CloudNetX (CNX-001). Set it up and run it.

1. A payments platform is replacing an ageing three-tier access, aggregation and core data centre network. Instrumentation shows that 85 percent of flows are server to server across racks, tail latency must stay predictable as the fabric grows, and the team wants to add capacity a rack at a time without redesigning the core. Which fabric BEST satisfies these constraints?

• A. A collapsed core with all racks trunked back to a redundant pair of switches
• B. A full mesh of top-of-rack switches with direct links between all racks
• C. A two-tier spine-and-leaf fabric with equal-cost multipath between every leaf and every spine
• D. A hub-and-spoke design with the aggregation layer as the hub

Correct answer: C. A spine-and-leaf fabric gives every leaf an equal-cost path to every other leaf through the spine, so cross-rack latency is uniform and predictable, and capacity grows by adding spines or leaves without re-architecting the core.

Why the others are wrong. A: Every east-west flow between racks would funnel through one pair of devices, so cross-rack latency stops being predictable as the fabric grows. B: A full mesh between racks needs a new link on every existing switch each time a rack is added, which breaks the requirement to grow a rack at a time. D: Hub-and-spoke is optimised for traffic to and from a centre, but here 85 percent of traffic is between spokes, so the hub becomes the bottleneck.

2. An organisation is retiring its remote-access VPN in favour of zero trust network access. Which two outcomes are the direct architectural consequences of the change? (Choose two.)

• A. Remote devices no longer receive a route into the corporate network
• B. Internal applications no longer need to be patched as frequently
• C. Access is authorised per application for each session rather than granted once at connection time
• D. Traffic from remote devices becomes encrypted for the first time
• E. Multi-factor authentication becomes possible for remote users

Correct answer: A. Removing the VPN removes the network route the device used to receive, and access becomes a per-application authorisation evaluated for each session rather than a one-off admission to the network.

Why the others are wrong. B: Patching obligations are unchanged; the access model does not alter the vulnerability of the application itself. D: A remote-access VPN already encrypted its tunnel, so encryption is not a new outcome. E: Multi-factor authentication was already available on the VPN, so it is not a consequence of the change.

3. A retailer with 300 branches must route all branch traffic through a central security stack for inspection and logging before it reaches either the data centre or the internet. Branch-to-branch traffic is negligible, the branches are geographically dispersed, and the network team is only four people. Which topology BEST fits?

• A. Hub-and-spoke with the central inspection stack at the hub
• B. Full mesh between all 300 branches
• C. Partial mesh grouping branches into regional clusters with local breakout
• D. Point-to-point circuits from every branch to both data centres

Correct answer: A. Hub-and-spoke concentrates all flows through the hub, which is exactly where the central inspection stack sits, and it keeps the configuration on each of the 300 branch devices small enough for a small team to operate.

Why the others are wrong. B: A full mesh would carry branch-to-branch traffic directly and bypass the central inspection stack, which the compliance requirement forbids. C: Regional local breakout means traffic leaves to the internet without passing the central stack, failing the inspection requirement. D: This doubles circuit count and cost for 300 sites without adding anything the hub design does not already provide.

4. An auditor reviews an enterprise that describes itself as having adopted zero trust. Every employee authenticates with multi-factor authentication at a VPN concentrator, and once connected a device can reach any subnet in the data centre. Which finding BEST describes the gap?

• A. The multi-factor method in use is not phishing resistant, so the authentication itself is weak
• B. The VPN concentrator is a single point of failure for all remote access
• C. Authentication happens once at the perimeter and the network still grants broad implicit trust afterwards, so access is never evaluated per resource
• D. Traffic between data centre subnets is not encrypted

Correct answer: C. Zero trust requires an access decision per resource against identity, device and context. A single strong authentication at the perimeter followed by full internal reachability is exactly the implicit trust model the approach exists to remove.

Why the others are wrong. A: Strengthening the factor improves the front door but leaves the unrestricted post-connection reachability that the finding is about. B: Availability is a genuine concern but it says nothing about the implicit trust a device receives once it connects. D: Encryption protects confidentiality on the wire and does not change what a connected device is permitted to reach.

5. An architect must explain to a steering group why the new hybrid platform collects metrics, logs and traces rather than only one of them. Users report that a checkout request is slow, but every individual service reports healthy. Which explanation BEST justifies the three signal types together?

• A. Metrics, logs and traces contain the same information in three formats, so collecting all three protects against one tool failing
• B. Logs alone can reconstruct a distributed request as long as every service logs a timestamp
• C. Metrics say something is wrong, logs explain a single event in detail, and traces show where the time went across the whole request path
• D. Traces replace metrics and logs once sampling is enabled

Correct answer: C. Metrics show that something is wrong and when, logs give the detail of a specific event, and traces stitch one request together across every service and network boundary it crossed, which is the only one of the three that shows where inside a distributed path the time went.

Why the others are wrong. A: They carry different information rather than the same information three times, so this misstates why all three are needed. B: Timestamps in separate logs do not tie the parts of one request together without a shared trace identifier propagated across services. D: Traces are usually sampled and are per-request, so they cannot provide the continuous aggregate view that alerting and capacity work depend on.

6. Two branches, Leeds and Bristol, reach a cloud payroll workload across the same SD-WAN fabric and the same regional hub. Leeds users work normally. Bristol users time out. Both branches receive the same overlay policy, both resolve the workload name to the same private address, a capture at the hub shows Bristol traffic arriving and being forwarded into the cloud, and a capture on the workload itself shows the Bristol requests arriving and replies being generated. What is the MOST likely cause?

• A. A security group on the workload is denying the Bristol source range
• B. Bristol SD-WAN policy is steering the traffic to the wrong regional hub
• C. The cloud subnet route table has no entry covering the Bristol prefix, so replies follow the default route instead of the hybrid path
• D. Split-horizon DNS is giving Bristol a different address for the workload

Correct answer: C. The requests arrive and the workload replies, so everything up to and including the server is working. The failure has to be on the return path, and the usual reason is that the cloud subnet route table carries a route for the Leeds prefix but nothing covering the Bristol prefix, so replies fall to the default route and never come back through the hub.

Why the others are wrong. A: The capture on the workload shows the Bristol requests arriving and replies being generated, so the security group already permitted the flow. B: The capture at the regional hub shows Bristol traffic arriving there and being forwarded, so the steering decision was correct. D: Both branches were confirmed to resolve the workload name to the same private address, so resolution is identical on both sides.

7. Three exchange co-location sites in the same metropolitan area run a distributed matching engine. Any added hop costs money, the traffic pattern between all three is symmetric and heavy, and the budget allows dedicated fibre between all pairs. Which topology is the BEST design choice?

• A. Hub-and-spoke with one site nominated as the hub
• B. A spine-and-leaf fabric spanning the three sites
• C. A partial mesh linking two pairs and relaying the third pair
• D. A full mesh of dedicated point-to-point fibre between all three sites

Correct answer: D. With only three sites, symmetric heavy traffic and a hard latency budget, a full mesh gives every pair a single direct hop and the link count stays trivially small at three.

Why the others are wrong. A: Two of the three site pairs would take two hops through the hub, which adds latency the matching engine cannot absorb. B: Spine-and-leaf is a data centre fabric for many racks; stretching it across three sites inserts spine hops between sites for no benefit at this scale. C: The relayed pair takes an extra hop, so the latency budget is met for two pairs and missed for the third.

8. An organisation is replacing its remote-access VPN with a zero trust network access service. Which statement BEST describes what changes about the access model itself?

• A. Users are authorised to named applications through a broker, and the device is never given a route onto the corporate network
• B. Users authenticate with multi-factor authentication instead of a password alone
• C. Traffic between the device and the corporate edge becomes encrypted
• D. Remote users are presented to internal systems from a smaller pool of source addresses

Correct answer: A. The defining change is that the user is authorised to named applications through a broker, and the device is never placed on the corporate network, so there is no route to abuse.

Why the others are wrong. B: Multi-factor authentication can be bolted onto a VPN as well, so it is not what distinguishes the access model. C: A remote-access VPN already encrypts its tunnel, so encryption is not the difference. D: Source address ranges describe where traffic appears to come from, not whether the device is placed on the network.