Free Practice Questions for CompTIA CNX-001 Exam

Comprehensive and Detailed Explanation From Exact Extract:

This scenario describes a classic example of social engineering. An attacker impersonated the help desk and convinced the user to change their password, likely to one the attacker controlled. Social engineering attacks manipulate human behavior to bypass technical security measures.

Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide — under “Social Engineering Threats”:

“Social engineering involves manipulating individuals to perform actions or divulge confidential information, such as passwords, often by impersonating trusted entities like IT support.”

Other options:

A. Initialization vector relates to encryption vulnerabilities.

B. On-path (formerly man-in-the-middle) requires network interception, which is not described here.

C. Evil twin is a rogue Wi-Fi AP attack, not applicable to this VPN login context.

Comprehensive and Detailed Explanation From Exact Extract:

According to the standard CompTIA troubleshooting methodology, once the issue has been identified and a solution has been implemented (e.g., failing over traffic to the backup link), the next logical step is to verify full system functionality. This ensures that the backup path is working as intended and that services have resumed properly for the users.

Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide — under “Troubleshooting Process”:

“After implementing the solution, it is critical to verify full system functionality to ensure the resolution has addressed the problem without causing unintended consequences.”

Other options:

A. Documenting lessons learned is the final step.

B. The plan of action should have been created before the failover.

C. Identifying the problem already occurred earlier in the scenario.

================================================

Comprehensive and Detailed Explanation From Exact Extract:

To verify that the certificate and the private key match, one can extract the modulus from both files and compare their hash values. The correct syntax involves using openssl x509 to extract the modulus from the certificate, and openssl rsa to extract the modulus from the private key, followed by an MD5 hash to ensure they match.

Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide — under “TLS/SSL Certificate Validation and Troubleshooting”:

“To verify that the private key and certificate match, compare the modulus values. A mismatch results in failed TLS handshakes.”

Other options:

A & C: Incorrect syntax (openssl-list and openssl-rsa are not valid commands).

B: The commands shown are used to verify CSRs, not matching keys.

================================================

Comprehensive and Detailed Explanation From Exact Extract:

Runbooks and knowledge base articles provide step-by-step instructions for resolving common issues, helping new employees quickly become productive with minimal supervision. These documents can be updated as new issues arise and serve as a foundational training and operational resource.

Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide — under “Operational Documentation and Knowledge Transfer”:

“Runbooks contain standardized procedures for handling recurring operational tasks. Knowledge base articles enable consistent troubleshooting and resolution with minimal oversight.”

Other options:

A. A Statement of Work (SOW) is used for defining project deliverables, not training.

C. Network diagrams are useful for understanding architecture, but not for operational procedures.

D. A mentor program can help, but it doesn’t scale or provide immediate troubleshooting steps.

================================================

Comprehensive and Detailed Explanation From Exact Extract:

Network flow logging (e.g., AWS VPC Flow Logs, Azure NSG Flow Logs, or GCP VPC Flow Logs) is a cloud-native feature that records metadata about network conversations, including source and destination IPs, ports, and traffic volume. It does not capture payloads but provides detailed flow-level insight without requiring agents or intrusive configuration changes, making it the most efficient and least effort solution.

Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide — under “Cloud-native Network Monitoring”:

“Network flow logging provides metadata about traffic within cloud VPCs and is used for visibility, troubleshooting, and security auditing without packet inspection.”

Other options:

B. SNMP traps monitor device health, not traffic flows.

C. QoS tagging controls traffic priority but doesn’t log flows.

D. Monitoring agents collect system-level metrics and logs, but require installation and configuration.

================================================

Comprehensive and Detailed Explanation From Exact Extract:

Geofencing is a network access control method that enforces restrictions based on location data. In this scenario, the organization requires access to be permitted only when users are on premises (i.e., within a specific physical location). Geofencing can be implemented using source IP ranges or GPS-based location data to define boundaries (fences). This allows access to certain applications or services only when the user is inside a designated network or area.

MFA (Option A) provides identity assurance but does not enforce physical location-based restrictions.

UEBA (Option C) provides behavioral analytics but is not used for real-time access control.

PKI (Option D) provides identity validation through certificates but is not location-aware.

Relevant Extract from CompTIA CloudNetX CNX-001 Official Study Guide:

“Geofencing allows organizations to define physical or logical boundaries that restrict or allow access based on user location. Policies can be configured to allow access only when users are on a trusted campus or corporate network, denying requests originating from outside the geofenced area.”

Covered under the topic: “Access Control Technologies and Identity Enforcement Mechanisms.”

Comprehensive and Detailed Explanation From Exact Extract:

Replacing reserved IPs with dynamic ones can lead to IP reuse issues. Dynamic public IPs can be reallocated to other customers once released. If DNS entries or firewall rules still refer to the original IP, this can lead to data leakage or incorrect routing. Also, some services (e.g., NSGs, load balancers) may require persistent IPs.

Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide — under “Public IP Management in Cloud Environments”:

“Dynamic public IPs are subject to reuse after release. Services that rely on IP persistence, such as security groups or load balancers, may encounter unexpected behavior or security risks if replaced with dynamically assigned IPs.”

Other options:

A. Asymmetric routing involves traffic leaving and returning via different paths.

B. IP spoofing is a malicious attack, not related to address reassignment.

C. IP exhaustion relates to resource limits, not dynamic reuse.

Comprehensive and Detailed Explanation From Exact Extract:

PortFast is a feature in Spanning Tree Protocol (STP) that allows switch ports connected to end devices (like user workstations) to bypass the usual STP states (Listening and Learning) and transition immediately to the Forwarding state. This significantly reduces convergence time and speeds up the network availability when new switches or ports are introduced.

Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide — under “STP Optimization Techniques”:

“PortFast reduces STP convergence time by immediately placing access ports into the forwarding state, useful in environments where rapid network availability is required.”

Other options:

A. BPDU Guard is used to disable ports that receive Bridge Protocol Data Units, enhancing security but not STP speed.

B. Priority modifies bridge priority but doesn’t reduce convergence time.

C. Tagging relates to VLAN identification, not STP behavior.

================================================

Firewalls → VPN tunnel down

The IPsec tunnel between on-prem Firewall 1 and cloud Firewall 2 (ipip0/ipip2) is down, so no traffic can traverse to the cloud.

Application NSG → Misconfigured rule

There’s a “block” rule for 10.3.9.0/24 → 192.2.1.0/24, preventing legitimate on-prem clients from reaching Application A.

Comprehensive and Detailed Explanation From Exact Extract:

A Content Delivery Network (CDN) distributes content across geographically distributed edge locations to provide faster access and higher quality to users, especially in areas with suboptimal connectivity to central data centers. By caching and serving content from edge servers near users, CDNs reduce latency and improve streaming performance globally.

Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide — under “CDN and Cloud Edge Services”:

“CDNs provide globally distributed edge nodes for content caching and delivery, ensuring low-latency, high-bandwidth access for end users regardless of their location.”

Other options:

A. Reduces quality, contrary to the stated goal.

B. DNS-based routing helps with direction but does not solve content delivery or bandwidth issues.

C. Load balancers help distribute traffic locally, but do not provide edge caching or bandwidth optimization.