CNX-001 CompTIA CloudNetX Free Practice Test - 20 Questions
This practice set covers core cloud networking concepts for the CNX-001 exam, including deployment models, network segmentation, load balancing, SDN architecture, firewall types, VPN technologies, storage choices, DNS, high availability, BGP routing, zero-trust micro-segmentation, CDN, multi-VPC connectivity, DHCP, Kubernetes network policies, VPC fundamentals, subnet types, NAT gateways, flow logs, and multi-cloud connectivity. You will apply decision-making in hybrid, private, and public cloud scenarios, focusing on performance, security, and cost optimization. Master these areas to build a strong foundation for the certification.
What this CNX-001 practice set measures
This is an analysis of the practice bank, not a claim about the vendor's live exam blueprint. Use it to identify the knowledge, judgment, and recall patterns exercised here, then verify your coverage against the current official exam guide.
Cloud Deployment Models and Connectivity
This section examines how organizations choose between hybrid, multi-cloud, and dedicated connectivity. The hybrid model allows sensitive data to remain on-premises while bursting compute to the cloud. Proper BGP configuration prevents route hijacking that can blackhole traffic. For multi-cloud strategies, dedicated circuits like Direct Connect and ExpressRoute provide low latency and security. Transit gateways simplify inter-VPC routing across multiple accounts. Understanding these options ensures cost-effective, secure, and performant network design.
- Hybrid cloud supports data residency and elastic compute during peak periods.
- Accidental advertisement of more specific BGP routes can hijack traffic (prefix hijacking).
- Transit gateway acts as a hub for VPC and on-prem connectivity, reducing complexity.
- Direct Connect (AWS) and ExpressRoute (Azure) provide private, high-bandwidth connections from on-premises.
Network Segmentation and Security
Effective segmentation isolates environments and enforces least privilege. VPCs with separate subnets provide Layer 3 isolation by default. For finer control, network security groups (NSGs) with application security groups allow micro-segmentation independent of subnet boundaries. Stateful firewall rules track connections to permit return traffic while blocking unsolicited inbound. In containerized environments, Kubernetes Network Policies restrict pod-to-pod traffic. Placing web servers in public subnets and databases in private subnets follows security best practices.
- VPC subnets offer Layer 3 isolation for separating dev, test, and production.
- NSGs with application security groups enable tag-based micro-segmentation.
- Stateful firewall rules track connection state; stateless treat each packet independently.
- Kubernetes Network Policies provide native pod-to-pod traffic control.
- Public subnets have direct internet access; private subnets require a NAT gateway for outbound.
Load Balancing and Performance Optimization
Load balancing algorithms and content delivery networks (CDNs) are key to performance. For applications with variable session lengths, the least connections algorithm distributes traffic to the server with fewest active connections, avoiding overload. CDNs cache static content at edge locations, dramatically reducing latency for global users without application changes. Storage selection also impacts performance: block storage offers low-latency high throughput for analytics workloads compared to object or file storage.
- Least connections algorithm adapts to server load, ideal for variable session lengths.
- CDN caches static content at edge to reduce latency and offload origin servers.
- Block storage provides high throughput and low latency for parallel processing.
- Round robin ignores current load; weighted round robin assigns fixed weights.
Cloud Networking Fundamentals and Monitoring
A solid grasp of foundational components is critical. The SDN control plane makes forwarding decisions; a slow control plane can cause delays. DNS resolution within a VPC is achieved via private hosted zones, which are not publicly resolvable. DHCP option sets allow automatic domain assignment to instances. VPC Flow Logs capture metadata about all IP traffic without sampling, enabling detailed traffic analysis. NAT gateways provide outbound internet for private subnets while blocking inbound connections.
- Control plane in SDN handles forwarding decisions; data plane forwards packets.
- Private hosted zones allow custom domain resolution within VPC only.
- DHCP option set domain-name configures hostname suffix for VPC instances.
- VPC Flow Logs capture full (non-sampled) metadata of IP traffic for analysis.
- NAT gateway enables outbound internet from private subnets without allowing inbound.
Practice CNX-001 CompTIA CloudNetX with real flashcards
Read the prompt, commit to an answer, then flip the card. Move through the deck at your own pace and repeat any topic that does not come back quickly.
Card 1 of 20
1 reviewed this session
Static practice bank
Start the 20-question diagnostic
The complete question bank is embedded in this pre-rendered page. There is no database request or second content download when you begin.
A company requires that sensitive customer data remain stored on-premises due to regulatory mandates, but it wants to leverage cloud resources for compute-intensive analytics during peak periods. Which cloud deployment model best meets this requirement?
Show hint
Compare and contrast cloud deployment models
Study workflow
Turn one CNX-001 attempt into a study plan
- 1
Set Up a Hybrid Cloud Network
Create a dedicated connection (e.g., Direct Connect) from on-premises to your cloud VPC. Configure a VPN as backup. Establish BGP sessions to exchange routes. Use a private hosted zone for internal DNS resolution. Test failover by simulating a circuit outage and verifying traffic flows over the VPN.
- 2
Implement Micro-segmentation with NSGs
Group application tiers using application security groups (ASGs). Create network security group (NSG) rules that allow traffic only between required ASGs and ports. Apply NSGs to VM network interfaces. Verify connectivity using a tool like VPC Flow Logs to ensure only permitted traffic traverses.
- 3
Configure Load Balancer with Least Connections
Deploy a load balancer (e.g., Application Load Balancer). Set the routing algorithm to least connections. Register backend instances with health checks enabled. Monitor active connection counts and adjust scaling policies to maintain even distribution during traffic spikes.
- 4
Deploy a CDN for Global Static Content
Create a CDN distribution (e.g., CloudFront or Azure CDN) with an origin pointing to your web server or storage bucket. Configure caching policies with appropriate TTLs. Update DNS to point to the CDN endpoint. Test from multiple geographic locations to verify latency reduction.
- 5
Enable VPC Flow Logs for Traffic Analysis
Create a flow log in your VPC, specifying the Destination (S3 bucket or CloudWatch Logs), IAM role, and log format. Enable for all network interfaces or specific subnets. Analyze logs using tools like Athena to identify top talkers, denied traffic, or anomalies. Set alerts for unusual patterns.
FAQ
Questions about this CNX-001 practice page
Clear boundaries on what the bank covers, how to use it, and where official vendor information still matters.
What is the difference between a public and private subnet in a VPC?+
A public subnet has a route to an internet gateway, allowing instances to receive inbound internet traffic. A private subnet lacks that route; instances can only initiate outbound connections via a NAT gateway. Placing sensitive resources in private subnets reduces attack surface.
How does a NAT gateway enable outbound internet from private subnets?+
A NAT gateway resides in a public subnet and has an elastic IP. Private subnet routes direct outbound traffic to the NAT gateway, which forwards it to the internet. The gateway allows return traffic only for initiated connections, blocking unsolicited inbound.
What is the role of the control plane in SDN (Software-Defined Networking)?+
The control plane is the centralized intelligence that makes forwarding decisions and programs the data plane. It separates the decision logic from packet forwarding, enabling dynamic network management. A slow or misconfigured control plane can delay route convergence and affect traffic.
How does least connections load balancing differ from round robin?+
Least connections sends new requests to the server with the fewest active connections, adapting to current load. Round robin cycles through servers sequentially regardless of their load, which can cause uneven distribution during variable session lengths.
What is BGP route hijacking and how can it be prevented?+
BGP route hijacking occurs when a network advertises a more specific prefix than intended, diverting traffic. To prevent it, use prefix filters on BGP peers, implement route validation, and apply maximum prefix limits. Monitoring and alerting on unexpected route announcements helps detect incidents.
Build the next review session
Browse another free bank or use the study strategy guide to turn your misses into spaced review.