CompTIA · CNX-001
CompTIA CloudNetX validates advanced skills in designing and implementing secure, scalable hybrid network architectures across multi-cloud environments. It demonstrates expertise in network security, Zero Trust implementation, hybrid connectivity, and network troubleshooting for experienced network architects.
Questions
598
Duration
165 minutes
Passing Score
Pass/Fail
Difficulty
ProfessionalLast Updated
Apr 2026
Use this CNX-001 practice exam to prepare for CompTIA CloudNetX (CNX-001) with realistic questions, detailed explanations, and focused study modes. The practice bank includes 598 questions for CompTIA CNX-001, so you can review the exam steadily instead of relying on one long cram session.
As you practice, pay extra attention to recurring topics such as Network Architecture Design, Hybrid Connectivity (VPNs, SD-WAN, MPLS), Network Security & Zero Trust, Identity & Access Management, and Network Operations & Monitoring. Start with short sessions to identify weak areas, then move into timed quizzes once your accuracy is consistent.
The explanations are especially useful when you want to connect exam wording to the responsibilities and scenarios described in the official certification guidance. Use the free preview first, then unlock the full question bank when you are ready to build a complete study routine.
CompTIA CloudNetX (CNX-001) is a professional-level, vendor-neutral certification launched on February 18, 2025, that validates advanced expertise in designing and implementing secure, scalable network architectures across hybrid and multi-cloud environments. It is CompTIA's most advanced networking credential, positioned above Cloud+ and targeting seasoned professionals who must architect solutions spanning on-premises infrastructure and multiple cloud platforms simultaneously. The certification covers four weighted domains: Network Architecture Design (31%), Network Security (28%), Network Troubleshooting (25%), and Network Operations, Monitoring & Performance (16%), ensuring candidates demonstrate both design-level thinking and hands-on operational competency.
CloudNetX is notable for its emphasis on Zero Trust implementation, Secure Access Service Edge (SASE), software-defined networking, and infrastructure automation—technologies that define modern enterprise hybrid networking. It is also recognized under the DoD Cyber Workforce framework (DoDM 8140.03 and the NICE Framework), making it relevant for government and defense sector professionals. The certification remains valid for three years and requires 75 Continuing Education Units (CEUs) for renewal.
CloudNetX is designed for experienced network professionals who have moved beyond implementation into architecture and design. CompTIA specifically targets individuals serving in roles such as network architect, security architect, enterprise architect, or senior network engineer who are responsible for hybrid cloud connectivity, secure network design, and multi-platform infrastructure strategy.
The certification is best suited for professionals who regularly work across on-premises data centers and cloud environments (AWS, Azure, GCP, or combinations thereof), design Zero Trust and SASE frameworks, lead network automation initiatives, and perform advanced troubleshooting across complex hybrid topologies. It is not intended for early-career IT professionals; the recommended experience baseline assumes a decade of IT work with significant architecture-level responsibility.
CompTIA recommends candidates have at least 10 years of IT experience overall, with a minimum of 5 years specifically in a network architect role working with hybrid cloud environments. There are no mandatory prerequisite certifications, but CompTIA recommends foundational knowledge equivalent to holding Network+, Security+, and Cloud+ certifications before attempting CNX-001.
Practically, candidates should have hands-on familiarity with VPN technologies, SD-WAN, MPLS, BGP/OSPF routing, firewall rule management, Zero Trust Network Access (ZTNA), Identity and Access Management (IAM) solutions including SSO, MFA, and PKI, as well as infrastructure-as-code tooling and network monitoring platforms. Candidates without a strong security background should ensure they are comfortable with microsegmentation, Cloud Access Security Broker (CASB) concepts, and privileged access management before sitting for the exam.
The CNX-001 exam consists of a maximum of 90 questions delivered in a maximum of 165 minutes. Questions are a mix of multiple-choice (single and multiple response) and performance-based questions (PBQs), which simulate real-world hybrid network scenarios requiring hands-on problem-solving rather than recall alone. The exam is available in English and can be taken at a Pearson VUE testing center or via online proctored delivery.
Scoring uses a pass/fail model with no scaled score reported—candidates simply pass or fail. CompTIA has not published a specific numeric passing threshold for CNX-001. The exam version is V1, and the certification is expected to retire approximately three years after the February 2025 launch date, consistent with CompTIA's standard lifecycle policy.
CloudNetX positions certified professionals for senior individual contributor and leadership roles in network and cloud architecture. Target job titles include Network Architect, Security Architect, Enterprise Architect, Cloud Network Engineer, and Network Operations Lead—roles that typically command premium compensation due to the scarcity of professionals with verified multi-cloud, hybrid network design skills. Because the certification is vendor-neutral, it complements rather than competes with vendor-specific credentials (e.g., AWS Advanced Networking, Azure Network Engineer Associate), making it attractive to employers managing heterogeneous environments.
The certification carries formal recognition under the U.S. Department of Defense Cyber Workforce framework (DoDM 8140.03 and NICE Framework), opening doors to defense contractor and federal agency roles that require mapped credential compliance. As enterprise adoption of hybrid and multi-cloud architectures accelerates, the demand for architects who can design secure, Zero Trust-aligned network infrastructure across platforms continues to grow—making CloudNetX a differentiating credential for professionals seeking advancement beyond operational networking into strategic architecture roles.
5 sample questions with answers and explanations. Start a practice session to test yourself across all 598 questions.
Preview — answers shown1. Northwind Traders has deployed a multi-tier web application in a single cloud region using three availability zones. The application tier runs on virtual machines. A network performance audit reveals that application servers in AZ-1 frequently communicate with database servers in AZ-3 for every transaction, generating significant cross-AZ traffic costs. The architecture was originally designed with application servers distributed evenly across all three AZs. Which design change would MOST effectively reduce cross-AZ data transfer costs while maintaining high availability? (Select one!)
Explanation
Cross-AZ data transfer costs are incurred when traffic crosses availability zone boundaries. The root cause is application servers in one AZ communicating with database instances in a different AZ on every transaction. Co-locating application server instances with their corresponding database tier within the same AZ, and configuring the load balancer to route user requests to the AZ-local application stack, eliminates the cross-AZ hop for application-to-database communication. This maintains high availability because each AZ contains a complete stack. Enabling cross-zone load balancing actually increases cross-AZ traffic by deliberately routing requests across zones — it improves distribution but worsens cost for architectures with intra-tier dependencies. Migrating everything to a single AZ eliminates cross-AZ charges but destroys high availability, violating a stated requirement. VPC endpoints are for accessing cloud provider managed services such as object storage or API endpoints — they do not apply to inter-AZ traffic between customer-managed EC2 instances or virtual machines.
2. Relecloud's security architect is implementing Zero Trust Architecture. During a review of the ZTA component model, the architect needs to identify which component is responsible for making the actual access decision by evaluating the requesting identity, device health, and contextual signals against defined policies. Which Zero Trust component performs this function? (Select one!)
Explanation
The Policy Engine (PE) is the decision-making brain of the Zero Trust Architecture. It evaluates access requests by analyzing the requesting subject's identity, device health score (from CMDB/endpoint management), contextual signals (time, location, behavior analytics from SIEM), and compares these against defined access policies to render a permit or deny decision. The Policy Enforcement Point (PEP) is the gatekeeper that sits near protected resources and physically enables, monitors, or terminates connections—it executes the decision but does not make it. The Policy Administrator (PA) acts as the translator between the PE's decision and the PEP's enforcement action; it commands the PEP to allow or deny based on what the PE decided. The Identity Provider (IdP) authenticates users and devices and provides identity assertions to the PE, but the IdP itself does not evaluate the full access policy context—it is one input to the PE's decision.
3. Litware is deploying VXLAN overlay networks for multi-tenant isolation in their on-premises data center with 10GbE infrastructure configured with standard 1500-byte MTU. After deployment, applications experience fragmentation-related packet loss and degraded throughput. The network team investigates the encapsulation overhead. What is the correct VXLAN overhead and the recommended underlay MTU configuration? (Select one!)
Explanation
VXLAN encapsulates original Layer 2 Ethernet frames in UDP/IP packets with the following overhead: 14-byte outer Ethernet header, 20-byte outer IP header, 8-byte UDP header, and 8-byte VXLAN header — totaling 50 bytes. To forward a standard 1500-byte payload without fragmentation, the underlay network must support at least 1550-byte frames (jumbo frames). VXLAN does not use GRE encapsulation; GRE is a separate tunneling protocol with different overhead characteristics. VXLAN does not inherently include IPsec encryption; that would be a separate overlay. The 8-byte figure only accounts for the VXLAN header itself, ignoring the outer Ethernet, IP, and UDP headers that are all required for VXLAN encapsulation.
4. Litware has configured security groups for their EC2 instances. An engineer proposes adding the following rule to an existing security group: Rule: Outbound DENY TCP port 443 to 0.0.0.0/0 The engineer claims this will block the instance from making outbound HTTPS calls. What is the actual effect of this configuration? (Select one!)
Explanation
Security groups only support allow rules — deny rules are not possible and cannot be created. Unlike NACLs which support both allow and deny rules evaluated by rule number, security groups work as allowlists where all traffic is denied by default and rules only specify what is permitted. The proposed deny rule would be rejected by the cloud provider's API. To restrict outbound HTTPS traffic from an instance, the engineer should remove the outbound allow rule for port 443 rather than attempting to add a deny rule. If outbound HTTPS restriction is needed with fine-grained control, NACLs (which support deny rules at the subnet level) should be used instead. Security groups are stateful, meaning return traffic for allowed inbound connections is automatically permitted regardless of outbound rules.
5. A network architect at Fabrikam is evaluating the transition from WPA2-Personal to WPA3-Personal for their corporate wireless network. The security team wants to understand the specific cryptographic improvement WPA3-Personal provides over WPA2-Personal, particularly regarding protection against password-guessing attacks against captured handshake traffic. Which capability correctly distinguishes WPA3-Personal from WPA2-Personal? (Select one!)
Explanation
The primary security improvement WPA3-Personal provides over WPA2-Personal is the replacement of the PSK-based 4-way handshake with SAE (Simultaneous Authentication of Equals), also known as Dragonfly. WPA2-Personal's 4-way handshake can be captured passively and subjected to offline dictionary attacks — an attacker records the handshake, then systematically tests millions of password guesses against the captured data without further network interaction. SAE prevents this by providing forward secrecy and mutual authentication that cannot be broken through offline analysis of captured exchanges. Even if an attacker captures the SAE handshake, they cannot use it to derive the session keys or test password guesses offline. Both WPA2-Personal and WPA3-Personal use AES-CCMP encryption. AES-GCMP-256 is specific to WPA3-Enterprise's 192-bit security suite. 802.1X with RADIUS is the hallmark of WPA2/WPA3-Enterprise, not Personal mode. PMF is enhanced in WPA3 but is not the primary cryptographic distinction.
$7.99
One-time access to this exam