CompTIA · CNX-001
CompTIA CloudNetX validates advanced skills in designing and implementing secure, scalable hybrid network architectures across multi-cloud environments. It demonstrates expertise in network security, Zero Trust implementation, hybrid connectivity, and network troubleshooting for experienced network architects.
Practice Questions
598
≈ 6 practice exams
Duration
165 minutes
Passing Score
Pass/Fail
Difficulty
ProfessionalLast Updated
Apr 2026
Use this CNX-001 practice exam to prepare for CompTIA CloudNetX (CNX-001) with realistic questions, detailed explanations, and focused study modes. The practice bank includes 598 questions for CompTIA CNX-001, so you can review the exam steadily instead of relying on one long cram session.
As you practice, pay extra attention to recurring topics such as Network Architecture Design, Hybrid Connectivity (VPNs, SD-WAN, MPLS), Network Security & Zero Trust, Identity & Access Management, and Network Operations & Monitoring. Start with short sessions to identify weak areas, then move into timed quizzes once your accuracy is consistent.
The explanations are especially useful when you want to connect exam wording to the responsibilities and scenarios described in the official certification guidance. Use the free preview first, then unlock the full question bank when you are ready to build a complete study routine.
CompTIA CloudNetX (CNX-001) is a professional-level, vendor-neutral certification launched on February 18, 2025, that validates advanced expertise in designing and implementing secure, scalable network architectures across hybrid and multi-cloud environments. It is CompTIA's most advanced networking credential, positioned above Cloud+ and targeting seasoned professionals who must architect solutions spanning on-premises infrastructure and multiple cloud platforms simultaneously. The certification covers four weighted domains: Network Architecture Design (31%), Network Security (28%), Network Troubleshooting (25%), and Network Operations, Monitoring & Performance (16%), ensuring candidates demonstrate both design-level thinking and hands-on operational competency.
CloudNetX is notable for its emphasis on Zero Trust implementation, Secure Access Service Edge (SASE), software-defined networking, and infrastructure automation—technologies that define modern enterprise hybrid networking. It is also recognized under the DoD Cyber Workforce framework (DoDM 8140.03 and the NICE Framework), making it relevant for government and defense sector professionals. The certification remains valid for three years and requires 75 Continuing Education Units (CEUs) for renewal.
CloudNetX is designed for experienced network professionals who have moved beyond implementation into architecture and design. CompTIA specifically targets individuals serving in roles such as network architect, security architect, enterprise architect, or senior network engineer who are responsible for hybrid cloud connectivity, secure network design, and multi-platform infrastructure strategy.
The certification is best suited for professionals who regularly work across on-premises data centers and cloud environments (AWS, Azure, GCP, or combinations thereof), design Zero Trust and SASE frameworks, lead network automation initiatives, and perform advanced troubleshooting across complex hybrid topologies. It is not intended for early-career IT professionals; the recommended experience baseline assumes a decade of IT work with significant architecture-level responsibility.
CompTIA recommends candidates have at least 10 years of IT experience overall, with a minimum of 5 years specifically in a network architect role working with hybrid cloud environments. There are no mandatory prerequisite certifications, but CompTIA recommends foundational knowledge equivalent to holding Network+, Security+, and Cloud+ certifications before attempting CNX-001.
Practically, candidates should have hands-on familiarity with VPN technologies, SD-WAN, MPLS, BGP/OSPF routing, firewall rule management, Zero Trust Network Access (ZTNA), Identity and Access Management (IAM) solutions including SSO, MFA, and PKI, as well as infrastructure-as-code tooling and network monitoring platforms. Candidates without a strong security background should ensure they are comfortable with microsegmentation, Cloud Access Security Broker (CASB) concepts, and privileged access management before sitting for the exam.
The CNX-001 exam consists of a maximum of 90 questions delivered in a maximum of 165 minutes. Questions are a mix of multiple-choice (single and multiple response) and performance-based questions (PBQs), which simulate real-world hybrid network scenarios requiring hands-on problem-solving rather than recall alone. The exam is available in English and can be taken at a Pearson VUE testing center or via online proctored delivery.
Scoring uses a pass/fail model with no scaled score reported—candidates simply pass or fail. CompTIA has not published a specific numeric passing threshold for CNX-001. The exam version is V1, and the certification is expected to retire approximately three years after the February 2025 launch date, consistent with CompTIA's standard lifecycle policy.
CloudNetX positions certified professionals for senior individual contributor and leadership roles in network and cloud architecture. Target job titles include Network Architect, Security Architect, Enterprise Architect, Cloud Network Engineer, and Network Operations Lead—roles that typically command premium compensation due to the scarcity of professionals with verified multi-cloud, hybrid network design skills. Because the certification is vendor-neutral, it complements rather than competes with vendor-specific credentials (e.g., AWS Advanced Networking, Azure Network Engineer Associate), making it attractive to employers managing heterogeneous environments.
The certification carries formal recognition under the U.S. Department of Defense Cyber Workforce framework (DoDM 8140.03 and NICE Framework), opening doors to defense contractor and federal agency roles that require mapped credential compliance. As enterprise adoption of hybrid and multi-cloud architectures accelerates, the demand for architects who can design secure, Zero Trust-aligned network infrastructure across platforms continues to grow—making CloudNetX a differentiating credential for professionals seeking advancement beyond operational networking into strategic architecture roles.
5 sample questions with answers and explanations. The full bank has 598 questions, enough for 6 full-length practice exams.
Preview — answers shown1. Litware is investigating a DNS resolution issue in their hybrid cloud environment. Internal users can resolve on-premises DNS names, and cloud instances can resolve cloud-hosted DNS names, but cloud instances cannot resolve on-premises DNS names. The environment uses split-horizon DNS with separate internal and external views. The VPC is configured with a custom DNS resolver forwarding to on-premises DNS servers at 10.50.10.10. What is the most likely misconfiguration? (Select one!)
Explanation
Split-horizon DNS uses different views for internal and external queries, typically based on source IP address ACLs. The on-premises DNS server's internal view likely restricts responses to on-premises IP ranges and does not include the cloud VPC CIDR ranges. When cloud instances query the on-premises DNS server, their source IPs fall into the external view which does not contain internal DNS records. The solution is to add the cloud VPC CIDR ranges to the internal view ACL on the on-premises DNS server. VPC Flow Logs do not capture DNS query content or responses. BGP advertising routes does not affect DNS resolution as long as network connectivity to the DNS server exists. If security groups blocked UDP 53 outbound, no DNS queries would work at all, not just on-premises names.
2. Tailspin's security operations team is mapping observed attacker behavior to the MITRE ATT&CK framework. They detected an incident where an attacker sent phishing emails with malicious attachments (T1566.001), then used those attachments to execute PowerShell scripts (T1059.001). The team needs to categorize these observations correctly. What is the relationship between tactics and techniques in this scenario? (Select one!)
Explanation
In the MITRE ATT&CK framework, tactics represent the adversary's tactical objectives — the 'why' of an action (such as Initial Access, Execution, Persistence, Privilege Escalation). Techniques represent the 'how' — specific methods to achieve those tactical objectives. T1566 Phishing is a technique under the Initial Access tactic, with T1566.001 being the sub-technique for spearphishing attachments. T1059 Command and Scripting Interpreter is a technique under the Execution tactic, with T1059.001 being the PowerShell sub-technique. The scenario shows two different tactics being achieved through specific techniques. Tactics are not numbered with T-codes; only techniques and sub-techniques use this numbering.
3. Fabrikam is implementing a hybrid DNS architecture for their multi-cloud environment spanning Azure and on-premises Active Directory. Corporate applications must resolve on-premises DNS names in the corp.fabrikam.com domain, while cloud services must resolve Azure private DNS zones for private endpoints. On-premises servers also need to resolve Azure private DNS names. How should the DNS architect configure this environment? (Select one!)
Explanation
Azure Private DNS Resolver provides the correct hybrid DNS architecture. Inbound endpoints receive DNS queries originating from on-premises networks (via ExpressRoute or VPN) and resolve them against Azure Private DNS zones, enabling on-premises systems to reach Azure private endpoints. Outbound endpoints forward queries for on-premises zones (such as corp.fabrikam.com) from Azure resources to on-premises DNS servers. Conditional forwarders on on-premises DNS route Azure private DNS queries to the Azure resolver inbound endpoint. Simply using Azure-provided DNS without integration leaves on-premises systems unable to resolve Azure private names. Zone transfer-based split-horizon creates synchronization complexity and does not address conditional forwarding between environments. Azure Traffic Manager provides application-layer routing based on health and geography—it is not a DNS infrastructure solution for private name resolution between environments.
4. Relecloud's network operations team is evaluating monitoring strategies for their hybrid cloud environment that includes on-premises Cisco switches, cloud VMs, and containerized applications. They need a monitoring approach that works for both legacy on-premises devices that cannot be upgraded and modern cloud-native auto-scaling workloads. Which combination of monitoring approaches BEST covers all components? (Select two!)
Multiple correct answersExplanation
Heterogeneous hybrid environments require complementary monitoring strategies for fundamentally different infrastructure types. SNMP polling is the established protocol for on-premises network devices — Cisco switches, routers, and firewalls have supported SNMP agents for decades, exposing interface statistics, error counters, CPU utilization, and other MIB-defined metrics. SNMP operates over UDP 161 for queries and UDP 162 for traps, and is the correct tool for infrastructure that cannot be upgraded to cloud-native agents. Cloud-native monitoring services like CloudWatch and Azure Monitor are the correct tools for cloud workloads because they auto-discover resources as auto-scaling groups add and remove instances, integrate natively with container orchestration platforms for pod-level metrics, require no network reachability configuration, and provide API-based metric collection that scales elastically. Together, SNMP covers the legacy on-premises layer while cloud-native monitoring covers the dynamic cloud layer. Replacing all on-premises devices to eliminate SNMP is impractical — network device refresh cycles are typically 5-7 years and the scenario implies existing infrastructure that cannot be upgraded. Physical monitoring servers performing ICMP ping sweeps only test reachability and provide none of the detailed interface-level metrics available through SNMP. Extending SNMP with custom MIBs to describe cloud virtual resources is technically possible but requires significant custom development and ignores the auto-discovery and auto-scaling capabilities of native cloud monitoring.
5. Relecloud is deploying a new branch connectivity solution for 45 retail locations. Each branch requires internet access, cloud application access, and connectivity back to the corporate data center. The network team wants to implement application-aware traffic steering that can prioritize point-of-sale traffic over general internet browsing, use any available transport including broadband and LTE as backup, and be centrally managed without per-device CLI configuration. Which technology BEST meets these requirements? (Select one!)
Explanation
SD-WAN directly addresses all stated requirements in a single technology platform. It provides transport independence — SD-WAN can simultaneously use MPLS, broadband internet, LTE, and 5G links, selecting the best path based on real-time performance metrics. Application-aware routing allows traffic steering policies to prioritize point-of-sale transactions over general browsing without requiring application changes. Centralized management via an orchestrator or controller eliminates per-device CLI configuration, enabling policy changes to be pushed to all 45 branches simultaneously. MPLS requires per-device configuration and cannot easily use multiple transport types or commodity internet. Traditional IPsec VPNs use static routing without application awareness. Direct Connect is a dedicated connection technology requiring weeks to provision per location and is impractical and prohibitively expensive for 45 retail branches.
CompTIA A+ Core 1 (220-1101)
220-1101 · 700 questions
CompTIA A+ Core 2 (220-1102)
220-1102 · 700 questions
CompTIA Cloud+ (CV0-004)
CV0-004 · 700 questions
CompTIA Cybersecurity Analyst+ (CySA+) (CS0-003)
CS0-003 · 700 questions
CompTIA Data+ (DA0-001)
DA0-001 · 700 questions
CompTIA DataSys+ (DS0-001)
DS0-001 · 700 questions
$17.99
One-time access to this exam