CNX-001 Exam Guide: Cost, Format and Study Plan

The CNX-001 exam is CompTIA CloudNetX V1. It has a maximum of 90 questions, a maximum of 165 minutes, and a pass/fail result only. CompTIA lists the exam at $544.00, and our voucher costs $224.99.

This guide gives you the format, the domain weights, the price details, an 8-week plan and a hands-on drill. Facts come from the official CompTIA CloudNetX page.

What CloudNetX proves and who it fits

CompTIA says CloudNetX validates your ability to design and implement secure, scalable networking solutions in hybrid environments. It covers security design, network monitoring, performance optimization and advanced troubleshooting. Hands-on skills such as Zero Trust implementation are part of it.

CompTIA points the certification at three roles: network architect, security architect and enterprise architect. This is not an entry-level exam. The recommended experience is at least 10 years of IT experience, including 5 years in a network architect role. CompTIA also recommends hybrid cloud experience and foundational knowledge equivalent to Network+, Security+ and Cloud+.

The skills CompTIA lists are:

• Analyze business requirements and design secure network architectures for hybrid environments.

• Implement Zero Trust principles, configure access controls and secure hybrid networks.

• Monitor network performance, automate tasks and keep networks reliable.

• Diagnose and resolve connectivity, performance and security issues in hybrid networks.

Skills measured and how to split your study hours

The exam has four domains. Weights tell you where the points are, so spend your hours in the same proportions. The last column is a suggested split of a 72-hour plan, which is our own estimate and not a CompTIA figure.

What each domain covers, per CompTIA:

• Network architecture design: IP addressing, routing protocols and NAT. Mesh, star and spine-and-leaf topologies. VPNs, SD-WAN, MPLS and public cloud connections. Load balancing, redundancy, autoscaling and CDNs. Campus power, environmental factors and physical access controls.

• Network security: Threats, vulnerabilities and mitigations. Firewalls, encryption protocols and NAC. Firewall rules, security groups and URL filtering. ZTNA, SASE, microsegmentation and CASB. SSO, MFA, PKI and privileged access management. Wireless encryption, authentication and isolation.

• Network operations, monitoring, and performance: Risk, continuity and service delivery. Metrics, dashboards, logging and alerting. Infrastructure as code, automation tools and scripting.

• Network troubleshooting: DNS, VPN and cloud interconnectivity problems. Latency, load balancing and packet loss. Firewall faults, unauthorized access and hybrid vulnerabilities.

If SASE and ZTNA are new to you, our NSE 7 SASE Administrator guide shows how one vendor builds them. Use it as a lab idea, not as exam content.

Exam format at a glance

Performance-based questions ask you to do a task, not pick an answer. Budget your time so a long simulation does not eat the minutes you need for the rest.

With 165 minutes and up to 90 questions, you have about 110 seconds per question on average. Move fast on short items and bank time for the hands-on ones.

Cost: official price vs our voucher

Prices below are in USD and were checked on November 9, 2026. CompTIA can change prices, so confirm the current figure on the official page before you buy.

Our CNX-001 CompTIA CloudNetX voucher is valid for 12 months and redeemed with Pearson VUE.

Here is how delivery and refunds work:

• The code is emailed within 12 hours of payment and also appears in your account.

• You can cancel for a full refund before delivery.

• A delivered code is non-refundable, with one exception. If the test provider rejects it as invalid, already used or expired on first use, contact support within 14 days with your order number and a screenshot. We replace or refund the code.

Full terms are on the refund page and the delivery page.

Because the voucher lasts 12 months, buy it when your plan is set. Book the exam for the end of week 8, and keep a few weeks of the 12-month voucher validity spare in case you need to reschedule.

An 8-week study plan at about 9 hours a week

This plan assumes you already work with networks daily. If you do not, add weeks and spend the extra time on the lab work. It totals 72 hours and matches the weights above.

1. Week 1 (9 h): IP addressing, routing protocols, NAT, and mesh, star and spine-and-leaf designs. Sketch each topology and note its failure points.

2. Week 2 (9 h): VPN, SD-WAN, MPLS and cloud connections. Add load balancing, redundancy, autoscaling and CDNs.

3. Week 3 (9 h): 4 h on campus power, environment and physical access. 5 h on firewalls, encryption protocols and NAC.

4. Week 4 (9 h): ZTNA, SASE, microsegmentation and CASB. Then SSO, MFA, PKI and privileged access management.

5. Week 5 (9 h): 6 h on threats, mitigations, firewall rules, security groups, URL filtering and wireless security. 3 h starting operations and risk.

6. Week 6 (9 h): Metrics, dashboards, logging, alerting, infrastructure as code and scripting for hybrid environments.

7. Week 7 (9 h): Troubleshooting DNS, VPN and cloud interconnects. Practice latency and packet loss diagnosis.

8. Week 8 (9 h): Troubleshooting firewalls and unauthorized access, then timed practice with at least one full-length run.

After each week, write five scenario notes in the form: symptom, likely cause, how you would prove it, fix. This builds the habit the performance-based questions reward.

Worked example: a hybrid VPN drill

Scenario: an app in a cloud network cannot reach a server on-premises over a site-to-site VPN. Small requests work, but large transfers stall. Walk the problem in a fixed order.

1. Check name resolution, because DNS failures look like connectivity failures.

2. Check the path and where it stops.

3. Test the packet size, because tunnel overhead often lowers the usable MTU.

On a Linux test host, you can run:

dig app.internal.example.com @10.0.0.2
traceroute -n 10.20.0.15
ping -M do -s 1472 10.20.0.15
ping -M do -s 1372 10.20.0.15

If the 1472-byte ping fails with a fragmentation message but the 1372-byte ping works, the path MTU is lower than 1500. Lowering the MTU or the TCP MSS on the tunnel is a common fix. Run the same drill with a firewall rule blocking the port to see how that symptom differs: pings may pass while the application port fails.

This drill maps to the troubleshooting objectives on VPN, cloud interconnectivity, DNS and packet loss. You can repeat it in a free lab with two small virtual networks and a tunnel.

Common mistakes

• Studying all domains equally. Architecture and security together are 59% of the exam. Troubleshooting alone is 25%.

• Reading without building. The exam includes performance-based questions. Configure a VPN, a firewall rule and a monitoring alert at least once.

• Memorizing acronyms only. Know when to pick SD-WAN over MPLS, or ZTNA over a traditional VPN, and why.

• Skipping operations. At 16% it is the smallest domain, but infrastructure as code and alerting are easy points if you have practiced.

• Buying the voucher too early. It is valid for 12 months. Start the clock once your plan is underway.

• Trusting any single practice test. Third-party questions vary in quality. Use them to find weak areas, then go back to the objectives.

After you pass

Update your resume with the full name, CompTIA CloudNetX. Point to the roles CompTIA names: network architect, security architect or enterprise architect. Back the credential with a short write-up of a design you built in your lab, such as a hybrid network with a documented Zero Trust policy.

If you want to widen your path, browse our Networking certifications for the next step.

Ready to book? Get the CNX-001 voucher and schedule your Pearson VUE slot.

Sources

• CompTIA CloudNetX certification (official page)