SK0-005 Practice Test 21 — 15 Questions

Question 1

A server administrator is troubleshooting a server that is not responding to network requests. The server's link lights are on, and the switch port shows activity. The administrator cannot ping the server by IP address from another subnet, but can ping it from a host on the same subnet. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The default gateway is misconfigured on the server.. The correct answer is that the default gateway is misconfigured on the server. The ability to ping locally but not remotely indicates a routing issue. The server can reach local hosts directly but needs a correct gateway to reach other subnets. Checking and correcting the default gateway configuration restores connectivity.

Answer

The switch port is configured for the wrong VLAN.

Answer

A firewall on the server is blocking ICMP from remote subnets.

Answer

The server's NIC is faulty.

Question 2

A server administrator is troubleshooting a server that is not responding to network requests. The server's link lights are on, and the switch port shows activity. The administrator cannot ping the server by IP address from another subnet, but can ping it from a host on the same subnet. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The switch port is configured for 1 GbE, limiting throughput.. The correct answer is that the switch port is configured for 1 GbE, limiting throughput. When a 10 GbE NIC connects to a 1 GbE switch port, the link speed is negotiated at 1 GbE, capping performance. This is a straightforward configuration mismatch that can be resolved by reconfiguring the switch port to support higher speeds if the hardware allows.

Answer

The network cable is Cat 5e, which cannot support 10 GbE.

Answer

The server's NIC driver is outdated and does not support 10 GbE.

Answer

The NIC is set to half-duplex mode.

Question 3

A system administrator needs to implement a secure method for remote administrators to manage servers in a data center. The solution must provide encrypted communication, support multi-factor authentication, and allow centralized logging of all administrative sessions. Which solution should be implemented?

Accepted Answer

A jump server (bastion host) with SSH, MFA, and centralized session recording. A jump server with SSH, MFA, and centralized session recording provides encrypted access, enforces multi-factor authentication, and logs all administrative sessions in one place. This satisfies all requirements and is a common best practice for secure remote administration. Other options lack centralized session logging or are platform-specific.

Answer

Remote Desktop Protocol (RDP) with Network Level Authentication (NLA) and Group Policy

Answer

VPN with IPsec and RADIUS authentication

Answer

SSH with key-based authentication and session logging via auditd

Question 4

A server administrator is troubleshooting a server that is not responding to network requests. The server's link lights are on, and the switch port shows activity. The administrator cannot ping the server by IP address from another subnet, but can ping it from a host on the same subnet. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The boot order in the BIOS/UEFI settings.. When a server detects a hard drive but fails to boot with a no bootable device error, the boot order is the most likely culprit. The system may be trying to boot from a non-bootable device. Checking and adjusting the boot order in BIOS/UEFI is a quick first step.

Answer

The integrity of the operating system files.

Answer

The RAID controller configuration.

Answer

The physical connections of the hard drive.

Question 5

A server administrator is tasked with installing a new PCIe SSD into a server that will be used for a high-transaction database. The server has available PCIe 4.0 x16 slots. Which of the following should the administrator consider to maximize performance?

Accepted Answer

Ensure the SSD is installed in a slot with direct CPU lanes rather than chipset lanes. To maximize performance, the PCIe SSD should be installed in a slot with direct CPU lanes. CPU-attached slots provide dedicated bandwidth and lower latency compared to chipset-attached slots, which may share bandwidth. Physical placement, riser cards, or downgrading to PCIe 3.0 do not improve performance and can introduce bottlenecks or compatibility issues.

Answer

Use a PCIe riser card to install the SSD vertically

Answer

Configure the slot to run in PCIe 3.0 mode for compatibility

Answer

Install the SSD in the slot closest to the power supply

Question 6

A company is implementing a disaster recovery plan and needs to determine the maximum acceptable amount of data loss measured in time. The business can tolerate losing up to 4 hours of transactions. Which metric should the administrator use to define this requirement?

Accepted Answer

Recovery Point Objective (RPO). The Recovery Point Objective (RPO) specifically quantifies the maximum tolerable data loss in terms of time. By stating that up to 4 hours of transactions can be lost, the business is defining an RPO of 4 hours. This metric directly drives backup frequency and replication intervals to ensure that no more than 4 hours of data is ever at risk.

Answer

Recovery Time Objective (RTO)

Answer

Mean Time Between Failures (MTBF)

Answer

Mean Time To Repair (MTTR)

Question 7

A security administrator at a financial services firm is implementing a defense-in-depth strategy for a new Windows Server 2022 file server that will host sensitive client data. The administrator needs to ensure that data at rest on the server's hard drives is protected in a way that does not require users to enter separate credentials and does not rely on the operating system's file permissions. Which technology should the administrator implement?

Accepted Answer

BitLocker Drive Encryption with TPM protector. BitLocker with a TPM protector provides full-disk encryption that is transparent to users and independent of file system permissions. The TPM stores the encryption key and releases it only during a verified boot process, so no separate credentials are needed. This directly addresses the need to protect data at rest on the server's drives without relying on NTFS.

Answer

Storage Spaces with thin provisioning

Answer

Encrypting File System (EFS) on all user data folders

Answer

NTFS permissions with inheritance enabled

Question 8

A server administrator is troubleshooting a server that is not responding to network requests. The server's link lights are on, and the switch port shows activity. The administrator cannot ping the server by IP address from another subnet, but can ping it from a host on the same subnet. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The server's power supplies are not properly seated or are failing intermittently.. Event ID 6008 indicates an unexpected shutdown, which is often caused by a power loss. Even with redundant power supplies, if one supply is failing intermittently or not properly connected, the server may shut down if the remaining supply cannot handle the load or if there is a brief power interruption. Checking the power supply status and reseating them is a logical step. The lack of PDU outages rules out external power issues.

Answer

The PDUs are not providing enough power to the server, causing brownouts.

Answer

The server's BIOS is configured to shut down when a redundant power supply fails.

Answer

The server's operating system is missing a critical update, causing random reboots.

Question 9

A Linux server administrator notices that a server's root filesystem is running out of space. The administrator runs 'df -h' and sees that / is 100% full, but 'du -sh /*' shows that the total size of all directories is only 20 GB, while the filesystem is 100 GB. Which of the following is the MOST likely cause?

Accepted Answer

A large file has been deleted but is still held open by a running process.. The discrepancy between df and du is typically caused by deleted files that are still held open by running processes. These files no longer have directory entries, so du does not see them, but the kernel keeps the blocks allocated until the file descriptors are closed. The administrator can identify such files using lsof +L1 or by checking /proc/*/fd.

Answer

The root filesystem is actually a logical volume that is not properly resized.

Answer

There are many small files that du is not counting due to a bug.

Answer

The filesystem has suffered corruption, causing df to report incorrect usage.

Question 10

A server administrator is configuring a RAID array on a new server with six 4 TB SAS drives. The server will host a large email archive that requires maximum usable capacity and can tolerate the loss of up to two drives without data loss. Write performance is not critical, but read performance should be adequate. Which RAID level should the administrator choose?

Accepted Answer

RAID 6. RAID 6 provides dual parity, allowing the array to survive two simultaneous drive failures while offering usable capacity of n-2 drives. With six 4 TB drives, that yields 16 TB, which is greater than RAID 10's 12 TB. RAID 5 can only survive one failure, and RAID 0 offers no redundancy, so RAID 6 is the correct choice for this scenario.

Answer

RAID 0

Answer

RAID 5

Answer

RAID 10

Question 11

An administrator is configuring a server to use a hardware security module (HSM) for disk encryption key storage. The administrator wants to ensure that if the server is stolen, the encrypted disks cannot be decrypted even if the disks are moved to another system. Which statement best describes why the HSM supports this goal?

Accepted Answer

The HSM stores the encryption keys in a tamper-resistant device and releases them only to authorized systems, so removing the disks does not expose the keys.. An HSM protects keys in tamper-resistant hardware and releases them only to authorized systems after authentication. Because the keys never leave the HSM in usable form and are not stored on the disks, moving the disks to another system does not allow decryption. The other options either embed keys in the disks, expose them via cloud retrieval, or store them in plaintext.

Answer

The HSM stores the keys in a plaintext file on the boot volume so the operating system can load them at startup.

Answer

The HSM encrypts the disks with a key that is embedded in the disk firmware, so the key travels with the disks.

Answer

The HSM synchronizes keys to a cloud service so any server can retrieve them after authenticating with a user password.

Question 12

A server administrator is troubleshooting a server that is not responding to network requests. The server's link lights are on, and the switch port shows activity. The administrator cannot ping the server by IP address from another subnet, but can ping it from a host on the same subnet. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The power supply unit (PSU). Event ID 41 (Kernel-Power) indicates that the system rebooted without a clean shutdown, often due to power interruption. The most likely hardware cause is the power supply unit. Checking the PSU's capacity and health is the logical first step.

Answer

The memory (RAM) modules

Answer

The hard drive for bad sectors

Answer

The CPU temperature

Question 13

A company has a primary data center and a warm site 50 miles away. The disaster recovery plan specifies a recovery time objective (RTO) of 4 hours and a recovery point objective (RPO) of 15 minutes. The administrator is reviewing the backup and replication strategy. Which combination best meets these objectives?

Accepted Answer

Asynchronous replication every 10 minutes to the warm site with automated failover. Asynchronous replication every 10 minutes keeps data loss within the 15-minute RPO, and automated failover to a warm site can achieve the 4-hour RTO. This combination balances cost and performance without requiring synchronous replication over a long distance.

Answer

Nightly full backups shipped to the warm site and restored during a disaster

Answer

Synchronous replication to the warm site with manual failover procedures

Answer

Daily differential backups to local storage and weekly full backups to tape stored offsite

Question 14

A server administrator is troubleshooting a server that is not responding to network requests. The server's link lights are on, and the switch port shows activity. The administrator cannot ping the server by IP address from another subnet, but can ping it from a host on the same subnet. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The RAID controller cache is disabled or the battery-backed write cache is in a failed state.. High I/O wait with low CPU usage during write-heavy operations points to a storage bottleneck. A RAID controller with a disabled or failed write cache cannot buffer writes, forcing synchronous disk access and increasing I/O wait. Verifying the RAID controller cache status and battery condition is the most likely fix.

Answer

The server's CPU is throttling due to excessive heat, causing processes to wait on I/O.

Answer

The backup application is using a compression algorithm that is CPU-intensive.

Answer

The network interface card is dropping packets, causing retransmissions and disk writes to stall.

Question 15

A company is drafting a disaster recovery plan for its primary data center. The plan must address both the maximum tolerable data loss and the maximum tolerable downtime for critical systems. Which of the following metrics should the plan explicitly define to meet these requirements? (Choose two.)

Accepted Answer

Recovery point objective (RPO). The two metrics that directly express maximum tolerable data loss and maximum tolerable downtime are the recovery point objective and the recovery time objective. RPO sets the acceptable data loss in time, and RTO sets the acceptable downtime. Reliability and repair averages such as MTBF and MTTR describe failure and repair behavior but do not define business tolerance for loss or downtime.

Answer

Recovery service level (RSL)

Answer

Mean time between failures (MTBF)

Answer

Mean time to repair (MTTR)