SK0-005 Practice Test 11 — 15 Questions

Question 1

Refer to the exhibit. A server administrator is reviewing security logs after a suspected brute-force attack on the SSH service. The following excerpt from /var/log/secure is displayed. Which security control would have been MOST effective in preventing the successful login?

Accepted Answer

Implementing fail2ban or similar intrusion prevention.. Option B is correct because fail2ban or a similar intrusion prevention system monitors logs for repeated failures and blocks the attacker's IP address after a configurable number of attempts, stopping the attack before the correct password is guessed. Option A is wrong because a strong password policy might resist guessing for a long time, but the admin password was eventually guessed; it does not actively prevent repeated attempts. Option C is wrong because disabling root login would not have prevented the attack on the admin account, which was the one compromised. Option D is wrong because changing the SSH port is security through obscurity and does not prevent brute-force attempts once the port is discovered.

Answer

Disabling root login via SSH.

Answer

Enforcing a strong password policy.

Answer

Using a different SSH port.

Question 2

An organization wants to test its disaster recovery plan with minimal disruption to business operations and minimal cost. The test should verify the plan's effectiveness by discussing scenarios. Which type of test should they perform?

Accepted Answer

Tabletop exercise. Option C is correct because a tabletop exercise is a discussion-based review of the plan steps with key stakeholders, requiring no system downtime and very low cost. A full interruption test (Option A) actually shuts down primary systems and fails over, causing disruption. A parallel test (Option B) runs systems at the DR site without cutting over but still involves significant resource allocation. A simulation test (Option D) may involve live drills or emulate components, often costing more than a tabletop.

Answer

Parallel test

Answer

Full interruption test

Answer

Simulation test

Question 3

During a security incident, a server is suspected to be compromised by malware. The incident response team needs to preserve evidence and minimize impact. Which TWO actions should be taken FIRST? (Select TWO.)

Accepted Answer

Disconnect the server from the network.. Options B and C are correct. Disconnecting the server from the network (B) is an immediate containment step to prevent data exfiltration or spread. Capturing a forensic image of system memory (C) preserves volatile data such as running processes, network connections, and encryption keys before they are lost. Option A is wrong because powering off loses all volatile evidence. Option D is wrong because running an AV scan modifies files and could destroy forensic artifacts. Option E is wrong because rebooting erases memory and may trigger malware countermeasures.

Answer

Run an antivirus scan.

Answer

Reboot the server in safe mode.

Answer

Power off the server immediately.

Question 4

After an unexpected power outage, a server fails to boot and displays an error indicating a degraded RAID array. The server has a RAID 5 configuration with four disks. One disk has failed, but the hot spare did not automatically rebuild. The administrator needs to restore data availability as quickly as possible. Which action should the technician take FIRST?

Accepted Answer

Replace the failed disk and initiate a manual rebuild.. Option A is correct because replacing the failed disk and initiating a manual rebuild directly restores redundancy and availability using the existing parity data. Option B is wrong because the hot spare is not faulty; the rebuild did not trigger automatically, likely due to a configuration issue, and swapping it does not address the failed disk. Option C is wrong because while a bad battery or cache can cause rebuild failures, checking this is a later step; the immediate need is to replace the failed disk to restore redundancy. Option D is wrong because a backup restore is a last resort and may result in data loss; the array is degraded but still functional, so rebuilding is faster and less disruptive.

Answer

Restore the server from the latest backup.

Answer

Check the RAID controller battery and cache.

Answer

Replace the hot spare with a new disk.

Question 5

A company is creating a disaster recovery plan for its on-premises data center. Which THREE elements are essential to include in the DR plan? (Select THREE.)

Accepted Answer

Contact information for key personnel.. Options A, C, and E are correct. Contact information for key personnel (A) ensures that the recovery team can be reached during a crisis. RTO and RPO for each critical system (C) define the recovery goals and guide the technical implementation. The list of failover site addresses and access procedures (E) provides vital instructions for reaching and securing the secondary location. Option B is wrong because cleaning procedures are operational but not a core DR plan element. Option D is wrong because backup procedures are part of the backup policy, not the disaster recovery plan; the DR plan assumes backups exist and focuses on restoring from them.

Answer

Detailed instructions for cleaning server hardware.

Answer

Step-by-step procedures for performing backups.

Question 6

A server administrator notices that a recently installed PCIe network card is not being recognized by the operating system. The server is running Windows Server 2019. The administrator has verified that the card is securely seated and that the slot is enabled in the BIOS. Which of the following should the administrator try FIRST to resolve the issue?

Accepted Answer

Check the Hardware Compatibility List (HCL) for Windows Server 2019.. Option B is correct because the first step when a newly installed device is not recognized should be to verify hardware compatibility with the operating system (checking the Hardware Compatibility List). This ensures the device has supported drivers. Options A and C are physical steps that have already been considered (secure seating, slot enabled), and D (updating BIOS) is a later step after confirming compatibility.

Answer

Replace the network card with a known-good card.

Answer

Reseat the network card in a different PCIe slot.

Answer

Update the server BIOS to the latest version.

Question 7

A virtualized server running multiple VMs experiences a sudden performance degradation during peak hours. Storage latency spikes and CPU ready time increases significantly. The hypervisor shows high memory overcommitment but no swapping. Which action would most likely resolve the issue without adding hardware?

Accepted Answer

Migrate one or more VMs to another host. Option B is correct because migrating VMs reduces resource contention on the host, lowering CPU ready time and potentially alleviating storage I/O pressure. Option A would only address memory pressure, not CPU ready. Option C is already enabled by default and would not resolve high ready time. Option D might help CPU contention but could degrade application performance and does not address storage latency directly.

Answer

Reduce the number of vCPUs assigned to each VM

Answer

Increase memory reservation for all VMs

Answer

Enable transparent page sharing

Question 8

Refer to the exhibit. A backup administrator scheduled a nightly backup to a network share. The backup job fails with the error shown in the log. What is the most likely cause?

Accepted Answer

The service account lacks write permissions to the share. Option C is correct because the “Access denied” message indicates a permissions issue, likely that the service account running the backup lacks write access to the share. The share being offline would likely show “network path not found,” a full disk would show “insufficient space,” and the software not installed would prevent the job from running at all.

Answer

The backup destination disk is full

Answer

The network share is offline

Answer

The backup software is not installed

Question 9

After a thunderstorm, a server in a remote office is reachable via remote console but has no network connectivity. The network switch port shows a steady link light, but the server's NIC shows no link light. Which of the following is the MOST likely cause?

Accepted Answer

The NIC hardware has failed.. Option C is correct. A lack of link light on the server's NIC while the switch has a link indicates a physical failure between the NIC and the cable, such as a damaged NIC. Option A would result in no link on the switch as well. Option B would still allow the NIC to establish link. Option D would not affect link lights.

Answer

TCP/IP stack corruption.

Answer

Switch port is administratively disabled.

Answer

Incorrect VLAN assignment on the switch port.

Question 10

A company performs full backups every Sunday and differential backups daily. After a ransomware attack, they discover that both the production data and all attached backup media were encrypted. They need to ensure data can be recovered in the future. Which of the following is the BEST change to their backup strategy?

Accepted Answer

Store backups on an air-gapped or offline system.. Option D is correct because air-gapped backups are physically isolated and cannot be reached by ransomware, ensuring recoverability. Option A increases backup frequency but doesn't protect against ransomware that encrypts attached media. Option B changes backup type but still leaves backups online and vulnerable. Option C protects data at rest but if the encryption keys are on the same system, they can be compromised, and encryption itself doesn't prevent deletion/encryption by ransomware.

Answer

Encrypt the backup data using AES-256.

Answer

Perform full backups daily instead of weekly.

Answer

Switch from differential to incremental daily backups.

Question 11

A small business relies on a single Dell PowerEdge T340 tower server running Windows Server 2019 as its primary domain controller and file server. The server is situated in a locked, air-conditioned IT closet and is protected by an online surge protector. During a severe thunderstorm last evening, the building experienced a momentary power loss. This morning, the administrator found the server completely powered off. When the power button is pressed, the front panel diagnostic LEDs briefly illuminate, and all internal cooling fans start spinning for about two to three seconds, but then the server abruptly powers down. There are no audible beep codes, and the monitor never receives a video signal. The administrator has already verified the power cable is firmly seated in both the server and the surge protector, swapped the power cable with a known-good one, and tested the surge protector with another device, which powered on normally. No spare parts are immediately available, and server downtime must be kept to a minimum. What should the administrator do FIRST to diagnose and resolve the problem?

Accepted Answer

Replace the power supply with a compatible, known-good unit.. Option B is correct: the brief fan spin with immediate shutdown and absence of POST is a classic sign of a failing power supply that cannot maintain output under load. After a power surge, the power supply is the most probable damaged component. Option A is wrong because motherboard failure would typically produce beep codes or consistent power without POST, and swapping it is high-effort without first testing the power supply. Option C is wrong because RAM issues usually generate beep codes or a continuous power-on state with no boot, not the described brief spin-down. Option D is wrong because the administrator already confirmed other devices work on the same circuit, ruling out a supply-side issue.

Answer

Swap the motherboard with an identical one from a spare parts inventory.

Answer

Connect the server directly to a different power outlet, bypassing the surge protector.

Answer

Remove the server's RAM modules and reinstall them one at a time, testing after each.

Question 12

A database administrator notices that the primary SQL Server instance has been experiencing severe performance degradation over the past hour. The server is a virtual machine with 8 vCPUs and 64 GB of RAM, and it normally operates with around 40% CPU utilization. Currently, Task Manager shows 100% CPU usage, with the sqlservr.exe process consuming nearly all cycles. The database response times have increased tenfold, and some queries are timing out. There are no scheduled maintenance jobs running, and the transaction log backup completed successfully earlier. The DBA checks active sessions and finds one long-running ad-hoc query from a new reporting tool that was deployed this morning. The query is performing a cross join on two large tables with missing WHERE clauses, causing a Cartesian product. Ending the session will roll back the query and free resources.

Accepted Answer

Identify and kill the offending long-running query using the SQL Server management tools.. Option A is the correct immediate action. Identifying and terminating the specific offending query is the fastest way to restore normal operation without disrupting other database activities. Option B (adding vCPUs) is not a quick fix and doesn't address the root cause. Option C (restarting the SQL service) will disconnect all users and cause unnecessary downtime. Option D (increasing the VM's memory) won't help a CPU-bound problem caused by an inefficient query.

Answer

Increase the virtual machine's memory allocation from 64 GB to 128 GB to reduce paging.

Answer

Immediately add more vCPUs to the virtual machine to handle the increased load.

Answer

Restart the SQL Server service to clear all active connections and start fresh.

Question 13

After a power outage, a server fails to boot and displays a "Missing operating system" error. The server uses RAID 1 for the OS disk. The administrator verifies both drives are present in the RAID configuration utility but one drive is marked as failed. What should the administrator do FIRST?

Accepted Answer

Check the boot order in BIOS/UEFI. Option C is correct because the system may be trying to boot from an incorrect device, especially after a power event may have reset BIOS settings. Option A is a later step if the array is truly broken. Option B is not the first step because the array itself may be bootable. Option D is unlikely to restore a failed drive.

Answer

Boot from a Windows recovery media and run chkdsk

Answer

Reseat the failed drive and attempt to boot

Answer

Replace the failed drive and rebuild the array

Question 14

A server uses NIC teaming with LACP (802.3ad) for load balancing and failover. After replacing a failed switch with a new switch of the same model, the server loses network connectivity. The switch ports show no activity. Which of the following is the MOST likely cause?

Accepted Answer

LACP is not enabled on the switch ports.. LACP must be explicitly enabled and configured on switch ports to form a port-channel (Option D). New switches ship with default configurations that do not include LACP. The server's NIC teaming mode (Option A) was previously working, so it is likely correct. Access port configuration (Option B) would affect VLAN membership but not completely drop traffic. Firmware differences (Option C) rarely cause total loss of connectivity without other configuration mismatches.

Answer

The switch ports are not configured as access ports.

Answer

The new switch has a different firmware version.

Answer

The server's NIC teaming mode is set to active/passive.

Question 15

After installing additional RAM modules in a server, the BIOS displays only a portion of the installed memory. The modules are identical in speed and size but from different manufacturers. Which of the following is the BEST initial troubleshooting step?

Accepted Answer

Reseat all memory modules and ensure proper slot population.. Reseating memory and checking population order (Option C) are the first steps because improper seating or incorrect slot placement can cause the BIOS to not recognize all modules. Updating BIOS (Option A) might help if a compatibility issue exists, but physical inspection should come first. Replacing the motherboard (Option B) is too extreme. Running memtest86 (Option D) is useful but should follow physical checks.

Answer

Replace the motherboard.

Answer

Run memtest86 immediately.

Answer

Update the server BIOS firmware.

SK0-005 Practice Test 11 — 15 Questions

Exhibit

SK0-005 Practice Test 11 — 15 Questions

Exhibit