SK0-005 Practice Test 13 — 15 Questions

Question 1

A server fails to complete POST and emits a series of beeps: two long, three short. According to the manufacturer's documentation, this beep code indicates a memory error. The server has eight DIMMs installed. Which of the following steps should the technician perform FIRST?

Accepted Answer

Reseat all memory modules and attempt to boot.. Option A is correct. Reseating memory modules is the least invasive and often the most effective first step for beep codes indicating memory errors, as poor connections from thermal expansion or vibration can cause such issues. Option B is excessive before attempting reseating. Option C may reset BIOS settings but does not physically reseat RAM. Option D does not directly address the immediate memory detection failure.

Answer

Replace all memory modules.

Answer

Clear the CMOS battery.

Answer

Update the server's UEFI firmware.

Question 2

A server's performance degrades significantly during peak usage hours. Monitoring shows high memory utilization and consistently high disk I/O. Which of the following should the technician check FIRST?

Accepted Answer

Page file location and configuration. Option B is correct because high memory usage and heavy disk I/O suggest excessive paging. Checking the page file location and its performance (e.g., on a slow disk) is the first step to diagnose paging bottlenecks. Option A is less likely if CPU is not a known issue. Option C would typically cause different symptoms. Option D is unrelated to immediate memory/disk correlation.

Answer

RAID controller battery status

Answer

Network bandwidth utilization

Answer

CPU utilization statistics

Question 3

Refer to the exhibit. A Linux server started reporting I/O errors to its local disk. The administrator runs `dmesg` and sees the output shown. Which of the following is the MOST likely cause of the errors?

Accepted Answer

The disk has a bad sector that cannot be remapped.. Option B is correct. The 'Medium Error' sense key along with 'Unrecovered read error - auto reallocate failed' indicates a physical bad sector that the drive could not reallocate. Option A would typically produce a different hostbyte (e.g., DID_NO_CONNECT). Option C, outdated firmware, rarely causes medium errors. Option D, filesystem corruption, would manifest as filesystem-level errors, not SCSI sense codes.

Answer

The filesystem on /dev/sda is corrupted.

Answer

The SCSI cable is loose.

Answer

The RAID controller firmware is outdated.

Question 4

A small business has a single file server running Windows Server 2019. The server uses two internal SATA drives in a RAID 1 mirror for the operating system and data. The company's backup solution performs a full backup every night to an external USB hard drive, which is stored in the server room. The IT administrator recently noticed that the server's system volume is running low on space and decides to migrate the data to a larger drive. During the migration, the server crashes and will not boot. The administrator attempts to restore from the latest backup but finds that the backup drive is corrupted and cannot be read. The company has no offsite backups. What should the administrator have done to prevent this situation?

Accepted Answer

Regularly test backup restorations to verify data integrity.. The correct answer is D: Regularly test backup restorations to verify data integrity. The administrator assumed backups were valid without verification. Option A is wrong because RAID 1 provides redundancy but does not protect against corruption or accidental deletion; the issue here is backup corruption. Option B is wrong because cloud backup is a good practice but not strictly required; the root cause is lack of backup testing. Option C is wrong because while documentation is helpful, it would not prevent data loss from a corrupted backup drive.

Answer

Implement a RAID 5 array instead of RAID 1 for better redundancy.

Answer

Document the backup procedure and create a disaster recovery plan.

Answer

Use a cloud-based backup service with offsite storage.

Question 5

A large enterprise uses a centralized backup solution with a backup server running Commvault. Backups are stored on a deduplicated disk array and replicated to a secondary site for disaster recovery. The company's security team detects ransomware activity that has encrypted several file servers. The backup administrator checks the backup repository and finds that the backup data is also encrypted because the backup service account had permissions to modify backup files, and the ransomware propagated to the repository. The last known good backup is from two weeks ago, which is too old for the organization's RPO of 24 hours. The backup administrator is under pressure to restore operations quickly. Which of the following should the administrator implement to prevent this from recurring?

Accepted Answer

Immutable backup storage and a dedicated service account with least-privilege access.. The correct answer is A: Implement immutable backup storage and use a separate service account with write permissions only during backup windows. Immutable backups cannot be modified or deleted by any user or process, including ransomware. Option B is wrong because air-gapping alone does not prevent access if the backup server is compromised; immutable storage is more robust. Option C is wrong because while MFA is a good security practice, it does not protect backups that are already accessible with valid credentials. Option D is wrong because encryption of backup data protects it during transit or while stored, but does not prevent the ransomware from encrypting the files if the backup system is accessible.

Answer

Encrypt all backup data at rest and in transit.

Answer

Require multi-factor authentication for the backup service account.

Answer

Air-gap the backup repository by disconnecting it from the network except during backup windows.

Question 6

A medium-sized company runs an e-commerce platform on a cluster of three physical servers hosting virtual machines. The disaster recovery plan includes daily backups to a remote data center using Veeam Backup & Replication. The company's annual disaster recovery drill is scheduled for next week. During the drill, the IT team plans to simulate a complete site failure by powering off the primary data center. The recovery time objective (RTO) is 4 hours, and the recovery point objective (RPO) is 1 hour. The team successfully restores the VMs at the remote site, but the application experiences significant performance degradation and many transactions fail due to database inconsistency. Investigation reveals that the backup was taken at 2:00 AM, but the failure occurred at 10:00 AM, and the application's database had transactions between 2:00 AM and 10:00 AM that were not captured. What should the IT team do to improve the recovery process?

Accepted Answer

Enable log shipping with point-in-time recovery for the database.. The correct answer is B: Implement log shipping with point-in-time recovery for the database. The RPO of 1 hour is not being met because the backup schedule is daily. Option A is wrong because while a faster WAN can reduce backup time, the core issue is the backup frequency, not bandwidth. Option C is wrong because the issue is not data redundancy but recovery granularity; RAID protects against drive failure but not data loss from missing transactions. Option D is wrong because increasing RTO does not solve the RPO violation; the goal is to reduce data loss, not relax the time target.

Answer

Configure RAID 10 on all database servers to improve disk performance.

Answer

Upgrade the WAN connection between sites to reduce backup transfer times.

Answer

Adjust the RTO to 8 hours to allow for more comprehensive backups.

Question 7

Refer to the exhibit. A disaster recovery test reveals the following timeline for a critical application. The business requires an RTO of 2 hours. Which of the following actions would MOST effectively reduce the RTO to meet the requirement?

Accepted Answer

Implement database replication to eliminate the database restore time.. Option A is correct because the database restore takes 120 minutes—the largest portion of the RTO. Replication would make the database continuously available, reducing that time to near zero and bringing total RTO to about 120 minutes (provisioning + validation) which meets the 2-hour target. Option B could reduce VM provisioning time but not address the database restore. Option C reduces validation by 30 minutes, not enough. Option D does not significantly impact VM provisioning time, which is already only 60 minutes.

Answer

Add more network bandwidth to speed up VM provisioning.

Answer

Use a warm site with pre-configured storage.

Answer

Automate application validation to reduce that phase by half.

Question 8

A server administrator is troubleshooting a network connectivity issue where a newly installed server cannot communicate with other devices on the same subnet. The server has a static IP address configured. Other devices on the same switch can communicate. Which TWO of the following could be the cause of the issue? (Select TWO)

Accepted Answer

The switch port is configured with port security and has learned a different MAC address.. Options A and B are correct. An incorrect subnet mask (A) would cause the server to misinterpret which IPs are local, preventing communication with devices on the same subnet. Port security on the switch (B) could block traffic if the learned MAC address does not match. Option C (default gateway) is irrelevant for same-subnet communication. Option D (DNS) affects name resolution, not basic IP connectivity. Option E (DHCP) is not used since the server has a static IP.

Answer

The DNS server address is incorrect.

Answer

The server's default gateway is incorrectly set.

Answer

The DHCP server has exhausted its scope.

Question 9

Refer to the exhibit. A backup job to a network share failed. The administrator reviews the backup log. What is the most likely cause of the failure?

Accepted Answer

The backup user account lacks appropriate permissions.. Option B is correct. The 'Access is denied' error clearly indicates a permissions problem—the backup user account does not have the necessary rights to write to the share. Option A would present a 'network path not found' or 'host unreachable' error. Option C would also indicate network unreachable, not access denied. Option D would typically produce a 'path too long' error, not access denied.

Answer

The backup server is powered off.

Answer

The network link is down.

Answer

The backup file path exceeds the maximum length.

Question 10

A technician is troubleshooting a server that fails to boot after a scheduled power outage. The server is connected to a UPS. Upon pressing the power button, the server powers on briefly (fans spin, lights flash) and then shuts down after 2 seconds. The POST does not complete. The server has a dual power supply with each connected to a separate PDU. Which of the following is the MOST likely cause?

Accepted Answer

A short circuit in the motherboard. Option C is correct because immediate power-off after a brief spin-up is a classic symptom of a short circuit, often on the motherboard. Option A is wrong because a failed power supply would typically prevent any power-on or cause beep codes, not a brief power-on. Option B is wrong because the UPS battery condition would not cause this behavior if the server is receiving utility power; also the server is receiving power momentarily. Option D is wrong because a dead CMOS battery would cause date/time loss but not prevent boot completely.

Answer

The UPS battery is depleted

Answer

One of the power supplies has failed

Answer

The CMOS battery is dead

Question 11

Refer to the exhibit. The Print Spooler service on a critical Windows Server 2019 fails to start at every boot. The server was recently updated with the latest cumulative patch. Which of the following is the MOST likely cause?

Accepted Answer

A service on which the Print Spooler depends is not starting. Event ID 7000 with a timeout error strongly suggests a dependency service is not starting correctly. The Print Spooler depends on the Remote Procedure Call (RPC) service among others; a recent patch may have altered the startup configuration of a dependency. The Print Spooler runs under the LocalSystem account, so password expiration is not a factor. A corrupt driver usually causes the service to crash after starting, not a timeout. Insufficient disk space would generate a different error.

Answer

The system drive has insufficient free space

Answer

A recent printer driver update is corrupted

Answer

The password for the service account has expired

Question 12

A Windows Server 2019 file server hosts a shared folder named \FS01\SalesDocs. The share permissions are configured to grant the 'Everyone' group Full Control. The NTFS permissions on the D:\Shares\SalesDocs folder are set as follows: The 'Sales' security group has Allow Read & Execute, List Folder Contents, and Read. The 'Managers' group has Allow Modify. A user, Alice, is a member of the 'Sales' group and also a member of the 'Temporary_Contractors' group. She recently had her account moved from the 'Contractors' OU to the 'Sales' OU. When Alice attempts to access \FS01\SalesDocs from her Windows 10 workstation, she receives an 'Access Denied' error. Other members of the 'Sales' group can access the folder without issues. The administrator verifies that Alice's group membership includes both 'Sales' and 'Temporary_Contractors'. The effective permissions tool on the folder shows that Alice should have Read access. However, she still cannot access the share. Which of the following is the most likely cause of Alice's access denial and the appropriate next step to resolve it?

Accepted Answer

The 'Temporary_Contractors' group has an explicit Deny permission on the NTFS security for D:\Shares\SalesDocs, which overrides her Allow permissions. The administrator should remove Alice from that group or modify the Deny entry.. Option A is correct because an explicit Deny permission for Temporary_Contractors would override all Allow permissions, resulting in access denied despite the effective permissions tool showing allowed access (which may not account for Deny in all views). Option B is incorrect because 'Everyone' includes authenticated users, and the share permissions are permissive. Option C suggests a token issue, but effective permissions already reflect her group membership; a token issue would typically result in no access to Sales group resources, conflicting with others' access. Option D is unlikely without other offline files symptoms.

Answer

Alice's user token was not updated after her OU move; she needs to log off and log back on to obtain the new group membership, but the token hadn't expired. The administrator should wait or force logoff.

Answer

Her workstation's offline files cache is corrupt, causing access denied. The administrator should clear the CSC cache on her machine.

Answer

The share permissions 'Everyone Full Control' are invalid because 'Everyone' does not include authenticated users from other domains. The administrator should add 'Authenticated Users' with Change permission.

Question 13

Refer to the exhibit. A technician is troubleshooting a server that is experiencing data corruption. What is the MOST likely cause?

Accepted Answer

Faulty RAID controller. Event ID 11 with a controller error typically indicates a faulty RAID controller or HBA, not a disk failure or cable issue.

Answer

Corrupted file system

Answer

Loose data cable

Answer

Failed hard disk drive

Question 14

Refer to the exhibit. A server technician sees the following output. What is the current status of the RAID array?

Accepted Answer

Degraded. The 'State' line clearly indicates 'clean, degraded', and one device is marked as 'removed'. The array is operational but missing a drive.

Answer

Rebuilding

Answer

Healthy

Answer

Failed

Question 15

A medium-sized organization runs several critical virtual machines on a Windows Server 2019 Hyper-V host with 64 GB of RAM and two 12-core processors. One of the VMs, a database server, has been experiencing intermittent performance degradation, specifically during peak hours. The VM is configured with 4 vCPUs and 16 GB of static memory. The host's overall CPU utilization rarely exceeds 40%, and memory usage is around 50%. The administrator logs into the host and checks the VM's CPU usage in Hyper-V Manager, which shows it averaging 65% with occasional spikes to 95%. However, inside the VM, Task Manager shows constant 95-100% CPU usage on all logical processors. No other VMs are reporting performance issues. The administrator needs to determine the root cause and apply a fix that does not involve adding more physical resources or rebooting the production VM during business hours. Which of the following actions should the administrator take?

Accepted Answer

Use Performance Monitor on the host to examine 'Hyper-V Hypervisor Virtual Processor' metrics for the VM and compare with in-guest CPU usage to identify scheduling issues. Option C is correct because comparing the host-level guest CPU metrics (which show 65% average) with the in-guest metrics (100%) reveals that the VM is being limited by its vCPU allocation, likely due to co-scheduling or contention with other VMs' vCPUs on the same physical cores. Investigating and adjusting CPU scheduling or reservation settings can alleviate this. Option A is wrong because the host's overall CPU is fine; the issue is within the VM or hypervisor scheduling. Option B is wrong because increasing vCPUs without diagnosing the bottleneck might worsen contention. Option D is wrong because increasing memory won't resolve a CPU bottleneck.

Answer

Increase the VM's memory from 16 GB to 32 GB to reduce paging and improve performance

Answer

Increase the VM's vCPU count to 8 to handle the workload and reduce contention

Answer

Check the host's overall CPU usage in Task Manager and increase the VM's vCPU count if the host has spare capacity