CNX-001 CompTIA CloudNetX Certification Exam Topics and Questions

Network Architecture Design carries the largest share of the exam, and it sets the foundation every other topic builds on. The domain spans physical topology choices, IP addressing schemes, hybrid connectivity models, and availability engineering. Where candidates lose marks here is in conflating design intent with implementation detail: the exam wants you to know why a topology or protocol is chosen, not just how it works at a surface level.

– Core protocols and addressing

IP addressing and routing are not background knowledge here, they are directly examinable. You need to know when to apply static versus dynamic routing, how NAT affects address visibility across boundaries, and which routing protocols suit which topology. The distinction between interior and exterior protocols matters, as does understanding what NAT breaks and why that matters for hybrid designs. Networking protocols such as spanning tree and link aggregation come up in the context of design decisions, so focus on the trade-offs each introduces rather than the operational commands.

– Topology and physical infrastructure

Mesh, star, and spine-and-leaf each solve a different problem, and the exam tests whether you can match topology to requirement. Spine-and-leaf is the data-centre default for east-west traffic; star suits centralised control; mesh suits resilience where any-to-any paths matter. Campus installations add a physical layer: power capacity, cooling, and physical access controls are all fair game. Do not treat these as soft background topics. An item may give you a scenario with power constraints or environmental factors and ask you to select the appropriate design response.

– Hybrid connectivity

VPNs, SD-WAN, MPLS, and public cloud connections are rarely tested in isolation. Items tend to present a hybrid environment and ask which connectivity model satisfies the stated requirements, whether that is latency, cost, redundancy, or policy control. SD-WAN versus MPLS is a classic comparison the exam exploits: know what SD-WAN gains over MPLS and what it gives up. Public cloud connections such as direct-connect-style services introduce their own availability considerations, so treat them as part of the hybrid picture rather than a separate cloud topic.

– Availability and scale

Load balancing, redundancy, autoscaling, and CDNs are grouped under availability solutions, but the exam approaches them through scenario-based recommendations. You are expected to identify which mechanism addresses a given failure mode or capacity demand. A CDN solves a different problem from autoscaling, and both differ from redundancy at the network layer. Know the boundaries. Items will describe a symptom or a business requirement and expect you to select the appropriate availability mechanism, so practise mapping requirement to solution rather than memorising definitions.

How Network Architecture Design is tested

At 31% of the exam, this topic will account for roughly a third of your sitting. Items are scenario-driven: you will be given a business or technical requirement and asked to select or recommend a design element. The trap is treating every item as a protocol recall question. Many items reward understanding trade-offs: why spine-and-leaf over three-tier, why SD-WAN over MPLS in a given cost or latency context, why a CDN rather than autoscaling for a particular availability problem.

Candidates lose marks by anchoring to the most familiar technology rather than the one that fits the stated constraint. Read the scenario for the binding requirement, whether that is cost, latency, redundancy, or physical limitation, before evaluating options. Items on campus installations tend to catch candidates who skipped the physical and environmental sub-topic entirely. NAT and routing protocol items reward knowing the operational consequence of a choice, not just its definition. Expect a mix of single-best-answer and multi-select formats across this topic.

Network Security is the second-largest slice of the exam, and it demands more than familiarity with security products. The domain runs from threat identification and firewall configuration through to modern zero-trust architectures and wireless controls. Where candidates underestimate it is in the IAM and zero-trust sub-topics: these are not conceptual overviews, they are configuration-level decisions the exam will put you in the middle of.

– Threats, vulnerabilities, and mitigations

This sub-topic asks you to connect a threat type to the right mitigation, in the right order. Items do not reward listing every possible control; they reward selecting the one that addresses the specific vulnerability described. The distinction between a threat and a vulnerability matters here: misidentifying one as the other leads you to a plausible-sounding but wrong mitigation. Focus on the relationship between attack surface, exploit path, and the control that closes that path. Generic security hygiene answers rarely win against a targeted mitigation that fits the scenario.

– Firewalls, encryption, and access control

Firewall rules, security groups, and URL filtering are all covered under access controls, and the exam treats them as distinct mechanisms with distinct scopes. Security groups operate at a different layer than traditional firewall rules, and URL filtering addresses a different threat vector than either. Encryption protocols appear in the context of what they protect and where they break: knowing that a protocol encrypts in transit but not at rest, for example, is the kind of boundary the exam exploits. NAC items tend to focus on enforcement points and what happens when a device fails a posture check.

– Zero trust and cloud security

ZTNA, SASE, microsegmentation, and CASB are tested as a related cluster, but the exam distinguishes their functions precisely. ZTNA controls access to applications; CASB governs cloud service usage; microsegmentation limits lateral movement inside a network; SASE bundles networking and security at the edge. Items will describe a hybrid or cloud-first environment and ask which of these controls addresses the stated risk. The trap is treating them as interchangeable modern-security buzzwords. Each solves a specific problem, and the exam rewards candidates who can match problem to control without conflating them.

– IAM and wireless security

SSO, MFA, PKI, and privileged access management each address a different identity risk, and items will often present a scenario where one is insufficient without another. MFA adds a factor; SSO centralises authentication without necessarily strengthening it; PAM controls what privileged accounts can do after authentication. Wireless security items focus on encryption standard selection, authentication method, and the role of wireless isolation in limiting blast radius. Know which wireless encryption standards are considered deprecated and why, because the exam will present scenarios where a legacy standard is in use and ask you to identify the resulting risk.

How Network Security is tested

At 28%, Network Security is close behind the architecture topic in weight, and its items tend to be more scenario-dense. You will rarely see a straightforward recall item. Instead, expect a described environment with a specific threat or compliance requirement, followed by a choice between controls that are all plausible but only one of which fits the scenario precisely.

Candidates drop marks in two places. First, on zero-trust items, by selecting a control that addresses a related but different problem: choosing CASB when the scenario calls for ZTNA, for instance, or microsegmentation when the issue is cloud service governance. Second, on IAM items, by selecting MFA as a universal fix when the scenario's weakness is privileged account scope, not authentication strength. Items on wireless security reward knowing the practical consequence of a configuration choice, not just its name. The strongest responses in this topic match the described risk precisely to the control that closes it, without adding controls the scenario does not justify.

After the design and security domains, this topic shifts the focus to keeping a network running well day to day. At 16%, it is the smallest weighted area, but candidates who treat it as a light topic pay for that on items about automation and IaC, which are increasingly central to hybrid operations. The three sub-topics cover risk and continuity management, observability tooling, and the automation practices that tie hybrid environments together.

How Network Operations, Monitoring, and Performance is tested

Items in this topic tend to present an operational scenario: a service is degrading, a dashboard is showing an anomaly, or a change needs to be applied consistently across a hybrid environment. The exam rewards selecting the right tool or practice for the specific operational need described.

On monitoring items, candidates lose marks by selecting the most sophisticated-sounding tool rather than the one that matches the described use case. A dashboard solves a different problem from an alert threshold, and logging answers a different question from a real-time metric. Automation items are where candidates who skipped IaC suffer most: the exam expects you to know what infrastructure as code enables in a hybrid context and where scripting alone is insufficient. Risk and continuity items reward understanding the relationship between risk appetite, recovery objectives, and the operational controls that enforce them. The trap here is confusing a continuity plan with a redundancy design: one is a document-driven process decision, the other is an architectural one, and the exam distinguishes them.

Troubleshooting carries 25% of the exam and is where abstract knowledge meets applied diagnosis. The three sub-topics, connectivity, performance, and security challenges, are tested through scenarios that describe a symptom and ask you to identify the cause or the next diagnostic step. Candidates who know their theory but have not practised structured fault isolation tend to slow down here and make avoidable errors under time pressure.

How Network Troubleshooting is tested

Items in this topic give you a described symptom and ask what is causing it or what you should check next. The exam rewards methodical fault isolation over pattern-matching to the most familiar failure mode. DNS, VPN, and cloud interconnectivity items often hinge on knowing which layer to investigate first: a candidate who jumps to the application layer when the fault is in name resolution will select a plausible but wrong action.

Performance items on latency, load balancing, and packet loss are designed to separate candidates who understand the diagnostic path from those who know the technology in isolation. Latency and packet loss can share symptoms but have different causes and different fixes, and the exam exploits that. Security troubleshooting items, covering firewall misconfigurations, unauthorized access, and hybrid vulnerabilities, reward identifying the specific control that is failing rather than applying a broad remediation. The most common trap across all three sub-topics is selecting a fix before a cause has been established: items reward the diagnostic step that confirms the fault, not the remediation applied before diagnosis is complete.