CNX-001 practice questions 31–40

1. Question 31 · 81 in bank

   After a malicious actor used an open port in a company's lobby, a network architect needs to enhance network security. The solution must enable: Security posture check - Auto remediation capabilities - Network isolation - Device and user authentication - Which of the following technologies best meets these requirements?

   • AIPS
   • BMicrosegmentation
   • C802.1X
   • DNAC

   Show answer

   Answer: D

   Next question

2. Question 32 · 81 in bank

   A company deployed new applications in the cloud and configured a site-to-site VPN to connect the internal data center with the cloud. The IT team wants the internal servers to connect to those applications without using public IP addresses. Which of the following is the best solution?

   • ACreate a DNS server in the cloud. Configure the DNS server in the customer data center to forward DNS requests for cloud resources to the cloud DNS server.
   • BConfigure a NAT server on the cloud to allow internal servers to connect to the applications through the NAT server.
   • CRegister applications on the cloud with a public DNS sever and configure internal servers to connect to them using their public DNS names.
   • DConfigure proxy service in the site-to-site VPN to allow internal servers to access applications through the proxy.

   Show answer

   Answer: A

   Next question

3. Question 33 · 81 in bank

   An outage occurred after a software upgrade on core switching. A network administrator thinks that the firmware installed had a bug. Which of the following should the network administrator do next?

   • AEstablish a plan of action to resolve the issue.
   • BTest the theory to determine cause.
   • CDocument lessons learned.
   • DImplement the solution.

   Show answer

   Answer: B

   Next question

4. Question 34 · 81 in bank

   A network engineer identified several failed log-in attempts to the VPN from a user's account. When the engineer inquired, the user mentioned the IT help desk called and asked them to change their password. Which of the following types of attacks occurred?

   • AInitialization vector
   • BOn-path
   • CEvil twin
   • DSocial engineering

   Show answer

   Answer: D

   Next question

5. Question 35 · 81 in bank

   A company is replacing reserved public IP addresses with dynamic IP addresses. The network architect creates a list of assets with some dependencies to these reserved IPs:

   

   Which of the following issues may begin to affect cloud assets after the replacement is made?

   • AIP asymmetric routing
   • BIP spoofing
   • CIP exhaustion
   • DIP reuse

   Show answer

   Answer: D

   Next question

6. Question 36 · 81 in bank

   Select 2

   A network architect needs to design a solution to ensure every cloud environment network is built to the same baseline. The solution must meet the following requirements: Use automated deployment. Easily update multiple environments. Share code with a community of practice. Which of the following are the best solutions? (Choose two.)

   • ACI/CD pipelines
   • BPublic code repository
   • CDeployment runbooks
   • DPrivate code repository
   • EAutomated image deployment
   • FDeployment guides

   Show answer

   Answer: AB

   Next question

7. Question 37 · 81 in bank

   A network engineer adds a large group of servers to a screened subnet and configures them to use IPv6 only. The servers need to seamlessly communicate with IPv4 servers on the internal networks. Which of the following actions is the best way to achieve this goal?

   • AAdd IPv6 to the network cards on the internal servers so they can communicate with the screened subnet.
   • BSet up a bridge between the screened subnet and internal networks to handle the conversion.
   • CChange the servers in the screened subnet from IPv6 addresses to IPv4 addresses.
   • DImplement NAT64 on the router between the screened subnet and the internal network.

   Show answer

   Answer: D

   Next question

8. Question 38 · 81 in bank

   A customer asks a MSP to propose a ZTA design for its globally distributed remote workforce. Given the following requirements: Authentication should be provided through the customer's SAML identity provider. Access should not be allowed from countries where the business does not operate. Secondary authentication should be added to the workflow to allow for passkeys. Changes to the user's device posture and hygiene should require reauthentication into the network. Access to the network should only be allowed to originate from corporate-owned devices. Which of the following solutions should the MSP recommend to meet the requirements?

   • AEnforce certificate-based authentication. Permit unauthenticated remote connectivity only from corporate IP addresses. Enable geofencing. Use cookie-based session tokens that do not expire for remembering user log-ins. Increase RADIUS server timeouts.
   • BEnforce posture assessment only during the initial network log-on. Implement RADIUS for SSO. Restrict access from all non-U.S. IP addresses. Configure a BYOD access policy. Disable auditing for remote access.
   • CChain the existing identity provider to a new SAML. Require the use of time-based one-time passcode hardware tokens. Enable debug logging on the VPN clients by default. Disconnect users from the network only if their IP address changes.
   • DConfigure geolocation settings to block certain IP addresses. Enforce MFA. Federate the solution via SSO. Enable continuous access policies on the WireGuard tunnel. Create a trusted endpoints policy.

   Show answer

   Answer: D

   Next question

9. Question 39 · 81 in bank

   Application development team users are having issues accessing the database server within the cloud environment. All other users are able to use SSH to access this server without issues. The network architect reviews the following information to troubleshoot the issue: IPAM information:

   

   Traceroute output from an application developer's machine with the assigned IP 192.168.2.7:

   

   Which of the following is the most likely cause of the issue?

   • AThe core firewall is blocking the traffic.
   • BNetwork security groups do not have the correct outbound rule configured.
   • CThe server segment firewall is dropping the traffic.
   • DThe server segment gateway is having bandwidth issues.

   Show answer

   Answer: C

   Next question

10. Question 40 · 81 in bank

    A partner is migrating a client from on premises to a hybrid cloud. Given the following project status information, the initial project timeline estimates need to be revised:

    

    Which of the following documents needs to be revised to best reflect the current status of the project?

    • ABIA
    • BSLA
    • CSOW
    • DWBS

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CNX-001 practice, question 31. 81 questions available.