CompTIA CloudNetX CNX-001 (V1) Exam Objectives
This page translates the CompTIA CloudNetX CNX-001 exam objectives into clear, practical language. You’ll see what each domain covers, the kinds of tasks that show up on the exam, and a focused study plan that turns objectives into repeatable labs, PBQs, and job-ready network architect skills.
Last updated: November 9, 2025. Always verify against the official CompTIA blueprint before your exam.
TL;DR: CloudNetX validates the ability to design secure, highly available hybrid network architectures; implement Zero Trust and IAM; monitor and automate across on-prem and cloud; and troubleshoot connectivity, performance, access, and security. Domains and weights: 1) Network Architecture Design (31%) 2) Network Security (28%) 3) Network Operations, Monitoring & Performance (16%) 4) Network Troubleshooting (25%)
Table of Contents
- What Is Covered on CompTIA CloudNetX CNX-001?
- Objective-By-Objective Breakdown (with examples)
- Who Is CloudNetX For?
- Study Plan: How to Master the CNX-001 Objectives
- Free Checklist & Next Steps
- Frequently Asked Questions
What Is Covered on CompTIA CloudNetX CNX-001?
CloudNetX certifies senior skills to analyze requirements, design/secure networks for on-prem & cloud, automate operations, and troubleshoot hybrid environments. Exam at a glance: maximum 90 questions, multiple-choice + performance-based, pass/fail only; recommended experience: 10+ years IT, 5+ years network architect in hybrid cloud (Network+, Security+, Cloud+ or equivalent).
Objective-By-Objective Breakdown (with examples)
1) Network Architecture Design (31%)
Translate business needs into resilient hybrid designs.
- Core concepts: OSI; IPv4/IPv6; subnetting, CIDR, VLSM; NAT/PAT/port-forwarding; DHCP, NTP, DNS (+DNSSEC/DoT/DoH); TCP/UDP; auth protocols (802.1X, RADIUS, TACACS+, LDAP).
- Architectures/topologies: mesh, star, hub-and-spoke, spine-and-leaf, point-to-point; trusted/untrusted/screened subnets; N/S vs. E/W flows; segmentation with VLAN, VXLAN, GENEVE; prod vs. non-prod separation.
- Hybrid connectivity: MPLS, SD-WAN, cellular, satellite, dark fiber, DIA, metro; public-cloud links (Direct Connect/ExpressRoute/SDCI); VPN (site-to-site, point-to-site, split tunneling, WireGuard); bastion/SSH/RDP; PaaS private endpoints, transit gateways, VPC peering, private link.
- Availability: global/local load balancing (methods like RR/least-conn/weighted), VIPs, HA (active-active/active-passive), link aggregation, autoscaling, regions/AZs, CDN, fault/update domains, device/path redundancy.
- Campus & physical: power (PDU/UPS/EPO/generators), thermal/BTUs, humidity, fire suppression, physical access (video, biometrics, proximity, NFC).
- Campus wired & wireless: L2/L3 switch/router; PoE; three-tier vs. collapsed core; IDF/MDF, cable mgmt; STP, trunking, bonding; voice/video (SIP/WebRTC/RTSP/H.323); Wi-Fi APs (antennas, placement, 2.4/5/6 GHz, channels, SSIDs, roaming), BLE/NFC/LoRaWAN.
- Documentation: requirements (business/technical/regulatory, SOW), physical vs. logical diagrams, HLD/LLD, flow diagrams, verification/validation, runbooks, WBS, KB articles, baselines, reference architectures.
2) Network Security (28%)
Apply Zero Trust, IAM, and network controls that actually hold up.
- Access controls: firewall rules (incl. decryption, app-aware, allow/block, geo), NACLs, security groups (inbound/outbound), IPS/IDS signatures, URL/content filtering (categories, apps, file blocking), DLP, port security.
- Zero Trust: microsegmentation, SASE/SSE, CASB, identity as perimeter, device trust, least privilege, ZTNA.
- IAM: SSO (federation, SAML, OAuth 2.0, OIDC, passwordless), MFA, conditional access, geofencing, PAM, risk-based auth, RBAC/ABAC, endpoint trust, UEBA, PKI (cert-auth, KMS), tokens, JIT provisioning, SCIM, CIEM.
- Wireless security: AES; WPA2/WPA3; TKIP, PSK/enterprise; guest access, captive portal, L2 client isolation, MAC filtering.
- Appliance hardening: patch management (channels, verification), TLS inspection and cipher/algorithm considerations; secure web/application gateways; NAC & posture; dynamic lists.
3) Network Operations, Monitoring & Performance (16%)
Run it like production—observability first.
- Monitoring mindset: reactive vs. proactive; metrics/logs/traces; baselines and trend analysis; performance vs. cost.
- Automation & scripting: IaC concepts for resource provisioning/configuration; YAML/JSON fluency.
4) Network Troubleshooting (25%)
Triage by layers and evidence.
- Process: identify → hypothesize → test → remediate → verify → document lessons and preventive measures.
- Tools & commands (know when/why): Wireshark, Netcat, Nmap, Iperf, radclient, OpenSSL, Postman; tcpdump, dig, mtr, arp, netstat, curl, ping, nslookup, traceroute, ip/ipconfig/ifconfig, route, ss, dhclient, top, snmpwalk, nfdump.
- Wireless pain points: loss/degradation, low RSSI, band steering, channel overlap/width, roaming/sticky clients, Tx/Rx compatibility.
- Access/security faults: missing/misconfigured/over-permissive rules, URL filtering and geo restrictions gone wrong.
Who Is CloudNetX For?
CloudNetX targets seasoned network architects and senior network engineers operating hybrid environments who design secure architectures, integrate cloud connectivity, automate provisioning, and lead complex troubleshooting.
Study Plan: How to Master the CNX-001 Objectives
- Build a reference hybrid design
Create a small hub-and-spoke or spine-and-leaf core; add SD-WAN to two branch sites; connect to one public cloud via Direct Connect/ExpressRoute (mocked if needed). Document HLD/LLD, trust boundaries, and runbooks. - Wire Zero Trust & IAM
Segment with VLAN/VXLAN; add ZTNA, conditional access, MFA, and cert-based auth. Prove least-privilege via a before/after access review. - Automate the boring parts
Capture the build in IaC (YAML/JSON templates). Parameterize regions, CIDRs, and routing. Re-deploy twice to prove idempotence. - Observe and tune
Stand up dashboards for latency/loss/jitter, bandwidth, CPU/mem, and flow records. Set two high-value alerts (e.g., packet loss > threshold, failed cert auth). Trend for a week. - Break it—then fix it
Kill a route, mis-tag a VLAN, expire a cert, throttle a link, and corrupt a DNS entry. Troubleshoot using the listed tools/commands and record root cause + fix + prevention.
