SK0-005 Practice Test 1 — 10 Questions

Question 1

A server administrator is troubleshooting a Windows Server 2022 that cannot connect to a remote iSCSI target. The server has two network adapters: one for LAN traffic and one dedicated to iSCSI. The administrator verifies that the iSCSI adapter has a valid IP address, can ping the target, and that the iSCSI service is running. However, the iSCSI initiator shows the target as unavailable. Which action should the administrator take next?

Accepted Answer

Verify that the target's access control list includes the initiator's IQN.. The target is discovered but unavailable, while IP connectivity and the iSCSI service are confirmed. This points to an access control issue, such as the initiator IQN not being in the target's ACL. Verifying and adding the IQN to the target's allowed list is the correct next step. Firewall, driver reinstallation, and IP changes are either less likely or inappropriate given the symptoms.

Answer

Reinstall the iSCSI initiator driver on the server.

Answer

Check the Windows Firewall inbound rules for iSCSI traffic on the server.

Answer

Change the iSCSI adapter's IP address to be on the same subnet as the LAN adapter.

Question 2

An organization wants to test its disaster recovery plan with minimal disruption to business operations and minimal cost. The test should verify the plan's effectiveness by discussing scenarios. Which type of test should they perform?

Accepted Answer

Tabletop exercise. A tabletop exercise is a discussion-based review of the plan steps with key stakeholders, requiring no system downtime and very low cost. A full interruption test (Option A) actually shuts down primary systems and fails over, causing disruption. A parallel test (Option B) runs systems at the DR site without cutting over but still involves significant resource allocation. A simulation test (Option D) may involve live drills or emulate components, often costing more than a tabletop.

Answer

Parallel test

Answer

Full interruption test

Answer

Simulation test

Question 3

During a security incident, a server is suspected to be compromised by malware. The incident response team needs to preserve evidence and minimize impact. Which TWO actions should be taken FIRST? (Select TWO.)

Accepted Answer

Disconnect the server from the network.. Options B and C are correct. Disconnecting the server from the network (B) is an immediate containment step to prevent data exfiltration or spread. Capturing a forensic image of system memory (C) preserves volatile data such as running processes, network connections, and encryption keys before they are lost. Option A is wrong because powering off loses all volatile evidence. Option D is wrong because running an AV scan modifies files and could destroy forensic artifacts. Option E is wrong because rebooting erases memory and may trigger malware countermeasures.

Answer

Run an antivirus scan.

Answer

Reboot the server in safe mode.

Answer

Power off the server immediately.

Question 4

A company's backup policy sends nightly backups to a tape library in the same building as the production servers. A recent fire destroyed the server room, and the tapes were damaged by heat and water. Which change BEST addresses this single point of failure?

Accepted Answer

Ship a copy of each backup to an offsite location or replicate it to cloud storage outside the building.. The incident destroyed production and backup copies together because both lived in the same room. The most effective change is to keep at least one copy geographically separate, either by shipping tapes offsite or replicating to cloud storage. More frequent backups, a second in-room library, and tape parity all leave the site-level single point of failure intact.

Answer

Increase the backup frequency to every four hours so less data is lost between jobs.

Answer

Replicate the tape library to a second array in the same server room so backups exist on two media types.

Answer

Add parity to the tape library so a damaged tape can be reconstructed from the remaining tapes.

Question 5

A server administrator is configuring a new server that will host a high-traffic web application. The administrator needs to optimize the server's network performance. Which TWO of the following should be implemented? (Choose two.)

Accepted Answer

Configure NIC teaming for redundancy and load balancing.. Enabling jumbo frames and configuring NIC teaming are direct performance optimizations for a high-traffic web server. Jumbo frames reduce overhead for large transfers, while NIC teaming provides redundancy and load balancing. The other options either degrade performance or do not directly enhance it. These two together can significantly improve network throughput and reliability.

Answer

Assign a static IP address to the server.

Answer

Disable TCP offloading on the network adapter.

Answer

Set the network adapter to half-duplex mode.

Question 6

A company is creating a disaster recovery plan for its on-premises data center. Which THREE elements are essential to include in the DR plan? (Select THREE.)

Accepted Answer

Contact information for key personnel.. Options A, C, and E are correct. Contact information for key personnel (A) ensures that the recovery team can be reached during a crisis. RTO and RPO for each critical system (C) define the recovery goals and guide the technical implementation. The list of failover site addresses and access procedures (E) provides vital instructions for reaching and securing the secondary location. Option B is wrong because cleaning procedures are operational but not a core DR plan element. Option D is wrong because backup procedures are part of the backup policy, not the disaster recovery plan; the DR plan assumes backups exist and focuses on restoring from them.

Answer

Detailed instructions for cleaning server hardware.

Answer

Step-by-step procedures for performing backups.

Question 7

A server administrator is assembling a new high-performance server using a Supermicro X12 motherboard, two Intel Xeon Gold 5317 processors (LGA 4189 socket), and 16x 32GB DDR4-3200 ECC LRDIMMs for a total of 512GB of memory. The chassis has redundant 1600W power supplies. After assembling all components, the administrator powers on the server. All fans start spinning at full speed, and the front panel LEDs illuminate. However, the server does not POST, there are no beep codes, and no video output is displayed. The motherboard has a two-digit hexadecimal POST code LED display, which shows '00' and does not change. The motherboard manual states that code '00' indicates the CPU is not detected or has failed. The processors are confirmed to be the correct socket type and stepping as required by the motherboard. What should the technician do FIRST?

Accepted Answer

Reseat both processors and inspect the CPU sockets for bent pins. The POST code '00' typically indicates a CPU initialization failure. The first and least invasive step is to reseat the processors, checking for bent socket pins, debris, or improper mounting. This resolves a majority of such issues. Option A (replace both CPUs) is extreme and should only be done after ruling out physical installation issues. Option C (clear CMOS) may help if the BIOS was misconfigured for a previous CPU, but physical reseating is more direct. Option D (update BIOS) is not possible if the system cannot POST to enter the update utility; furthermore, if the CPUs are supported by the current BIOS version, updating is unnecessary.

Answer

Replace both processors as they are likely faulty

Answer

Clear the CMOS using the jumper or button on the motherboard

Answer

Update the BIOS to the latest version using the IPMI interface

Question 8

A server administrator is troubleshooting a Windows Server 2019 system that reports a stop error (blue screen) with the code CRITICAL_PROCESS_DIED. The server reboots automatically and then works normally for a few hours before the error recurs. The administrator has already updated all drivers and installed the latest Windows updates. Which action should the administrator take next to gather more detailed diagnostic information about the crashes?

Accepted Answer

Configure the system to write a kernel memory dump and analyze it with Windows Debugging Tools.. When a Windows server experiences recurring stop errors despite driver and OS updates, the administrator needs to capture and analyze a memory dump. The kernel memory dump contains the state of the kernel at the crash, including the call stack and loaded modules. Using Windows Debugging Tools (WinDbg) with the appropriate symbols allows the administrator to pinpoint the failing driver or process. Other options either do not capture crash-time state or address different problem classes.

Answer

Run the System File Checker (sfc /scannow) to repair corrupted system files.

Answer

Enable boot logging and restart the server in Safe Mode.

Answer

Use Performance Monitor to log memory and CPU usage over time.

Question 9

A company uses a two-node failover cluster for a critical application. The cluster nodes are located in the same data center, and the quorum configuration uses a file share witness on a separate server in the same data center. During a major power outage, both cluster nodes and the file share witness server lose power. What is the impact on cluster availability?

Accepted Answer

The cluster will be offline until one of the nodes or the witness comes back online.. With a two-node cluster plus a file share witness, quorum requires a majority of votes — 2 out of 3. When both nodes and the witness lose power simultaneously, no votes remain, so the cluster cannot achieve quorum and all clustered roles go offline. Availability is restored only when at least two of the three voting members (e.g., one node plus the witness, or both nodes) return.

Answer

The cluster will automatically fail over to a third site because the witness server is unavailable.

Answer

The cluster continues operating because the nodes can use a dynamic quorum and adjust the vote count.

Answer

The cluster remains online because the nodes can communicate directly and form quorum without the witness.

Question 10

A technician is preparing to add four new hot-swap SAS drives to a running server that uses a hardware RAID controller. Before inserting the drives, which of the following actions should the technician take? (Choose two.)

Accepted Answer

Confirm the drives are on the RAID controller's compatibility list. Before adding hot-swap drives, the technician must confirm the drives are supported by the RAID controller and that the chosen bays are free of existing array membership. Compatibility prevents rejection or dropout, and confirming empty bays prevents an accidental rebuild that would overwrite the newly inserted drive.

Answer

Set each new drive's SAS address to match the controller's expected value

Answer

Install the drives while the server is powered off to avoid damaging the backplane

Answer

Update the RAID controller firmware to the latest release immediately before insertion