Comprehensive and Detailed Explanation From Exact Extract:
Geofencing allows enforcement of access policies based on the geographic location of the user's IP address.
To comply with GDPR and control access based on user region, geofencing should be implemented to restrict or permit access to resources hosted in specific regions like Europe.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "Data Sovereignty and Regional Access Control":
"Geofencing enables organizations to restrict access to data or services based on geographic IP address, aiding in GDPR and other compliance frameworks." Other options:
* A. SASE is a broader framework, not a direct access control mechanism.
* B. NSGs operate at subnet/NIC level and do not interpret geolocation.
* C. CDNs cache data globally but don't control access by region directly.

Comprehensive and Detailed Explanation From Exact Extract:
NAT64 allows IPv6-only devices to communicate with IPv4-only systems. It translates IPv6 addresses to IPv4 and vice versa. This is essential in mixed environments where backward compatibility is needed, and cannot be resolved simply by dual-stacking or bridging.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "IP Version Compatibility and Translation":
"NAT64 allows seamless communication between IPv6-only clients and IPv4-only servers by translating address formats and protocol headers." Other options:
* A. Adding IPv6 to internal servers requires changes to all internal devices and does not scale well.
* B. Bridging does not handle protocol translation.
* C. Changing IPv6 servers back to IPv4 violates the requirement for IPv6-only configuration.

Comprehensive and Detailed Explanation From Exact Extract:
To verify that the certificate and the private key match, one can extract the modulus from both files and compare their hash values. The correct syntax involves using openssl x509 to extract the modulus from the certificate, and openssl rsa to extract the modulus from the private key, followed by an MD5 hash to ensure they match.
Relevant Extract from CompTIA CloudNetX CNX-001 Study Guide - under "TLS/SSL Certificate Validation and Troubleshooting":
"To verify that the private key and certificate match, compare the modulus values. A mismatch results in failed TLS handshakes." Other options:
* A & C: Incorrect syntax (openssl-list and openssl-rsa are not valid commands).
* B: The commands shown are used to verify CSRs, not matching keys.

In a small satellite campus with limited buildings and user density, a collapsed-core (two-tier) design combines the core and distribution layers into a single set of switches. This minimizes hardware, simplifies management, and still provides the necessary segmentation and resiliency for the classrooms, screening room, and student seating areas.

Deploying active-active clusters across two AZs in each of two regions ensures the application can survive both AZ- and entire-region failures, delivering the highest possible uptime.