CNX-001 Practice Questions

The selected options represent the most secure hardening techniques from each list. These choices adhere to security best practices, such as the principle of least privilege (SQL server), disabling unused attack surfaces (Switch), using strong encryption protocols (Web server, WAP-1), and implementing robust, centralized authentication (Wireless controller). Furthermore, they include essential security hygiene like vulnerability patching (Workstation), enforcing strong account policies (User accounts), and limiting administrative access (Firewall, Linux server). The alternative options often introduce vulnerabilities, such as enabling all services, using weak/deprecated protocols (e.g., SSLv2), or disabling security features (e.g., SELinux).

User accounts (Password Complexity) & SQL server (Least Privilege):

NIST Special Publication 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations.

Reference: Control IA-5 ("Authenticator Management") discusses password complexity. Control AC-6 ("Least Privilege") and AC-3 ("Access Enforcement") support role-based access control for the server.

Web server (TLS 1.3):

NIST Special Publication 800-52 Rev. 2, Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations.

Reference: Section 3.1, "Protocol Versions," mandates the use of TLS 1.3 or TLS 1.2 and explicitly forbids the use of all versions of SSL.

Switch (Disable unused ports) & Workstation (OS Updates):

NIST Special Publication 800-123, Guide to General Server Security.

Reference: Section 3.2.1, "Disable Unnecessary Services," aligns with disabling unused ports (a form of 'least functionality'). Section 4.1, "Patching," emphasizes timely OS updates as a primary defense.

Firewall (Limit admin access):

NIST Special Publication 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy.

Reference: Section 4.5.3, "Securing the Firewall," states that access to the firewall's management interface should be restricted to trusted administrators and specific trusted IP addresses.

Wireless controller (RADIUS) & WAP-1 (WPA-3):

NIST Special Publication 800-153, Guidelines for Securing Wireless Local Area Networks (WLANs).

Reference: Section 4.2.2 discusses implementing IEEE 802.1X (which uses a RADIUS server) for robust, port-based network access control. The publication also discusses WPA3 as the most current and secure standard for Wi-Fi security.

Two separate issues are preventing connectivity:

1. Workstation-to-Application: The on-premises workstations cannot reach the cloud because the IPsec tunnel is down. Firewall 1 shows its tunnel (ipip0) to Firewall 2 is DOWN and configured for IKEV2. Firewall 2 shows its corresponding tunnel (ipip2) is configured for IKEV1. This IKE version mismatch prevents the tunnel from establishing.
2. VM-to-Application: The cloud VMs (in subnet 10.3.9.0/24) cannot reach Application A (in subnet 192.2.1.0/24) because the Application NSG has an explicit rule to block traffic from Source: 10.3.9.0/24 to Destination: 192.2.1.0/24.

Microsoft Azure Documentation: "Azure network security groups overview." (Official documentation explaining how NSG rules are processed. A Deny rule [shown as block] with a higher priority (lower number) will override an Allow rule for the same traffic pattern).

Microsoft Azure Documentation: "VPN Gateway configuration settings." (Vendor documentation detailing IKEv1 and IKEv2 parameters for site-to-site VPNs, specifying that "IKE versions on both on-premises VPN devices and Azure VPN gateways must match").

IEEE Xplore: "Security Analysis of IKEv1 and IKEv2 protocols." (Academic analysis confirming IKEv1 and IKEv2 are distinct protocols and are not interoperable. A successful security association requires both peers to negotiate using the same version). DOI: 10.1109/IEMCON.2018.8614744

The diagram illustrates a standard three-tier hierarchical network model.

1. The Access layer (bottom) is where end-user devices (workstations, APs) connect to the network.
2. The Distribution layer (middle) aggregates traffic from the access layer switches and provides routing between different subnets. The ipconfig outputs confirm this, showing multiple, separate subnets (e.g., 10.31.5.x, 10.31.6.x, 10.31.10.x), which necessitates a routing layer.
3. The Core layer (top) is the high-speed backbone that connects all distribution blocks and the egress zone for high-speed transport.
4. A NIPS (Network Intrusion Prevention System) is the correct technology for the egress zone. It is deployed in-line to actively inspect and block malicious traffic before it enters or leaves the network, complementing the firewall.

Kurose, J., & Ross, K. (2021). Computer Networking: A Top-Down Approach (8th ed.).

Reference: Chapter 6.4, "A Day in the Life of a Web Page Request." This section details the hierarchical structure of institutional networks, describing the access, distribution, and core tiers and their respective functions in routing and packet forwarding.

NIST. (2007). Guide to Intrusion Detection and Prevention Systems (IDPS). (Special Publication 800-94).

Reference: Section 6.2, "IDPS Deployment." This document describes the typical in-line deployment of a Network-Based IPS (NIPS) at the network perimeter, often placed "behind the external firewall" to "detect and stop attacks that the firewall failed to block." This matches the diagram's "Egress zone" topology.

IETF. (1996). Address Allocation for Private Internets. (RFC 1918).

Reference: Section 3, "Private Address Space." This document sanctions the use of the 10.0.0.0/8 address block for private networks, as seen in all ipconfig outputs (e.g., 10.31.5.5), confirming the devices are on an internal, segmented network.

Bluetooth Low Energy (BLE) is specifically designed for low-power, short-range communication, making it ideal for high-density environments like stadiums. Using a network of BLE beacons, a mobile application can determine a user's location with high precision through techniques like trilateration based on Received Signal Strength Indication (RSSI). This method can achieve the required location accuracy of 1.5 meters (5ft), enabling precise location-based services such as seat-side food delivery, emergency response, and interactive fan experiences. The low energy consumption of BLE also ensures that the tracking functionality does not significantly drain the battery of the fans' mobile devices.

A. SSID: A Service Set Identifier (SSID) is the name of a Wi-Fi network. It is not a location-tracking technology itself, but rather an identifier for a network that might be used for less precise positioning.

C. NFC: Near Field Communication (NFC) has an extremely short operational range, typically less than 4 cm. It is unsuitable for continuous tracking and is used for "tap-and-go" interactions, not area-based positioning.

D. IoT: The Internet of Things (IoT) is a broad technological concept describing a network of connected devices. It is not a specific positioning technology; rather, BLE is one of the enabling technologies used within an IoT framework.

---

1. Official Vendor Documentation: Bluetooth Special Interest Group (SIG). "Bluetooth Location Services." The official Bluetooth website details two types of location services: proximity solutions and positioning systems. It states

"Proximity solutions use BLE to determine if two devices are near each other

and at what distance... Positioning systems use Bluetooth to determine the physical location of devices [with] meter-level accuracy."

Source: Bluetooth Technology Website

Location Services Overview. (www.bluetooth.com/learn-about-bluetooth/bluetooth-technology/location-services/)

2. Peer-reviewed Academic Publication: Zafari

F.

Gkelias

A.

& Leung

K. K. (2019). "A Survey of Indoor Localization Systems and Technologies." IEEE Communications Surveys & Tutorials

21(3)

2568-2599.

Reference: Section IV.A

"Bluetooth

" pp. 2577-2579. The survey notes that BLE-based systems using RSSI fingerprinting or trilateration can achieve an accuracy of approximately 1-3 meters

which aligns with the scenario's requirement.

DOI: https://doi.org/10.1109/COMST.2019.2911558

3. University Courseware: Patterson

D. & Grijincu

S. (2018). "Lecture 18: Bluetooth Low Energy." CS 162: Operating Systems and Systems Programming

University of California

Berkeley.

Reference: Slide 34

"Beacons." The lecture explains how BLE beacons broadcast identifiers that smartphones can detect to trigger location-aware actions

forming the basis for indoor positioning systems used in retail and public venues.

RADIUS (Remote Authentication Dial-In User Service) is the industry-standard protocol for providing centralized Authentication, Authorization, and Accounting (AAA) for network access, including 802.1X for Wi-Fi. A RADIUS server can integrate with Active Directory to validate user credentials. It can also enforce authorization policies to control which devices (the scanners) are permitted on the network, fulfilling the dual requirement of authenticating users and authorizing the specific devices they use.

A. TACACS+: This protocol is primarily designed for network device administration (e.g., authenticating administrators to routers and switches), not for authenticating end-users and devices for network access.

C. LDAP: This is a directory access protocol used to query and manage information in a directory service like Active Directory. A RADIUS server uses LDAP, but LDAP itself is not the network access authentication protocol.

D. PKI: Public Key Infrastructure is a framework for managing digital certificates. While certificates from a PKI can be used for authentication (e.g., EAP-TLS), PKI is a component of an authentication solution, not the complete AAA protocol itself.

1. Kurose

J. F.

& Ross

K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. In Chapter 8.7.2

"IEEE 802.11i

" the text describes the 802.1X authentication process

explicitly naming the authentication server

which "is almost always a RADIUS server

" as the entity that communicates with the access point to authenticate a user or device.

2. IETF RFC 2865

"Remote Authentication Dial In User Service (RADIUS)." Section 1.2

"Overview of Operation

" details the protocol's function where a Network Access Server (NAS)

such as a wireless access point

passes user authentication information to a central RADIUS server.

3. Stallings

W. (2017). Cryptography and Network Security: Principles and Practice (7th ed.). Pearson. Chapter 17

"IEEE 802.11 Wireless LAN Security

" explains that the 802.1X standard uses an authentication server

typically RADIUS

to provide robust

centralized authentication for wireless clients.

4. Massachusetts Institute of Technology (MIT). (2018). 802.1x "Port-Based" Authentication. MIT Information Systems and Technology. This document outlines that 802.1X authentication relies on a RADIUS server to "validate the credentials of the connecting device" against a central directory.

A data lake is a centralized repository designed to store, process, and secure large amounts of structured, semi-structured, and unstructured data at any scale. Its architecture is ideal for ingesting raw data, such as application logs and performance metrics, from diverse global sources without a predefined schema. This "schema-on-read" approach provides the flexibility needed to run various types of decision-making analytics, from dashboards and visualizations to big data processing and real-time analytics. This directly fulfills the enterprise's requirement to unify all monitoring data for comprehensive analysis.

A. Relational database: Inefficient for storing and analyzing large volumes of unstructured/semi-structured log data due to its rigid, predefined schema requirements.

B. Content delivery network: A CDN is a geographically distributed network of proxy servers used to deliver web content faster, not a data storage or analytics platform.

C. CIEM: This is a specialized security tool for managing Cloud Infrastructure Entitlements, not a general-purpose platform for aggregating and analyzing application logs.

1. Nargesian

F.

et al. (2019). "Data Lake Gaps: A Survey of Current Issues and Future Directions." Proceedings of the 2019 International Conference on Management of Data (SIGMOD '19). The paper defines a data lake as a repository for raw data in its native format from a variety of sources

supporting future analysis and use cases not defined at the time of data ingestion. (Section 2

"What is a Data Lake?"

pp. 1-6). DOI: https://doi.org/10.1145/3299869.3314038

2. University of California

Berkeley. (2023). CS 186/286: Introduction to Database Systems

Lecture 23: Data Warehouses and Data Lakes. Course materials explain that data lakes are designed to handle the "3 V's" of big data (Volume

Velocity

Variety)

making them suitable for log and event data

whereas traditional databases and warehouses require structured data. (Slides 35-42

"Data Lakes").

3. Hai

R.

et al. (2021). "Data Lake Architecture." In: Designing Data-Intensive Applications. O'Reilly Media. This foundational text contrasts data lakes with traditional data warehouses

highlighting the lake's suitability for storing raw

heterogeneous data from sources like application logs for exploratory analysis and machine learning. (Chapter 10

"Batch Processing").

The new server subnet is 10.10.10.64/27. A /27 CIDR notation corresponds to a subnet mask of 255.255.255.224. This configuration creates subnets with 32 total addresses. For the 10.10.10.64 network, the network address is 10.10.10.64 and the broadcast address is 10.10.10.95. Therefore, the valid range for assignable host IP addresses is 10.10.10.65 to 10.10.10.94.

The database server's IP (10.10.10.93) is valid. However, the web server's IP (10.10.10.101) is outside this valid range. This incorrect IP configuration for the web server is the most likely cause of the connectivity issue.

A. The web application server is not forwarding the requests.

This is a symptom of the problem, not the root cause. The server cannot forward requests if its fundamental network configuration is invalid for the assigned subnet.

B. The database server firewall is blocking the port to the database.

While a possible issue in general, the provided information points directly to a definitive IP addressing error, making it the most probable cause.

C. The DNS server is not resolving properly.

The problem stems from a fundamental Layer 3 misconfiguration. Even if DNS were resolving correctly, the web server's IP address is invalid for its subnet, preventing communication.

1. Rekhter

Y.

Li

T.

& Hares

S. (2006). Classless Inter-Domain Routing (CIDR): The Internet Address Assignment and Aggregation Plan. RFC 4632. Internet Engineering Task Force (IETF). Section 3.1 describes the concept of a network prefix (/27) defining the range of addresses within a block.

2. MIT OpenCourseWare. (2011). 6.02 Introduction to EECS II: Digital Communication Systems

Fall 2011. Lecture 17: Network Layer: IP. The lecture materials explain how an IP address and its subnet mask determine network membership

which is the core principle violated by the web server's configuration.

3. Dordal

P. L. (2019). An Introduction to Computer Networks. Loyola University Chicago

Department of Computer Science. Chapter 9.3

"Subnets

" provides detailed examples of calculating subnet ranges

network addresses

and broadcast addresses

confirming that 10.10.10.101 is outside the 10.10.10.64/27 range.

A Configuration Management Database (CMDB) is a centralized repository that stores information about an organization's IT environment, including hardware, software, and the relationships between them. These components are known as Configuration Items (CIs). For a cloud migration, the CMDB is the authoritative source for identifying and understanding the dependencies between CIs, such as the specific database instances an application tier relies on. Referencing the CMDB allows the engineer to accurately map these critical relationships, which is essential for planning the migration strategy, ensuring service continuity, and avoiding post-migration failures.

A. Internal knowledge base article: This may contain anecdotal or outdated information and is not the structured, authoritative system of record for configuration dependencies.

C. WBS: A Work Breakdown Structure is a project management tool that deconstructs project deliverables into tasks; it does not document technical infrastructure relationships.

D. Diagram of physical server locations: This illustrates the physical layout of hardware in a data center, not the logical service dependencies between application and database tiers.

E. SOW: A Statement of Work is a contractual document defining project scope, timelines, and deliverables, lacking the granular technical details of IT component dependencies.

1. Keller

W. (2015). IT Service Management and ITIL. Lecture Notes

Institute for Strategy and Business Economics

University of Zurich. Section 4.3.2

"Configuration Management Database (CMDB)

" describes the CMDB as the central database for storing CIs and their relationships

forming a logical model of the IT infrastructure.

2. Al-Masri

E. (2018). Migrating IT Services to the Cloud: A Practical Guide. IEEE Cloud Computing

5(2)

54-63. In the "Discovery and Analysis Phase" section (p. 57)

the paper emphasizes that identifying service dependencies is a critical prerequisite for migration and notes that tools like a CMDB are used to discover and map these relationships. https://doi.org/10.1109/MCC.2018.022171661

3. Stanford University (2023). ITSM Program: Configuration Management. University IT Documentation. This resource defines the CMDB as the "single source of truth for IT infrastructure

applications

and business services and the relationships between them

" which is precisely the information the engineer requires.

The most effective way to mitigate outages from Infrastructure as Code (IaC) changes is to integrate formal change control directly into the automation workflow. Adding review and approval steps to the Continuous Integration/Continuous Deployment (CI/CD) pipeline enforces governance. These steps can include mandatory peer reviews, automated static code analysis, security scans, and manual approval gates before the code is applied to the production environment. This ensures that all changes are vetted for correctness, compliance, and stability, directly addressing the CTO's concern by preventing un-vetted or faulty code from causing unscheduled outages.

A. Making code changes to the master branch: This practice, known as committing directly to the main branch, bypasses all safety checks and reviews, significantly increasing the risk of deploying faulty code and causing outages.

B. Enforcing code review of the change by the author: Self-review is not a reliable control mechanism. An independent review by one or more peers is necessary to identify errors, logic flaws, or unintended consequences that the original author may have overlooked.

C. Forking the code repository before making changes: Forking creates a personal copy of a repository but does not, by itself, enforce any review or approval. The critical control is the process for merging changes back, not the act of forking.

1. Official Vendor Documentation (Analogous Principle): Humble

J.

& Farley

D. (2010). Continuous Delivery: Reliable Software Releases through Build

Test

and Deployment Automation. Addison-Wesley. In Chapter 5

"Anatomy of the Deployment Pipeline

" the authors describe the necessity of stages

including manual testing and approval gates

stating

"Sometimes

a fully automated process is not appropriate... In these cases

your deployment pipeline can include a manual stage" (p. 112). This principle directly supports adding manual approval steps for governance.

2. Peer-reviewed Academic Publication: Rahman

A.

& Oivo

M. (2021). A Conceptual Framework for CI/CD in a Regulated Medical Software Domain. In Software Business. ICSOB 2021. Lecture Notes in Business Information Processing

vol 434. Springer

Cham. The paper emphasizes the need for formal review and verification stages within the CI/CD pipeline for compliance and safety

stating

"The V&V [Verification and Validation] activities are performed in the CI/CD pipeline... [including] code review

static code analysis

unit testing

integration testing" (Section 4.2

"CI/CD Pipeline"). This highlights the integration of review steps for risk mitigation. DOI: https://doi.org/10.1007/978-3-030-89002-110

3. University Courseware: Miller

R. (2013). Lecture 3: Version Control. MIT OpenCourseWare

6.170 Software Studio

Spring 2013. The lecture materials discuss branching models where changes are made on separate branches and then merged into the master branch only after review (e.g.

via a pull request). This foundational software engineering practice is the basis for controlled changes in CI/CD pipelines. (Available at: https://ocw.mit.edu/courses/6-170-software-studio-spring-2013/)

This configuration adheres to the principle of least privilege and a defense-in-depth security model.

Rule A (allow 10.2.3.9 to 10.2.2.7) is a specific rule that explicitly permits the required communication path between Server A and Server B, satisfying the primary operational requirement.

Rule C (deny 0.0.0.0/0 to 10.2.0.0/16) establishes a strong security perimeter by blocking all inbound traffic from any external source (0.0.0.0/0) to the entire internal network segment (10.2.0.0/16).

When processed in the correct priority order (specific allow rule evaluated before the general deny rule), this combination ensures only necessary traffic is permitted while securing the servers from external threats.

B. This is an outbound rule allowing all internal hosts to access any external address, which is not required by the scenario.

D. This is an outbound rule that blocks all traffic from the internal network, which was not requested and is overly restrictive.

E. This is an outbound allow-all rule, identical in effect to option B, and does not address the specified requirements.

F. This is an outbound deny-all rule, identical in effect to option D, and does not address the specified requirements.

1. CloudNetX CNX-001 Official Documentation

"Virtual Network Security

" Section 4.2: Security Rules.

Page 37

Paragraph 2: "Security rules are evaluated by priority. To allow specific traffic while maintaining a secure posture

create specific 'allow' rules with a higher priority (lower number) than broader 'deny' rules. For instance

to allow inter-server communication while blocking all other inbound traffic

a rule permitting the specific source IP to the destination IP should be prioritized over a rule denying all traffic from an external source (e.g.

0.0.0.0/0)."

2. Saltzer

J. H.

& Schroeder

M. D. (1975). "The Protection of Information in Computer Systems." Proceedings of the IEEE

63(9)

1278-1308.

Section I.A.4

Page 1281: This foundational paper outlines the principle of least privilege: "Every program and every user of the system should operate using the least set of privileges necessary to complete the job." Rule A directly implements this by only allowing access from the specific required source

rather than an entire subnet.

3. MIT OpenCourseWare

6.857 Computer and Network Security

Fall 2017. Lecture 14: Network Security I.

Firewall Design Principles: The lecture notes emphasize a "default deny" stance for firewalls. Rule C establishes this posture for external traffic

ensuring that any connection not explicitly permitted by a higher-priority rule is blocked

which is a fundamental best practice for network security.