CompTIA · CNX-001
CompTIA CloudNetX validates advanced skills in designing and implementing secure, scalable hybrid network architectures across multi-cloud environments. It demonstrates expertise in network security, Zero Trust implementation, hybrid connectivity, and network troubleshooting for experienced network architects.
Practice Questions
598
≈ 6 practice exams
Duration
165 minutes
Passing Score
Pass/Fail
Difficulty
ProfessionalLast Updated
Apr 2026
Use this CNX-001 practice exam to prepare for CompTIA CloudNetX (CNX-001) with realistic questions, detailed explanations, and focused study modes. The practice bank includes 598 questions for CompTIA CNX-001, so you can review the exam steadily instead of relying on one long cram session.
As you practice, pay extra attention to recurring topics such as Network Architecture Design, Hybrid Connectivity (VPNs, SD-WAN, MPLS), Network Security & Zero Trust, Identity & Access Management, and Network Operations & Monitoring. Start with short sessions to identify weak areas, then move into timed quizzes once your accuracy is consistent.
The explanations are especially useful when you want to connect exam wording to the responsibilities and scenarios described in the official certification guidance. Use the free preview first, then unlock the full question bank when you are ready to build a complete study routine.
CompTIA CloudNetX (CNX-001) is a professional-level, vendor-neutral certification launched on February 18, 2025, that validates advanced expertise in designing and implementing secure, scalable network architectures across hybrid and multi-cloud environments. It is CompTIA's most advanced networking credential, positioned above Cloud+ and targeting seasoned professionals who must architect solutions spanning on-premises infrastructure and multiple cloud platforms simultaneously. The certification covers four weighted domains: Network Architecture Design (31%), Network Security (28%), Network Troubleshooting (25%), and Network Operations, Monitoring & Performance (16%), ensuring candidates demonstrate both design-level thinking and hands-on operational competency.
CloudNetX is notable for its emphasis on Zero Trust implementation, Secure Access Service Edge (SASE), software-defined networking, and infrastructure automation—technologies that define modern enterprise hybrid networking. It is also recognized under the DoD Cyber Workforce framework (DoDM 8140.03 and the NICE Framework), making it relevant for government and defense sector professionals. The certification remains valid for three years and requires 75 Continuing Education Units (CEUs) for renewal.
CloudNetX is designed for experienced network professionals who have moved beyond implementation into architecture and design. CompTIA specifically targets individuals serving in roles such as network architect, security architect, enterprise architect, or senior network engineer who are responsible for hybrid cloud connectivity, secure network design, and multi-platform infrastructure strategy.
The certification is best suited for professionals who regularly work across on-premises data centers and cloud environments (AWS, Azure, GCP, or combinations thereof), design Zero Trust and SASE frameworks, lead network automation initiatives, and perform advanced troubleshooting across complex hybrid topologies. It is not intended for early-career IT professionals; the recommended experience baseline assumes a decade of IT work with significant architecture-level responsibility.
CompTIA recommends candidates have at least 10 years of IT experience overall, with a minimum of 5 years specifically in a network architect role working with hybrid cloud environments. There are no mandatory prerequisite certifications, but CompTIA recommends foundational knowledge equivalent to holding Network+, Security+, and Cloud+ certifications before attempting CNX-001.
Practically, candidates should have hands-on familiarity with VPN technologies, SD-WAN, MPLS, BGP/OSPF routing, firewall rule management, Zero Trust Network Access (ZTNA), Identity and Access Management (IAM) solutions including SSO, MFA, and PKI, as well as infrastructure-as-code tooling and network monitoring platforms. Candidates without a strong security background should ensure they are comfortable with microsegmentation, Cloud Access Security Broker (CASB) concepts, and privileged access management before sitting for the exam.
The CNX-001 exam consists of a maximum of 90 questions delivered in a maximum of 165 minutes. Questions are a mix of multiple-choice (single and multiple response) and performance-based questions (PBQs), which simulate real-world hybrid network scenarios requiring hands-on problem-solving rather than recall alone. The exam is available in English and can be taken at a Pearson VUE testing center or via online proctored delivery.
Scoring uses a pass/fail model with no scaled score reported—candidates simply pass or fail. CompTIA has not published a specific numeric passing threshold for CNX-001. The exam version is V1, and the certification is expected to retire approximately three years after the February 2025 launch date, consistent with CompTIA's standard lifecycle policy.
CloudNetX positions certified professionals for senior individual contributor and leadership roles in network and cloud architecture. Target job titles include Network Architect, Security Architect, Enterprise Architect, Cloud Network Engineer, and Network Operations Lead—roles that typically command premium compensation due to the scarcity of professionals with verified multi-cloud, hybrid network design skills. Because the certification is vendor-neutral, it complements rather than competes with vendor-specific credentials (e.g., AWS Advanced Networking, Azure Network Engineer Associate), making it attractive to employers managing heterogeneous environments.
The certification carries formal recognition under the U.S. Department of Defense Cyber Workforce framework (DoDM 8140.03 and NICE Framework), opening doors to defense contractor and federal agency roles that require mapped credential compliance. As enterprise adoption of hybrid and multi-cloud architectures accelerates, the demand for architects who can design secure, Zero Trust-aligned network infrastructure across platforms continues to grow—making CloudNetX a differentiating credential for professionals seeking advancement beyond operational networking into strategic architecture roles.
5 sample questions with answers and explanations. The full bank has 598 questions, enough for 6 full-length practice exams.
Preview — answers shown1. Contoso is deploying a containerized microservices application on Kubernetes. The frontend service must be accessible from the internet, while the order-processing and payment services should only be reachable from within the cluster. The payment service must be reachable from the order-processing service but not directly from the frontend. Which combination of Kubernetes service types achieves this architecture? (Select one!)
Explanation
The LoadBalancer service type for the frontend creates an external load balancer that assigns a publicly accessible IP address, enabling internet access as required. ClusterIP service type for both order-processing and payment creates services with cluster-internal IP addresses only, making them unreachable from outside the cluster. To enforce that the payment service is inaccessible from the frontend but accessible from order-processing, a NetworkPolicy is applied to the payment namespace or pods with an ingress rule that only allows connections from pods matching the order-processing label selector. Without the NetworkPolicy, both order-processing and frontend could reach the payment ClusterIP. NodePort for the frontend exposes the service on each node's IP address at a static port, which is accessible from outside the cluster but is not suitable for production internet-facing services as it requires direct node IP access and does not integrate with cloud load balancers. ExternalName creates a DNS CNAME alias to an external service and is not appropriate for internal service-to-service communication within the cluster. The CloudIP with ingress controller pattern is valid for external access but separating the ingress controller from the LoadBalancer service type adds unnecessary complexity when a direct LoadBalancer service meets the requirement, and omitting the NetworkPolicy fails the isolation requirement between frontend and payment.
2. Tailspin Technologies operates a Kubernetes cluster on AWS with the AWS VPC CNI plugin installed. A DevOps engineer is designing the IP addressing scheme for the cluster. The VPC is configured with the CIDR 10.10.0.0/16, and the cluster will scale to a maximum of 500 pods. The engineer notices that pods are receiving IP addresses directly from the VPC CIDR range rather than from a separate overlay network. Which statement correctly explains the networking behavior of the AWS VPC CNI plugin and its key implication for CIDR planning? (Select one!)
Explanation
The AWS VPC CNI plugin implements a native VPC networking approach where each pod receives an actual IP address from the VPC's subnet CIDR range. This is architecturally distinct from overlay-based CNI plugins like Flannel, which create a virtual overlay network and assign pod IPs from a separate, non-VPC address space. With the AWS VPC CNI, pods are first-class VPC citizens — they can be reached directly by other VPC resources, on-premises systems connected via Direct Connect, and security groups can be applied directly to pods. The critical implication is that VPC IP address capacity must account for both EC2 instance IPs and all pod IPs simultaneously. On a 500-pod cluster, the VPC subnets must be sized to accommodate 500 pod IPs plus EC2 node IPs plus reserved IPs for cloud infrastructure. A /16 VPC with 65,536 addresses has adequate capacity, but engineers who use smaller VPC CIDRs without accounting for pod IP consumption frequently run out of IP addresses as the cluster scales. The AWS VPC CNI does not create a VXLAN overlay — that is the behavior of Flannel and similar plugins. AWS VPC CNI does support secondary CIDR blocks through the ENABLE_PREFIX_DELEGATION feature for extending IP capacity, but in standard mode it assigns IPs from the primary VPC CIDR. Pod addressing from the VPC CIDR is the correct expected behavior for this CNI plugin, not a misconfiguration.
3. Relecloud is deploying a new branch connectivity solution for 45 retail locations. Each branch requires internet access, cloud application access, and connectivity back to the corporate data center. The network team wants to implement application-aware traffic steering that can prioritize point-of-sale traffic over general internet browsing, use any available transport including broadband and LTE as backup, and be centrally managed without per-device CLI configuration. Which technology BEST meets these requirements? (Select one!)
Explanation
SD-WAN directly addresses all stated requirements in a single technology platform. It provides transport independence — SD-WAN can simultaneously use MPLS, broadband internet, LTE, and 5G links, selecting the best path based on real-time performance metrics. Application-aware routing allows traffic steering policies to prioritize point-of-sale transactions over general browsing without requiring application changes. Centralized management via an orchestrator or controller eliminates per-device CLI configuration, enabling policy changes to be pushed to all 45 branches simultaneously. MPLS requires per-device configuration and cannot easily use multiple transport types or commodity internet. Traditional IPsec VPNs use static routing without application awareness. Direct Connect is a dedicated connection technology requiring weeks to provision per location and is impractical and prohibitively expensive for 45 retail branches.
4. Relecloud's public-facing application is experiencing a DDoS attack generating 50 Gbps of UDP traffic with randomized source IPs targeting their DNS servers. Which DDoS mitigation strategy should Relecloud implement first? (Select one!)
Explanation
The attack described is a volumetric DDoS attack at Layer 3/4, characterized by high-volume UDP traffic attempting to saturate bandwidth. Traffic scrubbing or blackholing is the appropriate mitigation for volumetric attacks, redirecting attack traffic to scrubbing centers or null routes to protect infrastructure. Web Application Firewalls operate at Layer 7 and are designed for application-layer attacks like HTTP floods, not volumetric UDP attacks. SYN cookies mitigate protocol-layer attacks like SYN floods by managing TCP connection state, but are ineffective against UDP floods. Application-level rate limiting cannot protect against 50 Gbps volumetric attacks that saturate network links before reaching the application.
5. Woodgrove is deploying a Kubernetes cluster for microservices across AWS. The platform team requires a Container Network Interface plugin that provides the best network performance, supports BGP routing, and enforces Kubernetes NetworkPolicy for microsegmentation. Which CNI plugin meets these requirements? (Select one!)
Explanation
Calico provides Layer 3 BGP-based networking with the best performance by avoiding overlay encapsulation, while supporting full Kubernetes NetworkPolicy enforcement for microsegmentation. Calico's architecture matches all requirements including BGP routing. Flannel provides simple overlay networking but lacks NetworkPolicy support, requiring separate policy enforcement. AWS VPC CNI assigns native VPC IPs to pods, providing good integration but doesn't use BGP routing as its primary mechanism. Cilium uses eBPF for high performance and supports NetworkPolicy but doesn't use BGP routing as its defining characteristic.
CompTIA A+ Core 1 (220-1101)
220-1101 · 700 questions
CompTIA A+ Core 2 (220-1102)
220-1102 · 700 questions
CompTIA Cloud+ (CV0-004)
CV0-004 · 700 questions
CompTIA Cybersecurity Analyst+ (CySA+) (CS0-003)
CS0-003 · 700 questions
CompTIA Data+ (DA0-001)
DA0-001 · 700 questions
CompTIA DataAI (DY0-001)
DY0-001 · 600 questions
$17.99
One-time access to this exam