Pass Guaranteed Quiz 2026 Realistic Verified Free CNX-001 Exam Dumps
Free CloudNetX CNX-001 Ultimate Study Guide (Updated 86 Questions)
NEW QUESTION # 37
A company is transitioning from on-premises to a hybrid environment. Due to regulatory standards, the company needs to achieve a high level of reliability and high availability for the connection between its data center and the cloud provider. Which of the following solutions best meets the requirements?
- A. Establish a VPN with two tunnels to a transit gateway at the cloud provider.
- B. Establish two Direct Connect connections to the cloud provider using two different suppliers.
- C. Establish a Direct Connect with the cloud provider and a redundant connection with a VPN over the internet.
- D. Establish a Direct Connect with the cloud provider and peer to two different VPCs in the cloud network.
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
Establishing two Direct Connect (or equivalent private connectivity services such as Azure ExpressRoute) connections with two different providers ensures maximum redundancy and reliability. This setup complies with high availability (HA) and fault-tolerance design best practices for regulated industries, where minimal downtime and service continuity are critical.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Hybrid Connectivity and High Availability":
"Redundant connections to cloud providers should use physically separate paths and providers to ensure fault tolerance and meet reliability requirements in hybrid cloud environments."
"Direct connections provide higher availability and consistent performance than VPNs." Other options:
* A. Peering to two VPCs does not ensure link redundancy.
* B. Combining Direct Connect with VPN offers backup but less reliability than dual Direct Connects.
* D. VPNs over the internet are lower in reliability and do not meet high availability standards required for regulated industries.
NEW QUESTION # 38
A network load balancer is not correctly validating a client TLS certificate. The network architect needs to validate the certificate installed on the load balancer before progressing. Which of the following commands should the architect use to confirm whether the private key and certificate match?
- A. openssl req -in certificate.csr -verify
openssl-verify -noout -modulus -in privkey.txt | openssl md5 - B. openssl x509 -noout -modulus -in cert.crt | openssl md5
openssl rsa -noout -modulus -in privkey.txt | openssl md5 - C. openssl-rsa -noout -modulus -in cert.crt | openssl md5
openssl-verify -noout -modulus -in privkey.txt | openssl md5 - D. openssl-list -noout -modulus -in cert.crt | openssl md5
openssl rsa -noout -modulus -in privkey.txt | openssl md5
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
To verify that the certificate and the private key match, one can extract the modulus from both files and compare their hash values. The correct syntax involves using openssl x509 to extract the modulus from the certificate, and openssl rsa to extract the modulus from the private key, followed by an MD5 hash to ensure they match.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "TLS/SSL Certificate Validation and Troubleshooting":
"To verify that the private key and certificate match, compare the modulus values. A mismatch results in failed TLS handshakes." Other options:
* A & C: Incorrect syntax (openssl-list and openssl-rsa are not valid commands).
* B: The commands shown are used to verify CSRs, not matching keys.
NEW QUESTION # 39
A security architect needs to increase the security controls around computer hardware installations. The requirements are:
* Auditable access logs to computer rooms
* Alerts for unauthorized access attempts
* Remote visibility to the inside of computer rooms
Which of the following controls best meet these requirements? (Choose two.)
- A. NFC access cards
- B. Automated lighting
- C. Locks and keys
- D. Motion sensors
- E. Video surveillance
- F. Security patrols
Answer: A,E
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
Video surveillance (A) provides continuous monitoring and allows for real-time, remote visibility of secure locations, such as computer rooms. When integrated with analytics, video surveillance systems can detect movement after hours or unauthorized access and generate immediate alerts. These systems also maintain video logs that can be audited later.
NFC access cards (B) allow controlled access to physical areas, generating time-stamped logs for each entry attempt. When connected to an access control system, these cards can trigger alerts for unauthorized access attempts, such as the use of expired credentials or access during restricted hours.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - Security Controls and Physical Security Section:
"Security access systems using NFC or smart cards allow traceability of personnel entry through electronic logs, while surveillance systems provide visibility and support forensic investigations."
"Video surveillance allows real-time monitoring of physical environments and helps detect unauthorized presence or access in sensitive locations."
NEW QUESTION # 40
An architect needs to deploy a new payroll application on a cloud host. End users' access to the application will be based on the end users' role. In addition, the host mustbe deployed on the 192.168.77.32/30 subnet.
Which of the following Zero Trust elements are being implemented in this design? (Choose two.)
- A. Microsegmentation
- B. CASB
- C. WAF
- D. Least privilege
- E. MFA
- F. Device trust
Answer: A,D
Explanation:
Least privilege: Granting users access to the payroll app strictly according to their roles enforces the principle of least privilege.
Microsegmentation: Placing the host in its own 192.168.77.32/30 subnet isolates it from other workloads, achieving microsegmentation.
NEW QUESTION # 41
A network load balancer is not correctly validating a client TLS certificate. The network architect needs to validate the certificate installed on the load balancer before progressing. Which of the following commands should the architect use to confirm whether the private key and certificate match?
- A. openssl req -in certificate.csr -verify
openssl-verify -noout -modulus -in privkey.txt | openssl md5 - B. openssl x509 -noout -modulus -in cert.crt | openssl md5
openssl rsa -noout -modulus -in privkey.txt | openssl md5 - C. openssl-rsa -noout -modulus -in cert.crt | openssl md5
openssl-verify -noout -modulus -in privkey.txt | openssl md5 - D. openssl-list -noout -modulus -in cert.crt | openssl md5
openssl rsa -noout -modulus -in privkey.txt | openssl md5
Answer: B
Explanation:
If the MD5 hashes match, the certificate and private key correspond correctly.
NEW QUESTION # 42
A cloud architect needs to change the network configuration at a company that uses GitOps to document and implement network changes. The Git repository uses main as the default branch, and the main branch is protected. Which of the following should the architect do after cloning the repository?
- A. Create a new branch for the change, then create a pull request including the changes.
- B. Check out the development branch, then perform and commit the changes back to the remote repository.
- C. Use the main branch to make and commit the changes back to the remote repository.
- D. Rebase the remote main branch after making the changes to implement.
Answer: A
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
With GitOps, all infrastructure changes are tracked as code and committed to version-controlled repositories.
When the main branch is protected, changes should not be committed directly. Instead, best practices require that a new feature or change branch be created, followed by a pull request (PR) for peer review and approval before merging into the protected branch.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Infrastructure as Code and GitOps":
"In GitOps workflows, changes are made in feature branches, reviewed via pull requests, and merged into protected branches only after validation, ensuring auditability and control over infrastructure deployments." Other options:
* A. Direct commits to protected branches are restricted and violate GitOps practices.
* C. The development branch may exist, but the question specifies main is the default, and the correct process requires a PR.
* D. Rebase is for integrating histories, not submitting approved changes.
NEW QUESTION # 43
A cafe uses a tablet-based point-of-sale system. Customers are complaining that their food is taking too long to arrive. During an investigation, the following is noticed:
Every kitchen printer did not print the orders.
Payments are processing correctly.
The cloud-based system has record of the orders.
This issue occurred when the cafe was busy.
Which of the following is the best way to mitigate this issue?
- A. Assigning the kitchen printers static IP addresses
- B. Adding an access point exclusively for the kitchen
- C. Upgrading the kitchen printers' wireless dongles
- D. Updating the application
Answer: B
Explanation:
By dedicating a separate Wi-Fi access point to the printers, you isolate their traffic from the customer-facing tablets. This prevents congestion during busy periods, ensuring orders reliably print even when the main network is under heavy load.
NEW QUESTION # 44
A user reports an issue connecting to a database server. The front-end application for this database is hosted on the company's web server. The network engineer has changed the network subnet that the company servers are located on along with the IP addresses of the servers. These are the new configurations:
New subnet for the servers is 10.10.10.64/27
Web server IP address is 10.10.10.101
Database server IP is 10.10.10.93
Which of the following ismostlikely causing the user's issue?
- A. The web server does not have the correct network configuration.
- B. The database server firewall is blocking the port to the database.
- C. The DNS server is not resolving properly.
- D. The web application server is not forwarding the requests.
Answer: A
Explanation:
With a /27 mask on 10.10.10.64/27, valid host addresses run from 10.10.10.65 through 10.10.10.94. The database server's IP (10.10.10.93) is in that range, but the web server's IP (10.10.10.101) falls outside it-so it's mis-configured and cannot reach the database.
NEW QUESTION # 45
A network architect is designing an expansion solution for the branch office network and requires the following business outcomes:
* Maximize cost savings with reduced administration overhead
* Easily expand connectivity to the cloud
* Use cloud-based services to the branch offices
Which of the following should the architect do to best meet the requirements?
- A. Design a SD-WAN solution to integrate with the cloud provider; use SD-WAN to connect branch offices to the cloud provider.
- B. Design an MPLS architecture for the branch offices and site-to-site VPN between headquarters and branch offices; use site-to-site connectivity to the cloud provider.
- C. Design a dark fiber solution for headquarters and branch offices' connectivity; deploy point-to-site VPN between headquarters and the cloud provider; use the headquarters connectivity to the cloud provider.
- D. Design point-to-site branch connectivity for offices to headquarters; deploy ExpressRoute and/or DirectConnect between headquarters and the cloud; use headquarters connectivity to connect to the cloud provider.
Answer: A
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
SD-WAN (Software-Defined Wide Area Networking) is ideal for enterprises that want to simplify WAN management, reduce operational overhead, and optimize connectivity to cloudservices. SD-WAN provides intelligent traffic routing, dynamic path selection, and direct-to-cloud access without backhauling traffic through a central data center.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "SD-WAN and Cloud Connectivity":
"SD-WAN enables efficient cloud access from branch offices and simplifies management through centralized policy control. It is cost-effective and reduces the need for complex hardware configurations and manual routing." Other options:
* B. Adds latency and overhead by backhauling through headquarters.
* C. MPLS is expensive and less flexible than SD-WAN.
* D. Dark fiber is high-cost and not scalable for cloud-first architectures.
NEW QUESTION # 46
A network engineer at an e-commerce organization must improve the following dashboard due to a performance issue on the website:
Which of the following is themostuseful information to add to the dashboard for the operations team's?
- A. Number of active incidents
- B. Number of orders
- C. 404 errors
- D. Concurrent users
Answer: D
Explanation:
Adding a concurrent-user count gives you the key context you're missing: it ties spikes in CPU, memory, disk I/O, and network traffic directly to how many people are actively hitting the site. You can then see whether performance issues align with increases in user load, enabling more targeted capacity planning and troubleshooting.
NEW QUESTION # 47
A developer reports errors when trying to access a web application. The developer uses Postman to troubleshoot and receives the following error:
* HTTP Status: 403 Forbidden
* Headers include authentication-related variables such as access_key, signature, salt, and timestamp
* The request is a GET request to a payment methods API
Which of the following is the cause of the issue?
- A. Incorrect HTTP redirection
- B. Lack of user authentication
- C. Too restrictive NGFW rule
- D. Requested element not found
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
A 403 Forbidden error indicates that the request was understood by the server but is refusing to fulfill it due to insufficient authorization. The developer is attempting to call a protected API that requires valid credentials such as an access key and signature (often used in HMAC-based APIs), but the values appear as Postman variables (e.g., {{rapyd_access_key}}), which suggests they were not replaced with actual credentials.
This typically means that the request lacks proper authentication or authorization headers, or the keys
/signature are incorrect or missing. The presence of access_key, signature, salt, and timestamp in the request implies the API requires authentication, but the variables were not resolved or valid.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "API Security and Authentication":
"A 403 error typically results from failed authentication or lack of proper authorization. Developers must ensure that tokens or signatures are valid, not missing, and properly injected." Other options:
* A. 404 is the code for a missing resource, not 403.
* C. A firewall rule would block the request entirely (e.g., no response or a 0 status), not result in a 403 from the server.
* D. HTTP redirection issues typically result in 3xx codes, not 403.
NEW QUESTION # 48
A customer asks a MSP to propose a ZTA design for its globally distributed remote workforce. Given the following requirements:
Authentication should be provided through the customer's SAML identity provider.
Access should not be allowed from countries where the business does not operate.
Secondary authentication should be added to the workflow to allow for passkeys.
Changes to the user's device posture and hygiene should require reauthentication into the network.
Access to the network should only be allowed to originate from corporate-owned devices.
Which of the following solutions should the MSP recommend to meet the requirements?
- A. Configure geolocation settings to block certain IP addresses.
Enforce MFA.
Federate the solution via SSO.
Enable continuous access policies on the WireGuard tunnel.
Create a trusted endpoints policy. - B. Enforce posture assessment only during the initial network log-on.
Implement RADIUS for SSO.
Restrict access from all non-U.S. IP addresses.
Configure a BYOD access policy.
Disable auditing for remote access. - C. Chain the existing identity provider to a new SAML.
Require the use of time-based one-time passcode hardware tokens.
Enable debug logging on the VPN clients by default.
Disconnect users from the network only if their IP address changes. - D. Enforce certificate-based authentication.
Permit unauthenticated remote connectivity only from corporate IP addresses.
Enable geofencing.
Use cookie-based session tokens that do not expire for remembering user log-ins.
Increase RADIUS server timeouts.
Answer: A
Explanation:
Federate the solution via SSO ensures authentication is handled by the customer's SAML identity provider.
Enforce MFA supports secondary authentication with passkeys.
Configure geolocation settings to block certain IP addresses prevents access from unauthorized countries.
Enable continuous access policies on the WireGuard tunnel forces re-authentication whenever device posture or hygiene changes.
Create a trusted endpoints policy restricts access to corporate-owned devices only.
NEW QUESTION # 49
An outage occurred after a software upgrade on core switching. A network administrator thinks that the firmware installed had a bug. Which of the following should the network administrator do next?
- A. Document lessons learned.
- B. Establish a plan of action to resolve the issue.
- C. Implement the solution.
- D. Test the theory to determine cause.
Answer: D
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
According to the structured troubleshooting methodology outlined in the CNX-001 objectives, once a potential root cause is identified (in this case, a suspected firmware bug), the next step is to test the theory to confirm the cause before taking action. This helps prevent misdiagnosis and unnecessary configuration changes.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Structured Troubleshooting Methodology":
"After identifying symptoms and forming a theory of probable cause, the next step is to test the theory to verify it is the actual cause of the problem." Other options:
* A. Establishing a plan of action comes after confirming the cause.
* C. Documenting lessons learned is the final step.
* D. Implementing the solution should only occur after the issue is confirmed.
NEW QUESTION # 50
A network administrator receives a ticket from one of the company's offices about video calls that work normally for one minute and then get very choppy. The network administrator pings the video server from that site to ensure that it is reachable:
(Ping output shows responses with varying latency times, including spikes: 11ms, 672ms, 849ms, 92ms, etc.)
Which of the following is most likely the cause of the video call issue?
- A. Jitter
- B. Loss
- C. Latency
- D. Throughput
Answer: A
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
Jitter refers to the variation in packet delay during transmission. In the ping output shown, the response times fluctuate significantly (11ms, 672ms, 849ms, 34ms), indicating inconsistent network performance. Such variation leads to a poor experience in real-time applications likevideo calls. High jitter causes packets to arrive out of order, resulting in stuttering or choppy audio/video.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Troubleshooting Real-Time Network Services":
"Jitter is the deviation in packet arrival times and directly affects real-time communications such as VoIP and video conferencing. Consistent latency is tolerable; inconsistent latency (jitter) is disruptive." Other options:
* A. Throughput refers to bandwidth and would cause consistent slowness.
* C. Latency alone, if stable, is acceptable; it's the inconsistency here that causes issues.
* D. Loss would be indicated by missing packets; the ping results show replies to all packets.
NEW QUESTION # 51
A cloud network engineer needs to enable network flow analysis in the VPC so headers and payload of captured data can be inspected. Which of the following should the engineer use for this task?
- A. Syslog service
- B. Network flows
- C. Traffic mirroring
- D. Application monitoring
Answer: C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
Traffic mirroring allows a copy of network traffic - including headers and payloads - to be sent to an analysis tool or appliance for deep packet inspection. This is essential for security analysis, network troubleshooting, and performance diagnostics in cloud environments.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Packet Capture and Network Flow Monitoring":
"Traffic mirroring enables the capture of full packet data, including payloads, for forensic or performance analysis within cloud networks." Other options:
* A. Application monitoring focuses on app-level metrics, not packet inspection.
* B. Syslog is log-based, not for inspecting packets.
* D. Network flows (e.g., NetFlow, VPC flow logs) provide metadata (source, destination, size) but not full packet content.
NEW QUESTION # 52
An application is hosted on a three-node cluster in which each server has identical compute and network performance specifications. A fourth node is scheduled to be added to the cluster with three times the performance as any one of the preexisting nodes. The network architect wants to ensure that the new node gets the same approximate number of requests as all of the others combined. Which of the following load- balancing methodologies should the network architect recommend?
- A. Weighted
- B. Least connections
- C. Round-robin
- D. Load-based
Answer: A
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
Weighted load balancing allows distribution of traffic based on server capacity or assignedweights. In this case, the new node should receive a weight of 3, and each of the three older nodes a weight of 1. This ensures the new node handles the same total number of requests as the other three combined (3:1:1:1).
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Load Balancing Algorithms and Traffic Distribution":
"Weighted load balancing accounts for node capacity, distributing requests proportionally according to performance capability or administrator-defined weights." Other options:
* A. Round-robin sends traffic equally to all servers regardless of capacity.
* B. Load-based requires dynamic performance measurement and is more complex.
* C. Least connections may work in certain cases, but doesn't guarantee proportional traffic split based on server performance.
NEW QUESTION # 53
A network architect is choosing design options for a new SD-WAN installation that has the following requirements:
All network traffic from the cloud must pass through inspection devices in a dedicated data center.
Ensure redundancy.
Centralize egress traffic.
Which of the following network topologies best meets these requirements?
- A. Star
- B. Point-to-point
- C. Partial mesh
- D. Hub-and-spoke
Answer: D
Explanation:
A hub-and-spoke design sends all branch and cloud traffic into the central hub (your data center) for inspection, then back out, meeting the requirement for centralized egress and security inspection. By deploying multiple hub nodes and using dynamic path selection, you also achieve redundancy without losing the centralized control plane.
NEW QUESTION # 54
A company deployed new applications in the cloud and configured a site-to-site VPN to connect the internal data center with the cloud. The IT team wants the internal servers to connect to those applications without using public IP addresses. Which of the following is thebestsolution?
- A. Register applications on the cloud with a public DNS sever and configure internal servers to connect to them using their public DNS names.
- B. Create a DNS server in the cloud. Configure the DNS server in the customer data center to forward DNS requests for cloud resources to the cloud DNS server.
- C. Configure proxy service in the site-to-site VPN to allow internal servers to access applications through the proxy.
- D. Configure a NAT server on the cloud to allow internal servers to connect to the applications through the NAT server.
Answer: B
Explanation:
By forwarding only the cloud application DNS queries to a cloud-hosted DNS zone that returns private IP addresses, your internal servers will resolve and connect over the site-to-site VPN without ever touching public IPs.
NEW QUESTION # 55
A large commercial enterprise that runs a global video streaming platform recently acquired a small business that serves customers in a geographic area with limited connectivity to the global telecommunications infrastructure. The executive leadership team issued a mandate to deliver the highest possible video streaming quality to all customers around the world. Which of the following solutions should the enterprise architect suggest to meet the requirements?
- A. Use a geographically weighted DNS solution to distribute the traffic.
- B. Deploy multiple local load balancers in the newly added geographic area.
- C. Utilize CDN for all customers regardless of geographic location.
- D. Serve the customers in the acquired area with a highly compressed version of content.
Answer: C
Explanation:
A global Content Delivery Network caches and serves video streams from edge nodes close to end users, minimizing latency and packet loss over limited backhaul links and ensuring the highest possible quality everywhere. By offloading traffic to a CDN, even customers in regions with constrained connectivity will receive optimized streams from the nearest POP rather than traversing the congested core network.
NEW QUESTION # 56
A company hosts its application s on the cloud and is expanding its business to Europe. The company must comply with General Data Protection Regulation to limit European customers' access to data. The network team configures the firewall rules but finds that some customers in the United States can access data hosted in Europe. Which of the following is the best option for the network team to configure?
- A. Network security groups
- B. Geofencing rule
- C. CDN
- D. SASE
Answer: B
Explanation:
Using a geofencing (geo#restriction) policy lets you block or allow traffic based on the client's geographic location. This ensures that only users in approved regions (e.g., the United States) can reach the European- hosted data, effectively preventing unintended European customer access without complex IP ACLs.
NEW QUESTION # 57
A company is expanding operations and opening a new facility. The executive leadership team decides to purchase an insurance policy that will cover the cost of rebuilding the facility in case of a natural disaster.
Which of the following describes the team's decision?
- A. Memorandum of understanding
- B. Business continuity
- C. Disaster recovery
- D. Risk transference
Answer: D
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
Risk transference is a risk management strategy in which the financial impact of a risk is shifted to a third party, such as an insurance company. In this scenario, the purchase of an insurance policy to cover potential damage or loss from a natural disaster is an example of transferring risk, not avoiding, mitigating, or accepting it.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide under "Risk Management Concepts":
"Risk transference involves moving the responsibility or financial burden of a risk to a third party, often through the purchase of insurance or third-party service agreements." This approach is contrasted with mitigation (reducing risk), acceptance (living with the risk), or avoidance (eliminating the risk).
NEW QUESTION # 58
An organization's Chief Technical Officer is concerned that changes to the network using IaC are causing unscheduled outages. Which of the following best mitigates this risk?
- A. Making code changes to the master branch
- B. Forking the code repository before making changes
- C. Enforcing code review of the change by the author
- D. Adding review/approval steps to the CI/CD pipelines
Answer: D
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
The best way to prevent unscheduled outages caused by Infrastructure as Code (IaC) changes is to implement automated review and approval gates in the CI/CD pipeline. This ensures that all changes undergo validation, peer review, testing, and possibly approval from stakeholders before being deployed, thus reducing the likelihood of production-impacting issues.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "CI/CD Security and IaC Controls":
"Incorporating approval gates and automated validation into CI/CD pipelines helps detect misconfigurations and unauthorized changes before deployment, reducing the risk of outages." Other options:
* A. Making changes directly to the master branch violates best practices.
* B. Self-review (by the author) lacks objectivity and fails peer validation.
* C. Forking creates a copy but does not introduce formal validation processes.
NEW QUESTION # 59
A company is transitioning from on premises to a hybrid environment. Due to regulatory standards, the company needs to achieve a high level of reliability and high availability for the connection between its data center and the cloud provider. Which of the following solutionsbestmeets the requirements?
- A. Establish a VPN with two tunnels to a transit gateway at the cloud provider.
- B. Establish two Direct Connect connections to the cloud provider using two different suppliers.
- C. Establish a Direct Connect with the cloud provider and a redundant connection with a VPN over the internet.
- D. Establish a Direct Connect with the cloud provider and peer to two different VPCs in the cloud network.
Answer: B
Explanation:
By provisioning two dedicated Direct Connect circuits from separate carriers (diverse physical paths and providers), you achieve a true highly available, fault-tolerant link that meets stringent reliability and regulatory requirements without relying on the public internet.
NEW QUESTION # 60
A company hosts a cloud-based e-commerce application and only wants the application accessed from certain locations. The network team configures a cloud firewall with WAF enabled, but users can access the application globally. Which of the following should the network team do?
- A. Implement a CDN
- B. Configure a NAT gateway
- C. Configure geo-restriction
- D. Reconfigure WAF rules
Answer: C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
A Web Application Firewall (WAF) is primarily used for inspecting HTTP/HTTPS requests and filtering out malicious traffic, such as SQL injection or cross-site scripting (XSS) attacks. However, WAFs do not restrict access based on geographical location by default.
To control access to the cloud-hosted application based on geographical location, the correct measure is to implement geo-restriction (geo-blocking). This technique limits access to cloud-based resources by using the source IP's geographical origin. Geo-restriction is typically enforced at the cloud firewall or load balancer level.
Relevant Extract from CompTIA CloudNetX CNX-001 Official Objectives:
"Cloud access control policies can enforce geo-restriction settings, ensuring applications and services are only accessible from authorized geographic regions." Also found under "Security Controls in Cloud Deployments" section:
"Geo-restriction uses IP geolocation data to restrict access to services based on geographic criteria, supporting compliance and security requirements."
NEW QUESTION # 61
......
CompTIA CNX-001 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
Get to the Top with CNX-001 Practice Exam Questions: https://www.practicematerial.com/CNX-001-exam-materials.html
Use Real CNX-001 Dumps Free Sample Questions and Practice Test Engine: https://drive.google.com/open?id=108yHcBvIfF0h16rHcDYoJFjM_KSrVY4B
