CompTIA CloudNetX: What CNX-001 Asks You to Decide

What Kind of Exam Is CompTIA CloudNetX?

CompTIA CloudNetX, exam code CNX-001, is an expert level, vendor-neutral network architecture exam in the CompTIA Xpert Series. It asks a maximum of 90 multiple choice and performance-based questions in a maximum of 165 minutes, is reported as pass or fail with no scaled score, and is delivered in English through Pearson VUE.

The four domains and their weights are Network Architecture Design at 31 percent, Network Security at 28 percent, Network Troubleshooting at 25 percent, and Network Operations, Monitoring, and Performance at 16 percent. Design and security together account for well over half of the exam.

Who CompTIA has in mind

The official CloudNetX page recommends at least ten years of IT experience, including five years in a network architect role, with hybrid cloud environments and knowledge equivalent to Network+, Security+ and Cloud+. That recommendation explains the question style better than any study tip: the exam is written for people who already make design decisions, and it tests the decisions rather than the vocabulary.

“For seasoned network professionals CompTIA CloudNetX can help them enhance and validate the advanced skills needed to excel in these complex environments.”

Why Does Almost Every CloudNetX Objective Start With a Scenario?

CloudNetX objectives start with a scenario because the exam measures judgement, not recall. Of the 25 objectives in the CNX-001 blueprint, 22 begin with the words “Given a scenario” and only three begin with “Explain”. In practice that means most items describe a situation first and only then ask a question about it.

The three “Explain” objectives are the threats, vulnerabilities and mitigations objective in Network Security, the operating and maintenance concepts objective in Network Operations, and the troubleshooting methodology objective in Network Troubleshooting. Those are where a short, direct item is most likely. Everything else asks you to analyze, select, configure, apply, use, evaluate or troubleshoot something inside a described environment.

The verb after the scenario tells you what kind of answer is wanted. “Select” and “recommend” mean several options are technically valid and one fits the constraints best. “Configure” and “implement” point to doing the work, which is where simulations live. “Analyze output” means the evidence is on screen and you have to read it. If you want to see how that wording turns into actual items, work through the CloudNetX sample questions and label each one by the objective verb it serves.

How Does a Requirements-Led Design Question Read?

A CloudNetX design question reads like a short client brief. It sets out what the business needs, the limits it works within and sometimes a compliance demand, then offers designs that are all workable somewhere. Six of the eight objectives in Network Architecture Design explicitly tie the choice to business requirements or business needs, so the brief decides the answer.

Find the constraint that rules options out

Most design items contain one phrase that eliminates half the answers. A requirement for a private path into a cloud provider points away from direct internet access and toward options such as ExpressRoute, Direct Connect or a software-defined cloud interconnect. A need for consistent policy across many branches favours SD-WAN over separate site-to-site VPNs. An availability target that must survive the loss of a whole site changes a local load balancer answer into a global one with regions and availability zones.

Separate the requirement types

The documentation objective names three kinds of requirement: business, technical and regulatory compliance. Reading a scenario with those three labels in mind is useful. Business requirements tell you about cost, time to market and growth. Technical ones tell you about latency, throughput and existing equipment. Compliance ones override both, so an option that is cheaper and faster still loses if it breaks a data residency rule.

Expect the physical layer too

CloudNetX is not only about cloud. The design domain includes campus wired and wireless components, power with UPS, PDU and generator choices, cooling measured in BTUs, and physical access controls. A scenario about a new floor or branch can turn on PoE budgets, a collapsed core versus a three-tier hierarchy, or whether 6GHz Wi-Fi is worth planning for.

What Does a CloudNetX Simulation Ask You to Do?

A CloudNetX simulation asks you to work inside an approximation of a real tool, such as a firewall console, a network diagram or a terminal, and produce a working result. CompTIA lists CloudNetX among its exams with simulation performance-based questions. These items allow more than one valid path, and scoring accounts for different possible approaches.

CompTIA’s guide to performance-based questions explained sets out how simulations behave, and three of those behaviours shape your exam strategy:

• A simulation covers the whole testing area and has a reset button, so a wrong start can be undone.
• You can skip a simulation and return to it later. Your work is saved as you go and when you move to another item.
• Partial credit may be given, so a simulation that you cannot finish is still worth attempting.

Virtual environment PBQs, which run full virtual machines and cannot be skipped, are a different item type. CompTIA lists SecurityX as the exam with both kinds; CloudNetX is listed with simulations only. That matters for pacing: you are free to move past a simulation that stalls you, answer the multiple choice items, and come back with the remaining time.

Which objectives suit a simulation

CompTIA does not publish how many simulations CNX-001 contains or which objectives they cover. The objective wording still gives a strong hint. The only objective phrased “configure” asks you to set firewall rules, network access control lists, network security groups, IPS and IDS signature rules, geolocation rules, URL filtering, DLP controls and port security. Treat that objective, along with the “use the appropriate tool or command” objective, as the most hands-on part of your preparation.

Where Do Tool Outputs and Commands Come In?

Tool output comes in through Network Troubleshooting, which carries 25 percent of CNX-001. Two of its objectives are about tools: one asks you to choose the right tool or command for a scenario, and the next asks you to analyze output from those tools to resolve performance, connectivity, and access and security issues.

The named tools are Wireshark, Netcat, Nmap, iperf, radclient, OpenSSL and Postman, with a spectrum analyzer, a heat map and a SIEM added for output analysis. The command list runs from ping, traceroute, nslookup and ipconfig to dig, mtr, ss, ip, tcpdump, snmpwalk and nfdump. You will not be asked to recite their flags in isolation. You will be shown what they returned, or asked which one would answer a specific question fastest.

Symptoms the exam names

The connectivity, performance and Wi-Fi objectives list the faults you are expected to recognise from that output. A few are worth practising until they feel obvious:

• Asymmetric routing, routing loops and BGP issues that appear in path traces
• MTU problems from misconfigured jumbo frames or fragmentation
• NAT table exhaustion, port exhaustion and IP address exhaustion
• Channel overlap, incorrect channel width and sticky clients on Wi-Fi
• Expired, revoked or mismatched certificates behind TLS failures

The methodology objective is the one “Explain” item in this domain, and it supports every other one: identify the problem, form a theory, test it, plan the fix, implement or escalate, verify, then document. Scenario answers that skip straight to a fix without testing the theory are often the distractors.

Which Frameworks Does the Security Domain Expect You to Know?

The CloudNetX security domain expects you to recognise the main threat models and control frameworks by name and know when each applies. Its mitigations list names the MITRE ATT&CK framework, the Cyber Kill Chain, the Cloud Controls Matrix, CIS benchmarks and the OWASP top 10, and a separate objective covers Zero Trust architecture.

For threat behaviour, MITRE ATT&CK is the reference to be comfortable with, because a scenario may describe an attacker’s actions and ask which mitigation interrupts them. The exam’s threat list includes BGP hijacking, on-path attacks, evil twin and rogue access points, credential reuse and data exfiltration, all of which map naturally to an ATT&CK style reading of what the attacker is trying to achieve.

Cloud controls and Zero Trust

For cloud governance questions, the Cloud Security Alliance’s Cloud Controls Matrix is the framework the blueprint names directly. It is a control catalogue, so knowing its purpose is more useful for the exam than memorising its domains.

The Zero Trust objective covers microsegmentation, SASE and SSE, CASB, identity as the perimeter, device trust, least privilege and Zero Trust network access. NIST’s Zero Trust Architecture publication, SP 800-207, gives the clearest vendor-neutral description of those ideas. In a scenario, the Zero Trust answer is usually the one that verifies every request and limits what a compromised device can reach, rather than the one that builds a stronger perimeter.

How Should You Plan for a Pass or Fail Result?

Plan for CloudNetX’s pass or fail result by preparing evenly across all four domains. CompTIA reports CNX-001 as pass or fail with no scaled score, so there is no published target number to aim at and no score report that tells you how close you came. The only safe plan is broad readiness.

That has two practical effects. First, a practice test percentage is a rough signal at best, because there is no official cut score to compare it with. Second, you cannot plan to bank marks in design and coast through operations. Operations is the smallest domain at 16 percent, but it covers SLAs and SLOs, RPO and RTO, cost management with OpEx and CapEx, infrastructure as code, GitOps and change management, and those topics also appear inside design and troubleshooting scenarios.

If you want the topic by topic picture of each domain before you start practising, the CloudNetX domain breakdown on this site walks through all four in detail.

A Preparation Sequence Built Around Question Types

A useful CloudNetX preparation sequence follows the item types in the CNX-001 blueprint rather than a reading list. Start with the few concept objectives, move to design scenarios, then to configuration and tool practice, and finish with timed mixed sets that rehearse skipping and returning to simulations.

1. Learn the three Explain objectives first, threats and mitigations, operating concepts and the troubleshooting methodology, because every scenario leans on them.
2. Practise design scenarios by underlining the business, technical and compliance requirement in each one before looking at the options.
3. Build or borrow a lab and configure firewall rules, security groups and access lists until the configure objective feels routine.
4. Run the named tools and commands against a working network, then break it on purpose and read the output.
5. Map each security scenario to ATT&CK tactics and Zero Trust principles to see which mitigation fits.
6. Sit timed mixed sets, skip any simulation that stalls you, and return to it once the multiple choice items are done.

Keep a log of every wrong answer with the objective it came from. A cluster of misses in one objective tells you where to go back to the lab; misses spread across objectives usually mean you are reading the scenario too fast. For extra exam day pacing advice, see the CloudNetX preparation tips page.

Frequently Asked Questions

How many questions are on the CompTIA CloudNetX exam?

CNX-001 has a maximum of 90 questions, mixing multiple choice items with performance-based simulations. CompTIA states an upper limit rather than a fixed count, so plan your pacing around the 165 minute maximum rather than an exact number of items.

What is the passing score for CNX-001?

There is no published passing score. CompTIA reports CloudNetX as pass or fail only, with no scaled score, so candidates receive a result rather than a number.

Does CloudNetX have performance-based questions?

Yes. CompTIA lists CloudNetX among its exams with simulation performance-based questions. Simulations have a reset button, can be skipped and revisited, and may earn partial credit.

Can I skip a simulation on CNX-001 and come back to it?

Yes. Simulation PBQs can be skipped and returned to later, and your work is saved as you move between items. Only virtual environment PBQs, which CompTIA lists for SecurityX, must be completed when they appear.

How much does the CloudNetX exam cost?

The CNX-001 exam price is $544 in US dollars, and the exam is scheduled through Pearson VUE.

What experience does CompTIA recommend before CloudNetX?

CompTIA recommends at least ten years of IT experience, including five years in a network architect role, with hybrid cloud environments and knowledge equivalent to Network+, Security+ and Cloud+.

Which CloudNetX domain carries the most weight?

Network Architecture Design carries 31 percent, followed by Network Security at 28 percent, Network Troubleshooting at 25 percent, and Network Operations, Monitoring, and Performance at 16 percent.

Are most CNX-001 questions scenario based?

Most are. Twenty-two of the 25 objectives begin with “Given a scenario”, so the majority of items describe an environment and ask you to choose, configure or diagnose something within it.

What tools should I practise for the CloudNetX troubleshooting domain?

The blueprint names Wireshark, Netcat, Nmap, iperf, radclient, OpenSSL and Postman, plus commands such as dig, mtr, ss, tcpdump, snmpwalk and nfdump. Practise reading their output, not just running them.

Is CloudNetX tied to one cloud provider?

No. CloudNetX is vendor-neutral. It names provider connectivity options such as ExpressRoute and Direct Connect, but it tests the design decision across hybrid and multi-vendor environments rather than one provider’s console.

Conclusion

CompTIA CloudNetX is an exam about decisions. Twenty-two of its 25 objectives start with a scenario, six of its eight design objectives turn on business requirements, and its simulations reward people who have configured and diagnosed real networks. With up to 90 items, 165 minutes and a pass or fail result, there is no score to aim for, only readiness across every domain. Prepare by item type: concepts first, then requirement-led design, hands-on configuration, tool output and the security frameworks the blueprint names. Then rehearse the timing, including when to skip a simulation and come back. If you are already working as a network or cloud architect, that preparation turns your daily judgement into a credential that says so.