SK0-005 Practice Test 10 — 10 Questions

Question 1

A junior administrator is managing a Linux server used by a development team. The root filesystem (/) has reached 98% capacity, causing the system to slow down and some applications to fail. The server has an LVM volume group with 20 GB of free space, but the root logical volume is 50 GB with an ext4 filesystem. The administrator needs to free space quickly and safely without rebooting or adding new disks. They log in via SSH and want to identify where the large files are and then take action. There are concerns about accidentally deleting critical system files or logs that might be needed for auditing. The server has the following typical directories: /var (with logs), /home (user files), /opt (application files), /tmp. Which of the following sequences of actions is the most appropriate to resolve the issue?

Accepted Answer

Run 'du -sh /*' to locate large directories, then examine and compress or truncate old log files in /var/log. Option A is correct because it uses 'du -sh /*' to safely identify the largest directories, then targets specific log files in /var/log that can be compressed or moved, freeing space without deleting required files. Option B is wrong because blindly removing all files in /tmp may delete needed temporary files for running applications. Option C is wrong because using 'find' with 'exec rm' is very dangerous and could delete critical files if misused. Option D is wrong because resizing the filesystem, while possible with LVM, should be considered after attempting to free space safely; also the free space in VG might be needed elsewhere.

Answer

Execute 'rm -rf /tmp/*' to clear temporary files and regain space

Answer

Use 'find / -type f -size +100M -exec rm {} \;' to delete all files larger than 100MB

Answer

Extend the root logical volume by 10 GB using 'lvextend' and then resize the filesystem with 'resize2fs'

Question 2

A financial services firm requires a disaster recovery site that provides immediate failover with zero data loss. Which type of site should they implement?

Accepted Answer

A hot site with synchronous replication.. Option A is correct because a hot site with synchronous replication ensures that data is written to both primary and secondary sites simultaneously, providing zero RPO and immediate failover. Option B (warm site) requires some time to bring systems online, leading to downtime and potential data loss. Option C (cold site) involves significant setup time and last-known-good backup restoration. Option D (cloud with daily snapshots) introduces an RPO of up to 24 hours, not zero data loss.

Answer

A warm site with asynchronous replication.

Answer

A cloud-based site with daily snapshots.

Answer

A cold site with tape restoration.

Question 3

A network administrator needs to configure centralized authentication for network devices. The solution must provide encryption of the entire authentication process, support for multiple protocols, and accounting of user actions. Which protocol should be used?

Accepted Answer

TACACS+. TACACS+ encrypts the entire authentication process, offers granular control over authorization, and supports accounting. RADIUS (B) only encrypts the password, not the entire session. LDAP (A) is a directory service, not an encryption-focused authentication protocol. Kerberos (C) uses tickets and encryption but is primarily for single sign-on within a domain, not commonly used for network device administration.

Answer

Kerberos

Answer

RADIUS

Answer

LDAP

Question 4

Refer to the exhibit. A Linux server's local firewall is configured as shown. The administrator is unable to perform backups to a network-attached storage (NAS) device using TCP port 10000. Which firewall rule is causing the issue?

Accepted Answer

The DROP all rule at the end blocks all traffic except SSH.. Option D is correct. The INPUT chain contains an explicit DROP all rule at the end, which blocks any traffic not explicitly allowed. The only allowed traffic is SSH on port 22. The backup traffic on port 10000 matches the DROP rule and is therefore dropped. Option A is incorrect because the policy ACCEPT is overridden by the explicit DROP. Option B allows SSH traffic but does not affect port 10000. Option C about subnets is irrelevant to the local firewall shown.

Answer

The INPUT policy is set to ACCEPT.

Answer

The NAS device uses a different subnet.

Answer

The SSH ACCEPT rule is allowing traffic.

Question 5

A small business needs a disaster recovery site that can be brought online within 2 hours of a primary site failure. The business can tolerate minimal data loss. Which type of recovery site should they implement?

Accepted Answer

Hot site. Option C is correct because a hot site maintains near-real-time data replication and preconfigured hardware, enabling failover within 2 hours and minimal data loss. A cold site (Option A) requires hardware setup and data restoration, taking days. A warm site (Option B) has pre-installed hardware but lacks current data, typically taking hours to a day to activate. A mobile site (Option D) is a portable solution with variable provisioning time and may not meet the 2-hour requirement consistently.

Answer

Cold site

Answer

Warm site

Answer

Mobile site

Question 6

A server has a RAID 5 array with four drives. One drive fails and is replaced. During the rebuild, a second drive reports a media error and the rebuild fails. What should the administrator do FIRST to minimize the risk of permanent data loss?

Accepted Answer

Back up all critical data before any further rebuilding. A media error on another drive during a RAID 5 rebuild indicates that drive may also be failing. If another drive fails completely, the entire array and its data will be lost. Therefore, the immediate priority is to back up critical data before any further rebuild action. Replacing the drive or restarting the controller could trigger another rebuild, risking complete array loss. A consistency check does not address the urgency.

Answer

Run a consistency check on the array

Answer

Replace the drive that reported the media error immediately

Answer

Restart the RAID controller to reinitialize the rebuild

Question 7

A company performs a full backup on Sunday and incremental backups Monday through Saturday. A server fails on Thursday at 10:00 AM. Which sequence correctly restores the data?

Accepted Answer

Restore Sunday full, then Monday, Tuesday, and Wednesday incrementals.. Option C is correct because an incremental backup captures only changes since the last backup, requiring the last full backup and all subsequent incrementals up to the point of failure. Options A and D are wrong because they skip Monday’s incremental (A) or both Monday and Tuesday (D). Option B is wrong because it restores out of order, which would not apply the data correctly.

Answer

Restore Sunday full, then Tuesday and Wednesday incrementals.

Answer

Restore Sunday full and Wednesday incremental only.

Answer

Restore Wednesday's incremental, then Sunday full.

Question 8

A mid-sized e-commerce company experienced a ransomware attack that encrypted all on-premises servers and their locally attached backup storage. The attack occurred on a Friday evening; the company was closed over the weekend. By Monday morning, the IT team discovered the encryption and found a ransom note demanding $500,000 in Bitcoin. The company has a disaster recovery plan that calls for restoring from daily tape backups stored offsite. However, the most recent offsite tape was taken home by a backup operator for the weekend and has not been returned. The tape contains full backups from Wednesday. The IT team has clean installation media and application software available. The company's RPO is 24 hours, and RTO is 48 hours. Management wants to minimize data loss and avoid paying the ransom. Based on this scenario, which of the following should the IT team do to recover the business operations?

Accepted Answer

Rebuild the servers from scratch using clean media, restore the latest offsite tape if available, and apply available transaction logs from the on-premises backup server that was encrypted (attempting to recover unencrypted logs).. Option A is correct because it follows the existing DR plan by restoring from the available offsite tape (even though a few days old) and builds clean servers to avoid reinfection. It also attempts to salvage any unencrypted transaction logs from the compromised environment to minimize data loss beyond Wednesday. Paying the ransom (Option B) is against best practices and may not guarantee full recovery. Waiting for the operator to return the tape (Option C) delays action and may still result in significant data loss; the operator's return is uncertain. Manually re-entering transactions (Option D) is highly labor-intensive, error-prone, and could exceed the 48-hour RTO.

Answer

Pay the ransom to obtain the decryption key, then restore the environment, and implement better security controls.

Answer

Rebuild the servers from scratch using clean media, and manually re-enter transactions since the last good backup based on paper records and customer emails.

Answer

Wait for the backup operator to return the tape, then restore from that tape, accepting data loss since Wednesday.

Question 9

A small law firm has a single on-premises server running their case management software, email, and document storage. They perform a full backup each night at 11 PM to an external USB 4 TB drive, which is then stored on a shelf in the server room. The server room is located in the basement of their office building. Last week, an electrical fire started in the server room, completely destroying the server and the backup drive. The firm lost all data since the last backup, and it took two weeks to procure new hardware and restore from an older, off-site backup that was taken during a manual process three months ago. Their insurance company now requires a formal disaster recovery plan. The firm has a limited budget and minimal IT staff. They want to prevent data loss and minimize downtime in future disasters. What is the BEST course of action to improve their disaster recovery capabilities?

Accepted Answer

Subscribe to a cloud backup service that performs automatic daily backups to a remote data center.. Option B is correct because cloud backup automatically sends data to a remote location, satisfying the off-site requirement of the 3-2-1 backup rule, is cost-effective for a small firm, and requires little IT overhead. Option A is wrong because mirroring on-site still leaves them vulnerable to site-wide disasters like fire. Option C is wrong because a fireproof safe does not protect against all disaster types and keeps the backup on-site. Option D is wrong because it still stores the backup on-site, increasing cost and management without solving the off-site need.

Answer

Increase backup frequency to every hour and store the drive in a desk drawer in a different room on the same floor.

Answer

Purchase a fireproof safe for the server room and store the USB backup drive in it after each backup.

Answer

Install a second server on-site and configure real-time mirroring between the two servers.

Question 10

An organization's disaster recovery plan specifies an RPO of 4 hours. Their current backup schedule performs a full backup at midnight and incremental backups every 2 hours from 8:00 AM to 8:00 PM. A server failure occurs at 3:00 AM, and data created after 8:00 PM the previous day is permanently lost. Which of the following is the MOST likely reason?

Accepted Answer

There is a gap in the backup schedule overnight that exceeds the RPO.. Option C is correct because the backup schedule has no coverage from 8:00 PM to 8:00 AM the next morning (except full at midnight), creating a 12-hour gap overnight that exceeds the 4-hour RPO. Data created after 8:00 PM and before the failure at 3:00 AM is lost because no backup captured it. Option A is incorrect because RPO is a requirement, not the cause. Option B is speculative. Option D refers to synthetic fulls, which are not relevant to this gap.

Answer

The incremental backups were not synthetically rolled into the full backup.

Answer

The RPO was set too low for the business requirements.

Answer

The backup media became corrupted.