CNX-001 Sample Questions & Answers

Microsegmentation provides the most granular and effective control for this scenario. An agent-based solution can enforce policies based on workload identity (e.g., tags, labels) rather than brittle IP addresses, which is crucial in an auto-scaling environment where IPs are dynamic. This allows for strict isolation and inspection of east-west traffic between the application and database tiers, regardless of their location or IP address, fulfilling the HIPAA compliance requirement.

A Geolocation routing policy directs users to the endpoint in the region geographically closest to them, minimizing latency. Combining this with a failover policy (often configured via health checks) ensures that if the primary region for a user becomes unhealthy, their DNS queries will be automatically resolved to the next-closest healthy region. This combination directly addresses both the low-latency and high-availability requirements.

Local Preference is a BGP attribute used to influence outbound traffic paths within a single Autonomous System (AS). By setting a higher Local Preference value for the routes received over the Direct Connect link, the on-premises router will prefer that path for egress traffic to AWS over the path learned via the backup VPN. AS Path Prepending is used to influence inbound traffic, not outbound.

The asyncio library is ideal for I/O-bound and high-level structured network code. Sending a network request and waiting for a reply is a classic I/O-bound task. asyncio uses a single-threaded, single-process cooperative multitasking model (event loop) that allows it to handle thousands of concurrent connections efficiently with less overhead than threading or multiprocessing, which are better suited for CPU-bound tasks.

The IKE Phase 1 process involves negotiating a set of security parameters (a security association or SA) between the VPN peers. These parameters include the encryption algorithm (e.g., AES-256), hashing algorithm (e.g., SHA-256), authentication method (e.g., pre-shared key), and Diffie-Hellman group. A 'proposal mismatch' error explicitly indicates that the set of these parameters sent by one peer is not acceptable to or does not match a configured policy on the other peer.

CDNs cache content at edge locations based on a Time-to-Live (TTL) value to reduce requests to the origin server. When content is updated at the origin before the TTL expires, the CDN will continue to serve the old, cached version. Cache invalidation (or purging) is a mechanism to manually force the CDN to remove a specific object from its cache, compelling it to fetch the latest version from the origin on the next request.

Just-in-Time (JIT) access is a core feature of modern PAM solutions that embodies the principle of least privilege. Instead of users having persistent, or 'standing,' administrative rights, JIT access allows for the temporary elevation of privileges for a specific purpose and a limited time. Once the task is complete or the time expires, the privileges are automatically revoked, thus eliminating standing privileges and significantly reducing the attack surface.

Application-aware routing is a key feature of SD-WAN that allows the creation of policies based on application identification (e.g., Layer 7 inspection). An administrator can define a policy that identifies the ICS traffic and steers it over the highest-quality, lowest-latency path (e.g., an MPLS circuit), while routing the less critical bulk data uploads over a lower-cost broadband link. This ensures service level agreements (SLAs) are met for critical applications.

Using time-based thresholds (e.g., 'CPU > 90% for 5 minutes') prevents alerts from firing for transient spikes or momentary blips, which are a common cause of alert noise. This ensures that the NOC is only notified of sustained problems that require attention.

An event correlation engine or an AIOps (AI for IT Operations) platform is designed to ingest alerts from multiple sources and use algorithms or rules to identify relationships. It can group symptomatic alerts (e.g., 'application unavailable') under a single root cause alert (e.g., 'router down'), drastically reducing the number of notifications and helping the NOC focus on the actual problem.

A Pilot Light strategy involves replicating data to a DR site and keeping a minimal, core set of services running (the 'pilot light'). In a disaster, the full infrastructure can be quickly scaled up around this core. This approach provides a much faster RTO (minutes to hours) than Backup and Restore, and is more cost-effective than a full Warm or Hot Standby. It can comfortably meet a 15-minute RTO and 1-hour RPO with proper automation.