CompTIA CNX-001 Practice Test Questions Answers

Comprehensive and Detailed Explanation From Exact Extract:

Geofencing is a network access control method that enforces restrictions based on location data. In this scenario, the organization requires access to be permitted only when users are on premises (i.e., within a specific physical location). Geofencing can be implemented using source IP ranges or GPS-based location data to define boundaries (fences). This allows access to certain applications or services only when the user is inside a designated network or area.

MFA (Option A) provides identity assurance but does not enforce physical location-based restrictions.

UEBA (Option C) provides behavioral analytics but is not used for real-time access control.

PKI (Option D) provides identity validation through certificates but is not location-aware.

Relevant Extract from CompTIA CloudNetX CNX-001 Official Study Guide:

“Geofencing allows organizations to define physical or logical boundaries that restrict or allow access based on user location. Policies can be configured to allow access only when users are on a trusted campus or corporate network, denying requests originating from outside the geofenced area.”

Covered under the topic: “Access Control Technologies and Identity Enforcement Mechanisms.”

Comprehensive and Detailed Explanation From Exact Extract:

Quality of Service (QoS) ensures that latency-sensitive traffic like videoconferencing is prioritized over bandwidth-heavy but delay-tolerant tasks like report generation. Implementing QoS on network switches allows the network to differentiate traffic types and ensure sufficient bandwidth for critical applications during congestion.

Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide — under “Traffic Prioritization and QoS”:

“QoS enables classification and prioritization of network traffic to ensure performance of mission-critical or real-time applications such as voice and video.”

Other options:

A. Scheduling tasks outside business hours is not scalable or reliable.

B. Load balancing applies to servers, not prioritization of LAN traffic.

D. Buying higher-end switches is costly and may not resolve contention under load.

================================================

Comprehensive and Detailed Explanation From Exact Extract:

Video surveillance (A) provides continuous monitoring and allows for real-time, remote visibility of secure locations, such as computer rooms. When integrated with analytics, video surveillance systems can detect movement after hours or unauthorized access and generate immediate alerts. These systems also maintain video logs that can be audited later.

NFC access cards (B) allow controlled access to physical areas, generating time-stamped logs for each entry attempt. When connected to an access control system, these cards can trigger alerts for unauthorized access attempts, such as the use of expired credentials or access during restricted hours.

Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide — Security Controls and Physical Security Section:

“Security access systems using NFC or smart cards allow traceability of personnel entry through electronic logs, while surveillance systems provide visibility and support forensic investigations.”

“Video surveillance allows real-time monitoring of physical environments and helps detect unauthorized presence or access in sensitive locations.”

================================================

Comprehensive and Detailed Explanation From Exact Extract:

nmap -A performs aggressive scanning, which includes OS detection, version detection, script scanning, and traceroute — exactly what is required in this case. It's the most effective and commonly used tool for comprehensive network reconnaissance prior to security testing.

Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide — under “Security Scanning and Reconnaissance Tools”:

“Nmap supports comprehensive scanning options, including OS fingerprinting, service version detection, and port scanning, enabling detailed pre-penetration testing assessments.”

Other options:

A. tcpdump is for packet capture, not scanning.

C. nc (netcat) is a port scanning tool, but it lacks OS/app detection.

D. hping3 is a packet generator, not suitable for full-service scanning.

================================================

Comprehensive and Detailed Explanation From Exact Extract:

A 403 Forbidden error indicates that the request was understood by the server but is refusing to fulfill it due to insufficient authorization. The developer is attempting to call a protected API that requires valid credentials such as an access key and signature (often used in HMAC-based APIs), but the values appear as Postman variables (e.g., {{rapyd_access_key}}), which suggests they were not replaced with actual credentials.

This typically means that the request lacks proper authentication or authorization headers, or the keys/signature are incorrect or missing. The presence of access_key, signature, salt, and timestamp in the request implies the API requires authentication, but the variables were not resolved or valid.

Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide — under “API Security and Authentication”:

“A 403 error typically results from failed authentication or lack of proper authorization. Developers must ensure that tokens or signatures are valid, not missing, and properly injected.”

Other options:

A. 404 is the code for a missing resource, not 403.

C. A firewall rule would block the request entirely (e.g., no response or a 0 status), not result in a 403 from the server.

D. HTTP redirection issues typically result in 3xx codes, not 403.