Free CompTIA CNX-001 Practice Exam with Questions & Answers | Set: 3

Comprehensive and Detailed Explanation From Exact Extract:

Using an active-active deployment across two regions with at least two Availability Zones (AZs) each provides the highest level of fault tolerance and geographic redundancy. This ensures continuity even if an entire region or multiple zones become unavailable. In regulated sectors such as healthcare, this meets strict availability and disaster recovery requirements.

Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide — under “High Availability and Multi-Region Design”:

“Active-active configurations across multiple regions and availability zones maximize uptime and ensure failover in the event of localized or regional failures.”

Other options:

B. Active-passive introduces delays in failover.

C. Active-active in one region offers no geographic redundancy.

D. Active-passive in two regions is slower and less efficient during failover.

Firewalls → VPN tunnel down

The IPsec tunnel between on-prem Firewall 1 and cloud Firewall 2 (ipip0/ipip2) is down, so no traffic can traverse to the cloud.

Application NSG → Misconfigured rule

There’s a “block” rule for 10.3.9.0/24 → 192.2.1.0/24, preventing legitimate on-prem clients from reaching Application A.

Comprehensive and Detailed Explanation From Exact Extract:

A mesh topology provides multiple redundant paths between nodes. It offers the highest availability and fault tolerance by allowing communication to continue even if one or more links or nodes fail. This is especially important in rural healthcare systems where reliability and access to critical services are paramount.

Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide — under “Network Topologies and Redundancy Models”:

“Mesh topologies provide optimal fault tolerance and support consistent data transmission through redundant links, ideal for mission-critical systems.”

Other options:

A. Collapsed core is cost-efficient but not fully redundant.

B. Hub-and-spoke introduces a single point of failure at the hub.

D. Star also relies on a central node and is not fault tolerant.

================================================

Comprehensive and Detailed Explanation From Exact Extract:

The Hub-and-Spoke topology is ideal for SD-WAN environments where traffic from branch offices or cloud workloads must route through a central location (the hub) for inspection, monitoring, or security enforcement. This structure centralizes egress and allows for redundant spoke paths via the hub. It also simplifies control and enforces compliance policies.

Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide — under “SD-WAN Topologies and Cloud Egress Strategies”:

“In a hub-and-spoke topology, spokes (remote offices or cloud nodes) connect through a central hub, allowing for centralized egress, traffic inspection, and simplified routing.”

Other options:

A. Point-to-point doesn’t scale and lacks centralized control.

C. Star topology is similar to hub-and-spoke but is more rigid and less suited for SD-WAN scalability.

D. Partial mesh allows direct spoke-to-spoke communication, bypassing centralized inspection.

================================================

Comprehensive and Detailed Explanation From Exact Extract:

A. Least privilege – This Zero Trust principle ensures users can only access the resources necessary for their job roles. Role-based access control (RBAC), as mentioned in the scenario, is a textbook implementation of least privilege.

C. Microsegmentation – Deploying the application in a small subnet (192.168.77.32/30 provides only 2 usable host IPs) limits lateral movement and isolates the host at a network level. This is a key characteristic of microsegmentation, where resources are placed in small, tightly controlled network segments.

Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide — under “Zero Trust Security Architecture”:

“Least privilege enforces access permissions based on job responsibilities.”

“Microsegmentation applies granular isolation policies between resources to reduce the attack surface and lateral movement.”

Other options:

B. Device trust involves assessing device posture and compliance before granting access.

D. CASB (Cloud Access Security Broker) governs cloud access, not access control or subnetting.

E. WAF protects web applications but is not a Zero Trust element directly related to access control.

F. MFA supports identity verification but is not directly evidenced in the scenario.

================================================