CompTIA CloudNetX (CNX-001) Practice Exam
Prepare for CompTIA’s expert-level hybrid-network architect exam across all four objective areas — network architecture design, security, operations and monitoring, and troubleshooting — with objective-mapped questions, instant feedback in Learn mode, and a full timed simulation in Exam mode. Start with a 24-hour free trial.
Start 24-hour free trial →CompTIA CloudNetX (CNX-001) exam at a glance
- Vendor
- CompTIA
- Exam code
- CNX-001
- Certification
- CompTIA CloudNetX
- Level
- Expert / network architect (CompTIA Xpert series)
- Released
- February 18, 2025 (current edition)
- Format
- Maximum of 90 questions; multiple-choice and performance-based
- Duration
- 165 minutes
- Scoring
- Pass/fail only — no scaled score is reported
- Delivery
- Pearson VUE test center or online proctored
- Recommended experience
- Several years in a network-architect role with hybrid-cloud experience; Network+, Security+, and Cloud+ (or equivalent) are useful groundwork
- Languages
- English
Source: CompTIA — CloudNetX (CNX-001) certification (exam details & objectives). Verify current details with CompTIA before scheduling.
About the CompTIA CloudNetX (CNX-001) certification
CompTIA CloudNetX is an expert-level credential in CompTIA’s Xpert series, aimed at the people who design networks rather than operate them: network, security, and enterprise architects working across hybrid and multi-cloud environments. It validates the ability to translate business requirements into secure, scalable network architecture — spanning on-premises infrastructure, cloud connectivity, Zero Trust and SASE security models, automation, and the advanced troubleshooting that holds a complex hybrid estate together. It sits well above the foundational and professional CompTIA exams in both depth and expectation.
CloudNetX (series code CNX-001) was introduced in February 2025. It delivers up to 90 questions — a mix of multiple-choice and scenario-driven performance-based items — across four objective areas, and unlike CompTIA’s core exams it is scored on a straight pass/fail basis with no scaled number. Network Architecture Design (31%) is the heaviest area, with Network Security (28%) close behind. Every PowerKram practice question maps to one of the four areas, so a weak score points you at the exact objective to revisit. For context on how senior certifications fit alongside formal education, see our guide to choosing certifications over a college degree.
CloudNetX (CNX-001) exam objectives and weights
CompTIA splits the exam across four objective areas. The weights below are CompTIA’s own and sum to 100% — plan your study time roughly in proportion to them.
Analyzing business, technical, and regulatory requirements to design secure, highly available hybrid architectures: cloud connectivity, SD-WAN, load balancing and HA, campus wired/wireless, redundancy, and the high- and low-level design documentation that supports it.
Threats and mitigations, security technologies (firewalls, encryption, NAC), access controls, Zero Trust (ZTNA, SASE, microsegmentation, CASB), IAM solutions (SSO, MFA, PKI, privileged access), and wireless security.
Diagnosing connectivity problems (DNS, VPN, cloud interconnects), performance issues such as latency, load balancing, and packet loss, and access and security faults across on-premises and cloud boundaries using a structured methodology.
Operations management (risk, continuity, service delivery), monitoring tools (metrics, dashboards, logging, alerting), and applying automation and scripting to administer and optimize the network at scale.
Who the CloudNetX exam is for
CloudNetX is built for senior practitioners moving into or already in architecture: network architects, security architects, and enterprise architects responsible for hybrid and multi-cloud network design. CompTIA frames it as an expert credential — it expects several years in a network-architect role and hybrid-cloud experience, with Network+, Security+, and Cloud+ (or equivalent knowledge) as useful groundwork rather than formal prerequisites. This is not an entry point; it is where an experienced networking professional proves architect-level judgment.
If you are still building toward that level, our Network+ practice exam and Cloud+ practice exam cover the networking and cloud-infrastructure foundations CloudNetX assumes. For where senior networking work leads in salary and scope, the network engineering career guide in our career hub maps the path toward architect roles.
What this CloudNetX practice exam delivers
Score by objective area
Every question is tagged to one of the four areas, so your report shows whether Architecture Design or Security — the two heaviest — is dragging your readiness, not just an overall result on this pass/fail exam.
Learn mode
Immediate feedback after each question with a full explanation of why the right answer is right and why the others are wrong — built for the design-tradeoff and best-architecture reasoning CloudNetX tests.
Exam mode
A timed simulation that mirrors the demanding 165-minute format and its mix of multiple-choice and scenario-based performance questions, so the pacing of a long expert exam feels familiar.
No setup, no download
Runs in the browser with nothing to install. Your 24-hour trial unlocks the full bank and both modes — no credit card required.
Sample CloudNetX practice questions
Ten free questions spanning the four objective areas at the architect level the exam expects, each with a full explanation. The complete bank is available with the 24-hour trial.
An architect must connect three branch sites to two public-cloud regions with resilient, policy-driven WAN paths and centralized control. Which design approach best fits?
- SD-WAN with redundant cloud on-ramps to both regions
- A single site-to-site IPsec tunnel to one region
- Per-site static routes with no failover
- Public-internet access from each branch with no overlay
Show answer & explanation
Correct: A — SD-WAN with redundant cloud on-ramps. SD-WAN gives centralized, application-aware policy and path selection across multiple transports, and redundant on-ramps to both regions provide the resilience and active failover a multi-site, multi-region hybrid design requires.
Why not the others: a single tunnel to one region (B) is a single point of failure with no regional redundancy; static routes without failover (C) cannot reroute on an outage; raw internet access with no overlay (D) lacks the security and policy control architects are expected to build in.
Source: CompTIA CloudNetX objectives — Network Architecture Design →An organization wants remote users to reach specific applications without granting broad network access, verifying identity and device posture on every request. Which model should the architect implement?
- A traditional flat VPN into the corporate LAN
- Zero Trust Network Access (ZTNA)
- An open guest SSID with a captive portal
- Port forwarding on the edge firewall
Show answer & explanation
Correct: B — ZTNA. Zero Trust Network Access brokers access to individual applications based on verified identity and device posture, granting least-privilege access per session rather than placing the user on the network — exactly the requirement described.
Why not the others: a flat VPN (A) puts the user on the LAN with broad reach, the opposite of least privilege; a guest SSID (C) is unrelated to application access; port forwarding (D) exposes services without identity-based control.
Source: CompTIA CloudNetX objectives — Zero Trust → Further reading: PowerKram — security practices guide →To limit lateral movement after a breach inside a hybrid data center, which design technique is most effective?
- A single large flat subnet for simplicity
- Disabling all logging to reduce noise
- Microsegmentation between workloads
- Allowing any-to-any traffic inside the trust zone
Show answer & explanation
Correct: C — microsegmentation. Segmenting workloads into fine-grained policy zones means a compromise in one workload cannot freely traverse to others, directly constraining lateral movement — a core Zero Trust design control.
Why not the others: a flat subnet (A) and any-to-any traffic (D) let an attacker move freely; disabling logging (B) removes the visibility needed to detect and contain the breach.
Source: CompTIA CloudNetX objectives — Access controls & segmentation →An application must stay available even if an entire cloud availability zone fails. Which design provides the strongest resilience?
- A single large instance in one zone
- Active-active deployment across multiple availability zones with health-based load balancing
- Nightly backups restored manually after an outage
- Vertical scaling of one server
Show answer & explanation
Correct: B — active-active across zones. Running the workload simultaneously in multiple availability zones behind a health-aware load balancer means a zone failure sheds to healthy capacity with little or no downtime — the high-availability pattern architects are expected to specify.
Why not the others: a single instance (A) and vertical scaling (D) keep all eggs in one zone; manual restore from backups (C) means real downtime and data-loss risk, not continuous availability.
Source: CompTIA CloudNetX objectives — Availability & high availability → Further reading: PowerKram — platform administration guide →An architect wants early warning of degradation before users report problems across a hybrid network. Which approach is most effective?
- Wait for help-desk tickets to identify issues
- Check device CPU only when something breaks
- Rely on monthly manual reports
- Baseline key metrics (latency, loss, jitter, throughput) with dashboards and threshold alerting
Show answer & explanation
Correct: D — baseline metrics with dashboards and alerting. Establishing baselines and alerting on deviations in latency, loss, jitter, and throughput surfaces degradation proactively, which is the operations-and-monitoring discipline the exam expects.
Why not the others: waiting for tickets (A) or reacting only on failure (B) is reactive by definition; monthly manual reports (C) are far too coarse to catch developing problems.
Source: CompTIA CloudNetX objectives — Monitoring tools →To deploy consistent network configurations repeatably across regions and prove idempotence, which practice should the architect adopt?
- Manually configuring each device through its console
- Infrastructure as Code (IaC) with version-controlled templates
- Copying settings from screenshots
- Emailing config snippets between engineers
Show answer & explanation
Correct: B — IaC with version control. Declarative, version-controlled templates let you redeploy identical configurations across regions and re-run them safely (idempotence), which is the automation approach CloudNetX expects at scale.
Why not the others: manual console work (A), screenshots (C), and emailed snippets (D) are error-prone, unrepeatable, and impossible to audit or roll back reliably.
Source: CompTIA CloudNetX objectives — Automation & scripting → Further reading: PowerKram — platform administration guide →Workstations can reach an on-prem server but cannot reach an application hosted in the cloud through the interconnect. What should the architect investigate first?
- The workstations’ monitor settings
- The data-center HVAC system
- Routing and security-group/firewall rules on the cloud interconnect path
- The corporate logo on the intranet
Show answer & explanation
Correct: C — routing and rules on the interconnect path. Local access works but cloud access fails, so the fault is along the hybrid path: missing or wrong routes, or security-group/firewall/NSG rules blocking the cloud-hosted application. That is where a structured investigation starts.
Why not the others: monitor settings (A), HVAC (B), and an intranet logo (D) have no bearing on cloud reachability.
Source: CompTIA CloudNetX objectives — Connectivity troubleshooting →An architect must ensure cloud backups are protected and meet regulatory obligations. Which practice should be followed?
- Leave backups on provider defaults
- Share the encryption keys publicly for convenience
- Enable backup encryption and enforce compliance/retention policies
- Disable audit logging to save space
Show answer & explanation
Correct: C — encrypt backups and enforce compliance/retention policy. Regulated data requires backups that are encrypted (at rest and in transit) and governed by explicit retention and compliance policies, with keys properly managed. That combination is what satisfies the obligation.
Why not the others: relying on defaults (A) may not meet the specific regulation; sharing keys publicly (B) destroys the protection encryption provides; disabling audit logging (D) removes the evidence trail compliance requires.
Source: CompTIA CloudNetX objectives — Security technologies & compliance → Further reading: PowerKram — security practices guide →Users report intermittent slowness reaching a cloud application. What is the most effective first step in a structured investigation?
- Rebrand the company intranet
- Delete all user accounts
- Replace every piece of network hardware
- Review resource and path metrics (latency, loss, utilization) against the baseline
Show answer & explanation
Correct: D — compare current metrics to the baseline. Intermittent slowness is diagnosed by gathering data first: comparing live latency, loss, and utilization along the path against the known-good baseline isolates where the degradation is, following proper troubleshooting methodology.
Why not the others: rebranding (A) is irrelevant; deleting accounts (B) is destructive and unrelated; wholesale hardware replacement (C) is a drastic guess before the cause is even known.
Source: CompTIA CloudNetX objectives — Performance troubleshooting →A company must restrict access to sensitive cloud resources based on where the user is connecting from. Which control best enforces this?
- Increasing monitor resolution
- Conditional access with geolocation-based policies
- Adding more cloud providers
- Removing firewall rules to simplify access
Show answer & explanation
Correct: B — geolocation-based conditional access. Conditional-access policies that evaluate location (alongside identity and device posture) can permit or block sessions by geography, which is the IAM control that enforces location-based access in a Zero Trust design.
Why not the others: monitor resolution (A) is irrelevant; adding providers (C) does not control access; removing firewall rules (D) weakens security rather than restricting access.
Source: CompTIA CloudNetX objectives — IAM solutions →Keep going: study guides and career paths
CloudNetX proves you can architect secure hybrid networks at scale — the top of CompTIA’s networking path. Two PowerKram hubs back this exam up.
Deep dive: CloudNetX exam structure, scoring, study path & where it sits
Exam structure and how it’s scored
CloudNetX (CNX-001) delivers a maximum of 90 questions in 165 minutes — a notably long sitting that reflects its expert level — combining multiple-choice items with demanding performance-based questions that drop you into a simulated hybrid-network design or troubleshooting task. Unlike CompTIA’s core exams, it is scored strictly pass/fail, with no scaled number reported. Performance-based items are time-consuming, so disciplined pacing across the long window matters more here than on a 90-minute exam. See our hybrid networking & security guides →
Where the weight sits and how to study
Network Architecture Design (31%) and Network Security (28%) together make up nearly 60% of the exam, with Network Troubleshooting (25%) close behind and Network Operations, Monitoring, and Performance (16%) the smallest area. Because the exam rewards architect-level judgment, reading alone will not carry you: build a reference hybrid design (hub-and-spoke or spine-and-leaf core, SD-WAN to branch sites, one cloud interconnect), wire in Zero Trust and IAM, capture the build in IaC, and stand up dashboards for latency, loss, and flow records. PowerKram’s objective-level scoring surfaces which of the four is weakest in your first practice run. Read the security practices guide →
Recommended experience and prerequisites
CloudNetX has no hard prerequisite, but it is genuinely an expert credential: CompTIA frames it for candidates with several years in a network-architect role and real hybrid-cloud experience, and many sources suggest a decade in IT overall. Network+, Security+, and Cloud+ (or equivalent knowledge) form a sensible foundation beneath it. The exam is delivered through Pearson VUE at a test center or online with a proctor; the online option needs a quiet, private room and a webcam system check. Fees and policies vary by region and change over time, so confirm the current voucher price on CompTIA’s site before you book. CompTIA’s official CloudNetX page →
Where CloudNetX sits in the CompTIA path
CloudNetX is part of CompTIA’s expert-tier Xpert series, sitting above the professional-level networking and security certifications. A common route is to build through Network+ and Cloud+ at the foundational and intermediate levels, add security depth, accumulate architecture experience, and then target CloudNetX to validate senior design capability. From here the career direction is firmly into architecture — network, security, and enterprise architect roles. For role-by-role context on where these senior paths lead, browse our Career Hub. Cloud Engineer role guide →
Frequently asked questions about the CloudNetX (CNX-001) exam
What are the CloudNetX (CNX-001) objective areas and weights?
How is the CloudNetX exam scored?
Does CloudNetX have prerequisites?
Where does CloudNetX sit in the CompTIA lineup?
When was CNX-001 released?
Start your free 24-hour CloudNetX practice trial
Full access to the question bank, both study modes, and objective-level scoring. No credit card required.
Start free trial →