SK0-005 Practice Test 5 — 25 Questions

Question 1

Refer to the exhibit. A web server is running on port 80, but users are unable to connect. The administrator has confirmed the web server service is running. The output of iptables -L is shown. What is the most likely reason for the connectivity issue?

Accepted Answer

The firewall is blocking incoming traffic on port 80. The iptables rules accept only related/established traffic and drop SSH. The catch-all REJECT rule blocks all other incoming connections, including HTTP on port 80, because no explicit ACCEPT rule exists for it.

Answer

The server's default gateway is incorrect

Answer

SELinux is enforcing and blocking port 80

Answer

The web server is not bound to the correct IP address

Question 2

You are the lead server administrator for a mid-sized e-commerce company. The web application is hosted on a farm of four Linux servers running Apache, fronted by a hardware load balancer. The load balancer currently uses a round-robin algorithm. Recently, the customer support team has received numerous complaints about slow page load times and occasional timeouts during checkout. You log into the server monitoring console and observe that one of the web servers, web03, has a CPU utilization consistently above 95%, while the other three servers are at around 30-40%. You connect via SSH to web03 and run the 'top' command, identifying a process named 'imagick' consuming 99% CPU. Further investigation reveals that this process is related to image resizing for product thumbnails, and it appears to have entered an infinite loop due to a malformed image file. Meanwhile, the load balancer continues to send requests to all servers equally, including the overloaded web03, causing some requests to time out. You need to restore performance immediately and prevent recurrence. Which of the following actions should you take?

Accepted Answer

Kill the 'imagick' process on web03, change the load balancer algorithm to least connections, and clear the malformed image.. Option B is correct because it directly addresses both issues: the runaway process (killing it stops the CPU drain) and the load balancer algorithm (switching to least connections prevents sending traffic to an already overloaded server). Additionally, clearing the malformed image addresses the root cause of the loop. Option A (adding servers) may temporarily hide the problem but does not fix the load distribution or the looping process; the overloaded server would still exist. Option C (rebooting all servers) is unnecessarily disruptive and does not address the root cause; the malformed image could trigger the loop again after reboot. Option D (increasing RAM) misidentifies the issue as memory-related when it is clearly CPU-bound; more RAM would not stop the infinite loop.

Answer

Reboot all four web servers to clear any stuck processes.

Answer

Increase RAM on web03 to handle the high CPU process better.

Answer

Add two more servers to the farm and keep the round-robin algorithm.

Question 3

A MySQL database server on Linux is experiencing high CPU utilization during peak business hours. Upon investigation, the administrator finds that the query cache hit ratio is below 20%, and the query_cache_size is set to 0. The server has 64 GB of RAM and the database workload is primarily read-heavy. Which of the following actions should the administrator take FIRST to improve performance?

Accepted Answer

Set query_cache_size to an appropriate value, such as 256M, and monitor.. Option D is correct because the query cache is disabled (size 0). Enabling it and setting an appropriate size will increase cache hits and reduce CPU load. Option A adds RAM but does not address the misconfigured cache. Option B identifies queries but does not directly fix the cache. Option C rebuilds indexes, which may not impact query caching.

Answer

Add more RAM to the server.

Answer

Rebuild all indexes on the database tables.

Answer

Enable the slow query log to identify inefficient queries.

Question 4

A small law firm has a single Windows Server 2016 Essentials server that functions as a domain controller and file server. After a sudden power outage over the weekend, the server does not boot normally. Instead, it displays a black screen with the message: 'BOOTMGR is missing. Press Ctrl+Alt+Del to restart.' The IT support specialist arrives on Monday morning to find the server in this state. The firm's operations are at a standstill because all case files and email archives are inaccessible. The specialist has access to the Windows Server 2016 installation media and a recent system state backup stored on an external drive. The server hardware passed POST, and all disks are detected in the BIOS. The specialist needs to restore the server's ability to boot into Windows as quickly as possible, with minimal risk to existing data. Which of the following procedures should the specialist perform FIRST?

Accepted Answer

Boot from the installation media, select 'Repair your computer', and from the Command Prompt run 'bootrec /fixmbr' and 'bootrec /fixboot'.. Option C is correct because the 'BOOTMGR is missing' error typically indicates a corrupt master boot record or boot sector. Using bootrec /fixmbr and /fixboot from the installation media repairs the boot files without affecting data. Option A is a full system restore, which risks data loss and is overkill. Option B is hardware reseating, unnecessary since POST passed. Option D, Last Known Good Configuration, does not fix missing boot manager files.

Answer

Connect the external backup drive, boot from the installation media, and perform a full system restore from the backup.

Answer

Open the server case, reseat the RAM modules and SATA cables, and then attempt to boot again.

Answer

Press F8 during startup to access Advanced Boot Options and select 'Last Known Good Configuration'.

Question 5

A system administrator manages a collection of Linux web servers that store custom application configurations in /etc/app/config. The configuration changes frequently, and the admin needs to implement an automated daily backup solution that captures the directory at 1 AM, compresses it with gzip, and retains the last 5 days of backups on a central NFS-mounted backup volume /mnt/backups. The solution should be simple and use standard tools. Which approach best meets these requirements?

Accepted Answer

Create a cron job that runs `tar -czf /mnt/backups/config-$(date +%Y%m%d).tar.gz /etc/app/config` at 1 AM, and another cron job at 2 AM that runs `find /mnt/backups -name "config-*.tar.gz" -mtime +5 -delete`.. Option B is correct because it uses tar with gzip compression and a dated filename to create daily compressed archives, and a separate cron job using find to delete files older than 5 days, fulfilling all requirements simply. Option A uses rsync which does not create a single compressed archive file and the retention method using find on directories is less suitable for daily snapshot rotation. Option C uses zip which does not easily support date-stamped filenames and relies on external NFS snapshots, which is not a self-contained solution. Option D uses Windows Server Backup on Linux, which is unsupported and inappropriate.

Answer

Use Windows Server Backup scheduled to back up the Linux server's directory via SMB share.

Answer

Create a cron job that runs `rsync -avz /etc/app/config /mnt/backups/` at 1 AM, with a separate cron job to delete old rsync snapshots using `find /mnt/backups -type d -mtime +5 -exec rm -rf {} \;`.

Answer

Write a shell script that uses `zip -r /mnt/backups/config.zip /etc/app/config`, schedule it via cron at 1 AM, and rely on the NFS server's built-in snapshot feature for retention.

Question 6

A Windows Server 2019 file server hosts a shared folder named \FS01\SalesDocs. The share permissions are configured to grant the 'Everyone' group Full Control. The NTFS permissions on the D:\Shares\SalesDocs folder are set as follows: The 'Sales' security group has Allow Read & Execute, List Folder Contents, and Read. The 'Managers' group has Allow Modify. A user, Alice, is a member of the 'Sales' group and also a member of the 'Temporary_Contractors' group. She recently had her account moved from the 'Contractors' OU to the 'Sales' OU. When Alice attempts to access \FS01\SalesDocs from her Windows 10 workstation, she receives an 'Access Denied' error. Other members of the 'Sales' group can access the folder without issues. The administrator verifies that Alice's group membership includes both 'Sales' and 'Temporary_Contractors'. The effective permissions tool on the folder shows that Alice should have Read access. However, she still cannot access the share. Which of the following is the most likely cause of Alice's access denial and the appropriate next step to resolve it?

Accepted Answer

The 'Temporary_Contractors' group has an explicit Deny permission on the NTFS security for D:\Shares\SalesDocs, which overrides her Allow permissions. The administrator should remove Alice from that group or modify the Deny entry.. Option A is correct because an explicit Deny permission for Temporary_Contractors would override all Allow permissions, resulting in access denied despite the effective permissions tool showing allowed access (which may not account for Deny in all views). Option B is incorrect because 'Everyone' includes authenticated users, and the share permissions are permissive. Option C suggests a token issue, but effective permissions already reflect her group membership; a token issue would typically result in no access to Sales group resources, conflicting with others' access. Option D is unlikely without other offline files symptoms.

Answer

Alice's user token was not updated after her OU move; she needs to log off and log back on to obtain the new group membership, but the token hadn't expired. The administrator should wait or force logoff.

Answer

Her workstation's offline files cache is corrupt, causing access denied. The administrator should clear the CSC cache on her machine.

Answer

The share permissions 'Everyone Full Control' are invalid because 'Everyone' does not include authenticated users from other domains. The administrator should add 'Authenticated Users' with Change permission.

Question 7

A server administrator is responsible for protecting sensitive data. The backup process copies files to a network share daily. Which of the following should the administrator do to BEST ensure the confidentiality of the backup data both during transfer and at rest?

Accepted Answer

Encrypt the backup files before transfer using a tool like GPG, and store them encrypted.. Encrypting the backup files before transfer (Option B) ensures data confidentiality during transit and while stored on the backup server. Option A provides network segmentation but no encryption. Option C encrypts only the transfer, not the data at rest. Option D is a physical security measure and does not encrypt the data.

Answer

Configure the network share with SMB encryption only.

Answer

Use a dedicated NIC for backup traffic on an isolated VLAN.

Answer

Place the backup server in a physically locked cage with restricted access.

Question 8

Refer to the exhibit. An administrator is reviewing logs after a server experienced performance issues and unexpected shutdowns. Based on the log entries, which component is MOST likely failing?

Accepted Answer

Hard disk drive. The log entries show multiple SCSI medium errors, unrecovered read errors, and auto-reallocation failures on device sda, which are classic signs of a failing hard disk drive (Option B). A RAID controller (A) would typically show different errors, RAM (C) would cause memory-related errors, and a power supply (D) would trigger power event logs.

Answer

RAID controller

Answer

RAM module

Answer

Power supply

Question 9

An organization requires a disaster recovery site that can be operational within 24 hours after a disaster declaration, with critical data replicated on a regular basis, but not necessarily real-time. Which type of site should they implement?

Accepted Answer

Warm site. Option A is correct because a warm site provides pre-installed hardware and network infrastructure, along with data backups that can be loaded and activated within a day. Hot sites offer immediate failover but are more expensive and not necessary here. Cold sites are empty space and take weeks. An alternate processing site is a vague term.

Answer

Alternate processing site

Answer

Cold site

Answer

Hot site

Question 10

After an unexpected power outage, a server fails to boot and displays an error indicating a degraded RAID array. The server has a RAID 5 configuration with four disks. One disk has failed, but the hot spare did not automatically rebuild. The administrator needs to restore data availability as quickly as possible. Which action should the technician take FIRST?

Accepted Answer

Replace the failed disk and initiate a manual rebuild.. Option A is correct because replacing the failed disk and initiating a manual rebuild directly restores redundancy and availability using the existing parity data. Option B is wrong because the hot spare is not faulty; the rebuild did not trigger automatically, likely due to a configuration issue, and swapping it does not address the failed disk. Option C is wrong because while a bad battery or cache can cause rebuild failures, checking this is a later step; the immediate need is to replace the failed disk to restore redundancy. Option D is wrong because a backup restore is a last resort and may result in data loss; the array is degraded but still functional, so rebuilding is faster and less disruptive.

Answer

Restore the server from the latest backup.

Answer

Check the RAID controller battery and cache.

Answer

Replace the hot spare with a new disk.

Question 11

A company performs a full backup on Sunday and incremental backups Monday through Saturday. A server fails on Thursday at 10:00 AM. Which sequence correctly restores the data?

Accepted Answer

Restore Sunday full, then Monday, Tuesday, and Wednesday incrementals.. Option C is correct because an incremental backup captures only changes since the last backup, requiring the last full backup and all subsequent incrementals up to the point of failure. Options A and D are wrong because they skip Monday’s incremental (A) or both Monday and Tuesday (D). Option B is wrong because it restores out of order, which would not apply the data correctly.

Answer

Restore Sunday full, then Tuesday and Wednesday incrementals.

Answer

Restore Sunday full and Wednesday incremental only.

Answer

Restore Wednesday's incremental, then Sunday full.

Question 12

A financial services firm requires a disaster recovery site that provides immediate failover with zero data loss. Which type of site should they implement?

Accepted Answer

A hot site with synchronous replication.. Option A is correct because a hot site with synchronous replication ensures that data is written to both primary and secondary sites simultaneously, providing zero RPO and immediate failover. Option B (warm site) requires some time to bring systems online, leading to downtime and potential data loss. Option C (cold site) involves significant setup time and last-known-good backup restoration. Option D (cloud with daily snapshots) introduces an RPO of up to 24 hours, not zero data loss.

Answer

A warm site with asynchronous replication.

Answer

A cloud-based site with daily snapshots.

Answer

A cold site with tape restoration.

Question 13

A company is creating a disaster recovery plan for its on-premises data center. Which THREE elements are essential to include in the DR plan? (Select THREE.)

Accepted Answer

Contact information for key personnel.. Options A, C, and E are correct. Contact information for key personnel (A) ensures that the recovery team can be reached during a crisis. RTO and RPO for each critical system (C) define the recovery goals and guide the technical implementation. The list of failover site addresses and access procedures (E) provides vital instructions for reaching and securing the secondary location. Option B is wrong because cleaning procedures are operational but not a core DR plan element. Option D is wrong because backup procedures are part of the backup policy, not the disaster recovery plan; the DR plan assumes backups exist and focuses on restoring from them.

Answer

Detailed instructions for cleaning server hardware.

Answer

Step-by-step procedures for performing backups.

Question 14

An organization stores backup tapes at an offsite facility. The tapes contain sensitive customer data. A security audit revealed that tapes were stolen from the facility. Which combination of measures would have MOST effectively prevented unauthorized data access?

Accepted Answer

Encrypt all backup data with strong encryption and restrict decryption keys to authorized personnel.. Option D is correct because encrypting the backup data and restricting decryption keys ensures that even if the tapes are physically stolen, the data remains unintelligible without the keys. Option A (password protection) can often be bypassed and does not secure the data itself. Option B only secures transport, not storage. Option C provides physical security but would not deter a determined thief and does not protect the data if the safe is compromised.

Answer

Password-protect the tapes and keep them in a locked safe.

Answer

Store tapes in a fireproof safe and limit access to key personnel.

Answer

Use a bonded courier service for transportation.

Question 15

Refer to the exhibit. A backup job to a network share failed. The administrator reviews the backup log. What is the most likely cause of the failure?

Accepted Answer

The backup user account lacks appropriate permissions.. Option B is correct. The 'Access is denied' error clearly indicates a permissions problem—the backup user account does not have the necessary rights to write to the share. Option A would present a 'network path not found' or 'host unreachable' error. Option C would also indicate network unreachable, not access denied. Option D would typically produce a 'path too long' error, not access denied.

Answer

The backup server is powered off.

Answer

The network link is down.

Answer

The backup file path exceeds the maximum length.

Question 16

An organization's disaster recovery plan specifies an RPO of 4 hours. Their current backup schedule performs a full backup at midnight and incremental backups every 2 hours from 8:00 AM to 8:00 PM. A server failure occurs at 3:00 AM, and data created after 8:00 PM the previous day is permanently lost. Which of the following is the MOST likely reason?

Accepted Answer

There is a gap in the backup schedule overnight that exceeds the RPO.. Option C is correct because the backup schedule has no coverage from 8:00 PM to 8:00 AM the next morning (except full at midnight), creating a 12-hour gap overnight that exceeds the 4-hour RPO. Data created after 8:00 PM and before the failure at 3:00 AM is lost because no backup captured it. Option A is incorrect because RPO is a requirement, not the cause. Option B is speculative. Option D refers to synthetic fulls, which are not relevant to this gap.

Answer

The incremental backups were not synthetically rolled into the full backup.

Answer

The RPO was set too low for the business requirements.

Answer

The backup media became corrupted.

Question 17

Refer to the exhibit. A Linux server's local firewall is configured as shown. The administrator is unable to perform backups to a network-attached storage (NAS) device using TCP port 10000. Which firewall rule is causing the issue?

Accepted Answer

The DROP all rule at the end blocks all traffic except SSH.. Option D is correct. The INPUT chain contains an explicit DROP all rule at the end, which blocks any traffic not explicitly allowed. The only allowed traffic is SSH on port 22. The backup traffic on port 10000 matches the DROP rule and is therefore dropped. Option A is incorrect because the policy ACCEPT is overridden by the explicit DROP. Option B allows SSH traffic but does not affect port 10000. Option C about subnets is irrelevant to the local firewall shown.

Answer

The INPUT policy is set to ACCEPT.

Answer

The NAS device uses a different subnet.

Answer

The SSH ACCEPT rule is allowing traffic.

Question 18

A financial services firm requires a disaster recovery solution that provides a Recovery Point Objective (RPO) of near zero and a Recovery Time Objective (RTO) of less than 2 hours. Which of the following site types is MOST appropriate?

Accepted Answer

Hot site. Option D is correct because a hot site is fully equipped, with near real-time data replication, enabling the fastest recovery and minimal data loss. A cold site (Option A) has the longest recovery time. A warm site (Option B) has some equipment but data must be restored from backup, increasing RTO and RPO. Cloud-based backup with daily replication (Option C) does not meet near-zero RPO.

Answer

Cloud-based backup with daily replication

Answer

Cold site

Answer

Warm site

Question 19

A database server hosts a critical application that requires a recovery point objective (RPO) of 4 hours. The company wants to minimize the impact on production performance during backups. Which backup strategy should be implemented?

Accepted Answer

A weekly full backup with hourly incremental backups.. Option C is correct because hourly incremental backups meet the 4-hour RPO while minimizing resource usage compared to more frequent full backups or continuous replication. Option A is wrong because differential backups grow in size and can still exceed the RPO window. Option B is wrong because nightly full backups would fail to meet the 4-hour RPO if a disaster occurs hours after the last backup. Option D is wrong because CDP with synchronous replication imposes high performance overhead and is unnecessary beyond the 4-hour RPO requirement.

Answer

Continuous data protection (CDP) with synchronous replication.

Answer

A weekly full backup with daily differential backups.

Answer

A nightly full backup.

Question 20

A small business has a limited budget and can tolerate up to 72 hours of downtime in the event of a disaster. Which type of disaster recovery site would be most cost-effective?

Accepted Answer

Cloud-based DR with pay-as-you-go.. Option D is correct because a cloud-based DR site with pay-as-you-go model requires no upfront investment in hardware and can be spun up as needed, making it cost-effective for a business with a high downtime tolerance. Option A is wrong because a hot site is the most expensive, with real-time replication. Option B is wrong because a warm site requires pre-installed hardware that incurs ongoing costs, even if data is not up-to-date. Option C is wrong because a cold site still requires occasional maintenance and may have hidden costs; modern cloud DR can be cheaper and more flexible.

Answer

Cold site with no pre-configured hardware.

Answer

Hot site with real-time replication.

Answer

Warm site with pre-installed hardware but no data.