SK0-005 Practice Test 15 — 15 Questions

Question 1

A datacenter administrator is reviewing physical security for a new colocation cage that houses servers containing regulated data. The cage has a locked mesh door, but the administrator must add a control that logs exactly which employee enters and exits, and when, without requiring a guard. Which solution BEST meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Install a biometric fingerprint reader on the cage door that records each authorized entry and exit in an audit log.. The requirement combines two needs: authenticate each individual and produce a timestamped record of entry and exit without human staffing. A biometric reader authenticates the specific person and writes each event to an audit log, so it satisfies both identity verification and automated logging. Mechanical keys, guards, and motion sensors each fail at least one of those needs in this colocation scenario.

Answer

Install a passive infrared motion sensor inside the cage that triggers an alert whenever movement is detected.

Answer

Replace the mesh door with a solid steel door and issue a mechanical key to each authorized employee.

Answer

Place a security guard at the cage entrance during all business hours to visually verify and log each person who enters.

Question 2

A company runs a critical SQL Server database on a physical server with a RAID 10 array. The database is backed up nightly to a local disk and replicated to a remote site every four hours. A ransomware attack encrypts the local database files and the local backup disk, but the remote replication target is unaffected. The administrator needs to restore service with the least data loss. Which recovery approach should the administrator use?

Accepted Answer

Restore the most recent replicated backup from the remote site to a clean server. The remote replication target survived the attack and contains the most recent clean data, so restoring from it to a clean server minimizes loss and avoids reinfection. Local backups and database files are compromised. Rebuilding RAID does not decrypt data, and permanent failover is an architectural change beyond the immediate recovery need.

Answer

Restore the nightly backup from the local backup disk after running antivirus scans

Answer

Fail over to the remote site and continue running production there permanently

Answer

Rebuild the RAID 10 array and restore the database from the encrypted local files

Question 3

A datacenter administrator is planning a disaster recovery site for a critical application. The business requires that the application be able to resume within 15 minutes of a primary site failure, but the application can tolerate up to 30 minutes of data loss. Which combination of metrics and site strategy best fits these requirements?

Accepted Answer

An RTO of 15 minutes and an RPO of 30 minutes, supported by a warm site with replicated data.. Recovery time objective defines how quickly service must be restored, while recovery point objective defines how much data loss is acceptable. The scenario requires an RTO of 15 minutes and an RPO of 30 minutes. A warm site with replicated data provides the pre-staged infrastructure and recent data needed to meet both targets.

Answer

An RTO of 30 minutes and an RPO of 15 minutes, supported by a cold site with offsite tape backups.

Answer

An RTO of 15 minutes and an RPO of 30 minutes, supported by a cold site with offsite tape backups.

Answer

An RTO of 30 minutes and an RPO of 15 minutes, supported by a warm site with replicated data.

Question 4

A company operates a rack of servers in a shared datacenter. Management wants to ensure that if a malicious actor gains physical access to the rack, they cannot simply remove a hard drive and read the data on another system. Which control BEST addresses this risk?

Accepted Answer

Enable full-disk encryption using a TPM-bound key so drives are unreadable when moved to another system.. The threat is offline reading of a drive after physical removal. Full-disk encryption with a TPM-bound key ensures the volume cannot be decrypted on another machine because the sealing key never leaves the original TPM. BIOS passwords, tamper seals, and badge access may deter or detect intruders, but none of them make the data itself unreadable once the disk is in an attacker's hands.

Answer

Configure the servers to require a BIOS password before booting from any device.

Answer

Install tamper-evident seals on the rack doors and audit them during monthly inspections.

Answer

Restrict datacenter badge access so only authorized staff can enter the cage area.

Question 5

A server administrator is troubleshooting a Linux web server that has become unresponsive to SSH and HTTP requests. The administrator connects through the out-of-band management console and finds the system load average extremely high, with a large number of processes in the D state. The administrator suspects an I/O bottleneck. Which of the following commands should the administrator use to identify the processes and devices contributing to the bottleneck? (Choose two.)

Accepted Answer

iotop -o. To diagnose an I/O bottleneck, the administrator needs both device-level and process-level visibility. iostat -x with an interval shows per-device utilization and queue metrics, while iotop -o shows which processes are actively performing I/O. Together they identify the saturated device and the workloads causing it. Memory, network, and service-status tools do not provide this combined view.

Answer

systemctl status httpd

Answer

free -m

Answer

netstat -tulpn

Question 6

A datacenter technician is troubleshooting a rack-mounted server whose front-panel health LED is solid amber and whose management interface reports a fan failure in bay 3. The server is still running production workloads. Which of the following should the technician do FIRST?

Accepted Answer

Verify whether the failed fan is redundant and monitor the server's thermal sensors and remaining fan speeds.. When a single fan fails on a server with redundant cooling and the system is still running production workloads, the priority is to confirm that redundancy and thermal margins are intact before touching hardware. Reading the management controller's fan and temperature sensors establishes whether the server is safe to continue operating, allowing a hot-swap replacement to be scheduled without an outage.

Answer

Schedule an immediate graceful shutdown of the server to replace the fan.

Answer

Disable the fan failure alert in the management interface to stop the amber LED.

Answer

Replace the fan immediately by pulling it from the chassis while the server continues running.

Question 7

A retail company runs its order-processing database on a physical server in a colocation facility. Management has approved a hot site contract for disaster recovery. During a tabletop exercise, the CIO asks the administrator to explain what the hot site contract actually provides on day one of a declared disaster. Which statement is accurate?

Accepted Answer

The hot site provides pre-installed hardware, power, and network connectivity, but the company must still restore its own data and configure the operating systems.. Hot, warm, and cold sites differ in how much infrastructure is pre-provisioned. A hot site includes hardware, power, cooling, and network connectivity ready to run workloads, so recovery time is measured in hours, but the organization's data, operating systems, and application configuration remain its own responsibility to restore. Understanding that boundary is essential for setting realistic recovery time objectives and for budgeting replication and restore tooling separately.

Answer

The hot site is a reserved space with power and cooling only, and the company must ship in servers and storage before recovery can begin.

Answer

The hot site becomes the permanent production data center after a disaster, and the original facility is decommissioned.

Answer

The hot site guarantees zero data loss because the provider continuously replicates the production database to the alternate facility.

Question 8

A company operates a single data center with 40 physical servers and no secondary site. Management has approved a project to improve disaster recovery posture and wants the ability to restore critical workloads after a total site loss. The budget is limited, and the company already owns a large tape library and an offsite vault contract. Which two components should the administrator include in the solution? (Choose two.)

Accepted Answer

Offsite rotation of backup media with documented chain-of-custody and retention schedules aligned to the recovery requirements.. With no secondary site and a constrained budget, the practical path is to ensure an offsite copy exists and that it can actually be used. Rotating media to the existing vault with proper custody records guarantees survivability, and documented, validated bare-metal restore procedures prove the organization can rebuild critical workloads from those media after losing the data center.

Answer

RAID 6 arrays on every production server to protect against multiple simultaneous drive failures.

Answer

A second UPS with extended battery modules installed in the same server room as the primary UPS.

Answer

A cloud-based warm standby environment running replicated virtual machines for all 40 servers with automatic failover.

Question 9

An administrator manages a two-node Windows Server 2022 cluster that hosts a critical SQL Server instance. The cluster uses shared storage on a SAN. During a failover test, the administrator observes that the SQL Server role takes several minutes to come online on the surviving node, exceeding the recovery time objective. The application team confirms the database itself starts quickly once the disk resources are available. Which factor should the administrator investigate first?

Accepted Answer

The time required for the SAN to revoke and re-present disk ownership to the surviving node, including any persistent reservation cleanup.. When a clustered role fails over, the surviving node must first acquire the shared disk resources, which involves releasing and re-establishing SCSI-3 persistent reservations and revalidating paths to the storage array. Only after those resources are online can dependent resources such as the SQL Server instance start. If the application starts quickly once disks are present, the recovery time objective miss originates in the storage handoff, so that interval should be measured before tuning anything else.

Answer

The size of the SQL Server transaction log file on the shared volume.

Answer

The number of processor cores assigned to the virtual machine hosting the SQL Server instance.

Answer

The cluster quorum configuration and whether a file share witness is reachable.

Question 10

An administrator manages a Linux-based server hosting a database that contains regulated customer records. The security policy requires that when the server reaches end of life, all data on its solid-state drives be rendered unrecoverable before the drives leave the building. The server will be repurposed to a non-production test role within the same company rather than destroyed. Which action should the administrator take?

Accepted Answer

Use the drive vendor's secure erase or cryptographic erase utility to reset the drives, then verify the result before reinstalling the operating system for the test role.. Solid-state drives remap logical blocks to physical cells, so overwriting every logical sector does not guarantee that copies in spare or retired cells are gone. A vendor secure erase or cryptographic erase resets the drive's internal encryption key or wipes all cells, including those outside the addressable range, and verification confirms the media is clean before it is reused.

Answer

Run a single-pass overwrite of the entire drive with zeros using dd, then reinstall the operating system.

Answer

Delete all partitions, create a new partition table, and format the drives with a fresh file system before reuse.

Answer

Encrypt the drives with LUKS using a new key and destroy the old key, keeping the drives encrypted for the test role.

Question 11

A server administrator is troubleshooting a Windows Server 2019 host that fails to apply a monthly cumulative update. Windows Update returns error 0x800f0922, and the C: volume has 30 GB free while the System Reserved partition has only 12 MB free. Which of the following is the MOST likely cause?

Accepted Answer

The System Reserved partition lacks sufficient free space for the update to stage its files.. Error 0x800f0922 during cumulative update installation is strongly associated with insufficient free space on the System Reserved or EFI System Partition, which the update uses to stage files. With only 12 MB free on that partition and ample space on C:, the reserved partition is the bottleneck. Freeing or extending it allows the update to complete.

Answer

The cumulative update is incompatible with the installed .NET Framework version.

Answer

The server's antivirus software is blocking the update package.

Answer

The Windows Update service is disabled on the server.

Question 12

A server administrator is troubleshooting a Windows Server that is experiencing performance degradation. The administrator suspects a memory leak in a custom application. Which of the following tools should the administrator use to monitor the application's memory usage over time?

Accepted Answer

Performance Monitor with the Process\Private Bytes counter.. To diagnose a memory leak, the administrator needs to collect performance data over time. Performance Monitor with the Process\Private Bytes counter is designed for this purpose, allowing the creation of a data collector set that logs memory usage for the specific process. Analyzing the log will reveal a consistent upward trend, confirming the leak.

Answer

Resource Monitor's Memory tab.

Answer

Event Viewer's Application log.

Answer

Task Manager's Processes tab.

Question 13

A server administrator is troubleshooting a Linux server that was working normally until a new kernel was installed. After rebooting, the server drops into a GRUB prompt instead of loading the operating system, and the administrator needs to restore normal boot as quickly as possible. Which of the following is the MOST appropriate action?

Accepted Answer

Regenerate the GRUB configuration file and verify the boot entries point to valid kernels.. A system that stops at the GRUB prompt has a functioning bootloader but no valid menu entry to load, which frequently follows a kernel update that did not regenerate the configuration. Rebuilding the GRUB configuration restores entries tied to the kernels present on disk. Initramfs rebuilds, bootloader reinstalls, and systemd target changes each apply to different stages and would not fix this symptom.

Answer

Reinstall the bootloader to the disk's master boot record or EFI system partition.

Answer

Change the default boot target in systemd to multi-user.target and reboot.

Answer

Boot a rescue environment and rebuild the initramfs for the installed kernel.

Question 14

A server administrator is troubleshooting a server that is exhibiting symptoms of overheating. The server is in a data center with proper cooling. Which of the following should the administrator check? (Choose two.)

Accepted Answer

Airflow direction and blanking panels. Overheating in a properly cooled data center often stems from server-specific cooling issues. Fan failures or degraded fan speeds directly reduce airflow, while improper airflow due to missing blanking panels or incorrect rack orientation can cause hot air recirculation. Both are common causes that should be checked. Other factors like power supply wattage, CPU utilization, and disk fragmentation do not directly cause overheating in a cooled environment.

Answer

Power supply wattage

Answer

Disk fragmentation

Answer

CPU utilization

Question 15

A server administrator is troubleshooting a Windows Server host that runs a database. Users report slow queries, and Performance Monitor shows sustained disk queue length above 2 with average disk sec/transfer over 25 ms on the data volume, while CPU and memory remain well below capacity. The volume resides on a hardware RAID 5 array of 7200 RPM SATA drives. Which of the following is the MOST likely cause?

Accepted Answer

Insufficient IOPS and write penalty from the RAID 5 array of slow SATA drives. The measured latency and queue depth on the data volume, combined with idle CPU and memory, isolate the bottleneck to storage. A RAID 5 array built on 7200 RPM SATA drives delivers modest random IOPS and penalizes small writes with read-modify-write operations, which is exactly the pattern a database generates. Upgrading to SSDs or a RAID 10 layout addresses the root cause.

Answer

CPU throttling due to thermal limits on the database server

Answer

Memory leak in the database process causing excessive paging

Answer

Network congestion between the database server and its clients