SK0-005 Practice Test 12 — 15 Questions

Question 1

A server running a critical database application crashes and fails to boot with the error message 'Operating System not found.' The server is equipped with a hardware RAID 5 array consisting of three identical disks. A technician suspects a disk failure. What is the MOST likely cause of this error?

Accepted Answer

Two or more disks have failed.. Option D is correct because RAID 5 can tolerate a single disk failure and continue operating in a degraded state. The 'Operating System not found' message indicates the RAID array is offline or the boot volume is inaccessible, which most commonly happens when two or more disks fail simultaneously, exceeding the redundancy of RAID 5. Option A would not cause this error; a single failure would allow the OS to boot. Option C is less common and might produce different errors. Option B could happen but is normally a second-order effect.

Answer

A single disk has experienced a complete failure.

Answer

The boot sector on the disk is corrupted.

Answer

The RAID controller firmware is corrupted.

Question 2

A medium-sized e-commerce company operates three critical servers: a web front-end, a database server, and a file server. Currently, a full backup of all servers is performed every Sunday starting at 11:00 PM and completes in about 6 hours. Differential backups run each weekday at 11:00 PM, taking roughly 2 hours. On a Wednesday at 10:00 AM, a ransomware attack encrypts all data on all servers. The IT team’s incident response plan requires restoration with an RPO of 4 hours and an RTO of 8 hours. The latest clean backup is Tuesday’s differential, resulting in approximately 10 hours of data loss. Future attacks could occur at any time. Management is willing to spend up to $200 per month to improve the backup strategy but cannot afford new hardware or a dedicated hot site. The team needs a solution that reduces both RPO and RTO within budget while maintaining simplicity for a small IT staff of two. Which of the following backup strategies should be implemented to best meet these requirements?

Accepted Answer

Implement hourly incremental backups with daily full backups to a cloud backup service, costing $50/month.. B is correct. Hourly incremental backups with daily fulls to a cloud service gives a maximum data loss of about one hour (if failure right before an incremental), meeting the 4-hour RPO. Daily full backups ensure faster restoration since only the last full and up to a few incrementals need to be applied, likely achieving an 8-hour RTO. The $50/month cost is within budget. Option A (daily full to NAS) extends the backup window to 8 hours and may not meet RPO if an attack occurs between backups. Option C (more frequent differentials) will cause backup times to grow, potentially exceeding the window, and still may have a 4-hour RPO gap if scheduled every 4 hours but an attack occurs after the last. Option D is cost-prohibitive. Thus, B is feasible and effective.

Answer

Switch to daily full backups to a local NAS, which takes 8 hours.

Answer

Adopt real-time replication to a hot site located offsite.

Answer

Continue the current strategy but increase the frequency of differential backups to every 4 hours.

Question 3

A medium-size enterprise runs a vSphere 7.0 cluster with two hosts (HostA and HostB) for production VMs. Each host has two 10GbE uplinks (vmnic0 and vmnic1) connected to separate physical switches (SW1 and SW2) for redundancy. A single vSphere standard switch (vSwitch0) uses both uplinks with teaming policy set to 'Route based on originating virtual port ID,' 'Network failure detection: Link status only,' and 'Notify switches: Yes.' Lately, several VMs running on HostA experience intermittent network disconnections lasting 20–30 seconds, while VMs on HostB are unaffected. The administrator checks vCenter events and sees repeated messages: 'Lost uplink redundancy on vSwitch0. vmnic0 is down.' followed seconds later by 'Uplink redundancy restored. vmnic0 is up.' The physical switch SW1's log shows the port for vmnic0 transitions through spanning-tree listening and learning states each time this occurs, taking about 15 seconds. The link is a trunk allowing all necessary VLANs, with no errors or security violations. The network team has already swapped the fiber cable and SFP+ transceiver for vmnic0 without improvement. The VMs affected are those whose virtual ports are pinned to vmnic0 by the load-balancing policy; VMs pinned to vmnic1 never experience disconnections. The administrator has also rebooted HostA and updated the NIC firmware, but the flapping continues. What should the administrator do to permanently resolve the intermittent connectivity?

Accepted Answer

Enable spanning-tree PortFast on the SW1 and SW2 ports connected to the hosts so the ports bypass the listening/learning states.. Option C is correct because the symptoms as confirmed by the switch log show that each link flap triggers spanning-tree recalculation, causing the port to cycle through listening and learning states before forwarding resumes. Enabling PortFast on switch ports that are connected to end devices (like ESXi hosts) allows immediate forwarding. Option A is wrong because changing to access mode would break multiple VLANs and still face STP delays. Option B is wrong because disabling notify switches might worsen MAC table inconsistencies. Option D is wrong because changing load balancing does not stop the flapping or STP convergence; the issue is at layer 2.

Answer

Disable the 'Notify switches' option on the vSwitch teaming configuration to avoid unnecessary RARP broadcasts.

Answer

Reconfigure the physical switch port for vmnic0 to an access port instead of a trunk to simplify spanning-tree operations.

Answer

Change the NIC teaming load balancing policy to 'Route based on IP hash' to distribute traffic across both uplinks more evenly.

Question 4

Refer to the exhibit. A technician receives an alert from the monitoring system showing the error in the exhibit. The server is still online, but performance has degraded. Which of the following is the MOST likely cause and appropriate action?

Accepted Answer

The hard disk drive is failing; back up data and replace the drive. Event ID 11 from Disk source indicates a controller error, often due to a failing disk or cable. The most likely cause is a failing hard drive. Backing up and replacing the drive is the appropriate action. Bad sectors might be the symptom but replacing is safer. Driver corruption is less likely; high I/O wouldn't cause a controller error.

Answer

The SATA controller driver is corrupted; reinstall the driver

Answer

The disk has a bad sector; run CHKDSK and monitor

Answer

The disk is experiencing high I/O; upgrade to SSD

Question 5

An administrator notices that a Linux server's /var/log/messages file is filled with repeated "eth0: link up" and "eth0: link down" entries every few seconds. The server is connected to a managed switch. Which of the following is the most likely cause?

Accepted Answer

The switch port is experiencing a flapping MAC address. Option D is correct because MAC address flapping on a switch port causes the link state to repeatedly change. Option A would cause performance issues but not constant link state changes. Option B might cause instability but is not the typical cause of flapping. Option C would block traffic but not cause the physical link to go up and down.

Answer

The switch port is configured for auto-negotiation while the NIC is set to 1000/full

Answer

The NIC driver is outdated

Answer

Spanning Tree Protocol is blocking the port

Question 6

A server cannot connect to a specific network share. The administrator can successfully ping the server's IP address from the client. Which of the following is MOST likely causing the issue?

Accepted Answer

Host-based firewall blocking file sharing ports. Option C is correct because Windows Firewall or an equivalent host-based firewall may block SMB (port 445) or NetBIOS ports, preventing share access even though ICMP is allowed. Option A is wrong because DNS would affect name resolution, not reachability by IP. Option B is wrong because an incorrect subnet mask would generally prevent any communication, including pings. Option D is wrong because a duplicate IP would cause intermittent connectivity or an IP conflict error, not a consistent inability to access shares while ping works.

Answer

Incorrect subnet mask

Answer

Duplicate IP address on the network

Answer

DNS server is misconfigured

Question 7

A server running a critical application fails to boot with the error: 'Boot device not found.' The server uses UEFI and a RAID 5 array for the OS. The administrator verifies that all disks are present and powered. Which of the following should the administrator check FIRST?

Accepted Answer

The array configuration in the RAID BIOS. Option C is correct. With all disks powered and present, the RAID array may be degraded or its configuration lost, leading to the boot device error. Checking the array configuration in the RAID controller's BIOS (or UEFI setup) allows verifying that the array is intact and the boot volume is accessible. Option A (RAID battery) is important for write cache but not directly causing 'boot device not found.' Option B (boot order) might be an issue, but after checking that the RAID array is operational; if the array is offline, boot order changes won't help. Option D (OS boot files) should be checked after ensuring the RAID subsystem is functional.

Answer

The integrity of the OS boot files

Answer

The boot order in UEFI

Answer

The RAID controller battery

Question 8

The Coho Vineyard company operates a two-node Windows Server failover cluster to provide high availability for a critical SQL database. Node A has been running the database workload without issues, while Node B was taken offline two weeks ago due to a memory module failure. The faulty memory was replaced, and Node B was powered on. The administrator verified that Node B boots correctly, the network links are up, and the cluster service is running. However, the database role fails to start on Node B. Checking the cluster logs reveals that Node B cannot join the cluster, and the event 'Cluster service has lost quorum' is recorded. The administrator confirms both nodes can ping each other and access the shared SAN storage, but the cluster disk resource appears as 'Offline' on Node B. What should the administrator do to resolve the issue and bring the database online?

Accepted Answer

Evict Node B from the cluster and re-add it.. Evicting and re-adding the node clears stale configuration and allows it to rejoin the cluster properly after an extended period offline and hardware replacement.

Answer

Manually force start the cluster service on Node B with the /forcequorum switch.

Answer

Restore the system state backup on Node B.

Answer

Run the cluster validation wizard to check configuration.

Question 9

A company is migrating a legacy line-of-business application from Windows Server 2012 R2 to a new Windows Server 2022 server that is a member of an Active Directory domain. The application runs as a Windows service under a domain service account named CORP\svc_app. The service account has been granted the 'Log on as a service' user right on the old server, and the application is configured to listen on a static TCP port 8443. After installing the application on the new server and configuring it with the same service account and port, the application fails to start. The administrator checks the Windows Event Viewer and sees two errors in the System log: 'The CORP\svc_app service failed to start due to the following error: The service did not start due to a logon failure' and 'The service cannot bind to the designated port 8443'. The administrator has already verified that the service account's password is correct and has not expired, that the account is enabled, that the port 8443 is not being used by another service, and that the Windows Firewall has an inbound rule allowing traffic on port 8443. The application's configuration file correctly points to port 8443. What should the administrator do to resolve the issue?

Accepted Answer

Grant the 'Log on as a service' user right to the CORP\svc_app account via Local Security Policy or Group Policy.. The correct answer is B. The 'Log on as a service' user right is a security policy setting that must be explicitly assigned to a service account on each individual server. Even though the account had this right on the old server, it does not automatically carry over to the new server. Without this right, the service cannot start, and the 'logon failure' error is a classic symptom. Option A is incorrect because the password was already verified as correct. Option C is incorrect because the application requires a static port (port 8443) and changing to a dynamic port would break client connectivity. Option D is incorrect because restarting the server does not assign the missing user right and will not resolve the logon failure.

Answer

Restart the Windows Server 2022 server to apply any pending policy changes.

Answer

Configure the application to use a dynamic port instead of the static port 8443.

Answer

Reset the service account password and update the service configuration.

Question 10

After applying a Windows security patch, a server fails to boot and displays 'Bootmgr is missing'. The server is UEFI-based. Which of the following is the MOST efficient way to resolve the issue?

Accepted Answer

Use the recovery environment to repair the boot loader.. Option D is correct because the error indicates boot loader corruption, and the recovery environment can repair it without reinstalling the OS or replacing hardware. Option A: chkdsk checks disk errors, not boot loader integrity. Option B is overly destructive and time-consuming. Option C: BIOS reset does not affect UEFI boot entries or file system boot loader files.

Answer

Reset the BIOS to factory settings.

Answer

Replace the hard drive and restore from backup.

Answer

Boot from the installation media and run chkdsk.

Question 11

A web application server is experiencing intermittent 502 Bad Gateway errors during peak usage hours. The server's reverse proxy logs show connections to the backend application server being refused. The application server's resource monitor shows CPU utilization at 95% and memory utilization at 40%. Which of the following actions is MOST likely to resolve the issue?

Accepted Answer

Adjust thread pool and connection timeout settings on the application server.. Option B is correct. High CPU and connection refusals commonly indicate that the application’s worker thread pool or connection queue is saturated, preventing new connections. Tuning thread pool and timeout settings can alleviate this. Adding CPU (option C) may help long-term but is not the most direct fix. Memory (option A) is not the bottleneck. Replacing the proxy (option D) does not address the backend overload.

Answer

Replace the reverse proxy with a hardware load balancer.

Answer

Add more CPU cores to the server.

Answer

Increase the server's physical memory.

Question 12

A file server running Windows Server 2016 is critical for a department's daily operations. For the past two weeks, it has been crashing with a blue screen every 1–2 days. The IT team collects minidump files and opens the latest one in WinDbg. After running '!analyze -v', they obtain the following output:
```
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses.
Arguments:
Arg1: fffff80012345678, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff80abcde1234, address which referenced memory
Debugging Details:
...
PROCESS_NAME:  fileserver.exe
SYMBOL_NAME:  NetAdapterCx.sys!NetAdapterCxSetLinkState+0x1234
IMAGE_NAME:  NetAdapterCx.sys
...
```
The server has 64GB ECC RAM, two Intel Xeon processors, and a Broadcom NetXtreme quad-port 10GbE NIC. The NIC driver was updated from version 7.12.6 to 7.14.8 two weeks ago as part of patch management. The BSODs started occurring immediately after that driver update; prior to the update, the server had been stable for over six months. The driver was obtained from the server manufacturer's support site and installed without error. The administrator wants to restore stability with minimal downtime and risk. Which action should the administrator take FIRST?

Accepted Answer

Boot into Safe Mode and roll back the network adapter driver to the previous version (7.12.6).. Option A is correct because the crash dump explicitly denotes NetAdapterCx.sys (the network driver framework) as the cause, and the problem started right after the driver was updated. Rolling back is the quickest and safest step to restore operational stability. Option B is wrong because an OS reinstall is extreme and unlikely to fix a driver-specific issue. Option C is wrong because the dump identifies a driver, not a memory fault, and ECC memory typically reports errors before causing crashes. Option D is wrong because a hardware replacement is costly and unnecessary when a driver rollback is available.

Answer

Replace the Broadcom NIC with a different brand network adapter and disable the onboard NIC in the BIOS.

Answer

Reinstall Windows Server 2016 and restore data from backups to eliminate any corrupted system files.

Answer

Run Windows Memory Diagnostic overnight to check for hardware memory errors that might corrupt driver loading.

Question 13

A server configured with a RAID 5 array and a hot spare experiences intermittent crashes under heavy disk I/O. A technician suspects a failing drive. Which of the following should the technician do FIRST?

Accepted Answer

Run the array manufacturer's diagnostic utility.. Running the manufacturer's diagnostic utility (Option B) is correct because it provides a non-invasive method to verify the health of the drives without disrupting the array. Replacing the hot spare (Option A) is premature without confirmation. Removing a suspected drive (Option C) risks data loss if the array is already degraded. Initiating a manual failover (Option D) is unnecessary if the drive has not actually failed.

Answer

Initiate a manual failover to the hot spare.

Answer

Remove the suspected drive and rebuild the array.

Answer

Replace the hot spare with a new drive.

Question 14

A large financial services company must comply with federal regulations mandating quarterly disaster recovery tests. Their primary data center in New York hosts all trading applications, and a hot site in Chicago is maintained with real-time data replication via synchronous mirroring. During the last DR test, the IT team successfully failed over network and storage within 8 minutes, meeting the 15-minute RTO for connectivity. However, they encountered a major issue: the hot site's firewalls, intrusion detection systems, and application-level access controls were not configured to match the primary environment. The security team had to manually create firewall rules, update IDS signatures, and reconfigure access policies based on documentation, which took over 4 hours. As a result, the total system readiness exceeded 4.5 hours, causing a significant gap in trading operations. The regulatory auditor noted this deficiency and required a corrective action plan. The company must ensure that the next DR test achieves full operational readiness, including security controls, within the 15-minute RTO. The IT budget is already allocated for the current fiscal year, so large capital expenditures are not possible, but the team can leverage existing tools and automation. Which of the following is the BEST approach to address this issue?

Accepted Answer

Implement a configuration management tool that automatically synchronizes firewall rules, IDS signatures, and access controls to the hot site in near real-time.. Option A is correct because implementing a configuration management or synchronization tool directly addresses the root cause—manual configuration—by automating the replication of security policies to the hot site in near real-time. This eliminates human error and delay, meeting the 15-minute RTO without requiring new hardware. Option B (detailed runbooks and drills) still relies on manual interaction, which is unlikely to achieve 15-minute readiness. Option C merely lowers the standard instead of fixing the process and would likely be rejected by regulators. Option D (identical hardware) does not automatically transfer configurations; they would still need to be applied, so it does not solve the time problem.

Answer

Develop detailed runbooks for the security team to manually configure devices during failover; then conduct quarterly drills to reduce configuration time.

Answer

Re-evaluate the RTO to extend it to 4 hours and inform regulators of a realistic capability.

Answer

Replace the existing firewalls and IDS at the hot site with identical hardware from the same vendors as the primary site.

Question 15

A server experienced an unexpected power loss. After power is restored, the server boots successfully, but several critical services fail to start automatically. The administrator checks the system logs and finds errors indicating missing LUNs from a SAN. The SAN administrator confirms the SAN is online and the LUNs are assigned to the server's WWNs. The server uses FC HBAs. Which TWO steps should the administrator perform to diagnose the issue?

Accepted Answer

Rescan the SCSI bus on the server.. Options A and C are correct. After an unexpected power loss, the SAN topology or host's view of LUNs may be stale. Rescanning the SCSI bus forces the host to re-discover all accessible LUNs. Checking FC switch zoning ensures that the path between the host and storage is still correctly allowed after the power event. Option B is unnecessary and disruptive, as the SAN is confirmed online. Option D is premature. Option E is unrelated to sudden LUN disappearance after power restoration.

Answer

Replace the FC HBAs.

Answer

Reboot the SAN controller.

Answer

Reinstall the multipathing driver.