SK0-005 Practice Test 4 — 25 Questions

Question 1

Refer to the exhibit. A server administrator runs a dmidecode command to check memory configuration and obtains the output shown. The system supports DDR4-2666, but all DIMMs are running at 1866 MT/s. Which action will allow the memory to run at the maximum supported speed?

Accepted Answer

Replace the DIMM in slot A1 with a DDR4-2666 registered module.. Correct: The slower 2133 MT/s DIMM in slot A1 limits all modules to its speed. Replacing it with a 2666 MT/s module allows the system to run at the highest common denominator. Option A is wrong because reordering slots won't change the speed limitation. Option C is wrong because XMP is for overclocking desktop memory, not typical on registered server DIMMs. Option D is wrong because clearing CMOS only resets BIOS settings, not memory speed mismatch.

Answer

Enable XMP profile in the BIOS to force all DIMMs to 2666 MT/s.

Answer

Clear the CMOS to reset the memory training data.

Answer

Move the DIMM from A1 to A2 and the DIMM from A2 to A1.

Question 2

To comply with company security policies, a server administrator must disable all unnecessary services on a newly deployed Windows Server 2019. The server will only act as a file server with no web hosting role. Which service should be disabled?

Accepted Answer

World Wide Web Publishing Service. The World Wide Web Publishing Service (W3SVC) is part of IIS and is not required for a file server role. Leaving it running increases the attack surface. Option A (DNS Server) might be used if the server provides name resolution, but it is not mentioned. Option B (DHCP Server) is also not specified as needed. Option D (Server service) is essential for file sharing and should not be disabled.

Answer

DHCP Server service

Answer

Server service

Answer

DNS Server service

Question 3

An organization uses a cloud-based backup solution with immutable storage to protect against ransomware. However, after a recent attack, an attacker with stolen administrator credentials was able to delete the backup data. Which of the following BEST explains why the backups were deleted?

Accepted Answer

The immutable storage policy was not configured correctly or had a retention lock that was not enabled.. True immutable storage prevents any deletion or modification, even by administrators, for a specified retention period. The fact that an admin could delete it indicates the immutability feature was misconfigured or not properly locked. Option B describes encryption at the source, but that would not allow deletion of existing backups. Option C is irrelevant to deletion. Option D: versioning helps but does not prevent deletion if immutability is not configured.

Answer

The backup solution did not support versioning.

Answer

The attacker used ransomware to encrypt the backup data at the source before it was sent.

Answer

The backup data was stored in a different geographic region than production.

Question 4

A system administrator manages a collection of Linux web servers that store custom application configurations in /etc/app/config. The configuration changes frequently, and the admin needs to implement an automated daily backup solution that captures the directory at 1 AM, compresses it with gzip, and retains the last 5 days of backups on a central NFS-mounted backup volume /mnt/backups. The solution should be simple and use standard tools. Which approach best meets these requirements?

Accepted Answer

Create a cron job that runs `tar -czf /mnt/backups/config-$(date +%Y%m%d).tar.gz /etc/app/config` at 1 AM, and another cron job at 2 AM that runs `find /mnt/backups -name "config-*.tar.gz" -mtime +5 -delete`.. It uses tar with gzip compression and a dated filename to create daily compressed archives, and a separate cron job using find to delete files older than 5 days, fulfilling all requirements simply. Option A uses rsync which does not create a single compressed archive file and the retention method using find on directories is less suitable for daily snapshot rotation. Option C uses zip which does not easily support date-stamped filenames and relies on external NFS snapshots, which is not a self-contained solution. Option D uses Windows Server Backup on Linux, which is unsupported and inappropriate.

Answer

Use Windows Server Backup scheduled to back up the Linux server's directory via SMB share.

Answer

Create a cron job that runs `rsync -avz /etc/app/config /mnt/backups/` at 1 AM, with a separate cron job to delete old rsync snapshots using `find /mnt/backups -type d -mtime +5 -exec rm -rf {} \;`.

Answer

Write a shell script that uses `zip -r /mnt/backups/config.zip /etc/app/config`, schedule it via cron at 1 AM, and rely on the NFS server's built-in snapshot feature for retention.

Question 5

A server administrator is responsible for protecting sensitive data. The backup process copies files to a network share daily. Which of the following should the administrator do to BEST ensure the confidentiality of the backup data both during transfer and at rest?

Accepted Answer

Encrypt the backup files before transfer using a tool like GPG, and store them encrypted.. Encrypting the backup files before transfer (Option B) ensures data confidentiality during transit and while stored on the backup server. Option A provides network segmentation but no encryption. Option C encrypts only the transfer, not the data at rest. Option D is a physical security measure and does not encrypt the data.

Answer

Configure the network share with SMB encryption only.

Answer

Use a dedicated NIC for backup traffic on an isolated VLAN.

Answer

Place the backup server in a physically locked cage with restricted access.

Question 6

A company performs annual disaster recovery tests. The last test revealed that the recovery time objective (RTO) was not met because the backup tapes were corrupted. The backup administrator proposes changes to the backup verification process. Which practice is MOST effective to ensure recoverability?

Accepted Answer

Implement automated integrity checks and periodic test restores.. Option B is correct because automated integrity checks and periodic test restores directly validate that backups are usable and meet recovery objectives, catching corruption early. Option A is wrong because increasing backup frequency does not verify that backups are error-free. Option C is wrong because verifying tapes before offsite storage reduces risk but does not guarantee ongoing media integrity; tapes can degrade over time. Option D is wrong because switching to disk-based backups avoids some tape-specific issues but still requires verification processes to ensure data is not corrupted.

Answer

Perform a full backup more frequently.

Answer

Switch to disk-based backups exclusively.

Answer

Store backup tapes offsite only after verification.

Question 7

A virtualized server running multiple VMs experiences a sudden performance degradation during peak hours. Storage latency spikes and CPU ready time increases significantly. The hypervisor shows high memory overcommitment but no swapping. Which action would most likely resolve the issue without adding hardware?

Accepted Answer

Migrate one or more VMs to another host. Migrating VMs reduces resource contention on the host, lowering CPU ready time and potentially alleviating storage I/O pressure. Option A would only address memory pressure, not CPU ready. Option C is already enabled by default and would not resolve high ready time. Option D might help CPU contention but could degrade application performance and does not address storage latency directly.

Answer

Reduce the number of vCPUs assigned to each VM

Answer

Increase memory reservation for all VMs

Answer

Enable transparent page sharing

Question 8

A network administrator needs to configure centralized authentication for network devices. The solution must provide encryption of the entire authentication process, support for multiple protocols, and accounting of user actions. Which protocol should be used?

Accepted Answer

TACACS+. TACACS+ encrypts the entire authentication process, offers granular control over authorization, and supports accounting. RADIUS (B) only encrypts the password, not the entire session. LDAP (A) is a directory service, not an encryption-focused authentication protocol. Kerberos (C) uses tickets and encryption but is primarily for single sign-on within a domain, not commonly used for network device administration.

Answer

Kerberos

Answer

RADIUS

Answer

LDAP

Question 9

A small business needs a disaster recovery site that can be brought online within 2 hours of a primary site failure. The business can tolerate minimal data loss. Which type of recovery site should they implement?

Accepted Answer

Hot site. A hot site maintains near-real-time data replication and preconfigured hardware, enabling failover within 2 hours and minimal data loss. A cold site (Option A) requires hardware setup and data restoration, taking days. A warm site (Option B) has pre-installed hardware but lacks current data, typically taking hours to a day to activate. A mobile site (Option D) is a portable solution with variable provisioning time and may not meet the 2-hour requirement consistently.

Answer

Cold site

Answer

Warm site

Answer

Mobile site

Question 10

A mid-sized e-commerce company experienced a ransomware attack that encrypted all on-premises servers and their locally attached backup storage. The attack occurred on a Friday evening; the company was closed over the weekend. By Monday morning, the IT team discovered the encryption and found a ransom note demanding $500,000 in Bitcoin. The company has a disaster recovery plan that calls for restoring from daily tape backups stored offsite. However, the most recent offsite tape was taken home by a backup operator for the weekend and has not been returned. The tape contains full backups from Wednesday. The IT team has clean installation media and application software available. The company's RPO is 24 hours, and RTO is 48 hours. Management wants to minimize data loss and avoid paying the ransom. Based on this scenario, which of the following should the IT team do to recover the business operations?

Accepted Answer

Rebuild the servers from scratch using clean media, restore the latest offsite tape if available, and apply available transaction logs from the on-premises backup server that was encrypted (attempting to recover unencrypted logs).. It follows the existing DR plan by restoring from the available offsite tape (even though a few days old) and builds clean servers to avoid reinfection. It also attempts to salvage any unencrypted transaction logs from the compromised environment to minimize data loss beyond Wednesday. Paying the ransom (Option B) is against best practices and may not guarantee full recovery. Waiting for the operator to return the tape (Option C) delays action and may still result in significant data loss; the operator's return is uncertain. Manually re-entering transactions (Option D) is highly labor-intensive, error-prone, and could exceed the 48-hour RTO.

Answer

Pay the ransom to obtain the decryption key, then restore the environment, and implement better security controls.

Answer

Rebuild the servers from scratch using clean media, and manually re-enter transactions since the last good backup based on paper records and customer emails.

Answer

Wait for the backup operator to return the tape, then restore from that tape, accepting data loss since Wednesday.

Question 11

Refer to the exhibit. A server administrator is reviewing security logs after a suspected brute-force attack on the SSH service. The following excerpt from /var/log/secure is displayed. Which security control would have been MOST effective in preventing the successful login?

Accepted Answer

Implementing fail2ban or similar intrusion prevention.. Option B is correct because fail2ban or a similar intrusion prevention system monitors logs for repeated failures and blocks the attacker's IP address after a configurable number of attempts, stopping the attack before the correct password is guessed. Option A is wrong because a strong password policy might resist guessing for a long time, but the admin password was eventually guessed; it does not actively prevent repeated attempts. Option C is wrong because disabling root login would not have prevented the attack on the admin account, which was the one compromised. Option D is wrong because changing the SSH port is security through obscurity and does not prevent brute-force attempts once the port is discovered.

Answer

Disabling root login via SSH.

Answer

Enforcing a strong password policy.

Answer

Using a different SSH port.

Question 12

After an unexpected power outage, a server fails to boot and displays an error indicating a degraded RAID array. The server has a RAID 5 configuration with four disks. One disk has failed, but the hot spare did not automatically rebuild. The administrator needs to restore data availability as quickly as possible. Which action should the technician take FIRST?

Accepted Answer

Replace the failed disk and initiate a manual rebuild.. Option A is correct because replacing the failed disk and initiating a manual rebuild directly restores redundancy and availability using the existing parity data. Option B is wrong because the hot spare is not faulty; the rebuild did not trigger automatically, likely due to a configuration issue, and swapping it does not address the failed disk. Option C is wrong because while a bad battery or cache can cause rebuild failures, checking this is a later step; the immediate need is to replace the failed disk to restore redundancy. Option D is wrong because a backup restore is a last resort and may result in data loss; the array is degraded but still functional, so rebuilding is faster and less disruptive.

Answer

Restore the server from the latest backup.

Answer

Check the RAID controller battery and cache.

Answer

Replace the hot spare with a new disk.

Question 13

A server administrator is restoring a file server from a full backup taken 7 days ago and incremental backups taken daily. The restoration fails with an error about missing catalog files. What is the most likely cause?

Accepted Answer

The incremental backup chain is broken. Incremental backups depend on a chain that starts with a full backup and then each subsequent incremental backup references the previous one. If any link in the chain is missing, corrupted, or the catalog that tracks the chain is damaged, the restore fails with an error about missing catalog files. The most likely cause is that the incremental backup chain is broken, meaning the backup software cannot locate the required incremental sets to reconstruct the file server state.

Answer

The hard drive on the file server has failed

Answer

The backup software is not compatible with the current OS version

Answer

The full backup media is corrupted

Question 14

You are the lead server administrator for a mid-sized e-commerce company. The web application is hosted on a farm of four Linux servers running Apache, fronted by a hardware load balancer. The load balancer currently uses a round-robin algorithm. Recently, the customer support team has received numerous complaints about slow page load times and occasional timeouts during checkout. You log into the server monitoring console and observe that one of the web servers, web03, has a CPU utilization consistently above 95%, while the other three servers are at around 30-40%. You connect via SSH to web03 and run the 'top' command, identifying a process named 'imagick' consuming 99% CPU. Further investigation reveals that this process is related to image resizing for product thumbnails, and it appears to have entered an infinite loop due to a malformed image file. Meanwhile, the load balancer continues to send requests to all servers equally, including the overloaded web03, causing some requests to time out. You need to restore performance immediately and prevent recurrence. Which of the following actions should you take?

Accepted Answer

Kill the 'imagick' process on web03, change the load balancer algorithm to least connections, and clear the malformed image.. It directly addresses both issues: the runaway process (killing it stops the CPU drain) and the load balancer algorithm (switching to least connections prevents sending traffic to an already overloaded server). Additionally, clearing the malformed image addresses the root cause of the loop. Option A (adding servers) may temporarily hide the problem but does not fix the load distribution or the looping process; the overloaded server would still exist. Option C (rebooting all servers) is unnecessarily disruptive and does not address the root cause; the malformed image could trigger the loop again after reboot. Option D (increasing RAM) misidentifies the issue as memory-related when it is clearly CPU-bound; more RAM would not stop the infinite loop.

Answer

Reboot all four web servers to clear any stuck processes.

Answer

Increase RAM on web03 to handle the high CPU process better.

Answer

Add two more servers to the farm and keep the round-robin algorithm.

Question 15

A company performs full backups every Sunday and differential backups daily. After a ransomware attack, they discover that both the production data and all attached backup media were encrypted. They need to ensure data can be recovered in the future. Which of the following is the BEST change to their backup strategy?

Accepted Answer

Store backups on an air-gapped or offline system.. Air-gapped backups are physically isolated and cannot be reached by ransomware, ensuring recoverability. Option A increases backup frequency but doesn't protect against ransomware that encrypts attached media. Option B changes backup type but still leaves backups online and vulnerable. Option C protects data at rest but if the encryption keys are on the same system, they can be compromised, and encryption itself doesn't prevent deletion/encryption by ransomware.

Answer

Encrypt the backup data using AES-256.

Answer

Perform full backups daily instead of weekly.

Answer

Switch from differential to incremental daily backups.

Question 16

A medium-size enterprise runs a vSphere 7.0 cluster with two hosts (HostA and HostB) for production VMs. Each host has two 10GbE uplinks (vmnic0 and vmnic1) connected to separate physical switches (SW1 and SW2) for redundancy. A single vSphere standard switch (vSwitch0) uses both uplinks with teaming policy set to 'Route based on originating virtual port ID,' 'Network failure detection: Link status only,' and 'Notify switches: Yes.' Lately, several VMs running on HostA experience intermittent network disconnections lasting 20–30 seconds, while VMs on HostB are unaffected. The administrator checks vCenter events and sees repeated messages: 'Lost uplink redundancy on vSwitch0. vmnic0 is down.' followed seconds later by 'Uplink redundancy restored. vmnic0 is up.' The physical switch SW1's log shows the port for vmnic0 transitions through spanning-tree listening and learning states each time this occurs, taking about 15 seconds. The link is a trunk allowing all necessary VLANs, with no errors or security violations. The network team has already swapped the fiber cable and SFP+ transceiver for vmnic0 without improvement. The VMs affected are those whose virtual ports are pinned to vmnic0 by the load-balancing policy; VMs pinned to vmnic1 never experience disconnections. The administrator has also rebooted HostA and updated the NIC firmware, but the flapping continues. What should the administrator do to permanently resolve the intermittent connectivity?

Accepted Answer

Enable spanning-tree PortFast on the SW1 and SW2 ports connected to the hosts so the ports bypass the listening/learning states.. Option C is correct because the symptoms as confirmed by the switch log show that each link flap triggers spanning-tree recalculation, causing the port to cycle through listening and learning states before forwarding resumes. Enabling PortFast on switch ports that are connected to end devices (like ESXi hosts) allows immediate forwarding. Option A is wrong because changing to access mode would break multiple VLANs and still face STP delays. Option B is wrong because disabling notify switches might worsen MAC table inconsistencies. Option D is wrong because changing load balancing does not stop the flapping or STP convergence; the issue is at layer 2.

Answer

Disable the 'Notify switches' option on the vSwitch teaming configuration to avoid unnecessary RARP broadcasts.

Answer

Reconfigure the physical switch port for vmnic0 to an access port instead of a trunk to simplify spanning-tree operations.

Answer

Change the NIC teaming load balancing policy to 'Route based on IP hash' to distribute traffic across both uplinks more evenly.

Question 17

Refer to the exhibit. A technician receives an alert from the monitoring system showing the error in the exhibit. The server is still online, but performance has degraded. Which of the following is the MOST likely cause and appropriate action?

Accepted Answer

The hard disk drive is failing; back up data and replace the drive. Event ID 11 from Disk source indicates a controller error, often due to a failing disk or cable. The most likely cause is a failing hard drive. Backing up and replacing the drive is the appropriate action. Bad sectors might be the symptom but replacing is safer. Driver corruption is less likely; high I/O wouldn't cause a controller error.

Answer

The SATA controller driver is corrupted; reinstall the driver

Answer

The disk has a bad sector; run CHKDSK and monitor

Answer

The disk is experiencing high I/O; upgrade to SSD

Question 18

A server administrator needs to deploy a new server that will host a database requiring high random read/write performance and maximum fault tolerance. The server has eight drive bays. Which RAID level should the administrator choose?

Accepted Answer

RAID 10. RAID 10 is the best choice for database servers needing high random I/O performance and fault tolerance. It stripes data across mirrored pairs, delivering fast reads and writes while allowing for drive failures. RAID 0 lacks redundancy, RAID 5 has write penalties and only single-drive fault tolerance, and RAID 6 has even greater write overhead. RAID 10 balances performance and redundancy effectively.

Answer

RAID 6

Answer

RAID 0

Answer

RAID 5

Question 19

An organization requires a disaster recovery site that can be operational within 24 hours after a disaster declaration, with critical data replicated on a regular basis, but not necessarily real-time. Which type of site should they implement?

Accepted Answer

Warm site. A warm site provides pre-installed hardware and network infrastructure, along with data backups that can be loaded and activated within a day. Hot sites offer immediate failover but are more expensive and not necessary here. Cold sites are empty space and take weeks. An alternate processing site is a vague term.

Answer

Alternate processing site

Answer

Cold site

Answer

Hot site

Question 20

An organization stores backup tapes at an offsite facility. The tapes contain sensitive customer data. A security audit revealed that tapes were stolen from the facility. Which combination of measures would have MOST effectively prevented unauthorized data access?

Accepted Answer

Encrypt all backup data with strong encryption and restrict decryption keys to authorized personnel.. Encrypting backup data with strong encryption and restricting decryption keys to authorized personnel (A) is the most effective control because it renders stolen tapes unreadable. Even if physical controls fail — as they did here — the data remains confidential without the keys. This is the principle of cryptographic protection as a last line of defense for data at rest.

Answer

Password-protect the tapes and keep them in a locked safe.

Answer

Store tapes in a fireproof safe and limit access to key personnel.

Answer

Use a bonded courier service for transportation.

SK0-005 Practice Test 4 — 25 Questions

Exhibit

SK0-005 Practice Test 4 — 25 Questions

Exhibit