[Jan 15, 2026] CNX-001 Exam Brain Dumps - Study Notes and Theory
Pass CompTIA CNX-001 Test Practice Test Questions Exam Dumps
CompTIA CNX-001 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
NEW QUESTION # 36
A company deployed new applications in the cloud and configured a site-to-site VPN to connect the internal data center with the cloud. The IT team wants the internal servers to connect to those applications without using public IP addresses. Which of the following is the best solution?
- A. Configure proxy service in the site-to-site VPN to allow internal servers to access applications through the proxy.
- B. Create a DNS server in the cloud. Configure the DNS server in the customer data center to forward DNS requests for cloud resources to the cloud DNS server.
- C. Configure a NAT server on the cloud to allow internal servers to connect to the applications through the NAT server.
- D. Register applications on the cloud with a public DNS server and configure internal servers to connect to them using their public DNS names.
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
To allow private IP-based communication between internal servers and cloud applications over asite-to-site VPN, private DNS resolution is necessary. The internal DNS server can be configured to forward specific DNS queries (for cloud-based applications) to a DNS server located in the cloud. This ensures applications can be resolved to private IPs, not public ones.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Hybrid Networking and DNS Integration":
"To support name resolution over hybrid connections like site-to-site VPN, enterprises should configure conditional forwarding to cloud-based DNS servers. This allows internal devices to resolve private IP addresses for cloud-based resources." Other options:
* B. NAT introduces complexity and may hide source IPs, which is not required in this case.
* C. Public DNS names map to public IPs, violating the requirement.
* D. A proxy is not needed if direct private IP-based access is available via VPN.
NEW QUESTION # 37
A network administrator needs to resolve connectivity issues in a hybrid cloud setup. Workstations and VMs are not able to access Application A. Workstations are able to access Server B.
INSTRUCTIONS
Click on workstations, VMs, firewalls, and NSGs to troubleshoot and gather information. Type help in the terminal to view a list of available commands.
Select the appropriate device(s) requiring remediation and identify the associated issue(s).
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Answer:
Explanation:
See explanation below.
Explanation:
Firewalls # VPN tunnel down
The IPsec tunnel between on-prem Firewall 1 and cloud Firewall 2 (ipip0/ipip2) is down, so no traffic can traverse to the cloud.
Application NSG # Misconfigured rule
There's a "block" rule for 10.3.9.0/24 # 192.2.1.0/24, preventing legitimate on-prem clients from reaching Application A.
NEW QUESTION # 38
A network architect is working on a physical network design template for a small education institution's satellite campus that is not yet built. The new campus location will consist of two small buildings with classrooms, one screening room with audiovisual equipment, and 200 seats for students. Which of the following enterprise network designs should the architect suggest?
- A. Dual-layer
- B. Hybrid
- C. Three-tier
- D. Collapsed core
Answer: D
Explanation:
In a small satellite campus with limited buildings and user density, a collapsed-core (two-tier) design combines the core and distribution layers into a single set of switches. This minimizes hardware, simplifies management, and still provides the necessary segmentation and resiliency for the classrooms, screening room, and student seating areas.
NEW QUESTION # 39
After a company migrated all services to the cloud, the security auditor discovers many users have administrator roles on different services. The company needs a solution that:
Protects the services on the cloud.
Limits access to administrative roles.
Creates a policy to approve requests for administrative roles on critical services within a limited time.
Forces password rotation for administrative roles.
Audits usage of administrative roles.
Which of the following is the best way to meet the company's requirements?
- A. Session-based token
- B. Privileged access management
- C. Conditional access
- D. Access control list
Answer: B
Explanation:
A Privileged Access Management (PAM) solution provides just-in-time elevation to administrative roles, enforces approval workflows with time-bound access, requires credential rotation, and offers comprehensive auditing of all privileged sessions, fully meeting the company's requirements.
NEW QUESTION # 40
A network load balancer is not correctly validating a client TLS certificate. The network architect needs to validate the certificate installed on the load balancer before progressing. Which of the following commands should the architect use to confirm whether the private key and certificate match?
- A. openssl-rsa -noout -modulus -in cert.crt | openssl md5
openssl-verify -noout -modulus -in privkey.txt | openssl md5 - B. openssl req -in certificate.csr -verify
openssl-verify -noout -modulus -in privkey.txt | openssl md5 - C. openssl-list -noout -modulus -in cert.crt | openssl md5
openssl rsa -noout -modulus -in privkey.txt | openssl md5 - D. openssl x509 -noout -modulus -in cert.crt | openssl md5
openssl rsa -noout -modulus -in privkey.txt | openssl md5
Answer: D
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
To verify that the certificate and the private key match, one can extract the modulus from both files and compare their hash values. The correct syntax involves using openssl x509 to extract the modulus from the certificate, and openssl rsa to extract the modulus from the private key, followed by an MD5 hash to ensure they match.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "TLS/SSL Certificate Validation and Troubleshooting":
"To verify that the private key and certificate match, compare the modulus values. A mismatch results in failed TLS handshakes." Other options:
* A & C: Incorrect syntax (openssl-list and openssl-rsa are not valid commands).
* B: The commands shown are used to verify CSRs, not matching keys.
NEW QUESTION # 41
A network architect is choosing design options for a new SD-WAN installation that has the following requirements:
* All network traffic from the cloud must pass through inspection devices in a dedicated data center.
* Ensure redundancy.
* Centralize egress traffic.
Which of the following network topologies best meets these requirements?
- A. Star
- B. Partial mesh
- C. Point-to-point
- D. Hub-and-spoke
Answer: D
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
The Hub-and-Spoke topology is ideal for SD-WAN environments where traffic from branch offices or cloud workloads must route through a central location (the hub) for inspection, monitoring, or security enforcement.
This structure centralizes egress and allows for redundant spoke paths via the hub. It also simplifies control and enforces compliance policies.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "SD-WAN Topologies and Cloud Egress Strategies":
"In a hub-and-spoke topology, spokes (remote offices or cloud nodes) connect through a central hub, allowing for centralized egress, traffic inspection, and simplified routing." Other options:
* A. Point-to-point doesn't scale and lacks centralized control.
* C. Star topology is similar to hub-and-spoke but is more rigid and less suited for SD-WAN scalability.
* D. Partial mesh allows direct spoke-to-spoke communication, bypassing centralized inspection.
NEW QUESTION # 42
End users are getting certificate errors and are unable to connect to an application deployed in a cloud. The application requires HTTPS connection. A network solution architect finds that a firewall is deployed between end users and the application in the cloud. Which of the following is the root cause of the issue?
- A. The firewall has an expired certificate while SSL/HTTPS inspection is enabled.
- B. The firewall on the application server has port 443 blocked.
- C. The end users do not have certificates on their laptops.
- D. The firewall has port 443 blocked while SSL/HTTPS inspection is enabled.
Answer: A
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
When SSL/HTTPS inspection is enabled on a firewall, it intercepts and decrypts HTTPS traffic. This requires the firewall to present its own trusted certificate to the client device. If that certificate is expired, the client browser will display a certificate error and block access to the application. This is a common misconfiguration that breaks HTTPS communication.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "TLS/SSL Inspection and Certificate Management":
"SSL inspection appliances must have valid certificates installed. Expired or untrusted certificates will result in browsers rejecting the HTTPS session and displaying errors to users." Other options:
* A. Would prevent connection, but not result in certificate errors.
* B. Blocked port 443 would prevent any connection, not cause cert errors.
* C. Client-side certificates are not required unless mutual TLS is configured, which is not stated here.
NEW QUESTION # 43
A network architect is designing a solution to place network core equipment in a rack inside a data center.
This equipment is crucial to the enterprise and must be as secure as possible to minimize the chance that anyone could connect directly to the network core. The current security setup is:
In a locked building that requires sign in with a guard and identification check.
In a locked data center accessible by a proximity badge and fingerprint scanner.
In a locked cabinet that requires the security guard to call the Chief Information Security Officer (CISO) to get permission to provide the key.
Which of the following additional measures should the architect recommend to make this equipment more secure?
- A. Make all engineers with access to the data center sign a statement of work.
- B. Have the CISO accompany any network engineer that needs to do work in this cabinet.
- C. Require anyone entering the data center for any reason to undergo a background check.
- D. Set up a video surveillance system that has cameras focused on the cabinet.
Answer: D
Explanation:
Recording and monitoring all activity at the cabinet greatly strengthens security by providing a real-time deterrent, an audit trail of who accessed it and when, and forensic evidence if an incident ever occurs.
NEW QUESTION # 44
A company provides an API that runs on the public cloud for its customers. A fixed number of VMs host the APIs. During peak hours, the company notices a spike in usage that results in network communication speeds slowing down for all customers. The management team has decided that access for all customers should be fair and accessible at all times. Which of the following is themostcost-effective way to address this issue?
- A. Use an allow list for customers using APIs.
- B. Enable throttling on APIs.
- C. Increase the MTU on the VMs.
- D. Increase the number of VMs running APIs.
Answer: B
Explanation:
Implementing request throttling (rate limiting) lets you cap how many requests each customer can make per time unit. This ensures no single user can saturate the API servers, providing fair access across all customers without the recurring costs of adding more VMs.
NEW QUESTION # 45
An architect needs to deploy a new payroll application on a cloud host. End users' access to the application will be based on the end users' role. In addition, the host must be deployed on the 192.168.77.32/30 subnet.
Which of the following Zero Trust elements are being implemented in this design? (Choose two.)
- A. MFA
- B. Least privilege
- C. Device trust
- D. WAF
- E. Microsegmentation
- F. CASB
Answer: B,E
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
A: Least privilege - This Zero Trust principle ensures users can only access the resources necessary for their job roles. Role-based access control (RBAC), as mentioned in the scenario, is a textbook implementation of least privilege.
C: Microsegmentation - Deploying the application in a small subnet (192.168.77.32/30 provides only 2 usable host IPs) limits lateral movement and isolates the host at a network level. This is a key characteristic of microsegmentation, where resources are placed in small, tightly controlled network segments.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Zero Trust Security Architecture":
"Least privilege enforces access permissions based on job responsibilities."
"Microsegmentation applies granular isolation policies between resources to reduce the attack surface and lateral movement." Other options:
* B. Device trust involves assessing device posture and compliance before granting access.
* D. CASB (Cloud Access Security Broker) governs cloud access, not access control or subnetting.
* E. WAF protects web applications but is not a Zero Trust element directly related to access control.
* F. MFA supports identity verification but is not directly evidenced in the scenario.
NEW QUESTION # 46
A network engineer is setting up guest access on a Wi-Fi network. After a recent network analysis, the engineer discovered that a user could access the guest network and attack the corporate network, since the networks share the same VLAN. Which of the following should the engineer do to prevent an attack like this one from happening?
- A. Configure Layer 2 client isolation for the wireless network.
- B. Set up a strong password on the guest wireless network.
- C. Set up a MAC filtering rule and add the MAC addresses of all corporate devices to the allow list.
- D. Set up a captive portal so all guest users have to register before gaining access to the wireless network.
Answer: A
Explanation:
By enabling client isolation at Layer 2, guest clients can still reach the Internet but cannot directly communicate with any other device on that VLAN, including your corporate endpoints, stopping lateral attacks without needing MAC whitelists or overly complex captive-portal setups.
NEW QUESTION # 47
A network architect is designing an expansion solution for the branch office network and requires the following business outcomes:
Maximize cost savings with reduced administration overhead
Easily expand connectivity to the cloud
Use cloud-based services to the branch offices
Which of the following should the architect do to best meet the requirements?
- A. Design point-to-site branch connectivity for offices to headquarters; deploy ExpressRoute and/or DirectConnect between headquarters and the cloud; use headquarters connectivity to connect to the cloud provider.
- B. Design a SD-WAN solution to integrate with the cloud provider; use SD-WAN to connect branch offices to the cloud provider.
- C. Design an MPLS architecture for the branch offices and site-to-site VPN between headquarters and branch offices; use site-to-site connectivity to the cloud provider.
- D. Design a dark fiber solution for headquarters and branch offices' connectivity; deploy point-to-site VPN between headquarters and the cloud provider; use the headquarters connectivity to the cloud provider.
Answer: B
Explanation:
By deploying SD-WAN you centrally manage and orchestrate all branch connections, minimizing administration overhead, while establishing direct, optimized tunnels into the cloud provider for low-latency, scalable access to cloud services.
NEW QUESTION # 48
A network administrator is troubleshooting an outage at a remote site. The administrator examines the logs and determines that one of the internet links at the site appears to be down. After the service provider confirms this information, the administrator fails over traffic to the backup link. Which of the following should the administrator do next?
- A. Establish a plan of action.
- B. Verify full system functionality.
- C. Identify the problem.
- D. Document the lessons learned.
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
According to the standard CompTIA troubleshooting methodology, once the issue has been identified and a solution has been implemented (e.g., failing over traffic to the backup link), the next logical step is to verify full system functionality. This ensures that the backup path is working as intended and that services have resumed properly for the users.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Troubleshooting Process":
"After implementing the solution, it is critical to verify full system functionality to ensure the resolution has addressed the problem without causing unintended consequences." Other options:
* A. Documenting lessons learned is the final step.
* B. The plan of action should have been created before the failover.
* C. Identifying the problem already occurred earlier in the scenario.
NEW QUESTION # 49
A network architect must design a new branch network that meets the following requirements:
*No single point of failure
*Clients cannot be impacted by changes to the underlying medium
*Clients must be able to communicate directly to preserve bandwidth
Which of the following network topologies should the architect use?
- A. Star
- B. Hub-and-spoke
- C. Spine-and-leaf
- D. Mesh
Answer: D
Explanation:
A full-mesh topology gives every node redundant paths to every other node, eliminating any single point of failure, and lets clients communicate directly over the optimal link without depending on an intermediate hub or core.
NEW QUESTION # 50
A network architect is designing an expansion solution for the branch office network and requires the following business outcomes:
* Maximize cost savings with reduced administration overhead
* Easily expand connectivity to the cloud
* Use cloud-based services to the branch offices
Which of the following should the architect do to best meet the requirements?
- A. Design point-to-site branch connectivity for offices to headquarters; deploy ExpressRoute and/or DirectConnect between headquarters and the cloud; use headquarters connectivity to connect to the cloud provider.
- B. Design a SD-WAN solution to integrate with the cloud provider; use SD-WAN to connect branch offices to the cloud provider.
- C. Design an MPLS architecture for the branch offices and site-to-site VPN between headquarters and branch offices; use site-to-site connectivity to the cloud provider.
- D. Design a dark fiber solution for headquarters and branch offices' connectivity; deploy point-to-site VPN between headquarters and the cloud provider; use the headquarters connectivity to the cloud provider.
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
SD-WAN (Software-Defined Wide Area Networking) is ideal for enterprises that want to simplify WAN management, reduce operational overhead, and optimize connectivity to cloudservices. SD-WAN provides intelligent traffic routing, dynamic path selection, and direct-to-cloud access without backhauling traffic through a central data center.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "SD-WAN and Cloud Connectivity":
"SD-WAN enables efficient cloud access from branch offices and simplifies management through centralized policy control. It is cost-effective and reduces the need for complex hardware configurations and manual routing." Other options:
* B. Adds latency and overhead by backhauling through headquarters.
* C. MPLS is expensive and less flexible than SD-WAN.
* D. Dark fiber is high-cost and not scalable for cloud-first architectures.
NEW QUESTION # 51
You are designing a campus network with a three-tier hierarchy and need to ensure secure connectivity between locations and traveling employees.
INSTRUCTIONS
Review the command output by clicking on the server, laptops, and workstations on the network.
Use the drop-down menus to determine the appropriate technology and label for each layer on the diagram.
Options may only be used once.
Click on the magnifying glass to make additional configuration changes.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Answer:
Explanation:
NEW QUESTION # 52
A network architect is designing a solution to secure the organization's applications based on the security policy. The requirements are:
Users must authenticate using one set of credentials.
External users must be located in authorized sites.
Session timeouts must be enforced.
Network access requirements should be changed as needed.
Which of the following best meet these requirements? (Choose two.)
- A. Single sign-on
- B. Static IP allocation
- C. Role-based access
- D. Multifactor authentication
- E. Conditional access policy
- F. Risk-based authentication
Answer: A,E
Explanation:
Single sign-on: Provides users with one set of credentials for authentication across all applications, simplifying access and reducing password fatigue.
Conditional access policy: Enforces location-based restrictions for external users, configurable session timeouts, and dynamic network access controls that can be updated as requirements evolve.
NEW QUESTION # 53
An organization wants to evaluate network behavior with a network monitoring tool that is not inline. The organization will use the logs for further correlation and analysis of potential threats. Which of the following is the best solution?
- A. SSL decryption of network packets with preconfigured alerts
- B. Syslog to a common dashboard used in the NOC
- C. NetFlow to feed into the SIEM
- D. SNMP trap with log analytics
Answer: C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
NetFlow provides flow-level metadata about IP traffic without requiring inline deployment. It summarizes who is talking to whom, for how long, and how much data was exchanged. It's ideal for behavior monitoring and threat detection when sent to a SIEM for correlation and analysis.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "NetFlow and Network Telemetry":
"NetFlow provides visibility into traffic patterns, which can be used for anomaly detection and security analysis when integrated with SIEM platforms." Other options:
* A. Syslog shows event-level data, but not network behavior.
* B. SNMP traps monitor device status, not traffic behavior.
* C. SSL decryption is complex and requires inline positioning.
NEW QUESTION # 54
A network architect is designing a new network for a rural hospital system. Given the following requirements:
*Highly available
*Consistent data transmission
*Resilient to simultaneous failures
Which of the following topologies should the architect use?
- A. Hub-and-spoke
- B. Collapsed core
- C. Mesh
- D. Star
Answer: D
Explanation:
A full-mesh topology provides multiple redundant, direct paths between every site, eliminating single points of failure, ensuring consistent transmission even if one or more links fail, and maximizing overall availability.
NEW QUESTION # 55
A network engineer is working on securing the environment in the screened subnet. Before penetration testing, the engineer would like to run a scan on the servers to identify the OS, application versions, and open ports. Which of the following commands should the engineer use to obtain the information?
- A. hping3 -1 10.10.10.x -rand-dest -I eth0
- B. tcpdump -ni eth0 src net 10.10.10.0/28
- C. nc -v -n 10.10.10.x 1-1000
- D. nmap -A 10.10.10.0/28
Answer: D
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
nmap -A performs aggressive scanning, which includes OS detection, version detection, script scanning, and traceroute - exactly what is required in this case. It's the most effective and commonly used tool for comprehensive network reconnaissance prior to security testing.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Security Scanning and Reconnaissance Tools":
"Nmap supports comprehensive scanning options, including OS fingerprinting, service version detection, and port scanning, enabling detailed pre-penetration testing assessments." Other options:
* A. tcpdump is for packet capture, not scanning.
* C. nc (netcat) is a port scanning tool, but it lacks OS/app detection.
* D. hping3 is a packet generator, not suitable for full-service scanning.
NEW QUESTION # 56
A customer asks a MSP to propose a ZTA (Zero Trust Architecture) design for its globally distributed remote workforce. Given the following requirements:
* Authentication should be provided through the customer's SAML identity provider.
* Access should not be allowed from countries where the business does not operate.
* Secondary authentication should be added to the workflow to allow for passkeys.
* Changes to the user's device posture and hygiene should require reauthentication into the network.
* Access to the network should only be allowed to originate from corporate-owned devices.
Which of the following solutions should the MSP recommend to meet the requirements?
- A. Chain the existing identity provider to a new SAML.
Require the use of time-based one-time passcode hardware tokens.
Enable debug logging on the VPN clients by default.
Disconnect users from the network only if their IP address changes. - B. Configure geolocation settings to block certain IP addresses.
Enforce MFA.
Federate the solution via SSO.
Enable continuous access policies on the WireGuard tunnel.
Create a trusted endpoints policy. - C. Enforce certificate-based authentication.
Permit unauthenticated remote connectivity only from corporate IP addresses.
Enable geofencing.
Use cookie-based session tokens that do not expire for remembering user log-ins.
Increase RADIUS server timeouts. - D. Enforce posture assessment only during the initial network log-on.
Implement RADIUS for SSO.
Restrict access from all non-U.S. IP addresses.
Configure a BYOD access policy.
Disable auditing for remote access.
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
D includes all the key elements of Zero Trust:
* MFA (Multi-Factor Authentication) supports secondary passkey-based authentication.
* Geolocation settings enforce geo-restrictions.
* SSO federation allows use of an existing SAML identity provider.
* Continuous access policies support dynamic reauthentication based on changes in posture.
* Trusted endpoint policies ensure only corporate-owned, compliant devices are allowed to connect.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Zero Trust Architecture and Identity Management":
"ZTA enforces continuous access policies that monitor session state, posture, and user behavior."
"Federated identity with SSO and posture-based trust evaluation are core ZTA components."
"Geo-restrictions and trusted endpoint policies limit exposure and enforce device compliance." Other options:
* A uses static session tokens and disables timely expiration, violating Zero Trust principles.
* B allows BYOD and disables auditing, which conflicts with compliance and monitoring.
NEW QUESTION # 57
A network engineer is designing a Layer 2 deployment for a company that occupies severalfloors in an office building. The engineer decides to make each floor its own VLAN but still allow for communication between all user VLANs. The engineer also wants to reduce the time necessary for STP convergence to occur when new switches come online. Which of the following should the engineer enable to accomplish this goal?
- A. Portfast
- B. BPDU Guard
- C. Tagging
- D. Priority
Answer: A
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
PortFast is a feature in Spanning Tree Protocol (STP) that allows switch ports connected to end devices (like user workstations) to bypass the usual STP states (Listening and Learning) and transition immediately to the Forwarding state. This significantly reduces convergence time and speeds up the network availability when new switches or ports are introduced.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "STP Optimization Techniques":
"PortFast reduces STP convergence time by immediately placing access ports into the forwarding state, useful in environments where rapid network availability is required." Other options:
* A. BPDU Guard is used to disable ports that receive Bridge Protocol Data Units, enhancing security but not STP speed.
* B. Priority modifies bridge priority but doesn't reduce convergence time.
* C. Tagging relates to VLAN identification, not STP behavior.
NEW QUESTION # 58
After a malicious actor used an open port in a company's lobby, a network architect needs to enhance network security. The solution must enable:
* Security posture check
* Auto remediation capabilities
* Network isolation
* Device and user authentication
Which of the following technologies best meets these requirements?
- A. NAC
- B. Microsegmentation
- C. 802.1X
- D. IPS
Answer: A
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
Network Access Control (NAC) evaluates the posture of a device before allowing access to the network. It can enforce security policies, authenticate users and devices, and isolate or remediate non-compliant devices.
NAC is widely used in enterprise environments to secure access at the network edge, such as in guest or public areas.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Access Control and Posture Assessment":
"NAC provides device authentication, security posture validation, and can enforce automated remediation or quarantine actions based on policy compliance." Other options:
* A. IPS detects and prevents known threats but does not perform access control or posture checks.
* B. Microsegmentation isolates workloads but lacks posture checks and auto-remediation.
NEW QUESTION # 59
......
Verified CNX-001 dumps Q&As - CNX-001 dumps with Correct Answers: https://examtorrent.testkingpdf.com/CNX-001-testking-pdf-torrent.html
