Free tool · No sign-up needed
5 free, original PBQs for CloudNetX (CNX-001), with firewall rules, a network diagram and drag-and-drop. Do each task, check it, and read why the answer is right.
Last updated
CompTIA CloudNetX
You do each task instead of picking an answer. Every question is explained after you check it, and you get a score at the end.
Take it further in OpenpassAI
OpenpassAI’s practice sessions add performance-based questions, with command-line and network topology tasks, to full timed exams, AI explanations and a readiness score.
The questions
Each one with its scenario and task. Try it above first, then open the explanation.
Question 1 · Network diagram · Network architecture design
A company is connecting its data center to a cloud network built as a hub with two spokes. The design needs an encrypted tunnel that links the data center to the hub, a device in the hub that inspects all traffic passing between the data center and the spokes, and a public entry point that spreads internet users’ requests across the application servers.
Place the right component in each of the three empty places.
The VPN gateway ends the encrypted tunnel from the data center. The firewall sits in the hub because every path between the data center and a spoke crosses the hub: one inspection point covers them all, which is the reason for a hub-and-spoke design. The load balancer faces the internet and shares requests among the application servers. A switch forwards frames inside one network, and an intrusion detection sensor only watches.
Question 2 · Firewall rules · Network security
A web application has three tiers: web, application and database. A review found that the web tier can open any connection it likes, including straight to the database, and that administrators have no approved path to the database at all. The policy is that each tier talks only to the next one, and administration goes through the bastion host.
Edit the rules until all seven requirements pass. The first matching rule decides, and anything unmatched is denied.
Narrow the web tier’s rule from “anywhere, any port” to the application tier on port 8443: a compromised web server then has one place to go, not the whole network. The existing rule from the application tier to the database stays. Add a rule from the bastion host to the database on port 22 so administrators have one audited way in. Segmenting between tiers like this limits how far an attacker can move sideways.
Question 3 · Matching · Network operations, monitoring, and performance
Video calls between two offices keep breaking up. The monitoring dashboard shows five measurements, and you need to know what each one is telling you.
Match each description to the metric it defines.
Latency is how long a packet takes to arrive. Jitter is how much that time varies from packet to packet, and it is what makes voice and video stutter even when average latency is fine. Packet loss is the share that never arrives. Bandwidth is what the link could carry, and throughput is what it actually delivered: a link with plenty of bandwidth can still have poor throughput when it is losing packets.
Question 4 · Sorting · Network security
A zero-trust roadmap lists nine technologies. The architecture board wants them grouped by the job each one does.
Put each technology under what it provides.
VLANs, virtual routing and forwarding (VRF) and microsegmentation all separate traffic, at coarser or finer levels. IPsec, TLS and MACsec encrypt traffic in transit, at the network layer, the transport layer and the data link layer respectively. 802.1X checks a device or user before a switch port or wireless network lets it on, RADIUS is the server that 802.1X usually asks, and multifactor authentication strengthens the proof of who is signing in.
Question 5 · Matching · Network troubleshooting
Since the cloud migration, the network team has had five recurring faults. Each one has a classic cause.
Match each symptom to the most likely cause.
A tunnel adds headers, so large packets no longer fit: small pings pass and big transfers stall, which is an MTU problem. Sites that reach the hub but not each other are missing each other’s routes. Stateful firewalls drop traffic whose replies come back a different way, which is asymmetric routing. Two networks using the same address range can’t route to each other. A name that resolves in the cloud but not on-premises means the on-premises DNS servers aren’t forwarding that zone.
CompTIA lists CloudNetX among its certifications with simulation performance-based questions: tasks in an approximation of a real tool, such as a firewall, a network diagram or a terminal window. CompTIA’s page on performance-based questions, read on November 12, 2026.
Guide
CompTIA describes performance-based questions as exam items that test your ability to solve problems in real-world settings. Most are simulations: an approximation of a tool such as a firewall, a network diagram, a terminal window or an operating system.
You don’t pick an answer. You do the task, and there can be more than one correct way to do it.
Try each question cold. Getting it wrong first and then reading why teaches more than reading the answer and nodding along.
A right answer reached by guessing is a wrong answer waiting for exam day. Every question here explains why each part is what it is.
CompTIA says a simulation question can be skipped and returned to later, with your work saved. If one is eating your time, move on, answer the multiple-choice questions and come back.
14 free labs in your browser: Linux and Windows command line, firewall rules and SOHO router setup, checked as you go.
Open the toolFree performance-based questions for 19 CompTIA exams: firewall rules, network diagrams, command-line tasks and drag-and-drop.
Open the toolFree practice tests for 261 popular certification exams, with explanations and a score by exam domain.
Open the toolFAQs
Find quick answers or contact our support team.
Yes. CompTIA lists CloudNetX among its certifications with simulation performance-based questions: tasks in an approximation of a real tool, such as a firewall, a network diagram or a terminal window. That is from CompTIA’s page on performance-based questions, read on November 12, 2026.
No. They’re original tasks written to each exam’s published objectives. Using leaked real exam questions breaks every vendor’s exam rules.
CompTIA says a performance-based question can have more than one correct way through it, that its scoring allows for the different approaches, and that partial credit may be given. Here, each question is scored by its parts, so you can see which part you missed.
CompTIA says a simulation question can be skipped and returned to later, and that your work on it is saved when you move on. A virtual-environment question has to be completed when you reach it: a warning screen tells you so first.
No. The questions run in your browser and nothing is saved. Sign up only if you want full practice exams and progress tracking.
OpenpassAI
Hi 👋 I’m OpenpassAI. Ready to prepare for your exam the smarter way?
Ready to explore OpenpassAI? I can show you how the platform helps you prepare, practice, and pass.
