SK0-005 Practice Test 12 — 15 Questions

Question 1

An organization's disaster recovery plan specifies an RPO of 4 hours. Their current backup schedule performs a full backup at midnight and incremental backups every 2 hours from 8:00 AM to 8:00 PM. A server failure occurs at 3:00 AM, and data created after 8:00 PM the previous day is permanently lost. Which of the following is the MOST likely reason?

Accepted Answer

There is a gap in the backup schedule overnight that exceeds the RPO.. Option C is correct because the backup schedule has no coverage from 8:00 PM to 8:00 AM the next morning (except full at midnight), creating a 12-hour gap overnight that exceeds the 4-hour RPO. Data created after 8:00 PM and before the failure at 3:00 AM is lost because no backup captured it. Option A is incorrect because RPO is a requirement, not the cause. Option B is speculative. Option D refers to synthetic fulls, which are not relevant to this gap.

Answer

The incremental backups were not synthetically rolled into the full backup.

Answer

The RPO was set too low for the business requirements.

Answer

The backup media became corrupted.

Question 2

Refer to the exhibit. A Linux server's local firewall is configured as shown. The administrator is unable to perform backups to a network-attached storage (NAS) device using TCP port 10000. Which firewall rule is causing the issue?

Accepted Answer

The DROP all rule at the end blocks all traffic except SSH.. Option D is correct. The INPUT chain contains an explicit DROP all rule at the end, which blocks any traffic not explicitly allowed. The only allowed traffic is SSH on port 22. The backup traffic on port 10000 matches the DROP rule and is therefore dropped. Option A is incorrect because the policy ACCEPT is overridden by the explicit DROP. Option B allows SSH traffic but does not affect port 10000. Option C about subnets is irrelevant to the local firewall shown.

Answer

The INPUT policy is set to ACCEPT.

Answer

The NAS device uses a different subnet.

Answer

The SSH ACCEPT rule is allowing traffic.

Question 3

A financial services firm requires a disaster recovery solution that provides a Recovery Point Objective (RPO) of near zero and a Recovery Time Objective (RTO) of less than 2 hours. Which of the following site types is MOST appropriate?

Accepted Answer

Hot site. Option D is correct because a hot site is fully equipped, with near real-time data replication, enabling the fastest recovery and minimal data loss. A cold site (Option A) has the longest recovery time. A warm site (Option B) has some equipment but data must be restored from backup, increasing RTO and RPO. Cloud-based backup with daily replication (Option C) does not meet near-zero RPO.

Answer

Cloud-based backup with daily replication

Answer

Cold site

Answer

Warm site

Question 4

A database server hosts a critical application that requires a recovery point objective (RPO) of 4 hours. The company wants to minimize the impact on production performance during backups. Which backup strategy should be implemented?

Accepted Answer

A weekly full backup with hourly incremental backups.. Option C is correct because hourly incremental backups meet the 4-hour RPO while minimizing resource usage compared to more frequent full backups or continuous replication. Option A is wrong because differential backups grow in size and can still exceed the RPO window. Option B is wrong because nightly full backups would fail to meet the 4-hour RPO if a disaster occurs hours after the last backup. Option D is wrong because CDP with synchronous replication imposes high performance overhead and is unnecessary beyond the 4-hour RPO requirement.

Answer

Continuous data protection (CDP) with synchronous replication.

Answer

A weekly full backup with daily differential backups.

Answer

A nightly full backup.

Question 5

A small business has a limited budget and can tolerate up to 72 hours of downtime in the event of a disaster. Which type of disaster recovery site would be most cost-effective?

Accepted Answer

Cloud-based DR with pay-as-you-go.. Option D is correct because a cloud-based DR site with pay-as-you-go model requires no upfront investment in hardware and can be spun up as needed, making it cost-effective for a business with a high downtime tolerance. Option A is wrong because a hot site is the most expensive, with real-time replication. Option B is wrong because a warm site requires pre-installed hardware that incurs ongoing costs, even if data is not up-to-date. Option C is wrong because a cold site still requires occasional maintenance and may have hidden costs; modern cloud DR can be cheaper and more flexible.

Answer

Cold site with no pre-configured hardware.

Answer

Hot site with real-time replication.

Answer

Warm site with pre-installed hardware but no data.

Question 6

A mid-sized manufacturing company operates a primary data center with all critical servers. They have a warm standby site located 100 miles away. For databases, the primary SAN uses synchronous replication to the standby SAN; no tape backups are taken for databases. File and application servers are backed up to an on-premises tape library using nightly incrementals with a weekly full backup every Sunday. Tapes are shipped off-site every Monday morning. On Tuesday morning, a ransomware attack encrypts the entire primary SAN. Because of the real-time replication, the standby SAN is encrypted almost instantly. The on-site tape library is also connected to the network and its tapes, including Sunday's full and Monday's incremental, are encrypted by the attack. The most recent off-site shipment was the previous Monday (eleven days ago), meaning the off-site tapes contain a full backup from eleven days ago and daily incrementals up to that point. The company's RPO is 1 hour for databases and 24 hours for file servers; RTO is 8 hours. The IT director must decide the best immediate course of action to restore operations while adhering to the DR plan as closely as possible.

Accepted Answer

Restore all systems from the 11-day-old off-site tapes, accepting the loss of data generated during the last 11 days.. Option D is correct because the off-site tapes are the only clean, unaffected backups available. Restoring from them is the only way to avoid paying the ransom and to ensure data integrity, even though it means losing 11 days of data. Option A is wrong because paying the ransom does not guarantee data recovery, encourages further crime, and may not meet compliance requirements. Option B is wrong because the replicated SAN data is already encrypted and likely unrecoverable without the decryption key. Option C is wrong because rebuilding databases from scratch is unnecessary when the off-site tapes include database backups (from the full/incremental set) and would result in far greater data loss.

Answer

Rebuild all database servers from scratch and restore file servers from the most recent off-site tapes, accepting 11 days of data loss for file servers too.

Answer

Attempt to restore the databases from the replicated SAN by breaking replication and scanning for uncorrupted blocks.

Answer

Pay the ransom demand to the attackers in hopes of receiving the decryption key.

Question 7

A system administrator needs to configure secure remote access to servers in the data center. The current setup uses password-based SSH, but the security policy mandates multifactor authentication and prevention of brute-force attacks. Which solution best meets these requirements?

Accepted Answer

Deploy a VPN with certificate-based authentication and enable MFA.. Option C is correct because a VPN with certificate-based authentication provides strong encryption and identity verification, and enabling MFA adds an extra layer of security that satisfies the multifactor mandate. Option A is wrong because SSH key authentication alone does not provide MFA; an attacker with the key can still connect. Option B is wrong because while fail2ban helps against brute-force, it does not implement MFA. Option D is wrong because RDP is less secure for remote server administration and NLA does not constitute full MFA.

Answer

Implement SSH key authentication only.

Answer

Use SSH with public key authentication and install fail2ban.

Answer

Enable RDP with network-level authentication.

Question 8

A company performs annual disaster recovery tests. The last test revealed that the recovery time objective (RTO) was not met because the backup tapes were corrupted. The backup administrator proposes changes to the backup verification process. Which practice is MOST effective to ensure recoverability?

Accepted Answer

Implement automated integrity checks and periodic test restores.. Option B is correct because automated integrity checks and periodic test restores directly validate that backups are usable and meet recovery objectives, catching corruption early. Option A is wrong because increasing backup frequency does not verify that backups are error-free. Option C is wrong because verifying tapes before offsite storage reduces risk but does not guarantee ongoing media integrity; tapes can degrade over time. Option D is wrong because switching to disk-based backups avoids some tape-specific issues but still requires verification processes to ensure data is not corrupted.

Answer

Perform a full backup more frequently.

Answer

Switch to disk-based backups exclusively.

Answer

Store backup tapes offsite only after verification.

Question 9

During a security incident, a server is suspected to be compromised by malware. The incident response team needs to preserve evidence and minimize impact. Which TWO actions should be taken FIRST? (Select TWO.)

Accepted Answer

Disconnect the server from the network.. Options B and C are correct. Disconnecting the server from the network (B) is an immediate containment step to prevent data exfiltration or spread. Capturing a forensic image of system memory (C) preserves volatile data such as running processes, network connections, and encryption keys before they are lost. Option A is wrong because powering off loses all volatile evidence. Option D is wrong because running an AV scan modifies files and could destroy forensic artifacts. Option E is wrong because rebooting erases memory and may trigger malware countermeasures.

Answer

Run an antivirus scan.

Answer

Reboot the server in safe mode.

Answer

Power off the server immediately.

Question 10

A small business needs a disaster recovery site that can be brought online within 2 hours of a primary site failure. The business can tolerate minimal data loss. Which type of recovery site should they implement?

Accepted Answer

Hot site. Option C is correct because a hot site maintains near-real-time data replication and preconfigured hardware, enabling failover within 2 hours and minimal data loss. A cold site (Option A) requires hardware setup and data restoration, taking days. A warm site (Option B) has pre-installed hardware but lacks current data, typically taking hours to a day to activate. A mobile site (Option D) is a portable solution with variable provisioning time and may not meet the 2-hour requirement consistently.

Answer

Cold site

Answer

Warm site

Answer

Mobile site

Question 11

A system administrator configures full backups on Sunday evenings and differential backups on weekdays. On Thursday morning, a disk failure occurs. Which of the following sets of backups is necessary to completely restore the server's data with the fewest number of backup files?

Accepted Answer

Sunday full and Wednesday differential. A differential backup includes all changes since the last full backup. Therefore, only the most recent differential and the last full backup are needed for a complete restore. Using Sunday's full and Wednesday's differential requires just two files, whereas incremental backups would require the full plus every incremental since. Option A (full plus all four differentials) is unnecessary. Option C references a Thursday backup that hasn't occurred yet. Option D ignores all changes since Sunday.

Answer

Sunday full only

Answer

Sunday full, Monday differential, Tuesday differential, Wednesday differential

Answer

Sunday full and Thursday differential

Question 12

Refer to the exhibit. A server administrator is reviewing security logs after a suspected brute-force attack on the SSH service. The following excerpt from /var/log/secure is displayed. Which security control would have been MOST effective in preventing the successful login?

Accepted Answer

Implementing fail2ban or similar intrusion prevention.. Option B is correct because fail2ban or a similar intrusion prevention system monitors logs for repeated failures and blocks the attacker's IP address after a configurable number of attempts, stopping the attack before the correct password is guessed. Option A is wrong because a strong password policy might resist guessing for a long time, but the admin password was eventually guessed; it does not actively prevent repeated attempts. Option C is wrong because disabling root login would not have prevented the attack on the admin account, which was the one compromised. Option D is wrong because changing the SSH port is security through obscurity and does not prevent brute-force attempts once the port is discovered.

Answer

Disabling root login via SSH.

Answer

Enforcing a strong password policy.

Answer

Using a different SSH port.

Question 13

A small law firm relies on a single server that hosts a document management system and email. The server is backed up nightly using differential backups to an external USB hard drive that remains connected to the server. One Monday morning, the office manager finds all files encrypted and a ransom note on the screen. The server’s event logs indicate that the encryption began at 2:00 AM on Saturday. The firm’s offsite backup policy rotates two sets of tapes, and the most recent set was taken offsite on Friday evening and is stored in a bank safe deposit box. The USB backup drive, still attached to the server, shows its files also encrypted. The firm does not have a cloud backup service for the server. The office manager wants to restore operations as quickly as possible with minimal data loss and zero risk of reinfection. What is the BEST course of action?

Accepted Answer

Reimage the server, then restore data from the Friday offsite tape backup.. A is correct. The offsite tape backup from Friday evening is air-gapped and predates the infection (Saturday 2:00 AM), ensuring it is clean. Reimaging the server provides a known-good operating system. Option B is risky because the USB drive’s backup likely contains infected files; even an antivirus scan might not detect all ransomware artifacts. Option C is not possible since there is no server cloud backup. Option D is not recommended and may not result in file recovery. Thus, A is the safest and most reliable method.

Answer

Restore the server from the firm's cloud backup service for email.

Answer

Scan the USB drive with antivirus, then restore the latest differential backup from it.

Answer

Pay the ransom to obtain the decryption key, then perform a full backup.

Question 14

A network administrator needs to configure centralized authentication for network devices. The solution must provide encryption of the entire authentication process, support for multiple protocols, and accounting of user actions. Which protocol should be used?

Accepted Answer

TACACS+. TACACS+ encrypts the entire authentication process, offers granular control over authorization, and supports accounting. RADIUS (B) only encrypts the password, not the entire session. LDAP (A) is a directory service, not an encryption-focused authentication protocol. Kerberos (C) uses tickets and encryption but is primarily for single sign-on within a domain, not commonly used for network device administration.

Answer

Kerberos

Answer

RADIUS

Answer

LDAP

Question 15

A system administrator notices unusual file encryption activity on a file server. The activity appears to be rapidly spreading to other servers, and ransom notes are appearing. Which of the following should the administrator do FIRST?

Accepted Answer

Disconnect the affected servers from the network. Option B is correct because the immediate priority in a ransomware outbreak is to contain the threat by disconnecting affected systems from the network, preventing further lateral movement and encryption of additional assets. Restoring from backup (Option A) is a recovery step that should occur after containment. Notifying law enforcement (Option C) is important but secondary to stopping the spread. Running an antivirus scan (Option D) may be ineffective on already encrypted systems and wastes time that should be spent on containment.

Answer

Notify law enforcement

Answer

Run antivirus scan on the affected servers

Answer

Restore the encrypted files from backup