Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
A cloud network engineer needs to enable network flow analysis in the VPC so headers and payload of captured data can be inspected. Which of the following should the engineer use for this task?
VPC Traffic Mirroring lets you capture copies of inbound and outbound network traffic, full packet headers and payload, and send them to appliances or analysis tools for deep inspection, which goes beyond the metadata provided by standard flow logs.
A network architect is creating a network topology for a global SD-WAN deployment. The business has offices in Asia, Europe, and the United States and makes use of data centers in the United States and Europe. Most traffic between sites must have the lowest latency possible. Which of the following topologies best meets this requirement?
A full-mesh SD-WAN topology allows each site to establish direct overlays with every other site, minimizing the number of hops and avoiding backhauling through a central hub, thereby delivering the lowest latency paths between Asia, Europe, and the US.
A network engineer is working on securing the environment in the screened subnet. Before penetration testing, the engineer would like to run a scan on the servers to identify the OS, application versions, and open ports. Which of the following commands should the engineer use to obtain the information?
The -A flag enables aggressive scanning, which combines OS detection, version detection, script scanning, and traceroute to give you detailed information on hosts in the 10.10.10.0/28 range.
A company is replacing reserved public IP addresses with dynamic IP addresses. The network architect creates a list of assets with some dependencies to these reserved IPs:
Which of the following issues may begin to affect cloud assets after the replacement is made?
Once you switch those public IPs from reserved (static) to dynamic, the cloud provider can reassign them to other tenants as soon as you deallocate. That ''reuse'' can lead to unexpected conflicts and broken security rules (for example your NSG allow lists still pointing to the old IPs might suddenly open traffic to an unrelated resource).
A network architect is choosing design options for a new SD-WAN installation that has the following requirements:
All network traffic from the cloud must pass through inspection devices in a dedicated data center.
Ensure redundancy.
Centralize egress traffic.
Which of the following network topologies best meets these requirements?
A hub-and-spoke design sends all branch and cloud traffic into the central hub (your data center) for inspection, then back out, meeting the requirement for centralized egress and security inspection. By deploying multiple hub nodes and using dynamic path selection, you also achieve redundancy without losing the centralized control plane.
A network administrator recently deployed new Wi-Fi 6E access points in an office and enabled 6GHz coverage. Users report that when they are connected to the new 6GHz SSID, the performance is worse than the 5GHz SSID. The network administrator suspects that there is a source of 6GHz interference in the office. Using the troubleshooting methodology, which of the following actions should the network administrator do next?
Before making configuration changes, you should verify and pinpoint the suspected interference source by analyzing the 6 GHz band. A spectrum analyzer will reveal any non-Wi-Fi transmissions or overlapping noise that's degrading performance, allowing you to target your remediation effectively.
Exam domains verified against: Official CompTIA CNX-001 exam guide, last checked September 2026.
Design network architectures by applying core networking concepts, IP addressing schemes, and routing protocols. Select topologies and connectivity solutions appropriate to business needs in hybrid cloud environments, considering load balancing, high availability, and redundancy for reliable network operation.
Identify threats and vulnerabilities in cloud and network environments, then select and configure appropriate security technologies including firewalls, encryption, and access controls. Apply Zero Trust architecture principles, identity and access management, wireless security, and appliance hardening to protect network environments.
Operate and maintain network environments through risk management, business continuity planning, and service management agreements. Monitor performance using tools and techniques for traffic analysis, log collection, and QoS. automate administration through infrastructure as code and DevOps practices.
Sample question from this domain above: Q1
Apply a systematic troubleshooting methodology to diagnose and resolve connectivity, performance, and security issues. Use command-line tools and network analysers to interpret output, identify root causes, and implement solutions across hybrid cloud environments.
Common questions about the exam itself
