A company's security team is evaluating a cloud access security broker (CASB) to gain visibility into shadow IT usage of unsanctioned cloud applications. They want to identify which applications are being used and by whom, without disrupting user productivity. Which CASB function is most relevant for this initial requirement?

Access control, which enforces policies on who can use specific cloud applications.

Shadow IT discovery, which identifies cloud applications in use and provides a risk assessment for each.

Data loss prevention (DLP), which scans data in the cloud for sensitive information.

Encryption, which encrypts data stored in cloud applications.

What is the primary purpose of microsegmentation in a network?

To increase network bandwidth by splitting traffic.

To isolate network segments to limit lateral movement of threats.

To replace the need for firewalls.

To simplify network management by reducing the number of VLANs.

What is a common deployment mode for a CASB?

API-based integration with cloud applications.

Replacing the cloud provider's security controls.

Physical appliance installed in each branch office.

Agentless monitoring of network traffic only.

A company is implementing ZTNA and wants to integrate it with its existing identity provider (IdP) and device management system. The goal is to enforce conditional access policies that consider user role, device compliance, and location. Which ZTNA feature is essential for this integration?

A built-in user directory that stores all user credentials and device information.

Support for Security Assertion Markup Language (SAML) and OpenID Connect (OIDC) for integration with the IdP.

A VPN client that is installed on all user devices and connects to the ZTNA broker.

A proprietary API that only works with the company's specific IdP and device management system.

An organization is implementing zero trust network access (ZTNA) to replace its remote access VPN. The goal is to provide users with access only to the specific applications they are authorized to use, not the entire network. Which ZTNA deployment characteristic is essential to achieve this?

A remote desktop protocol (RDP) gateway that allows users to connect to their office desktops.

A network-level VPN tunnel that assigns the user an IP address on the corporate network.

Application-specific access policies that are enforced by a ZTNA broker after verifying user identity and device posture.

A firewall rule that allows traffic from the user's IP address to the entire internal network.

CompTIACloudNetX

Domain 2Objective 4

Zero Trust CNX-001 Practice Questions (Page 5)

Part of the Network security domain, which accounts for 28% of the CNX-001 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~18–31 in this domain), expect 3–5 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

8concepts

28%of the exam

Questions 21–25

21application · medium
A company's security team is evaluating a cloud access security broker (CASB) to gain visibility into shadow IT usage of unsanctioned cloud applications. They want to identify which applications are being used and by whom, without disrupting user productivity. Which CASB function is most relevant for this initial requirement?
Select an answer first
22foundation · easy
What is the primary purpose of microsegmentation in a network?
Select an answer first
23foundation · easy
What is a common deployment mode for a CASB?
Select an answer first
24expert · hard
A company is implementing ZTNA and wants to integrate it with its existing identity provider (IdP) and device management system. The goal is to enforce conditional access policies that consider user role, device compliance, and location. Which ZTNA feature is essential for this integration?
Select an answer first
25application · medium
An organization is implementing zero trust network access (ZTNA) to replace its remote access VPN. The goal is to provide users with access only to the specific applications they are authorized to use, not the entire network. Which ZTNA deployment characteristic is essential to achieve this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CNX-001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CNX-001” is a trademark of its owner, used for identification only.