SK0-005 Practice Test 12 — 15 Questions

Question 1

A small law firm relies on a single server that hosts a document management system and email. The server is backed up nightly using differential backups to an external USB hard drive that remains connected to the server. One Monday morning, the office manager finds all files encrypted and a ransom note on the screen. The server’s event logs indicate that the encryption began at 2:00 AM on Saturday. The firm’s offsite backup policy rotates two sets of tapes, and the most recent set was taken offsite on Friday evening and is stored in a bank safe deposit box. The USB backup drive, still attached to the server, shows its files also encrypted. The firm does not have a cloud backup service for the server. The office manager wants to restore operations as quickly as possible with minimal data loss and zero risk of reinfection. What is the BEST course of action?

Accepted Answer

Reimage the server, then restore data from the Friday offsite tape backup.. A is correct. The offsite tape backup from Friday evening is air-gapped and predates the infection (Saturday 2:00 AM), ensuring it is clean. Reimaging the server provides a known-good operating system. Option B is risky because the USB drive’s backup likely contains infected files; even an antivirus scan might not detect all ransomware artifacts. Option C is not possible since there is no server cloud backup. Option D is not recommended and may not result in file recovery. Thus, A is the safest and most reliable method.

Answer

Restore the server from the firm's cloud backup service for email.

Answer

Scan the USB drive with antivirus, then restore the latest differential backup from it.

Answer

Pay the ransom to obtain the decryption key, then perform a full backup.

Question 2

A medium-sized company runs an e-commerce platform on a cluster of three physical servers hosting virtual machines. The disaster recovery plan includes daily backups to a remote data center using Veeam Backup & Replication. The company's annual disaster recovery drill is scheduled for next week. During the drill, the IT team plans to simulate a complete site failure by powering off the primary data center. The recovery time objective (RTO) is 4 hours, and the recovery point objective (RPO) is 1 hour. The team successfully restores the VMs at the remote site, but the application experiences significant performance degradation and many transactions fail due to database inconsistency. Investigation reveals that the backup was taken at 2:00 AM, but the failure occurred at 10:00 AM, and the application's database had transactions between 2:00 AM and 10:00 AM that were not captured. What should the IT team do to improve the recovery process?

Accepted Answer

Enable log shipping with point-in-time recovery for the database.. The correct answer is B: Implement log shipping with point-in-time recovery for the database. The RPO of 1 hour is not being met because the backup schedule is daily. Option A is wrong because while a faster WAN can reduce backup time, the core issue is the backup frequency, not bandwidth. Option C is wrong because the issue is not data redundancy but recovery granularity; RAID protects against drive failure but not data loss from missing transactions. Option D is wrong because increasing RTO does not solve the RPO violation; the goal is to reduce data loss, not relax the time target.

Answer

Configure RAID 10 on all database servers to improve disk performance.

Answer

Upgrade the WAN connection between sites to reduce backup transfer times.

Answer

Adjust the RTO to 8 hours to allow for more comprehensive backups.

Question 3

A medium-sized business runs a critical internal application on a single physical server running Windows Server 2019. The application is memory-intensive, often using up to 24 GB out of 32 GB RAM during peak hours. Over the past week, the server has experienced three unexpected reboots, each occurring during peak load. The server is not part of a cluster, and all data is stored on local disks. You have checked the Windows System event log and found Event ID 41 (Kernel-Power) indicating an unexpected shutdown. There are no related critical errors in the Application log. You have also reviewed the server's firmware logs and found multiple corrected memory errors (ECC) over the last month, with an increase in frequency just before each crash. The server is under warranty, and the hardware vendor's diagnostic tools report a failing memory module in DIMM slot A1. The vendor has recommended replacing the faulty DIMM immediately. However, the server is currently processing critical end-of-quarter financial reports that cannot be interrupted for at least 6 hours. Which of the following is the BEST course of action to minimize risk of data loss and downtime until a planned maintenance window?

Accepted Answer

Inform management of the criticality, request emergency approval for immediate maintenance, and if denied, ensure current backups are verified and monitor the server closely for any signs of degradation until the maintenance window.. Option D is correct because it follows proper change management: informing stakeholders, seeking emergency approval if needed, and mitigating risk by verifying backups and monitoring. Option A is wrong because immediately shutting down would interrupt critical processing and potential data loss, without management approval. Option B is wrong because Windows Memory Diagnostic is a boot-time tool and cannot effectively isolate memory regions to avoid crashes on a running production system. Option C is wrong because the server has already crashed, indicating uncorrectable errors; continuing without action risks data corruption and further unplanned outages.

Answer

Use Windows Memory Diagnostic tool to try to isolate the memory region and prevent the application from using it.

Answer

Continue running the server as is, as ECC memory can correct errors and the server will only crash if errors are uncorrectable; the risk is low.

Answer

Immediately shut down the server, replace the faulty DIMM, and restart.

Question 4

A user attempts to access a shared folder named \Server\Finance. The share permissions are set to 'Everyone – Full Control'. The NTFS permissions on the folder grant the user 'Read & Execute' but deny 'Write'. What is the user's effective permission when accessing the share over the network?

Accepted Answer

Read & Execute. When share and NTFS permissions combine, the most restrictive of the two applies. Share gives Full Control, NTFS gives Read & Execute, so effective access is Read & Execute.

Answer

Full Control

Answer

Write

Answer

No Access

Question 5

A server administrator is troubleshooting a server that intermittently loses network connectivity. The administrator suspects a hardware issue. Which two components should the administrator check first? (Choose two.)

Accepted Answer

Network cable. The correct answers are the NIC and the network cable. Intermittent network connectivity often stems from these components. Checking the NIC involves driver updates and event log review, while the cable should be reseated or replaced. These steps are quick, non-disruptive, and address the most probable causes.

Answer

CPU

Answer

Hard drive

Answer

Power supply unit (PSU)

Question 6

A database administrator notices that the primary SQL Server instance has been experiencing severe performance degradation over the past hour. The server is a virtual machine with 8 vCPUs and 64 GB of RAM, and it normally operates with around 40% CPU utilization. Currently, Task Manager shows 100% CPU usage, with the sqlservr.exe process consuming nearly all cycles. The database response times have increased tenfold, and some queries are timing out. There are no scheduled maintenance jobs running, and the transaction log backup completed successfully earlier. The DBA checks active sessions and finds one long-running ad-hoc query from a new reporting tool that was deployed this morning. The query is performing a cross join on two large tables with missing WHERE clauses, causing a Cartesian product. Ending the session will roll back the query and free resources.

Accepted Answer

Identify and kill the offending long-running query using the SQL Server management tools.. Option A is the correct immediate action. Identifying and terminating the specific offending query is the fastest way to restore normal operation without disrupting other database activities. Option B (adding vCPUs) is not a quick fix and doesn't address the root cause. Option C (restarting the SQL service) will disconnect all users and cause unnecessary downtime. Option D (increasing the VM's memory) won't help a CPU-bound problem caused by an inefficient query.

Answer

Increase the virtual machine's memory allocation from 64 GB to 128 GB to reduce paging.

Answer

Immediately add more vCPUs to the virtual machine to handle the increased load.

Answer

Restart the SQL Server service to clear all active connections and start fresh.

Question 7

After a power outage, a server fails to boot and displays a "Missing operating system" error. The server uses RAID 1 for the OS disk. The administrator verifies both drives are present in the RAID configuration utility but one drive is marked as failed. What should the administrator do FIRST?

Accepted Answer

Check the boot order in BIOS/UEFI. The system may be trying to boot from an incorrect device, especially after a power event may have reset BIOS settings. Option A is a later step if the array is truly broken. Option B is not the first step because the array itself may be bootable. Option D is unlikely to restore a failed drive.

Answer

Boot from a Windows recovery media and run chkdsk

Answer

Reseat the failed drive and attempt to boot

Answer

Replace the failed drive and rebuild the array

Question 8

Your organization is migrating a Windows Server 2019 file server with 2 TB of shared data to a new server running Windows Server 2022. The migration must minimize user downtime and ensure file permissions are preserved. Users access files during business hours (8 AM to 6 PM) and the migration must be completed within a four-hour window starting at 10 PM on Saturday. You plan to use DFS Replication (DFSR) for initial data copy and then perform a final synchronization during the cutover. After setting up DFSR between the old and new servers, you realize that the initial replication will take approximately 12 hours due to the large number of files. What should you do to complete the migration within the allowed window?

Accepted Answer

Use robocopy to pre-stage the data from old to new server during off-hours before the cutover, then enable DFSR to replicate only changes made after pre-staging; during the cutover window, do a final DFSR sync. Pre-staging with robocopy during off-hours moves the bulk of the 2 TB before the cutover window, so DFSR only has to replicate the delta of changes made after pre-staging. This shrinks the initial replication from ~12 hours to a manageable delta, allowing the final DFSR sync to complete inside the four-hour cutover window while preserving NTFS permissions and minimizing user downtime.

Answer

Disable DFSR and use robocopy with /MIR /COPYALL during the cutover window to copy all data

Answer

Perform a full backup of the old server and restore to the new server during the cutover window using Windows Backup

Answer

Increase the DFSR staging quota and bandwidth throttling to accelerate initial replication

Question 9

A technician must replace a failed 2.5-inch hot-swap SAS drive in a running production server. The array supports hot swapping and the replacement drive is on site. Which of the following is the FIRST step the technician should take?

Accepted Answer

Identify the failed drive's bay location using the management interface or drive LEDs.. Hot swapping still requires positive identification of the failed member before any hardware is touched. The management utility or the fault LED on the carrier confirms the correct bay, preventing removal of a healthy drive. Once identified, the failed drive can be pulled and the replacement inserted while the system remains online and rebuilds.

Answer

Remove the failed drive immediately and insert the replacement to begin rebuilding.

Answer

Shut down the operating system and power off the server before opening the drive bay.

Answer

Update the RAID controller firmware so the replacement drive is recognized.

Question 10

A system administrator needs to apply critical security patches to a production web server that cannot be taken offline. The server runs a Linux operating system and hosts a high-availability website. The administrator wants to ensure that if the patches cause a failure, the server can be quickly rolled back to its previous state. Which of the following actions should the administrator take FIRST?

Accepted Answer

Take a snapshot of the server's virtual machine before applying patches.. Taking a snapshot provides a point-in-time state of the virtual machine, allowing quick rollback if the patches cause issues. Option A backs up user data but does not capture the system state needed for a full rollback. Option C is a procedural step but not the first technical action to enable recovery. Option D is reckless and provides no rollback capability.

Answer

Back up all user data to a network share.

Answer

Schedule a maintenance window and notify users of potential downtime.

Answer

Apply the patches during off-peak hours without any additional steps.

Question 11

A system administrator notices unusual file encryption activity on a file server. The activity appears to be rapidly spreading to other servers, and ransom notes are appearing. Which of the following should the administrator do FIRST?

Accepted Answer

Disconnect the affected servers from the network. The FIRST action in a suspected ransomware attack is to contain the spread by isolating affected systems. Disconnecting the servers from the network immediately stops the malware from encrypting additional files on other servers and prevents lateral movement. This aligns with the containment phase of incident response, which takes priority over notification, scanning, or recovery.

Answer

Notify law enforcement

Answer

Run antivirus scan on the affected servers

Answer

Restore the encrypted files from backup

Question 12

A server administrator is configuring a new Windows Server 2022 server that will host a database. The database requires high write performance and low latency. The server has four 800 GB SSDs and a hardware RAID controller with a 2 GB battery-backed write cache. Which RAID level should the administrator choose to meet the performance requirements while providing redundancy?

Accepted Answer

RAID 10. RAID 10 provides both high write performance, due to its mirrored and striped design without parity overhead, and redundancy. RAID 5 and RAID 6 incur parity calculation overhead that reduces write performance, and RAID 0 lacks redundancy entirely, making it unsuitable for a database requiring fault tolerance.

Answer

RAID 0

Answer

RAID 5

Answer

RAID 6

Question 13

A server administrator is troubleshooting an issue where a database server's performance degrades every night at 2 AM. Resource monitor shows high disk I/O and CPU usage during that time. There are no scheduled tasks on the server. Which of the following should the administrator investigate FIRST?

Accepted Answer

Scheduled antivirus scans on the server. Centrally managed antivirus software may perform scans at a default time, causing high resource usage. Option B would result in network utilization, not local disk I/O. Option C is possible but typically scheduled and would appear in the task scheduler. Option D contradicts the statement that no scheduled tasks exist.

Answer

Network congestion from backups

Answer

Disk defragmentation tasks

Answer

A cron job misconfiguration

Question 14

A web application server is experiencing intermittent 502 Bad Gateway errors during peak usage hours. The server's reverse proxy logs show connections to the backend application server being refused. The application server's resource monitor shows CPU utilization at 95% and memory utilization at 40%. Which of the following actions is MOST likely to resolve the issue?

Accepted Answer

Adjust thread pool and connection timeout settings on the application server.. The 502 errors with connection refusals and 95% CPU (but only 40% memory) point to application-layer thread/connection exhaustion rather than raw hardware shortage. Tuning the thread pool and connection timeout settings allows the application server to handle more concurrent connections and recycle stuck ones, directly addressing the bottleneck.

Answer

Replace the reverse proxy with a hardware load balancer.

Answer

Add more CPU cores to the server.

Answer

Increase the server's physical memory.

Question 15

A server has a RAID 5 array with four drives. One drive fails and is replaced. During the rebuild, a second drive reports a media error and the rebuild fails. What should the administrator do FIRST to minimize the risk of permanent data loss?

Accepted Answer

Back up all critical data before any further rebuilding. A media error on another drive during a RAID 5 rebuild indicates that drive may also be failing. If another drive fails completely, the entire array and its data will be lost. Therefore, the immediate priority is to back up critical data before any further rebuild action. Replacing the drive or restarting the controller could trigger another rebuild, risking complete array loss. A consistency check does not address the urgency.

Answer

Run a consistency check on the array

Answer

Replace the drive that reported the media error immediately

Answer

Restart the RAID controller to reinitialize the rebuild