あなたを必ず合格させるCNX-001問題集PDF 2026年最新のに更新されたのは86問あります
CompTIA CNX-001リアル試験問題と解答を無料で提供いたします
CompTIA CNX-001 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
| トピック 4 |
|
質問 # 15
After a company migrated all services to the cloud, the security auditor discovers many users have administrator roles on different services. The company needs a solution that:
Protects the services on the cloud.
Limits access to administrative roles.
Creates a policy to approve requests for administrative roles on critical services within a limited time.
Forces password rotation for administrative roles.
Audits usage of administrative roles.
Which of the following is the best way to meet the company's requirements?
- A. Privileged access management
- B. Conditional access
- C. Access control list
- D. Session-based token
正解：A
解説：
A Privileged Access Management (PAM) solution provides just-in-time elevation to administrative roles, enforces approval workflows with time-bound access, requires credential rotation, and offers comprehensive auditing of all privileged sessions, fully meeting the company's requirements.
質問 # 16
You are designing a campus network with a three-tier hierarchy and need to ensure secure connectivity between locations and traveling employees.
INSTRUCTIONS
Review the command output by clicking on the server, laptops, and workstations on the network.
Use the drop-down menus to determine the appropriate technology and label for each layer on the diagram.
Options may only be used once.
Click on the magnifying glass to make additional configuration changes.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
正解：
解説：
質問 # 17
A company is expanding its network and needs to ensure improved stability and reliability. The proposed solution must fulfill the following requirements:
* Detection and prevention of network loops
* Automatic configuration of ports
* Standard protocol (not proprietary)
Which of the following protocols is the most appropriate?
- A. SIP
- B. BGP
- C. STP
- D. RTSP
正解：C
解説：
Comprehensive and Detailed Explanation From Exact Extract:
STP (Spanning Tree Protocol) is a Layer 2 standard protocol that prevents switching loops in Ethernet networks by creating a loop-free logical topology. It can automatically block and unblock redundant paths based on network changes, ensuring reliability and avoiding broadcast storms.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Ethernet Loop Prevention and Switching Protocols":
"STP is a standard Layer 2 protocol used to detect and prevent network loops, enhancing network stability in switched topologies." Other options:
* B. SIP is a signaling protocol used in VoIP.
* C. RTSP is for media streaming control.
* D. BGP is a routing protocol, not for Layer 2 loop prevention.
質問 # 18
An architecture team needs to unify all logging and performance monitoring used by global applications across the enterprise to perform decision-making analytics. Which of the following technologies is the best way to fulfill this purpose?
- A. CIEM
- B. Content delivery network
- C. Data lake
- D. Relational database
正解：C
解説：
Comprehensive and Detailed Explanation From Exact Extract:
A data lake is ideal for aggregating structured and unstructured data at scale. It supports storage and analysis of logs, performance metrics, and other telemetry data from various sources. Data lakes enable advanced analytics and machine learning for decision support.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Data Aggregation and Analytics":
"Data lakes allow storage and analysis of high-volume, diverse data types, including logs and monitoring data. They support enterprise-wide visibility and strategic decision-making." Other options:
* A. Relational databases are optimized for structured data and are less scalable for log aggregation.
* B. CDNs deliver content, not used for data aggregation.
* C. CIEM (Cloud Infrastructure Entitlement Management) governs cloud permissions, not logging.
質問 # 19
A network architect must design a new branch network that meets the following requirements:
* No single point of failure
* Clients cannot be impacted by changes to the underlying medium
* Clients must be able to communicate directly to preserve bandwidth
Which of the following network topologies should the architect use?
- A. Star
- B. Mesh
- C. Hub-and-spoke
- D. Spine-and-leaf
正解：B
解説：
Comprehensive and Detailed Explanation From Exact Extract:
A Mesh topology provides multiple redundant paths between all nodes, ensuring there is no single point of failure. Clients can communicate directly with each other without passing through a central hub, reducing bottlenecks and preserving bandwidth. Mesh networks are fault tolerant and resilient to changes in the underlying medium, making them ideal for distributed environments requiring high availability.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "WAN and LAN Topologies":
"In a mesh topology, every device is connected to every other device. This design offers fault tolerance and allows for direct communication paths between endpoints, maximizing bandwidth efficiency and eliminating single points of failure." Other options:
* A. Hub-and-spoke introduces a central point of failure and may limit bandwidth.
* C. Spine-and-leaf is ideal for data centers but not typically used for branch office designs.
* D. Star topology relies on a central switch and has a single point of failure.
質問 # 20
A company provides an API that runs on the public cloud for its customers. A fixed number of VMs host the APIs. During peak hours, the company notices a spike in usage that results in network communication speeds slowing down for all customers. The management team has decided that access for all customers should be fair and accessible at all times. Which of the following is the most cost-effective way to address this issue?
- A. Enable throttling on APIs.
- B. Increase the number of VMs running APIs.
- C. Use an allow list for customers using APIs.
- D. Increase the MTU on the VMs.
正解：A
質問 # 21
A cafe uses a tablet-based point-of-sale system. Customers are complaining that their food is taking too long to arrive. During an investigation, the following is noticed:
* Every kitchen printer did not print the orders
* Payments are processing correctly
* The cloud-based system has record of the orders
* This issue occurred when the cafe was busy
Which of the following is the best way to mitigate this issue?
- A. Updating the application
- B. Adding an access point exclusively for the kitchen
- C. Upgrading the kitchen printers' wireless dongles
- D. Assigning the kitchen printers static IP addresses
正解：B
解説：
Comprehensive and Detailed Explanation From Exact Extract:
Since payments are working and orders are being recorded in the cloud, the issue likely lies in the local wireless network between the tablets and the kitchen printers. If the issue only occurs during high usage periods, it's likely a congestion or signal quality issue. Adding a dedicated access point for the kitchen can isolate printer traffic and improve reliability.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Wireless Performance and Interference Management":
"Segmenting traffic or deploying dedicated APs for mission-critical devices can reduce contention and ensure reliability in congested wireless environments." Other options:
* A. App updates won't fix wireless interference.
* C. Dongle upgrades may help but don't isolate the traffic.
* D. Static IPs help with addressing, not with wireless reliability.
質問 # 22
A network architect needs to design a solution to ensure every cloud environment network is built to the same baseline. The solution must meet the following requirements:
* Use automated deployment.
* Easily update multiple environments.
* Share code with a community of practice.
Which of the following are the best solutions? (Choose two.)
- A. Deployment runbooks
- B. Deployment guides
- C. Public code repository
- D. CI/CD pipelines
- E. Private code repository
- F. Automated image deployment
正解：C、D
解説：
Comprehensive and Detailed Explanation From Exact Extract:
A: CI/CD pipelines - Continuous Integration and Continuous Deployment (CI/CD) pipelines allow automated and repeatable deployments of infrastructure and application code. This ensures consistency across environments and supports rapid, reliable updates to multiple environments simultaneously.
B: Public code repository - A public repository (e.g., GitHub, GitLab public projects) allows sharing code with the broader community of practice, enabling collaboration, peer review, and reuse. It supports version control and standardized deployment scripts (e.g., Terraform, Ansible).
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Infrastructure as Code and Automation Pipelines":
"CI/CD pipelines enable automated, consistent deployments across environments, reducing manual configuration errors."
"Public repositories facilitate code sharing and collaboration, supporting standardized infrastructure templates." Other options:
* C. Deployment runbooks are static and not inherently automated.
* D. Private repositories restrict sharing, conflicting with the requirement to share code.
* E. Image deployment refers to server builds, not full network configuration.
* F. Deployment guides are manual documents, not automation tools.
質問 # 23
A company's IT department is expected to grow from 100 to 200 employees, and the sales department is expected to grow from 1,000 to a maximum of 2,000 employees. Each employee owns a single laptop with a single IP allocated. The network architect wants to deploy network segmentation using the IP range 10.0.0.0
/8. Which of the following is the best solution?
- A. Allocate 10.1.0.0/22 to the IT department. Allocate 10.2.0.0/15 to the sales department.
- B. Allocate 10.1.0.0/16 to the IT department. Allocate 10.2.1.0/25 to the sales department.
- C. Allocate 10.1.0.0/30 to the IT department. Allocate 10.2.0.0/16 to the sales department.
- D. Allocate 10.1.0.0/16 to the IT department. Allocate 10.2.1.0/24 to the sales department.
正解：A
解説：
A /22 gives you 1,022 usable addresses, ample headroom for 200 IT laptops, while a /15 yields 32,766 addresses, covering up to 2,000 sales laptops with room to grow, all within the 10.0.0.0/8 space.
質問 # 24
A company hosts its applications on the cloud and is expanding its business to Europe. Thecompany must comply with General Data Protection Regulation (GDPR) to limit European customers' access to data. The network team configures the firewall rules but finds that some customers in the United States can access data hosted in Europe. Which of the following is the best option for the network team to configure?
- A. CDN
- B. SASE
- C. Geofencing rule
- D. Network security groups
正解：C
解説：
Comprehensive and Detailed Explanation From Exact Extract:
Geofencing allows enforcement of access policies based on the geographic location of the user's IP address.
To comply with GDPR and control access based on user region, geofencing should be implemented to restrict or permit access to resources hosted in specific regions like Europe.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Data Sovereignty and Regional Access Control":
"Geofencing enables organizations to restrict access to data or services based on geographic IP address, aiding in GDPR and other compliance frameworks." Other options:
* A. SASE is a broader framework, not a direct access control mechanism.
* B. NSGs operate at subnet/NIC level and do not interpret geolocation.
* C. CDNs cache data globally but don't control access by region directly.
質問 # 25
A network architect is choosing design options for a new SD-WAN installation that has the following requirements:
All network traffic from the cloud must pass through inspection devices in a dedicated data center.
Ensure redundancy.
Centralize egress traffic.
Which of the following network topologies best meets these requirements?
- A. Star
- B. Partial mesh
- C. Point-to-point
- D. Hub-and-spoke
正解：D
解説：
A hub-and-spoke design sends all branch and cloud traffic into the central hub (your data center) for inspection, then back out, meeting the requirement for centralized egress and security inspection. By deploying multiple hub nodes and using dynamic path selection, you also achieve redundancy without losing the centralized control plane.
質問 # 26
A company is expanding operations and opening a new facility. The executive leadership team decides to purchase an insurance policy that will cover the cost of rebuilding the facility in case of a natural disaster.
Which of the following describes the team's decision?
- A. Disaster recovery
- B. Risk transference
- C. Business continuity
- D. Memorandum of understanding
正解：B
解説：
By purchasing an insurance policy, the company shifts the financial burden of rebuilding after a natural disaster to the insurer, which is the essence of risk transference.
質問 # 27
A network engineer at an e-commerce organization must improve the following dashboard due to a performance issue on the website:
(Refer to the image: Website performance monitoring dashboard showing metrics like network usage, CPU usage, memory usage, and disk usage over time.)
Which of the following is the most useful information to add to the dashboard for the operations team?
- A. Number of orders
- B. Concurrent users
- C. 404 errors
- D. Number of active incidents
正解：B
解説：
Comprehensive and Detailed Explanation From Exact Extract:
While resource usage metrics (CPU, memory, disk, network) are important, the missing context here is user demand. Adding "Concurrent users" helps correlate resource utilization spikes with actual user load. For performance monitoring in web applications, concurrent sessions provide crucial insight into whether performance issues are demand-related.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Performance Monitoring and User Metrics":
"Monitoring user load metrics such as concurrent users provides insight into performance degradation and capacity planning. These are critical for identifying thresholds and auto-scaling requirements." Other options:
* A. 404 errors indicate broken links but don't explain performance issues.
* C. Number of orders tracks business activity, not system strain.
* D. Active incidents belong in an ITSM system, not real-time performance monitoring.
質問 # 28
A company is experiencing multiple switch failures. The network analyst discovers the following:
* Network recovery time is unacceptable and occurs after the shutdown of some switches.
* Some loops were detected in the network.
* No broadcast storm was detected.
Which of the following is the most cost-effective solution?
- A. Implement STP.
- B. Implement tagging.
- C. Add a new Layer 3 switch.
- D. Add multiple VLANs.
正解：A
解説：
Comprehensive and Detailed Explanation From Exact Extract:
Spanning Tree Protocol (STP) is a Layer 2 protocol that prevents loop conditions in redundant switch topologies. It automatically disables redundant links in a controlled way, allowing one active path at a time.
When a switch fails, STP recalculates and activates an alternate path. In this case, loops are detected, but no broadcast storms occurred, indicating that STP is not in place or not configured properly. Implementing STP is a low-cost and effective solution to resolve these issues.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Switching Technologies and Loop Prevention":
"STP prevents switching loops by dynamically identifying and disabling redundant paths. When a link failure occurs, STP re-converges to restore network connectivity."
"STP is an essential protocol in redundant Layer 2 topologies to avoid broadcast and loop issues." Other options:
* A. A Layer 3 switch adds routing functionality but does not prevent Layer 2 loops.
* B. VLANs segment broadcast domains but do not inherently prevent physical loops.
* D. Tagging (e.g., VLAN tagging) helps with segmentation but not with loop prevention.
質問 # 29
An administrator logged in to a cloud account on a shared machine but forgot to log out after the session ended. Which of the following types of security threats does this action pose?
- A. IP spoofing
- B. On-path attack
- C. Privilege escalation
- D. Zero-day
正解：C
解説：
Comprehensive and Detailed Explanation From Exact Extract:
Failing to log out of a privileged session on a shared device leaves that session accessible to the next user, potentially granting unauthorized access to administrative functions. This scenario aligns with privilege escalation, where an individual gains access to higher-level permissions than they are authorized to have.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Access Control and Security Threats":
"Privilege escalation occurs when a user gains elevated access rights, often due to misconfigurations or negligence, such as unattended administrative sessions." Other options:
* A. IP spoofing involves falsifying source IP addresses.
* B. Zero-day refers to unknown software vulnerabilities.
* C. On-path attacks involve intercepting traffic, not session misuse on local devices.
質問 # 30
A network administrator is troubleshooting a user's workstation that is unable to connect to the company network. The results of commands the administrator runs on the workstation are shown below:
A router on the same network shows the following output:
Which of the following is themostlikely cause of the issues?
- A. Asynchronous routing
- B. Broadcast storm
- C. IP address conflict
- D. DHCP server down
正解：C
質問 # 31
Security policy states that all inbound traffic to the environment needs to be restricted, but all external outbound traffic is allowed within the hybrid cloud environment. A new application server was recently set up in the cloud. Which of the following would most likely need to be configured so that the server has the appropriate access set up? (Choose two.)
- A. Network security group
- B. Port security
- C. Application gateway
- D. Screened subnet
- E. Firewall
- F. IPS
正解：A、E
解説：
A perimeter firewall enforces the organization's "deny inbound by default, allow all outbound" policy at the edge of the cloud environment, while an Azure-style NSG applies the same rule set at the VM/subnet level.
Together they ensure no inbound connections slip through and that outbound traffic remains unrestricted.
質問 # 32
A network engineer is working on securing the environment in the screened subnet. Before penetration testing, the engineer would like to run a scan on the servers to identify the OS, application versions, and open ports. Which of the following commands should the engineer use to obtain the information?
- A. hping3 -1 10.10.10.x -rand-dest -I eth0
- B. nc -v -n 10.10.10.x 1-1000
- C. nmap -A 10.10.10.0/28
- D. tcpdump -ni eth0 src net 10.10.10.0/28
正解：C
解説：
The -A flag enables aggressive scanning, which combines OS detection, version detection, script scanning, and traceroute to give you detailed information on hosts in the 10.10.10.0/28 range.
質問 # 33
End users are getting certificate errors and are unable to connect to an application deployed in a cloud. The application requires HTTPS connection. A network solution architect finds that a firewall is deployed between end users and the application in the cloud. Which of the following is the root cause of the issue?
- A. The firewall has an expired certificate while SSL/HTTPS inspection is enabled.
- B. The end users do not have certificates on their laptops.
- C. The firewall on the application server has port 443 blocked.
- D. The firewall has port 443 blocked while SSL/HTTPS inspection is enabled.
正解：A
解説：
Comprehensive and Detailed Explanation From Exact Extract:
When SSL/HTTPS inspection is enabled on a firewall, it intercepts and decrypts HTTPS traffic. This requires the firewall to present its own trusted certificate to the client device. If that certificate is expired, the client browser will display a certificate error and block access to the application. This is a common misconfiguration that breaks HTTPS communication.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "TLS/SSL Inspection and Certificate Management":
"SSL inspection appliances must have valid certificates installed. Expired or untrusted certificates will result in browsers rejecting the HTTPS session and displaying errors to users." Other options:
* A. Would prevent connection, but not result in certificate errors.
* B. Blocked port 443 would prevent any connection, not cause cert errors.
* C. Client-side certificates are not required unless mutual TLS is configured, which is not stated here.
質問 # 34
New devices were deployed on a network and need to be hardened.
INSTRUCTIONS
Use the drop-down menus to define the appliance-hardening techniques that provide themostsecure solution.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
正解：
解説：
Explanation:
質問 # 35
A large commercial enterprise that runs a global video streaming platform recently acquired a small business that serves customers in a geographic area with limited connectivity to the global telecommunications infrastructure. The executive leadership team issued a mandate to deliver the highest possible video streaming quality to all customers around the world. Which of the following solutions should the enterprise architect suggest to meet the requirements?
- A. Utilize CDN for all customers regardless of geographic location.
- B. Serve the customers in the acquired area with a highly compressed version of content.
- C. Deploy multiple local load balancers in the newly added geographic area.
- D. Use a geographically weighted DNS solution to distribute the traffic.
正解：A
解説：
A global Content Delivery Network caches and serves video streams from edge nodes close to end users, minimizing latency and packet loss over limited backhaul links and ensuring the highest possible quality everywhere. By offloading traffic to a CDN, even customers in regions with constrained connectivity will receive optimized streams from the nearest POP rather than traversing the congested core network.
質問 # 36
A network architect is designing a new network for a rural hospital system. Given the following requirements:
*Highly available
*Consistent data transmission
*Resilient to simultaneous failures
Which of the following topologies should the architect use?
- A. Collapsed core
- B. Star
- C. Hub-and-spoke
- D. Mesh
正解：B
解説：
A full-mesh topology provides multiple redundant, direct paths between every site, eliminating single points of failure, ensuring consistent transmission even if one or more links fail, and maximizing overall availability.
質問 # 37
An organization wants to evaluate network behavior with a network monitoring tool that is not inline. The organization will use the logs for further correlation and analysis of potential threats. Which of the following is thebestsolution?
- A. Syslog to a common dashboard used in the NOC
- B. SNMP trap with log analytics
- C. NetFlow to feed into the SIEM
- D. SSL decryption of network packets with preconfigured alerts
正解：C
解説：
NetFlow provides detailed, flow-level metadata (source/destination IPs, ports, protocols, byte counts, timestamps) without sitting inline. By exporting these records into your SIEM, you gain centralized logging and can correlate network behaviors with other security events for threat detection and analysis.
質問 # 38
A security architect needs to increase the security controls around computer hardware installations. The requirements are:
Auditable access logs to computer rooms
Alerts for unauthorized access attempts
Remote visibility to the inside of computer rooms
Which of the following controls best meet these requirements? (Choose two.)
- A. NFC access cards
- B. Security patrols
- C. Automated lighting
- D. Motion sensors
- E. Locks and keys
- F. Video surveillance
正解：A、F
解説：
Video surveillance provides continuous, remote visibility into computer rooms and can be integrated with analytics to generate alerts on unauthorized presence.
NFC access cards enforce controlled entry with a system that logs every card swipe and issues alerts on failed or out-of-hours attempts, giving you auditable access records and immediate notifications of any suspicious activity.
質問 # 39
......
合格できるCompTIA CNX-001試験情報と無料練習テスト：https://www.passtest.jp/CompTIA/CNX-001-shiken.html
2026年最新のの問題CNX-001問題集を試そう！更新されたCompTIA試験が合格できます：https://drive.google.com/open?id=1WAdt53l9ynimXYYwrWNpUyY8LhwLpR9I