Free CNX-001 practice test: 30 questions with answers

Network address translation at the boundary lets overlapping private ranges coexist by presenting mapped addresses that do not collide. Advertising identical prefixes creates ambiguous routes, removing routes breaks connectivity, and widening masks changes the addressing plan without solving the overlap.

Summarization replaces many specific prefixes with one aggregate route, which shrinks routing tables and update traffic. Path selection still depends on metrics and link costs, summarization does not encrypt updates, and end hosts still need a default gateway.

Spine-and-leaf gives predictable paths between leaves and scales by adding leaves or spines, which suits east-west traffic. A single core in a three-tier design becomes a bottleneck for east-west flows, a ring adds hops, and a flat unmanaged switch offers no segmentation or scale.

In this design endpoints connect to leaves and spines carry traffic between leaves, so each added spine adds parallel paths. Leaves are not cabled to each other in the standard model, and attaching endpoints to spines defeats the purpose of the layout.

SD-WAN combines several transports such as broadband and private circuits and steers applications using centrally managed policy. A single MPLS circuit lacks path diversity, a flat Layer 2 stretch over the internet is fragile, and static routes do not react to application performance.

An IPsec site-to-site tunnel encrypts and authenticates IP traffic between two gateways, which fits router-to-router protection over the internet. A plain GRE tunnel adds no encryption, an SSL portal is built for individual user access, and a VLAN extended over the internet is neither secure nor a sound site-to-site design.

A content delivery network caches content on geographically distributed edge servers, so most requests are served near readers and the origin sees less load. A bigger single origin, a funnel through one VPN concentrator, or a TCP window tweak does not address geographic latency or origin offload.

Layer 7 load balancers read HTTP request details such as path and headers, so they can send /api and /images to different pools and often terminate TLS. A Layer 4 balancer forwards by IP and port, a Layer 2 switch does not understand HTTP, and DNS round robin cannot inspect requests.

A stateful firewall keeps a table of active sessions, so it can permit return traffic that belongs to an allowed connection. A stateless filter evaluates each packet alone, and firewalls do not assign addresses, encrypt traffic or filter on MAC addresses for routed traffic.

NAC combined with 802.1X authenticates the device or user at the port and can assess posture, moving noncompliant endpoints into a quarantine network. Static port security only limits MAC addresses, a perimeter rule does not check endpoint health, and DHCP snooping protects address assignment rather than granting posture-based access.

Zero trust network access grants identity-based access to a specific application instead of the whole network, which matches least privilege. A full tunnel exposes the internal subnet, a shared account breaks accountability, and an open DMZ placement is risky for an unmanaged device.

A CASB sits between users and cloud services to give visibility into cloud use and enforce data and access policies. Leaf-spine routing, certificate issuance and request distribution are handled by other infrastructure, not by a CASB.

Certificates issued by an internal certificate authority give each device its own verifiable identity, which supports certificate-based wireless authentication. A shared wildcard certificate or pre-shared key is still a shared secret, and a captive portal serves guests rather than device identity.

Privileged access management grants elevated rights just in time, limits their duration and records sessions for audit. Shared permanent passwords, read-only SNMP strings and unauthenticated local accounts do not provide time-bound, individually accountable privilege.

SAE in WPA3-Personal performs a password-based key exchange that resists offline guessing from a captured handshake. Open authentication, WEP-style RC4 and captive portals do not provide that protection, and MAC filtering is easily spoofed.

Isolating guest traffic from internal networks and using 802.1X-based enterprise authentication both limit what a wireless client can reach and who may connect. Hiding the SSID is not a real control because clients still learn it during association, and WEP is broken and should not stay enabled.

Reachability by IP but not by name points to name resolution, so the DNS records and the resolver configuration are the first things to verify. The symptoms rule out general IP reachability problems, which makes MTU, VLAN assignment and subnet routing less likely causes.

The tunnel is up, so the problem lies in the routes delivered to the client or in the policy for that subnet, and checking them isolates the cause. Session lifetime and operating system reinstalls do not address the path, and PPTP is an obsolete protocol rather than a fix.

With the BGP session established, the next step is to confirm that routes for the cloud subnet are advertised and accepted in the right direction. DNS aliases, copper cabling for a fiber link and gateway changes do not address missing or filtered routes.

A repeated peak-time pattern points to congestion, so utilization and queue drops on the affected link show whether capacity is the bottleneck. DNS zone counts, firmware dates and SSID counts do not explain a time-of-day latency pattern.

Traceroute sends probes with increasing TTL values and reports each responding hop, so repeated loss or delay at one hop shows where the problem starts. Nslookup, ipconfig and netstat report DNS answers, local addresses and local sockets, not per-hop path behavior.

The logs show the firewall is denying the traffic, so a narrowly scoped permit rule for the client subnet and port is the targeted fix. Switch firmware, disabling logs and renaming hosts do not change the policy that is blocking the connection.

Error counters on each device and repeated probes from both ends reveal where and when loss occurs, which helps isolate intermittent faults. Rebooting the core switch disrupts service without evidence, and changing DNS servers does not measure packet loss.

Requiring a condition to persist over an evaluation window filters out brief spikes while still catching sustained degradation. Alerting on every sample creates noise, disabling thresholds hides problems until review, and waiting for user tickets is reactive.

Infrastructure as code with version control and automated pipelines makes the approved state the source of truth, so drift can be detected and corrected. Emailed summaries and yearly screenshots do not give continuous detection, and an untouched clone drifts from the live devices over time.

The recovery time objective is the target maximum downtime before a service must be restored. The recovery point objective refers to acceptable data loss, mean time between failures measures reliability, and MTU is a packet size setting.

A baseline comes from historical performance data and documented normal ranges, so later deviations stand out. Vendor default thresholds are not tuned to the environment, and one screenshot at installation says nothing about normal behavior over time.

Flow records such as NetFlow or IPFIX summarize conversations, which shows the top talkers and applications on a congested link. Error counters, link-state syslog and ping sweeps do not show how traffic volume is distributed among hosts.

A small share of slow requests can barely move the average while still hurting users, so percentile metrics expose the tail more clearly. Encryption does not prevent averaging, no standard requires percentile reporting to activate a link, and averages cover all samples rather than just the first packet.

Idempotent automation checks the current state and changes only what differs, so repeated runs converge to the same result. Concurrency, versioning and rollback are useful practices, but they are not what a no-change second run demonstrates.