SK0-005 Practice Test 2 — 30 Questions

Question 1

A Linux server is experiencing random reboots. The administrator checks the system logs and finds multiple entries indicating a machine check exception (MCE). The server is running the latest kernel and all firmware is up to date. Which of the following is the MOST likely cause of the reboots?

Accepted Answer

Failing CPU or memory hardware.. Machine check exceptions are hardware-level errors reported by the CPU, most commonly due to failing RAM or CPU. Random reboots with MCE logs indicate a hardware fault that firmware updates cannot resolve. The correct course is to run hardware diagnostics and replace the faulty component.

Answer

Overheating due to failed cooling fans.

Answer

A faulty power supply unit.

Answer

Incorrect kernel parameters for memory management.

Question 2

An administrator must choose a physical security control for a new server room door that will allow staff to enter quickly during an emergency while still recording who entered and when. Which solution BEST fits?

Accepted Answer

Install a badge reader with an electronic audit log and a fail-safe release that unlocks on power loss.. The door needs both accountability and safe, fast passage during emergencies. An electronic badge reader with an audit log records entries, while a fail-safe release ensures the lock disengages when power is lost so people are not trapped. Together they meet the physical security and life-safety requirements stated.

Answer

Install a biometric reader that grants access based on fingerprint recognition only.

Answer

Install a badge reader configured as fail-secure so the door remains locked when power is lost.

Answer

Install a mechanical keyed lock with keys issued to each staff member.

Question 3

A server administrator is troubleshooting a server that unexpectedly rebooted overnight. The administrator reviews the system logs and finds Event ID 6008 in the Windows System log, indicating an unexpected shutdown. There are no corresponding events for a thermal trip or power failure. Which of the following should the administrator check FIRST to determine the cause?

Accepted Answer

Check the server's out-of-band management controller logs for power or hardware events.. Event ID 6008 indicates an unexpected shutdown, which often stems from hardware or power issues. The out-of-band management controller logs are the best source for hardware-level events like power supply failures or thermal trips that are not visible to the OS. Reviewing these logs first can quickly identify or rule out hardware causes before moving to OS-level diagnostics.

Answer

Review the Windows Update history to see if a patch was installed that required a reboot.

Answer

Run a memory diagnostic to check for faulty RAM.

Answer

Verify that the UPS is functioning correctly and has enough battery capacity.

Question 4

A rack-mount server must be installed in a cabinet that is only 30 inches deep, while the server's rails are designed for a 36-inch cabinet and allow the chassis to extend beyond the front and rear posts. The server must remain serviceable and the cabinet doors must close. Which of the following should the technician do FIRST?

Accepted Answer

Verify the rail kit's minimum cabinet depth and obtain a shorter rail kit or a deeper cabinet if the specified depth is not met.. Rack rails are rated for a specific range of cabinet depths, and installing them in a shallower cabinet leaves the chassis unsupported at the rear and protruding past the posts. Checking the rail kit's published depth range and procuring compatible hardware or a deeper cabinet resolves the incompatibility before any damage or unsafe mounting occurs.

Answer

Install the server with the front posts only and let the rear of the chassis rest on the cabinet base.

Answer

Mount the server vertically using a wall-mount bracket instead of the rails.

Answer

Remove the cabinet's rear door to provide the extra clearance the server needs.

Question 5

A company is hardening a publicly reachable Linux web server that runs an SSH service for administration. The security team wants to reduce the attack surface and enforce stronger authentication. Which two actions BEST accomplish this? (Choose two.)

Accepted Answer

Require public key authentication and disable password-based SSH logins.. The strongest reductions in SSH attack surface come from removing weak authentication paths and eliminating shared, highly privileged logins. Requiring public keys with password authentication disabled blocks brute-force approaches, while forbidding direct root login enforces named accounts and per-user accountability. Together they harden authentication and limit the impact of a single compromised credential.

Answer

Install a host-based intrusion detection system that alerts on suspicious SSH login patterns.

Answer

Enable verbose logging of all SSH connection attempts to a remote syslog server.

Answer

Change the SSH service to listen on a non-standard port to hide it from scanners.

Question 6

A small office has a single physical server running Windows Server 2022 that hosts a file share and a print server. The administrator wants to ensure that if the server's operating system becomes corrupted, the server can be restored quickly to a working state. Which backup type should the administrator use?

Accepted Answer

Bare metal recovery backup. A bare metal recovery backup includes the operating system, applications, and data, enabling a complete restore even if the OS is corrupted. This meets the need to quickly return the server to a working state without a lengthy manual rebuild.

Answer

Volume shadow copy

Answer

System state backup

Answer

File-level backup of the file share only

Question 7

A technician is adding a second CPU to a dual-socket 2U server that previously ran with a single processor. After installing the matching CPU and heatsink, the server POSTs but the operating system only reports half of the newly installed memory, and the BIOS memory map shows several DIMM slots as unpopulated. Which of the following is the MOST likely cause?

Accepted Answer

The DIMMs installed on the second CPU's memory channels are not seated or are in the wrong slots.. Adding a processor activates a second set of memory channels, each with its own required slot population order. If the DIMMs are not moved into the slots owned by the new socket, those channels train as unpopulated and the OS sees only the memory attached to the original CPU. Verifying the server's population table and reseating DIMMs in the correct slots resolves the missing capacity.

Answer

The second CPU requires a BIOS firmware update before memory can be enabled.

Answer

The new CPU is not on the server's hardware compatibility list.

Answer

The memory controller interleave setting was disabled in the BIOS.

Question 8

A security administrator is hardening a Linux server that hosts a public web application. The server currently allows root login via SSH and uses default SSH port 22. The administrator wants to reduce the attack surface by implementing SSH best practices. Which two actions should the administrator take? (Choose two.)

Accepted Answer

Disable password authentication by setting PasswordAuthentication no and use SSH keys.. Disabling root login and disabling password authentication in favor of SSH keys are two fundamental SSH hardening practices. They reduce the attack surface by eliminating direct root access and removing the risk of password brute-force attacks. Changing the port is security through obscurity, enabling password authentication weakens security, and allowing SSH from any IP increases exposure. These two actions directly address the scenario's requirements.

Answer

Change the SSH port from 22 to a non-standard port, such as 2222.

Answer

Enable password authentication to ensure only authorized users can log in.

Answer

Allow SSH access from any IP address to ensure administrators can connect from anywhere.

Question 9

A technician is disposing of several decommissioned servers that previously stored customer financial records. The drives will leave the building. Which action BEST ensures the data cannot be recovered by anyone who obtains the drives?

Accepted Answer

Physically destroy the drives by shredding or degaussing them before disposal.. Because the drives contain regulated financial data and are leaving the facility, the disposal method must make recovery infeasible. Physical destruction through shredding or degaussing removes any possibility of reading the media, which is stronger than any software-based erasure and aligns with the requirement that the data cannot be recovered by a later holder.

Answer

Format each drive with the operating system's quick format option.

Answer

Move the drives to a locked storage room until a future disposal decision is made.

Answer

Delete all files and empty the recycle bin on each drive.

Question 10

A small office has a single physical server running Windows Server 2022 that hosts a file share and a print server. The administrator wants to protect against a hard drive failure that would cause downtime. The server has four drive bays, all currently empty. The administrator needs a solution that provides redundancy and maximizes usable capacity while tolerating one drive failure. Which of the following should the administrator implement?

Accepted Answer

RAID 5 with four drives. RAID 5 with four drives provides single-drive fault tolerance and uses all four bays, yielding usable capacity equal to three drives. RAID 0 offers no redundancy, RAID 1 with two drives wastes two bays, and RAID 5 with three drives leaves a bay unused. Therefore, four-drive RAID 5 best satisfies both redundancy and capacity maximization.

Answer

RAID 1 with two drives

Answer

RAID 5 with three drives

Answer

RAID 0 with four drives

Question 11

A company is implementing a disaster recovery strategy for its on-premises VMware vSphere environment. The IT manager wants to ensure that virtual machines can be recovered at a secondary site within 4 hours of a primary site failure. The secondary site has identical hardware but no active VMs. The company has a limited budget and wants to minimize ongoing costs. Which of the following solutions BEST meets these requirements?

Accepted Answer

Use VMware vSphere Replication to replicate VMs to the secondary site and perform manual recovery when needed.. VMware vSphere Replication offers a cost-effective way to replicate VMs to a secondary site without requiring expensive storage arrays or SRM licensing. It supports manual recovery, which can meet a 4-hour RTO. Other options either incur high costs, rely on slow tape restoration, or require expensive network infrastructure. Therefore, vSphere Replication is the best fit.

Answer

Implement VMware Site Recovery Manager (SRM) with array-based replication and automated failover.

Answer

Set up a stretched vSphere cluster across both sites with synchronous replication.

Answer

Configure nightly backups to tape and transport them to the secondary site for restoration.

Question 12

A data center technician must install a new 1U server into a rack that already contains several servers drawing significant power. The rack's power distribution unit reports that the current load is near its rated capacity. Which of the following should the technician do first to avoid overloading the circuit?

Accepted Answer

Calculate the new server's power draw and verify the PDU has sufficient headroom before connecting. Before adding any load, the technician must quantify the new server's power requirement and confirm the PDU and its upstream circuit have enough spare capacity. Only after that calculation can the connection be made safely, possibly requiring a second circuit or PDU if headroom is insufficient.

Answer

Move one existing server's power supply to a different PDU without checking its load

Answer

Connect the new server's power supplies to the nearest available outlets on the existing PDU

Answer

Install the server and immediately enable power capping to reduce its draw

Question 13

A company is implementing a disaster recovery plan for its on-premises data center. The plan must include measures to ensure data integrity and availability during a site-wide power failure. Which two actions should be included in the plan? (Choose two.)

Accepted Answer

Deploy an uninterruptible power supply (UPS) for all critical servers and storage.. To ensure data integrity and availability during a site-wide power failure, a UPS provides immediate battery power for graceful shutdown or ride-through, while a generator with ATS supplies long-term power to keep systems operational. Together, they form a layered power protection strategy. Other options compromise data integrity or do not address power failure directly.

Answer

Schedule full backups to run only during business hours.

Answer

Enable write caching on all storage controllers without battery backup.

Answer

Configure RAID 0 on all database servers to improve performance.

Question 14

A security team is hardening a fleet of Linux web servers that will be exposed to the internet. They want to reduce the attack surface and limit the impact of a compromised service account. Which two actions BEST support these goals? (Choose two.)

Accepted Answer

Configure the firewall to allow only ports 80 and 443 from any source and deny all other inbound traffic by default.. Reducing attack surface means exposing only necessary ports and removing unnecessary services, while limiting impact means confining what a compromised process can do. A default-deny firewall with only web ports open and running the service as a restricted non-privileged account with minimal file access both serve those goals. Disabling mandatory access control, granting passwordless sudo, and exposing credentials all increase risk.

Answer

Store database credentials in a world-readable configuration file so all administrators can access them during outages.

Answer

Grant the web service account sudo rights with no password so administrators can troubleshoot quickly during incidents.

Answer

Disable SELinux or AppArmor on the servers so that application updates do not fail during deployment.

Question 15

A company has a Windows Server 2022 server that runs a custom application which writes heavily to a local SSD. The administrator notices that the SSD's wear-leveling indicator shows significant wear after only six months. The server logs show frequent small write operations. Which action should the administrator take to reduce SSD wear while maintaining performance?

Accepted Answer

Configure the application to batch small writes into larger sequential writes.. The most effective way to reduce SSD wear from frequent small writes is to batch them into larger sequential writes, which lowers write amplification. This maintains performance while extending the drive's lifespan. Moving logs within the same SSD or enabling write caching does not reduce the total bytes written, and disabling the page file introduces instability without addressing the application's write pattern.

Answer

Move the application's log files to a different volume on the same SSD.

Answer

Enable write caching on the SSD controller.

Answer

Disable the page file on the SSD.

Question 16

A server administrator notices that a production file server intermittently loses network connectivity for a few seconds, and users report dropped SMB sessions. The switch port shows no errors, and the server's NIC link LED stays solid. The administrator suspects a duplex mismatch. Which tool should the administrator use to verify the NIC's current speed and duplex settings on a Linux server?

Accepted Answer

ethtool. A duplex mismatch occurs when one side of a link is set to full-duplex and the other to half-duplex, leading to collisions, dropped packets, and intermittent connectivity without a complete link loss. The NIC's link LED remains solid because the physical link is up. The ethtool utility directly reports the negotiated duplex and speed, allowing the administrator to confirm whether the server NIC is operating at half-duplex while the switch port is full-duplex. Other tools show symptoms or unrelated configuration but not the duplex setting itself.

Answer

netstat -i

Answer

ip addr show

Answer

tcpdump

Question 17

A technician receives an urgent alert that a critical file server at a remote branch office has gone offline and is unreachable over the network. The server is accessible via out-of-band IPMI, which indicates that chassis power is present, but the power LED on the server is blinking amber instead of steady green. The IPMI system event log reports "System board voltage regulator failure" as the last critical event before the failure. Attempts to use the remote KVM show no video output, and Wake-on-LAN commands have no effect. The branch office has no on-site IT personnel; the only staff are general office workers with minimal technical training. The earliest a field technician can travel to the site is 48 hours. The main office has an identically configured spare server and a backup image of the file server's system disk. The branch office staff can follow simple plug-and-play instructions if provided. Which of the following is the BEST immediate course of action to restore the file services with minimal downtime?

Accepted Answer

Ship the spare server and a pre-configured backup image to the branch office for local staff to swap.. Given the voltage regulator failure on the system board, the server is not repairable remotely. Shipping the pre-configured spare server allows non-technical staff to swap the entire unit by following simple cabling instructions, restoring service quickly without waiting for a technician. Option A is correct because it minimizes downtime by leveraging available resources. Option B is incorrect because voltage regulator modules are rarely field-replaceable; they are integrated into the motherboard, and dispatching a technician would take 48 hours plus repair time. Option C is incorrect because reseating the power supply is unlikely to fix a system board voltage regulator fault, and could cause further confusion for untrained staff. Option D is incorrect because ordering a replacement board and waiting for a technician to install it would take even longer, extending downtime unnecessarily.

Answer

Order a replacement system board and express ship it to the branch for a technician to install later.

Answer

Instruct a non-technical employee at the branch to reseat the power supply and clear the error log.

Answer

Dispatch a technician with a replacement voltage regulator module for on-site repair.

Question 18

A RAID 5 array is degraded due to a failed disk. What is the best practice for recovery?

Accepted Answer

Replace the failed disk and allow the array to rebuild automatically. In a RAID 5 array, a single disk failure leaves the array degraded but still operational because parity data on the remaining disks can reconstruct the missing data. Best practice is to replace the failed disk and allow the controller to rebuild the array automatically from parity, restoring redundancy without downtime or data loss. This is the standard hot-swap recovery procedure and requires no backup restore because the data is still intact.

Answer

Replace the failed disk and restore from backup

Answer

Replace the failed disk and perform a manual rebuild from backup

Answer

Delete the logical drive and recreate the array

Question 19

A server hosts a database that requires nightly backups. The backup strategy uses a full backup every Sunday and differential backups on other days. On Wednesday, the server fails. Which backup sets are required to restore to the most recent state?

Accepted Answer

Last full backup and the latest differential backup. A differential backup contains all changes since the last full backup. Therefore, only the last full backup and the latest differential are needed for a restore. Incremental backups would require all incrementals since the last full, but the scenario uses differential backups.

Answer

Last full backup and all differential backups since Sunday

Answer

Last full backup only

Answer

Last full backup and all incremental backups since Sunday

Question 20

A server administrator is troubleshooting a RAID controller issue on a production server. The server has a hardware RAID 5 array with three drives. The administrator notices that one drive's status LED is solid amber, and the RAID controller management utility reports the array as degraded. The administrator has a replacement drive of the same model and capacity. Which action should the administrator take to restore the array to optimal status?

Accepted Answer

Hot-swap the failed drive with the replacement and allow the controller to automatically rebuild the array.. A degraded RAID 5 array with a failed drive should be restored by replacing the failed drive and allowing the controller to rebuild. Hot-swapping is supported on most server backplanes and minimizes downtime. Recreating the array or replacing all drives destroys data, and forcing a failed drive online does not address the hardware failure. The correct action is to replace the single failed drive and rebuild.

Answer

Shut down the server, replace the drive, and then recreate the RAID array from scratch.

Answer

Replace all three drives simultaneously to ensure compatibility and rebuild the array.

Answer

Run a consistency check on the array and mark the failed drive as online.