CompTIA · CNX-001
CompTIA CloudNetX validates advanced skills in designing and implementing secure, scalable hybrid network architectures across multi-cloud environments. It demonstrates expertise in network security, Zero Trust implementation, hybrid connectivity, and network troubleshooting for experienced network architects.
Practice Questions
598
≈ 6 practice exams
Duration
165 minutes
Passing Score
Pass/Fail
Difficulty
ProfessionalLast Updated
Oct 2026
CloudNetX is an advanced vendor-neutral certification for designing and operating secure hybrid and multicloud networks. CNX-001 weights Network Architecture at 31%, Network Operations at 28%, Network Security at 16%, and Network Troubleshooting at 25%, with scenarios spanning cloud connectivity, routing, segmentation, resilience, observability, automation, and incident isolation.
The exam has no more than 90 multiple-choice and performance-based questions and allows up to 165 minutes. CompTIA reports only pass or fail and publishes no numeric threshold. It recommends 10 years of IT experience, including five years as a network architect in hybrid-cloud environments, plus knowledge comparable to Network+, Security+, and Cloud+.
Use these 617 questions at architecture depth: compare connectivity and routing patterns, reason about failure domains and traffic paths, place security controls, interpret telemetry, and choose the least disruptive troubleshooting step. CloudNetX is not simply a harder Cloud+ or Network+ exam; it joins both disciplines around enterprise-scale network design and operations.
CompTIA CloudNetX (CNX-001) validates advanced design and operation of secure networks across on-premises, cloud, hybrid, and multicloud environments. It targets experienced network architects who must connect platform choices, traffic paths, resilience, security, automation, observability, and troubleshooting.
The official weights are Network Architecture 31%, Network Operations 28%, Network Security 16%, and Network Troubleshooting 25%. These weights differ from early third-party summaries that swapped operations and security.
CloudNetX is designed for experienced network architects and senior network professionals responsible for secure connectivity across on-premises, hybrid, and multicloud environments. The role involves architecture, operations, security, automation, observability, and advanced troubleshooting.
CompTIA recommends 10 years of IT experience, including five years working as a network architect in hybrid-cloud environments, plus knowledge equivalent to Network+, Security+, and Cloud+.
CompTIA recommends candidates have at least 10 years of overall IT experience, with a minimum of 5 years specifically in a network architect role working with hybrid cloud environments. There are no mandatory prerequisite certifications, but CompTIA recommends foundational knowledge equivalent to holding Network+, Security+, and Cloud+ before attempting CNX-001.
Practically, candidates should have hands-on familiarity with VPN technologies, SD-WAN, MPLS, BGP/OSPF routing, firewall rule management, Zero Trust Network Access (ZTNA), Identity and Access Management (IAM) solutions including SSO, MFA, and PKI, and infrastructure-as-code tooling and network monitoring platforms. Candidates without a strong security background should be comfortable with microsegmentation and Cloud Access Security Broker (CASB) concepts before sitting for the exam.
CNX-001 contains a maximum of 90 multiple-choice and performance-based questions and allows up to 165 minutes. It is available in English through Pearson VUE testing centers or OnVUE online proctoring.
CompTIA reports only pass or fail and does not publish a numeric passing threshold. The current version is V1 and launched February 18, 2025.
CloudNetX provides a vendor-neutral signal for senior hybrid and multicloud networking work. It is relevant to network architect, cloud network engineer, infrastructure architect, security architect, and advanced network-operations roles.
It complements vendor certifications by testing cross-platform design and operations. Its value is the ability to reason across providers and on-premises systems rather than memorising one cloud's configuration interface.
5 sample questions with answers and explanations. The full bank has 598 questions, enough for 6 full-length practice exams.
Preview — answers shown1. Tailspin is designing a multi-region active-active architecture for a critical application. Each region has a component with 99.9% availability. The system functions if either region is operational. What is the overall system availability? (Select one!)
Explanation
This is a parallel availability calculation because the system remains operational if either region works. The formula is: 1 - (1 - 0.999) × (1 - 0.999) = 1 - (0.001 × 0.001) = 1 - 0.000001 = 0.999999 or 99.9999%. Parallel components dramatically improve availability compared to series components, where you multiply the availability values directly.
2. Adatum is deploying a Kubernetes cluster on-premises and requires NetworkPolicy enforcement to restrict pod-to-pod communication, high performance without overlay network overhead, and BGP integration with existing data center routing. Which CNI plugin meets these requirements? (Select one!)
Explanation
Calico in BGP mode provides Layer 3 routing without overlay encapsulation overhead, supports NetworkPolicy enforcement for pod security, and integrates directly with BGP for data center routing. Flannel does not support NetworkPolicy enforcement. Kubenet is the default but ignores NetworkPolicy objects. AWS VPC CNI is specific to AWS EKS and not suitable for on-premises deployments.
3. Adatum requires Layer 2 encryption for their 10 Gbps AWS Direct Connect connection to protect data in transit between their data center and AWS at the link layer. Which encryption technology should be implemented? (Select one!)
Explanation
MACsec (802.1AE) provides Layer 2 point-to-point encryption specifically designed for high-speed links like Direct Connect. It operates at the data link layer to encrypt traffic hop-by-hop between network devices. IPsec operates at Layer 3, TLS at Layer 7, and both add overhead. MACsec is the standard for encrypting dedicated connections like Direct Connect at the link layer with minimal performance impact.
4. Alpine Ski House has 5 VPCs that need full mesh connectivity for inter-VPC communication. As they plan to scale to 50 VPCs over the next year, they want to minimize operational complexity and support transitive routing. Which solution should they choose? (Select one!)
Explanation
Transit Gateway provides transitive routing with a hub-and-spoke model, eliminating the need for mesh connectivity. With 50 VPCs, VPC Peering would require 1,225 individual peering connections (N×(N-1)/2) which is operationally complex and non-transitive. Transit Gateway scales to thousands of VPCs with simple attachments and centralized route management, though it incurs per-attachment and per-GB data processing fees. VPN connections would be operationally complex and introduce encryption overhead for traffic that remains within the cloud provider's network. Internet Gateway routing would expose traffic to the public internet and require public IP addressing, introducing security risks.
5. Tailspin Toys needs to choose a VPN solution for site-to-site connectivity. They require fast reconnection for mobile sites, simpler configuration with fewer lines of code, and modern cryptographic primitives without negotiation overhead. Which VPN technology should they select? (Select one!)
Explanation
WireGuard has approximately 4,000 lines of code compared to hundreds of thousands in IPsec implementations, uses fixed modern cryptographic primitives (Curve25519 for key exchange, ChaCha20 for encryption, Poly1305 for authentication) without negotiation overhead, and provides significantly faster reconnection for roaming devices. WireGuard operates on UDP port 51820 and is designed for simplicity. IPsec with IKEv2 requires cipher negotiation in Phase 1 (IKE) and Phase 2 (IPsec SA), uses UDP ports 500/4500 and IP Protocol 50 (ESP), and has more complex configuration. SSL/TLS VPN and L2TP/IPsec add additional complexity and do not offer the same simplicity benefits.
CNX-001 has a maximum of 90 multiple-choice and performance-based questions and allows up to 165 minutes.
CompTIA reports only pass or fail and does not publish a numeric passing threshold.
Network Architecture is 31%, Network Operations 28%, Network Security 16%, and Network Troubleshooting 25%.
There are no enforced prerequisites. CompTIA recommends 10 years in IT, including five years in network architecture for hybrid-cloud environments.
CloudNetX focuses on advanced hybrid and multicloud network architecture and operations; Cloud+ has broader cloud-infrastructure administration coverage.
CloudNetX is valid for three years and can be renewed through CompTIA's Continuing Education program.
CompTIA Cloud+ (CV0-004)
CV0-004 · 700 questions
CompTIA Network+ (N10-009)
N10-009 · 699 questions
CompTIA SecurityX (CAS-005)
CAS-005 · 599 questions
CompTIA A+ Core 2 (220-1102)
220-1102 · 700 questions
CompTIA AutoOps+ (AT0-001)
AT0-001 · 447 questions
CompTIA Cybersecurity Analyst+ (CySA+) (CS0-003)
CS0-003 · 700 questions
$29.99
One-time access to this exam