SK0-005 Practice Test 4 — 25 Questions

Question 1

You are the lead server administrator for a mid-sized e-commerce company. The web application is hosted on a farm of four Linux servers running Apache, fronted by a hardware load balancer. The load balancer currently uses a round-robin algorithm. Recently, the customer support team has received numerous complaints about slow page load times and occasional timeouts during checkout. You log into the server monitoring console and observe that one of the web servers, web03, has a CPU utilization consistently above 95%, while the other three servers are at around 30-40%. You connect via SSH to web03 and run the 'top' command, identifying a process named 'imagick' consuming 99% CPU. Further investigation reveals that this process is related to image resizing for product thumbnails, and it appears to have entered an infinite loop due to a malformed image file. Meanwhile, the load balancer continues to send requests to all servers equally, including the overloaded web03, causing some requests to time out. You need to restore performance immediately and prevent recurrence. Which of the following actions should you take?

Accepted Answer

Kill the 'imagick' process on web03, change the load balancer algorithm to least connections, and clear the malformed image.. Option B is correct because it directly addresses both issues: the runaway process (killing it stops the CPU drain) and the load balancer algorithm (switching to least connections prevents sending traffic to an already overloaded server). Additionally, clearing the malformed image addresses the root cause of the loop. Option A (adding servers) may temporarily hide the problem but does not fix the load distribution or the looping process; the overloaded server would still exist. Option C (rebooting all servers) is unnecessarily disruptive and does not address the root cause; the malformed image could trigger the loop again after reboot. Option D (increasing RAM) misidentifies the issue as memory-related when it is clearly CPU-bound; more RAM would not stop the infinite loop.

Answer

Reboot all four web servers to clear any stuck processes.

Answer

Increase RAM on web03 to handle the high CPU process better.

Answer

Add two more servers to the farm and keep the round-robin algorithm.

Question 2

A small law firm has a single Windows Server 2016 Essentials server that functions as a domain controller and file server. After a sudden power outage over the weekend, the server does not boot normally. Instead, it displays a black screen with the message: 'BOOTMGR is missing. Press Ctrl+Alt+Del to restart.' The IT support specialist arrives on Monday morning to find the server in this state. The firm's operations are at a standstill because all case files and email archives are inaccessible. The specialist has access to the Windows Server 2016 installation media and a recent system state backup stored on an external drive. The server hardware passed POST, and all disks are detected in the BIOS. The specialist needs to restore the server's ability to boot into Windows as quickly as possible, with minimal risk to existing data. Which of the following procedures should the specialist perform FIRST?

Accepted Answer

Boot from the installation media, select 'Repair your computer', and from the Command Prompt run 'bootrec /fixmbr' and 'bootrec /fixboot'.. Option C is correct because the 'BOOTMGR is missing' error typically indicates a corrupt master boot record or boot sector. Using bootrec /fixmbr and /fixboot from the installation media repairs the boot files without affecting data. Option A is a full system restore, which risks data loss and is overkill. Option B is hardware reseating, unnecessary since POST passed. Option D, Last Known Good Configuration, does not fix missing boot manager files.

Answer

Connect the external backup drive, boot from the installation media, and perform a full system restore from the backup.

Answer

Open the server case, reseat the RAM modules and SATA cables, and then attempt to boot again.

Answer

Press F8 during startup to access Advanced Boot Options and select 'Last Known Good Configuration'.

Question 3

A server administrator is responsible for protecting sensitive data. The backup process copies files to a network share daily. Which of the following should the administrator do to BEST ensure the confidentiality of the backup data both during transfer and at rest?

Accepted Answer

Encrypt the backup files before transfer using a tool like GPG, and store them encrypted.. Encrypting the backup files before transfer (Option B) ensures data confidentiality during transit and while stored on the backup server. Option A provides network segmentation but no encryption. Option C encrypts only the transfer, not the data at rest. Option D is a physical security measure and does not encrypt the data.

Answer

Configure the network share with SMB encryption only.

Answer

Use a dedicated NIC for backup traffic on an isolated VLAN.

Answer

Place the backup server in a physically locked cage with restricted access.

Question 4

A financial services firm requires zero data loss in the event of a primary data center failure. They operate two data centers 50 miles apart connected by a high-bandwidth, low-latency link. Which replication method should they use to meet this requirement?

Accepted Answer

Synchronous replication. Option B is correct because synchronous replication writes data to both sites before acknowledging the write to the application, ensuring zero data loss (RPO=0). Asynchronous replication (Option A) introduces a delay and can lose the latest transactions. Snapshot replication (Option C) is point-in-time and not continuous, leading to potential data loss between snapshots. Backup replication nightly (Option D) can lose up to a day's data.

Answer

Asynchronous replication every 15 minutes

Answer

Snapshot replication every hour

Answer

Backup replication nightly

Question 5

A database server hosts a critical application that requires a recovery point objective (RPO) of 4 hours. The company wants to minimize the impact on production performance during backups. Which backup strategy should be implemented?

Accepted Answer

A weekly full backup with hourly incremental backups.. Option C is correct because hourly incremental backups meet the 4-hour RPO while minimizing resource usage compared to more frequent full backups or continuous replication. Option A is wrong because differential backups grow in size and can still exceed the RPO window. Option B is wrong because nightly full backups would fail to meet the 4-hour RPO if a disaster occurs hours after the last backup. Option D is wrong because CDP with synchronous replication imposes high performance overhead and is unnecessary beyond the 4-hour RPO requirement.

Answer

Continuous data protection (CDP) with synchronous replication.

Answer

A weekly full backup with daily differential backups.

Answer

A nightly full backup.

Question 6

A system administrator configures full backups on Sunday evenings and differential backups on weekdays. On Thursday morning, a disk failure occurs. Which of the following sets of backups is necessary to completely restore the server's data with the fewest number of backup files?

Accepted Answer

Sunday full and Wednesday differential. A differential backup includes all changes since the last full backup. Therefore, only the most recent differential and the last full backup are needed for a complete restore. Using Sunday's full and Wednesday's differential requires just two files, whereas incremental backups would require the full plus every incremental since. Option A (full plus all four differentials) is unnecessary. Option C references a Thursday backup that hasn't occurred yet. Option D ignores all changes since Sunday.

Answer

Sunday full only

Answer

Sunday full, Monday differential, Tuesday differential, Wednesday differential

Answer

Sunday full and Thursday differential

Question 7

A company runs a popular public-facing e-commerce website hosted on a farm of five Windows Server 2019 web servers behind a hardware load balancer. Recently, users have been reporting intermittent '503 Service Unavailable' errors during peak shopping hours. The administrator checks the load balancer and finds that all servers are marked as healthy with low CPU and memory usage. However, when inspecting a sample server, the administrator notices a large number of TCP connections in the TIME_WAIT state, consuming all available ephemeral ports. The application is ASP.NET based and uses IIS. The server configuration is as follows: Windows Server 2019 Standard, 4 vCPUs, 16 GB RAM, default TCP/IP settings. The administrator needs to resolve the connectivity issues without making changes to the application code or altering the network architecture. Which of the following actions should the administrator take to fix the problem PERMANENTLY?

Accepted Answer

Increase the ephemeral port range using netsh, and consider reducing the TIME_WAIT delay via registry settings.. Option A is correct because ephemeral port exhaustion is the root cause. Increasing the ephemeral port range provides more ports, and reducing TIME_WAIT delay frees them faster. Option B adds servers, which is a temporary workaround and does not prevent port exhaustion on each server. Option C requires nightly restarts, causing brief outages and not solving the underlying issue. Option D limits concurrent connections but may degrade performance and does not address port exhaustion.

Answer

Add two additional web servers to the farm to distribute the load.

Answer

Schedule a nightly restart of the IIS application pools.

Answer

Reduce the maximum number of concurrent connections in the IIS application pool settings.

Question 8

A company performs annual disaster recovery tests. The last test revealed that the recovery time objective (RTO) was not met because the backup tapes were corrupted. The backup administrator proposes changes to the backup verification process. Which practice is MOST effective to ensure recoverability?

Accepted Answer

Implement automated integrity checks and periodic test restores.. Option B is correct because automated integrity checks and periodic test restores directly validate that backups are usable and meet recovery objectives, catching corruption early. Option A is wrong because increasing backup frequency does not verify that backups are error-free. Option C is wrong because verifying tapes before offsite storage reduces risk but does not guarantee ongoing media integrity; tapes can degrade over time. Option D is wrong because switching to disk-based backups avoids some tape-specific issues but still requires verification processes to ensure data is not corrupted.

Answer

Perform a full backup more frequently.

Answer

Switch to disk-based backups exclusively.

Answer

Store backup tapes offsite only after verification.

Question 9

A small law firm relies on a single server that hosts a document management system and email. The server is backed up nightly using differential backups to an external USB hard drive that remains connected to the server. One Monday morning, the office manager finds all files encrypted and a ransom note on the screen. The server’s event logs indicate that the encryption began at 2:00 AM on Saturday. The firm’s offsite backup policy rotates two sets of tapes, and the most recent set was taken offsite on Friday evening and is stored in a bank safe deposit box. The USB backup drive, still attached to the server, shows its files also encrypted. The firm does not have a cloud backup service for the server. The office manager wants to restore operations as quickly as possible with minimal data loss and zero risk of reinfection. What is the BEST course of action?

Accepted Answer

Reimage the server, then restore data from the Friday offsite tape backup.. A is correct. The offsite tape backup from Friday evening is air-gapped and predates the infection (Saturday 2:00 AM), ensuring it is clean. Reimaging the server provides a known-good operating system. Option B is risky because the USB drive’s backup likely contains infected files; even an antivirus scan might not detect all ransomware artifacts. Option C is not possible since there is no server cloud backup. Option D is not recommended and may not result in file recovery. Thus, A is the safest and most reliable method.

Answer

Restore the server from the firm's cloud backup service for email.

Answer

Scan the USB drive with antivirus, then restore the latest differential backup from it.

Answer

Pay the ransom to obtain the decryption key, then perform a full backup.

Question 10

A system administrator needs to apply critical security patches to a production web server that cannot be taken offline. The server runs a Linux operating system and hosts a high-availability website. The administrator wants to ensure that if the patches cause a failure, the server can be quickly rolled back to its previous state. Which of the following actions should the administrator take FIRST?

Accepted Answer

Take a snapshot of the server's virtual machine before applying patches.. Option B is correct because taking a snapshot provides a point-in-time state of the virtual machine, allowing quick rollback if the patches cause issues. Option A backs up user data but does not capture the system state needed for a full rollback. Option C is a procedural step but not the first technical action to enable recovery. Option D is reckless and provides no rollback capability.

Answer

Back up all user data to a network share.

Answer

Schedule a maintenance window and notify users of potential downtime.

Answer

Apply the patches during off-peak hours without any additional steps.

Question 11

A server has two NICs configured in a team using LACP. The server loses network connectivity when one NIC is physically disconnected, even though both links show as active in the teaming software before the failure. What is the most likely cause of the issue?

Accepted Answer

LACP is not correctly configured on the switch. For LACP to work properly, the switch must be explicitly configured to bundle the ports into a port channel. If the switch is not configured for LACP, it may not handle the failover correctly, causing a loss of connectivity when one link drops. NIC driver issues or STP are less likely to cause this specific symptom, and setting the team to Switch Independent would not use LACP.

Answer

The teaming mode is set to 'Switch Independent' instead of LACP

Answer

Spanning Tree Protocol is blocking the failover path

Answer

NIC driver version mismatch between the two adapters

Question 12

Refer to the exhibit. An administrator is reviewing logs after a server experienced performance issues and unexpected shutdowns. Based on the log entries, which component is MOST likely failing?

Accepted Answer

Hard disk drive. The log entries show multiple SCSI medium errors, unrecovered read errors, and auto-reallocation failures on device sda, which are classic signs of a failing hard disk drive (Option B). A RAID controller (A) would typically show different errors, RAM (C) would cause memory-related errors, and a power supply (D) would trigger power event logs.

Answer

RAID controller

Answer

RAM module

Answer

Power supply

Question 13

A server hosts a database that requires nightly backups. The backup strategy uses a full backup every Sunday and differential backups on other days. On Wednesday, the server fails. Which backup sets are required to restore to the most recent state?

Accepted Answer

Last full backup and the latest differential backup. A differential backup contains all changes since the last full backup. Therefore, only the last full backup and the latest differential are needed for a restore. Incremental backups would require all incrementals since the last full, but the scenario uses differential backups.

Answer

Last full backup and all differential backups since Sunday

Answer

Last full backup only

Answer

Last full backup and all incremental backups since Sunday

Question 14

A financial services firm requires a disaster recovery solution that provides a Recovery Point Objective (RPO) of near zero and a Recovery Time Objective (RTO) of less than 2 hours. Which of the following site types is MOST appropriate?

Accepted Answer

Hot site. Option D is correct because a hot site is fully equipped, with near real-time data replication, enabling the fastest recovery and minimal data loss. A cold site (Option A) has the longest recovery time. A warm site (Option B) has some equipment but data must be restored from backup, increasing RTO and RPO. Cloud-based backup with daily replication (Option C) does not meet near-zero RPO.

Answer

Cloud-based backup with daily replication

Answer

Cold site

Answer

Warm site

Question 15

A small business has a limited budget and can tolerate up to 72 hours of downtime in the event of a disaster. Which type of disaster recovery site would be most cost-effective?

Accepted Answer

Cloud-based DR with pay-as-you-go.. Option D is correct because a cloud-based DR site with pay-as-you-go model requires no upfront investment in hardware and can be spun up as needed, making it cost-effective for a business with a high downtime tolerance. Option A is wrong because a hot site is the most expensive, with real-time replication. Option B is wrong because a warm site requires pre-installed hardware that incurs ongoing costs, even if data is not up-to-date. Option C is wrong because a cold site still requires occasional maintenance and may have hidden costs; modern cloud DR can be cheaper and more flexible.

Answer

Cold site with no pre-configured hardware.

Answer

Hot site with real-time replication.

Answer

Warm site with pre-installed hardware but no data.

Question 16

A junior administrator is managing a Linux server used by a development team. The root filesystem (/) has reached 98% capacity, causing the system to slow down and some applications to fail. The server has an LVM volume group with 20 GB of free space, but the root logical volume is 50 GB with an ext4 filesystem. The administrator needs to free space quickly and safely without rebooting or adding new disks. They log in via SSH and want to identify where the large files are and then take action. There are concerns about accidentally deleting critical system files or logs that might be needed for auditing. The server has the following typical directories: /var (with logs), /home (user files), /opt (application files), /tmp. Which of the following sequences of actions is the most appropriate to resolve the issue?

Accepted Answer

Run 'du -sh /*' to locate large directories, then examine and compress or truncate old log files in /var/log. Option A is correct because it uses 'du -sh /*' to safely identify the largest directories, then targets specific log files in /var/log that can be compressed or moved, freeing space without deleting required files. Option B is wrong because blindly removing all files in /tmp may delete needed temporary files for running applications. Option C is wrong because using 'find' with 'exec rm' is very dangerous and could delete critical files if misused. Option D is wrong because resizing the filesystem, while possible with LVM, should be considered after attempting to free space safely; also the free space in VG might be needed elsewhere.

Answer

Execute 'rm -rf /tmp/*' to clear temporary files and regain space

Answer

Use 'find / -type f -size +100M -exec rm {} \;' to delete all files larger than 100MB

Answer

Extend the root logical volume by 10 GB using 'lvextend' and then resize the filesystem with 'resize2fs'

Question 17

A financial services firm requires a disaster recovery site that provides immediate failover with zero data loss. Which type of site should they implement?

Accepted Answer

A hot site with synchronous replication.. Option A is correct because a hot site with synchronous replication ensures that data is written to both primary and secondary sites simultaneously, providing zero RPO and immediate failover. Option B (warm site) requires some time to bring systems online, leading to downtime and potential data loss. Option C (cold site) involves significant setup time and last-known-good backup restoration. Option D (cloud with daily snapshots) introduces an RPO of up to 24 hours, not zero data loss.

Answer

A warm site with asynchronous replication.

Answer

A cloud-based site with daily snapshots.

Answer

A cold site with tape restoration.

Question 18

A network administrator needs to configure centralized authentication for network devices. The solution must provide encryption of the entire authentication process, support for multiple protocols, and accounting of user actions. Which protocol should be used?

Accepted Answer

TACACS+. TACACS+ encrypts the entire authentication process, offers granular control over authorization, and supports accounting. RADIUS (B) only encrypts the password, not the entire session. LDAP (A) is a directory service, not an encryption-focused authentication protocol. Kerberos (C) uses tickets and encryption but is primarily for single sign-on within a domain, not commonly used for network device administration.

Answer

Kerberos

Answer

RADIUS

Answer

LDAP

Question 19

Refer to the exhibit. A Linux server's local firewall is configured as shown. The administrator is unable to perform backups to a network-attached storage (NAS) device using TCP port 10000. Which firewall rule is causing the issue?

Accepted Answer

The DROP all rule at the end blocks all traffic except SSH.. Option D is correct. The INPUT chain contains an explicit DROP all rule at the end, which blocks any traffic not explicitly allowed. The only allowed traffic is SSH on port 22. The backup traffic on port 10000 matches the DROP rule and is therefore dropped. Option A is incorrect because the policy ACCEPT is overridden by the explicit DROP. Option B allows SSH traffic but does not affect port 10000. Option C about subnets is irrelevant to the local firewall shown.

Answer

The INPUT policy is set to ACCEPT.

Answer

The NAS device uses a different subnet.

Answer

The SSH ACCEPT rule is allowing traffic.

Question 20

A small business needs a disaster recovery site that can be brought online within 2 hours of a primary site failure. The business can tolerate minimal data loss. Which type of recovery site should they implement?

Accepted Answer

Hot site. Option C is correct because a hot site maintains near-real-time data replication and preconfigured hardware, enabling failover within 2 hours and minimal data loss. A cold site (Option A) requires hardware setup and data restoration, taking days. A warm site (Option B) has pre-installed hardware but lacks current data, typically taking hours to a day to activate. A mobile site (Option D) is a portable solution with variable provisioning time and may not meet the 2-hour requirement consistently.

Answer

Cold site

Answer

Warm site

Answer

Mobile site