SK0-005 Practice Test 4 — 10 Questions

Question 1

A Linux server is experiencing random reboots. The administrator checks the system logs and finds multiple entries indicating a machine check exception (MCE). The server is running the latest kernel and all firmware is up to date. Which of the following is the MOST likely cause of the reboots?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Failing CPU or memory hardware.. Machine check exceptions are hardware-level errors reported by the CPU, most commonly due to failing RAM or CPU. Random reboots with MCE logs indicate a hardware fault that firmware updates cannot resolve. The correct course is to run hardware diagnostics and replace the faulty component.

Answer

Overheating due to failed cooling fans.

Answer

A faulty power supply unit.

Answer

Incorrect kernel parameters for memory management.

Question 2

An administrator must choose a physical security control for a new server room door that will allow staff to enter quickly during an emergency while still recording who entered and when. Which solution BEST fits?

Accepted Answer

Install a badge reader with an electronic audit log and a fail-safe release that unlocks on power loss.. The door needs both accountability and safe, fast passage during emergencies. An electronic badge reader with an audit log records entries, while a fail-safe release ensures the lock disengages when power is lost so people are not trapped. Together they meet the physical security and life-safety requirements stated.

Answer

Install a biometric reader that grants access based on fingerprint recognition only.

Answer

Install a badge reader configured as fail-secure so the door remains locked when power is lost.

Answer

Install a mechanical keyed lock with keys issued to each staff member.

Question 3

A server administrator is troubleshooting a server that unexpectedly rebooted overnight. The administrator reviews the system logs and finds Event ID 6008 in the Windows System log, indicating an unexpected shutdown. There are no corresponding events for a thermal trip or power failure. Which of the following should the administrator check FIRST to determine the cause?

Accepted Answer

Check the server's out-of-band management controller logs for power or hardware events.. Event ID 6008 indicates an unexpected shutdown, which often stems from hardware or power issues. The out-of-band management controller logs are the best source for hardware-level events like power supply failures or thermal trips that are not visible to the OS. Reviewing these logs first can quickly identify or rule out hardware causes before moving to OS-level diagnostics.

Answer

Review the Windows Update history to see if a patch was installed that required a reboot.

Answer

Run a memory diagnostic to check for faulty RAM.

Answer

Verify that the UPS is functioning correctly and has enough battery capacity.

Question 4

A rack-mount server must be installed in a cabinet that is only 30 inches deep, while the server's rails are designed for a 36-inch cabinet and allow the chassis to extend beyond the front and rear posts. The server must remain serviceable and the cabinet doors must close. Which of the following should the technician do FIRST?

Accepted Answer

Verify the rail kit's minimum cabinet depth and obtain a shorter rail kit or a deeper cabinet if the specified depth is not met.. Rack rails are rated for a specific range of cabinet depths, and installing them in a shallower cabinet leaves the chassis unsupported at the rear and protruding past the posts. Checking the rail kit's published depth range and procuring compatible hardware or a deeper cabinet resolves the incompatibility before any damage or unsafe mounting occurs.

Answer

Install the server with the front posts only and let the rear of the chassis rest on the cabinet base.

Answer

Mount the server vertically using a wall-mount bracket instead of the rails.

Answer

Remove the cabinet's rear door to provide the extra clearance the server needs.

Question 5

A company is hardening a publicly reachable Linux web server that runs an SSH service for administration. The security team wants to reduce the attack surface and enforce stronger authentication. Which two actions BEST accomplish this? (Choose two.)

Accepted Answer

Require public key authentication and disable password-based SSH logins.. The strongest reductions in SSH attack surface come from removing weak authentication paths and eliminating shared, highly privileged logins. Requiring public keys with password authentication disabled blocks brute-force approaches, while forbidding direct root login enforces named accounts and per-user accountability. Together they harden authentication and limit the impact of a single compromised credential.

Answer

Install a host-based intrusion detection system that alerts on suspicious SSH login patterns.

Answer

Enable verbose logging of all SSH connection attempts to a remote syslog server.

Answer

Change the SSH service to listen on a non-standard port to hide it from scanners.

Question 6

A small office has a single physical server running Windows Server 2022 that hosts a file share and a print server. The administrator wants to ensure that if the server's operating system becomes corrupted, the server can be restored quickly to a working state. Which backup type should the administrator use?

Accepted Answer

Bare metal recovery backup. A bare metal recovery backup includes the operating system, applications, and data, enabling a complete restore even if the OS is corrupted. This meets the need to quickly return the server to a working state without a lengthy manual rebuild.

Answer

Volume shadow copy

Answer

System state backup

Answer

File-level backup of the file share only

Question 7

A technician is adding a second CPU to a dual-socket 2U server that previously ran with a single processor. After installing the matching CPU and heatsink, the server POSTs but the operating system only reports half of the newly installed memory, and the BIOS memory map shows several DIMM slots as unpopulated. Which of the following is the MOST likely cause?

Accepted Answer

The DIMMs installed on the second CPU's memory channels are not seated or are in the wrong slots.. Adding a processor activates a second set of memory channels, each with its own required slot population order. If the DIMMs are not moved into the slots owned by the new socket, those channels train as unpopulated and the OS sees only the memory attached to the original CPU. Verifying the server's population table and reseating DIMMs in the correct slots resolves the missing capacity.

Answer

The second CPU requires a BIOS firmware update before memory can be enabled.

Answer

The new CPU is not on the server's hardware compatibility list.

Answer

The memory controller interleave setting was disabled in the BIOS.

Question 8

A security administrator is hardening a Linux server that hosts a public web application. The server currently allows root login via SSH and uses default SSH port 22. The administrator wants to reduce the attack surface by implementing SSH best practices. Which two actions should the administrator take? (Choose two.)

Accepted Answer

Disable password authentication by setting PasswordAuthentication no and use SSH keys.. Disabling root login and disabling password authentication in favor of SSH keys are two fundamental SSH hardening practices. They reduce the attack surface by eliminating direct root access and removing the risk of password brute-force attacks. Changing the port is security through obscurity, enabling password authentication weakens security, and allowing SSH from any IP increases exposure. These two actions directly address the scenario's requirements.

Answer

Change the SSH port from 22 to a non-standard port, such as 2222.

Answer

Enable password authentication to ensure only authorized users can log in.

Answer

Allow SSH access from any IP address to ensure administrators can connect from anywhere.

Question 9

A technician is disposing of several decommissioned servers that previously stored customer financial records. The drives will leave the building. Which action BEST ensures the data cannot be recovered by anyone who obtains the drives?

Accepted Answer

Physically destroy the drives by shredding or degaussing them before disposal.. Because the drives contain regulated financial data and are leaving the facility, the disposal method must make recovery infeasible. Physical destruction through shredding or degaussing removes any possibility of reading the media, which is stronger than any software-based erasure and aligns with the requirement that the data cannot be recovered by a later holder.

Answer

Format each drive with the operating system's quick format option.

Answer

Move the drives to a locked storage room until a future disposal decision is made.

Answer

Delete all files and empty the recycle bin on each drive.

Question 10

A small office has a single physical server running Windows Server 2022 that hosts a file share and a print server. The administrator wants to protect against a hard drive failure that would cause downtime. The server has four drive bays, all currently empty. The administrator needs a solution that provides redundancy and maximizes usable capacity while tolerating one drive failure. Which of the following should the administrator implement?

Accepted Answer

RAID 5 with four drives. RAID 5 with four drives provides single-drive fault tolerance and uses all four bays, yielding usable capacity equal to three drives. RAID 0 offers no redundancy, RAID 1 with two drives wastes two bays, and RAID 5 with three drives leaves a bay unused. Therefore, four-drive RAID 5 best satisfies both redundancy and capacity maximization.

Answer

RAID 1 with two drives

Answer

RAID 5 with three drives

Answer

RAID 0 with four drives