answer

    • Use a content delivery network (CDN)

    A CDN caches static content at edge locations, reducing latency for global users. Deploying instances everywhere is costly and overkill. Edge computing (Lambda@Edge) is for dynamic processing. Compression reduces bandwidth but not latency significantly.

13. Question 13

    Link to question

    A company has multiple AWS accounts, each with its own VPC. They need to enable low-latency, high-bandwidth connectivity between all VPCs while minimizing complexity. Which solution is most appropriate?

    1. Transit gateway

    2. Internet gateway with VPN

    3. VPC peering in a full mesh

    4. AWS Direct Connect

    Show answer and explanation

    Correct answer

    • Transit gateway

    Transit gateway acts as a hub to connect multiple VPCs and on-premises networks, simplifying management. Full mesh VPC peering becomes complex as accounts grow. Internet gateway with VPN adds internet dependency. Direct Connect is for on-prem to cloud.

14. Question 14

    Link to question

    An administrator needs to assign a custom domain name (e.g., example.internal) to instances in a VPC so that they can automatically register their hostnames. Which DHCP option set configuration is required?

    1. Add a private hosted zone in Route 53

    2. Set the domain-name option to example.internal

    3. Configure a DNS forwarder on each instance

    4. Modify the VPC's default DHCP options set

    Show answer and explanation

    Correct answer

    • Set the domain-name option to example.internal

    DHCP option sets allow specifying domain-name, which instances use to append to hostnames. A private hosted zone is for DNS resolution, not domain assignment. DNS forwarders are for external resolution. Modifying default set may work but custom set is more flexible.

15. Question 15

    Link to question

    A microservices application running in Kubernetes must restrict traffic between pods so that only the frontend can communicate with the API backend. Which native Kubernetes resource should be used?

    1. Pod security policy

    2. Ingress controller

    3. Network policy

    4. Service mesh sidecar proxy

    Show answer and explanation

    Correct answer

    • Network policy

    Kubernetes Network Policies define ingress and egress rules for pod-to-pod traffic, enabling micro-segmentation. Pod security policy restricts security contexts. Ingress controller handles HTTP routing from outside. Service mesh provides more advanced traffic management but is not native.

16. Question 16

    Link to question

    Which component provides logically isolated virtual network in the cloud, allowing full control over IP addressing, subnets, and route tables?

    1. Virtual LAN (VLAN)

    2. Virtual Private Network (VPN)

    3. Virtual Routing and Forwarding (VRF)

    4. Virtual Private Cloud (VPC)

    Show answer and explanation

    Correct answer

    • Virtual Private Cloud (VPC)

    A VPC is a cloud-specific construct that provides logical isolation and full control over networking. VLANs operate at Layer 2 and are more limited in cloud. VPN connects networks securely. VRF is a routing technology used in physical routers.

17. Question 17

    Link to question

    A web server must be accessible from the internet, while a database server should only be reachable from the web server. Which subnet type should each be placed in?

    1. Web server in public subnet; database in private subnet

    2. Web server in private subnet; database in public subnet

    3. Both in public subnet with security groups

    4. Both in private subnet with NAT gateway

    Show answer and explanation

    Correct answer

    • Web server in public subnet; database in private subnet

    Public subnets have direct internet access via internet gateway; private subnets do not. Placing web server in public and database in private follows least privilege. Reverse would expose database. Both in public is insecure. Both in private prevents web server from being publicly accessible without additional components.

18. Question 18

    Link to question

    Instances in a private subnet need to download software updates from the internet. Which component enables outbound connectivity without allowing inbound traffic?

    1. Internet gateway

    2. NAT gateway

    3. Virtual private gateway

    4. Egress-only internet gateway

    Show answer and explanation

    Correct answer

    • NAT gateway

    A NAT gateway allows instances in private subnets to initiate outbound traffic while blocking inbound from internet. Internet gateway enables both inbound and outbound for public subnets. Virtual private gateway connects to VPN. Egress-only internet gateway is for IPv6 only.

19. Question 19

    Link to question

    A network engineer wants to analyze traffic patterns between VMs to troubleshoot performance issues. The engineer needs to capture metadata about IP traffic (source, destination, protocol, ports) without sampling. Which cloud monitoring solution is best?

    1. CloudWatch metrics

    2. AWS X-Ray

    3. VPC Flow Logs

    4. CloudTrail

    Show answer and explanation

    Correct answer

    • VPC Flow Logs

    VPC Flow Logs capture metadata about all IP traffic in a VPC, providing full (non-sampled) data for analysis. CloudWatch metrics give aggregate statistics, not per-flow. X-Ray traces application requests. CloudTrail logs API calls, not network traffic.

20. Question 20

    Link to question

    An organization with a multi-cloud strategy needs to connect its data center to both AWS and Azure with low latency and high bandwidth, avoiding the public internet. Which solution is most suitable?

    1. Site-to-site VPN to each cloud provider

    2. SD-WAN over internet

    3. IPsec VPN to a single provider and then cloud-to-cloud VPN

    4. Direct Connect to AWS and ExpressRoute to Azure

    Show answer and explanation

    Correct answer

    • Direct Connect to AWS and ExpressRoute to Azure

    Direct Connect (AWS) and ExpressRoute (Azure) provide dedicated, private connections from on-premises to each cloud, bypassing the internet. VPNs use public internet. SD-WAN over internet still uses public internet. Cloud-to-cloud VPN adds complexity and latency.