SK0-005 Practice Test 4 — 25 Questions

Question 1

Refer to the exhibit. A server administrator configured iptables rules on a Linux server. Immediately afterward, they are unable to connect to the server via SSH. The output of 'iptables -L INPUT -n' is shown. What is the most likely cause of the connectivity issue?

Accepted Answer

The DROP rule for port 22 appears before the ACCEPT rule, causing all SSH packets to be dropped.. iptables processes rules in order. The DROP rule for destination port 22 appears before the ACCEPT rule, so all incoming SSH packets are dropped before the ACCEPT rule can permit new connections.

Answer

The last DROP rule blocks all traffic, including established SSH sessions.

Answer

The default INPUT policy is set to ACCEPT, allowing all traffic.

Answer

The ACCEPT rule for port 22 is missing the ESTABLISHED state, preventing return traffic.

Question 2

An administrator needs to remotely manage several Linux servers securely without using passwords. Which of the following is the BEST method?

Accepted Answer

Use SSH with key-based authentication.. Option C is correct because SSH with key-based authentication provides strong, password-less remote access. Option A is wrong because RDP is primarily used on Windows, not typical for Linux. Option B is wrong because Telnet is insecure, and SSH tunneling does not make Telnet secure. Option D is wrong because VNC is less secure and not designed for efficient server administration.

Answer

Use Telnet with SSH tunneling.

Answer

Use VNC with a strong password.

Answer

Use RDP with certificate-based authentication.

Question 3

A server administrator notices that a database server is experiencing high CPU usage at specific times of the day. After checking logs, the administrator finds that a report generation task scheduled at those times is causing the issue. The task cannot be rescheduled or optimized further. Which of the following actions should the administrator take to ensure the server remains responsive for other applications during peak usage?

Accepted Answer

Configure the task to run at a lower priority.. Option D is correct because lowering the priority (nice value) of the task allows other processes to utilize the CPU without being blocked. Option A is wrong because adding vCPUs does not guarantee other processes will get CPU time if the task consumes all available cycles. Option B is wrong because processor affinity only pins a process to a specific CPU core but does not change its scheduling priority. Option C is wrong because replacing hardware is not immediate and may not solve scheduling contention.

Answer

Add more virtual CPUs to the server's VM.

Answer

Move the database to a server with faster CPU cores.

Answer

Configure processor affinity to dedicate a core to the database process.

Question 4

A company is planning to deploy a new web application on multiple servers behind a load balancer. The application requires consistent session data across all servers for seamless user experience. Which of the following solutions would BEST meet this requirement?

Accepted Answer

Store session data in a shared, high-performance in-memory data store like Redis.. Option B is correct because a shared in-memory data store like Redis provides low-latency access to session data for all servers, ensuring consistency and high availability. Option A is wrong because round-robin DNS does not handle session persistence. Option C is wrong because sticky sessions tie a user to one server; if that server fails, the session is lost and consistency is not maintained across servers. Option D is wrong because synchronous database replication adds latency and complexity, making it less suitable for high-performance web applications.

Answer

Configure each web server to store sessions locally and use sticky sessions on the load balancer.

Answer

Use round-robin DNS to distribute traffic.

Answer

Implement database session storage with synchronous replication between servers.

Question 5

A server administrator receives an alert that a critical server's disk is almost full. Upon investigation, the administrator finds a large log file that has grown significantly. The log file is rotated daily, but today's rotation failed. Which command should the administrator use FIRST to free up space immediately?

Accepted Answer

> /var/log/large.log to truncate the file.. Option A is correct because truncating the file to zero size instantly reclaims disk space without removing the file, which could cause issues if processes still have it open. Option B is wrong because deleting the file will not free space if any process holds an open file handle. Option C is wrong because moving the file has similar issues as deletion. Option D is wrong because running logrotate might fail if the disk is full or if the rotation script is broken; truncation is quicker and safer under pressure.

Answer

logrotate -f /etc/logrotate.conf to force log rotation.

Answer

rm -rf /var/log/large.log to delete the file.

Answer

mv /var/log/large.log /backup/ to move the file.

Question 6

A server administrator configures a scheduled task to back up a database using a command-line tool. The task runs successfully when executed manually, but fails when run via the task scheduler. The log shows 'Error: Access denied.' What is the MOST likely cause?

Accepted Answer

The scheduled task is running under the wrong user account.. Option C is correct because 'Access denied' usually points to permission issues; the task scheduler may run under a different user account that lacks necessary privileges. Option A is wrong because a full destination would yield a 'disk full' error, not access denied. Option B is wrong because if the tool were not installed, the error would be 'command not found.' Option D is wrong because a stopped database service would produce a connection error, not access denied.

Answer

The database service is stopped.

Answer

The command-line tool is not installed.

Answer

The backup destination is full.

Question 7

An administrator is monitoring a server that has a hardware RAID 5 array consisting of four 2 TB disks. The RAID controller's management software reports that one disk has a status of 'Pred Fail' (predictive failure). The array also has a dedicated hot spare disk already installed and set up. The array is still fully functional with no data loss, but the 'Pred Fail' warning indicates the disk is likely to fail soon. The server is a production database server that cannot be taken offline except for scheduled maintenance windows, which are not until the following weekend. The administrator needs to ensure data integrity and avoid any risk of downtime or data loss while waiting for the replacement. Which immediate action should the administrator take?

Accepted Answer

Use the RAID management software to initiate a proactive replacement of the pred fail disk with the hot spare. Option A is correct because replacing the failing disk with the hot spare proactively prevents the array from becoming degraded or failing if another disk fails, ensuring continuous protection. Option B is wrong because waiting risks catastrophic failure if another disk fails before the spare activates. Option C is wrong because a full backup is not a substitute for immediate redundancy restoration. Option D is wrong because removing the disk from the array manually would degrade it and risk data loss if another disk fails during the rebuild.

Answer

Wait for the disk to completely fail so that the hot spare will automatically rebuild the array

Answer

Take a full backup immediately and then replace the disk during the next maintenance window

Answer

Remove the pred fail disk from the array to force the hot spare to rebuild, then re-add the disk later

Question 8

A medium-sized business runs a critical internal application on a single physical server running Windows Server 2019. The application is memory-intensive, often using up to 24 GB out of 32 GB RAM during peak hours. Over the past week, the server has experienced three unexpected reboots, each occurring during peak load. The server is not part of a cluster, and all data is stored on local disks. You have checked the Windows System event log and found Event ID 41 (Kernel-Power) indicating an unexpected shutdown. There are no related critical errors in the Application log. You have also reviewed the server's firmware logs and found multiple corrected memory errors (ECC) over the last month, with an increase in frequency just before each crash. The server is under warranty, and the hardware vendor's diagnostic tools report a failing memory module in DIMM slot A1. The vendor has recommended replacing the faulty DIMM immediately. However, the server is currently processing critical end-of-quarter financial reports that cannot be interrupted for at least 6 hours. Which of the following is the BEST course of action to minimize risk of data loss and downtime until a planned maintenance window?

Accepted Answer

Inform management of the criticality, request emergency approval for immediate maintenance, and if denied, ensure current backups are verified and monitor the server closely for any signs of degradation until the maintenance window.. Option D is correct because it follows proper change management: informing stakeholders, seeking emergency approval if needed, and mitigating risk by verifying backups and monitoring. Option A is wrong because immediately shutting down would interrupt critical processing and potential data loss, without management approval. Option B is wrong because Windows Memory Diagnostic is a boot-time tool and cannot effectively isolate memory regions to avoid crashes on a running production system. Option C is wrong because the server has already crashed, indicating uncorrectable errors; continuing without action risks data corruption and further unplanned outages.

Answer

Use Windows Memory Diagnostic tool to try to isolate the memory region and prevent the application from using it.

Answer

Continue running the server as is, as ECC memory can correct errors and the server will only crash if errors are uncorrectable; the risk is low.

Answer

Immediately shut down the server, replace the faulty DIMM, and restart.

Question 9

A company has an internal web application running on a Windows Server 2019 IIS server. Recently, users have been experiencing intermittent slow responses and occasional '503 Service Unavailable' errors. The server has 32 GB RAM and currently hosts only this application. The application pool is configured to use a private memory limit of 2 GB and a request queue limit of 1000. Performance monitoring reveals that the application pool's private memory gradually increases over several hours until it reaches 2 GB, at which point the pool recycles. The slow responses and errors coincide with the recycling events. The administrator suspects a memory leak in the application code but cannot modify the application immediately. The server must remain available during business hours (8 AM to 8 PM). Which of the following is the best short-term mitigation?

Accepted Answer

Configure Performance Monitor alerts to recycle the application pool when memory usage reaches 1.8 GB, and schedule it during low-usage hours. Option A is correct because monitoring the memory usage and triggering a graceful recycle before hitting the limit can prevent sudden 503 errors and maintain availability, and it can be scheduled during off-peak times. Option B is wrong because scheduling a reboot requires downtime. Option C is wrong because adding RAM does not fix a memory leak; the pool will still hit its limit and recycle. Option D is wrong because restarting every hour would cause frequent disruptions and is not user-friendly.

Answer

Use a script to stop and start the application pool service every hour

Answer

Increase the physical RAM to 64 GB and raise the private memory limit to 4 GB

Answer

Schedule a nightly reboot of the server to clear memory and reset the application pool

Question 10

A system administrator is notified that a server with a RAID 5 array of four 2TB drives has a single failed drive. The server uses hot-swappable drives and a hardware RAID controller. Which of the following actions should the administrator perform FIRST?

Accepted Answer

Replace the failed drive and allow the array to rebuild.. Option A (Replace the failed drive and allow the array to rebuild) is correct because with a hot-spare, the array can rebuild automatically after replacing the failed drive, minimizing data vulnerability. Option B (Perform a full backup) is prudent but not immediate; the array is still functional in degraded mode. Option C (Reboot the server and access the RAID controller BIOS) delays recovery and may cause unnecessary downtime. Option D (Replace all drives to increase storage) is unnecessary and wasteful.

Answer

Replace all four drives with larger capacity drives to expand storage.

Answer

Reboot the server and enter the RAID controller BIOS to mark the drive as offline.

Answer

Perform a full backup of the array before taking any action.

Question 11

A Linux database server has recently exhibited sluggish response times. An analysis of system performance shows high CPU wait I/O, frequent page swapping, and a low cache hit ratio. The server has 16GB of RAM, and the database itself stores 100GB of active data. Which of the following is the MOST effective long-term solution to improve performance?

Accepted Answer

Increase the physical RAM in the server to at least 64GB.. Option C (Increase physical RAM to 64GB) is correct because the server is experiencing memory pressure leading to excessive swapping and low cache utilization. More RAM allows the database to cache a larger portion of active data in memory, reducing I/O wait and improving response times. Option A (Add faster SSDs) may reduce I/O wait but does not address the root cause—memory starvation. Option B (Tune the database query cache) might provide minor relief but is not a substitute for adequate memory. Option D (Increase swap space) would worsen performance by enabling more swapping.

Answer

Tune the database engine's query cache size.

Answer

Configure the server to use a larger swap partition.

Answer

Replace the existing hard drives with faster SSDs.

Question 12

Refer to the exhibit. A server administrator is troubleshooting a DNS resolution issue on a Windows Server 2019. The exhibit shows the output of the command `nslookup` queried against the server's own IP. Based on the output, what is the most likely cause of the resolution failure?

Accepted Answer

The DNS server does not have an A record for server1.contoso.com.. Option D is correct because the NXDOMAIN response indicates the queried name does not exist in the DNS zone. Option A is wrong because forwarding is irrelevant for an authoritative zone. Option B is wrong because reverse lookup zones are for IP-to-name resolution, not name-to-IP. Option C is wrong because root hints are used for recursion, not for authoritative responses.

Answer

The DNS server's root hints are misconfigured.

Answer

The DNS server is not configured to forward queries to an external DNS server.

Answer

The DNS server has an incorrect reverse lookup zone configuration.

Question 13

A company wants to protect its Microsoft SQL Server database with a backup strategy that provides point-in-time recovery up to every 15 minutes. The database is critical and runs on a dedicated server. Which backup schedule should be implemented?

Accepted Answer

Full backup weekly, differential daily, transaction log backups every 15 minutes.. Option B (Full backup weekly, differential daily, transaction log backups every 15 minutes) is correct because full and differential backups provide a base, while frequent transaction log backups enable granular point-in-time restore. Option A lacks transaction log backups, so recovery granularity is limited to daily. Option C uses mirroring, which is high availability (not a backup) and does not protect against logical corruption. Option D uses snapshot technology but snapshots alone are not a backup and may impact performance if taken every 15 minutes.

Answer

Use storage-level snapshots every 15 minutes on a SAN.

Answer

Full backup daily, differential backup hourly.

Answer

Set up database mirroring with automatic failover and full weekly backups.

Question 14

Refer to the exhibit. A server administrator encounters an authentication issue when accessing a web server. The exhibit shows an error from the Domain Controller's event log. What is the most likely cause of the problem?

Accepted Answer

The web server's service account is not configured to support AES encryption types.. Option B is correct because the error shows that the requested encryption types (etype 18 is AES) are missing from the account's available etypes, indicating the service account is not configured to support AES. Option A would produce a clock skew error. Option C would result in a password expiration event. Option D would cause name resolution or host not found errors, not a Kerberos encryption mismatch.

Answer

The DNS service is not resolving the web server's FQDN.

Answer

The domain controller clock is out of sync with the web server.

Answer

The service account for the web server has an expired password.

Question 15

An administrator needs to configure a critical web service on a Linux server to automatically restart if it crashes unexpectedly. The server uses systemd. Which of the following best accomplishes this goal?

Accepted Answer

Configure the service's systemd unit file with Restart=always. Option C is correct because setting Restart=always in the systemd unit file ensures the service restarts regardless of exit code, which is the proper systemd method. Option A is wrong because a cron job introduces a potential delay and is less reliable than built-in service supervision. Option B is wrong because an init.d script with a loop is an outdated approach and not recommended with systemd. Option D is wrong because inetd starts services on demand, not for persistent daemons.

Answer

Set the service to run under inetd so it starts on demand

Answer

Write a cron job to check the service status every minute and start it if stopped

Answer

Create an init.d script that loops and re-executes the service if it exits

Question 16

A server hosts a database that requires nightly backups. The backup strategy uses a full backup every Sunday and differential backups on other days. On Wednesday, the server fails. Which backup sets are required to restore to the most recent state?

Accepted Answer

Last full backup and the latest differential backup. A differential backup contains all changes since the last full backup. Therefore, only the last full backup and the latest differential are needed for a restore. Incremental backups would require all incrementals since the last full, but the scenario uses differential backups.

Answer

Last full backup and all differential backups since Sunday

Answer

Last full backup only

Answer

Last full backup and all incremental backups since Sunday

Question 17

A medium-sized organization runs several critical virtual machines on a Windows Server 2019 Hyper-V host with 64 GB of RAM and two 12-core processors. One of the VMs, a database server, has been experiencing intermittent performance degradation, specifically during peak hours. The VM is configured with 4 vCPUs and 16 GB of static memory. The host's overall CPU utilization rarely exceeds 40%, and memory usage is around 50%. The administrator logs into the host and checks the VM's CPU usage in Hyper-V Manager, which shows it averaging 65% with occasional spikes to 95%. However, inside the VM, Task Manager shows constant 95-100% CPU usage on all logical processors. No other VMs are reporting performance issues. The administrator needs to determine the root cause and apply a fix that does not involve adding more physical resources or rebooting the production VM during business hours. Which of the following actions should the administrator take?

Accepted Answer

Use Performance Monitor on the host to examine 'Hyper-V Hypervisor Virtual Processor' metrics for the VM and compare with in-guest CPU usage to identify scheduling issues. Option C is correct because comparing the host-level guest CPU metrics (which show 65% average) with the in-guest metrics (100%) reveals that the VM is being limited by its vCPU allocation, likely due to co-scheduling or contention with other VMs' vCPUs on the same physical cores. Investigating and adjusting CPU scheduling or reservation settings can alleviate this. Option A is wrong because the host's overall CPU is fine; the issue is within the VM or hypervisor scheduling. Option B is wrong because increasing vCPUs without diagnosing the bottleneck might worsen contention. Option D is wrong because increasing memory won't resolve a CPU bottleneck.

Answer

Increase the VM's memory from 16 GB to 32 GB to reduce paging and improve performance

Answer

Increase the VM's vCPU count to 8 to handle the workload and reduce contention

Answer

Check the host's overall CPU usage in Task Manager and increase the VM's vCPU count if the host has spare capacity

Question 18

A junior administrator is managing a Linux server used by a development team. The root filesystem (/) has reached 98% capacity, causing the system to slow down and some applications to fail. The server has an LVM volume group with 20 GB of free space, but the root logical volume is 50 GB with an ext4 filesystem. The administrator needs to free space quickly and safely without rebooting or adding new disks. They log in via SSH and want to identify where the large files are and then take action. There are concerns about accidentally deleting critical system files or logs that might be needed for auditing. The server has the following typical directories: /var (with logs), /home (user files), /opt (application files), /tmp. Which of the following sequences of actions is the most appropriate to resolve the issue?

Accepted Answer

Run 'du -sh /*' to locate large directories, then examine and compress or truncate old log files in /var/log. Option A is correct because it uses 'du -sh /*' to safely identify the largest directories, then targets specific log files in /var/log that can be compressed or moved, freeing space without deleting required files. Option B is wrong because blindly removing all files in /tmp may delete needed temporary files for running applications. Option C is wrong because using 'find' with 'exec rm' is very dangerous and could delete critical files if misused. Option D is wrong because resizing the filesystem, while possible with LVM, should be considered after attempting to free space safely; also the free space in VG might be needed elsewhere.

Answer

Execute 'rm -rf /tmp/*' to clear temporary files and regain space

Answer

Use 'find / -type f -size +100M -exec rm {} \;' to delete all files larger than 100MB

Answer

Extend the root logical volume by 10 GB using 'lvextend' and then resize the filesystem with 'resize2fs'

Question 19

A corporation's backup strategy currently involves a weekly full backup every Saturday night and daily differential backups Monday through Friday. The company has a 5 TB dataset with a daily change rate of about 10%. The full backup takes 12 hours and runs into Monday morning, impacting production performance. The backup window is from 10 PM to 6 AM. The company requires faster backups that can complete within the window, and they also want an offsite copy of the backups for disaster recovery. The existing backup server has direct-attached disk storage and a tape library. The network bandwidth to the offsite location is limited to 100 Mbps. The administrator is evaluating changes to the backup methodology and infrastructure to meet these requirements. Which of the following solutions best addresses the speed and offsite requirements?

Accepted Answer

Implement a disk-to-disk-to-cloud solution using changed block tracking for daily incrementals and replication to the cloud. Option D is correct because it uses changed block tracking to perform incremental backups quickly, stores them on disk (fast), and replicates to cloud, which achieves offsite copy despite limited bandwidth by sending only changed blocks. Option A is wrong because synthetic full backups still require reading all data to synthesize, and offsite copy is not addressed. Option B is wrong because multiple tape drives increase throughput but do not directly reduce the amount of data backed up daily, and offsite tape handling is manual. Option C is wrong because daily differentials will still grow each day and may exceed the window, and offsite is not specified.

Answer

Upgrade the tape library to use multiple tape drives for parallel backups and rotate tapes offsite daily

Answer

Switch to synthetic full backups combined with incremental forever; store backups locally on disk

Answer

Continue weekly fulls but perform daily incremental backups instead of differentials; keep tapes on-site

Question 20

A server has a RAID 5 array with four drives. One drive fails and is replaced. During the rebuild, a second drive reports a media error and the rebuild fails. What should the administrator do FIRST to minimize the risk of permanent data loss?

Accepted Answer

Back up all critical data before any further rebuilding. A media error on another drive during a RAID 5 rebuild indicates that drive may also be failing. If another drive fails completely, the entire array and its data will be lost. Therefore, the immediate priority is to back up critical data before any further rebuild action. Replacing the drive or restarting the controller could trigger another rebuild, risking complete array loss. A consistency check does not address the urgency.

Answer

Run a consistency check on the array

Answer

Replace the drive that reported the media error immediately

Answer

Restart the RAID controller to reinitialize the rebuild