CompTIA CloudNetX CNX-001 (V1) Exam Practice Test 1

Conditional access evaluates contextual signals such as device recognition, location, and behavior, and risk-based authentication uses that context to decide when additional verification, like MFA, is actually warranted. This balances security with user convenience by not challenging every login equally. RBAC controls what an authenticated user can do, not whether additional verification is required at login.

A certificate whose common name or subject alternative name does not match the requested URL is a textbook certificate mismatch issue, which browsers flag to protect users from potentially connecting to the wrong or a malicious server. If the certificate is additionally issued by an authority the client does not trust, that compounds into a separate trust issue on top of the mismatch. Neither DHCP exhaustion nor broadcast storms have anything to do with how a browser validates a presented certificate.

When one segment is configured for jumbo frames but a device in the path still uses the standard MTU, large packets that exceed that device's MTU may be dropped or require fragmentation, which is especially disruptive if fragmentation is disabled or blocked. Small packets remain unaffected because they fall well under both MTU sizes. Ensuring MTU is configured consistently across every device in the path is required whenever jumbo frames are enabled.

A NAT device maintains a finite table of active address and port translations, and when that table fills up during peak usage, new outbound connections can fail to establish even though already-established sessions continue working. This is a common scaling issue for NAT devices serving many hosts through a limited pool of public addresses and ports. Increasing the available port range, adding more public IPs, or scaling out NAT capacity are typical remediations.

Rising latency across several consecutive hops points toward congestion or a slower link somewhere in that segment of the path, which is useful for narrowing down where a performance problem originates. A timeout specifically at the final hop is a very common and often benign finding, since some devices are configured to silently drop or not respond to the ICMP or UDP probes traceroute uses, even while still forwarding or serving other traffic normally. Neither of these findings says anything about DNS resolution, which traceroute does not test.

Netcat is a lightweight utility well suited to quickly testing whether a specific port is open and accepting connections, without the overhead of a full packet capture and analysis tool. Wireshark is more appropriate when detailed packet-level inspection of the traffic itself is needed. Iperf measures throughput between two points rather than testing individual port reachability.

The troubleshooting methodology calls for testing a theory of probable cause before acting on it, since untested assumptions can lead to wasted effort or unintended side effects. If the test confirms the theory, the engineer proceeds to plan and implement a fix; if not, a new theory is established or the issue is escalated. Jumping straight to a fix skips validating that the theory actually explains the reported symptoms.

An Operational-level Agreement defines commitments between internal teams supporting a service, distinct from a Service-level Agreement, which is typically a commitment made to an external customer. Both types of agreements support the overall service being delivered, but only the SLA typically carries customer-facing contractual weight, such as service credits. Understanding the distinction helps teams correctly escalate and track internal versus customer-facing commitments.

Desired state configuration defines the intended configuration as code, and the tooling continuously or periodically compares the live device configuration against that baseline, flagging any drift caused by manual changes or unintended modifications. This is central to infrastructure as code practices applied to network devices, not just servers. Mutable infrastructure, by contrast, allows configurations to be changed in place without necessarily comparing against a declared baseline.

Jitter measures the variation in delay between packets arriving, which is especially disruptive for real-time voice and video traffic that expects a steady, predictable stream. Throughput measures the actual data transfer rate achieved, which is relevant to whether enough bandwidth is available for a smooth call. SSID naming, PoE wattage, and VLAN tagging are unrelated to diagnosing jitter or throughput-related call quality problems.

Recovery Point Objective defines the maximum acceptable amount of data loss, measured as a point in time, so a 15-minute RPO means backups or replication must occur at least that frequently. Recovery Time Objective defines the maximum acceptable downtime before systems must be restored, so a 4-hour RTO drives how quickly failover or recovery procedures must complete. Confusing the two can lead to a disaster recovery plan that protects data adequately but restores service too slowly, or vice versa.

Default credential management requires changing every appliance's factory-set username and password before it is placed into production, since default credentials are widely known and are one of the first things attackers try against exposed devices. This is one of the most basic and impactful appliance-hardening steps, alongside disabling unneeded services and restricting administrative interface access. Automated configuration reviews can help catch appliances that were deployed without this step being completed.

WPA3 improves on WPA2 with stronger encryption and protection against offline dictionary attacks. A preshared key is a straightforward shared-secret authentication method common in home and small-office networks. Captive portals are commonly used for guest Wi-Fi to display terms of use or collect credentials before granting broader access, while MAC filtering restricts access by physical address, though it is easily bypassed by address spoofing and should not be relied on as a primary control.

VLSM allows each subnet to be sized to its actual host requirement rather than forcing every subnet to the same fixed size, which minimizes wasted address space. A /26 supports 62 usable hosts for the 60-host segment, while smaller /28s handle the 14-host segments efficiently. A single flat /24 would not provide the isolation the design calls for, and NAT64 solves IPv4-to-IPv6 translation, not subnet sizing.

Microsegmentation applies granular security policy between individual workloads, even within the same subnet, so that lateral movement requires explicit permission rather than being allowed by default because two hosts happen to share a network segment. This directly limits how far an attacker can spread from a single compromised host. SSO and geofencing address authentication and location-based access, not lateral movement between workloads.

A network security group enforces its own inbound and outbound rules independently of the guest operating system's firewall, so traffic can be blocked at the NSG level even when the OS itself would allow it. Checking the NSG's inbound rules for a permitted rule from the administrator's source IP on the SSH port is the direct next step. DNS and time zone settings have no bearing on whether a specific inbound port is reachable.

A WAF is purpose-built to detect and block application-layer attacks like SQL injection and cross-site scripting that target web applications specifically. An NGFW provides broader network traffic inspection, combining traditional firewalling with application awareness and intrusion prevention across general traffic. DNSSEC protects DNS record integrity and has no bearing on SQL injection, which occurs at the application layer.

BGP hijacking occurs when an unauthorized or misconfigured autonomous system announces routes for IP prefixes it does not own, causing internet traffic to be misdirected toward it. This can lead to traffic interception, denial of service, or route instability for the legitimate owner. Mitigations include route origin validation and filtering based on registered prefix ownership.

Spanning Tree Protocol detects redundant Layer 2 paths between switches and logically blocks enough of them to eliminate loops, while keeping a path available to activate automatically if the active link fails. Without STP, redundant links at Layer 2 would create a loop that broadcasts and multicasts traffic indefinitely, quickly overwhelming the network. STP is a foundational requirement whenever physical link redundancy is built into a switched campus design.

A UPS provides nearly instantaneous battery-backed power the moment utility power fails, bridging the short gap until generators start and reach full capacity. Without a UPS, equipment would lose power during that transition window even with generators present. An EPO switch is a safety mechanism for manually cutting power in an emergency, not a power continuity solution.

The least connections method actively tracks how many open connections each backend server currently has and routes new connections to the one with the fewest, which helps evenly distribute load when session durations vary widely. Round robin instead cycles through servers in a fixed order regardless of their current load. Weighted load balancing biases distribution toward servers assigned a higher capacity weight, not toward real-time connection counts.

Dedicated cloud interconnect offerings, such as AWS Direct Connect or Azure ExpressRoute, provide a private, dedicated circuit into the cloud provider's network that bypasses the public internet, offering more consistent latency and bandwidth. A site-to-site VPN still traverses the public internet, even though the payload is encrypted. Point-to-site VPNs and split tunneling are designed for individual remote users, not data center to cloud connectivity.

Spine-and-leaf is the standard data center fabric because every leaf uplinks to every spine, giving consistent latency between any two leaf-connected devices, which suits heavy east-west traffic. Hub-and-spoke centralizes connectivity through a hub, which is cost-effective but makes the hub a potential bottleneck or single point of failure. Full mesh maximizes redundancy at the cost of significant cabling and configuration complexity, which is why it is reserved for small, critical cores.

802.1X provides the port-based control that decides whether a device may pass traffic on a switch port until it authenticates. RADIUS commonly serves as the backend that 802.1X consults to authenticate the device or user and to log accounting data. LDAP is a directory access protocol that RADIUS or another system might query, but it does not itself perform port-based access control.

BGP is the protocol used to exchange routing information between autonomous systems, making it the standard choice for peering with multiple external providers such as cloud networks and ISPs. OSPF is a link-state protocol designed for routing within a single autonomous system, not between separate ones. STP prevents loops at Layer 2 and has no role in inter-AS routing.