SK0-005 Practice Questions 1 — 50 Questions

Question 1

A server administrator is troubleshooting a Windows Server 2022 that cannot connect to a remote iSCSI target. The server has two network adapters: one for LAN traffic and one dedicated to iSCSI. The administrator verifies that the iSCSI adapter has a valid IP address, can ping the target, and that the iSCSI service is running. However, the iSCSI initiator shows the target as unavailable. Which action should the administrator take next?

Accepted Answer

Verify that the target's access control list includes the initiator's IQN.. The target is discovered but unavailable, while IP connectivity and the iSCSI service are confirmed. This points to an access control issue, such as the initiator IQN not being in the target's ACL. Verifying and adding the IQN to the target's allowed list is the correct next step. Firewall, driver reinstallation, and IP changes are either less likely or inappropriate given the symptoms.

Answer

Reinstall the iSCSI initiator driver on the server.

Answer

Check the Windows Firewall inbound rules for iSCSI traffic on the server.

Answer

Change the iSCSI adapter's IP address to be on the same subnet as the LAN adapter.

Question 2

An organization wants to test its disaster recovery plan with minimal disruption to business operations and minimal cost. The test should verify the plan's effectiveness by discussing scenarios. Which type of test should they perform?

Accepted Answer

Tabletop exercise. A tabletop exercise is a discussion-based review of the plan steps with key stakeholders, requiring no system downtime and very low cost. A full interruption test (Option A) actually shuts down primary systems and fails over, causing disruption. A parallel test (Option B) runs systems at the DR site without cutting over but still involves significant resource allocation. A simulation test (Option D) may involve live drills or emulate components, often costing more than a tabletop.

Answer

Parallel test

Answer

Full interruption test

Answer

Simulation test

Question 3

During a security incident, a server is suspected to be compromised by malware. The incident response team needs to preserve evidence and minimize impact. Which TWO actions should be taken FIRST? (Select TWO.)

Accepted Answer

Disconnect the server from the network.. Options B and C are correct. Disconnecting the server from the network (B) is an immediate containment step to prevent data exfiltration or spread. Capturing a forensic image of system memory (C) preserves volatile data such as running processes, network connections, and encryption keys before they are lost. Option A is wrong because powering off loses all volatile evidence. Option D is wrong because running an AV scan modifies files and could destroy forensic artifacts. Option E is wrong because rebooting erases memory and may trigger malware countermeasures.

Answer

Run an antivirus scan.

Answer

Reboot the server in safe mode.

Answer

Power off the server immediately.

Question 4

A company's backup policy sends nightly backups to a tape library in the same building as the production servers. A recent fire destroyed the server room, and the tapes were damaged by heat and water. Which change BEST addresses this single point of failure?

Accepted Answer

Ship a copy of each backup to an offsite location or replicate it to cloud storage outside the building.. The incident destroyed production and backup copies together because both lived in the same room. The most effective change is to keep at least one copy geographically separate, either by shipping tapes offsite or replicating to cloud storage. More frequent backups, a second in-room library, and tape parity all leave the site-level single point of failure intact.

Answer

Increase the backup frequency to every four hours so less data is lost between jobs.

Answer

Replicate the tape library to a second array in the same server room so backups exist on two media types.

Answer

Add parity to the tape library so a damaged tape can be reconstructed from the remaining tapes.

Question 5

A server administrator is configuring a new server that will host a high-traffic web application. The administrator needs to optimize the server's network performance. Which TWO of the following should be implemented? (Choose two.)

Accepted Answer

Configure NIC teaming for redundancy and load balancing.. Enabling jumbo frames and configuring NIC teaming are direct performance optimizations for a high-traffic web server. Jumbo frames reduce overhead for large transfers, while NIC teaming provides redundancy and load balancing. The other options either degrade performance or do not directly enhance it. These two together can significantly improve network throughput and reliability.

Answer

Assign a static IP address to the server.

Answer

Disable TCP offloading on the network adapter.

Answer

Set the network adapter to half-duplex mode.

Question 6

A company is creating a disaster recovery plan for its on-premises data center. Which THREE elements are essential to include in the DR plan? (Select THREE.)

Accepted Answer

Contact information for key personnel.. Options A, C, and E are correct. Contact information for key personnel (A) ensures that the recovery team can be reached during a crisis. RTO and RPO for each critical system (C) define the recovery goals and guide the technical implementation. The list of failover site addresses and access procedures (E) provides vital instructions for reaching and securing the secondary location. Option B is wrong because cleaning procedures are operational but not a core DR plan element. Option D is wrong because backup procedures are part of the backup policy, not the disaster recovery plan; the DR plan assumes backups exist and focuses on restoring from them.

Answer

Detailed instructions for cleaning server hardware.

Answer

Step-by-step procedures for performing backups.

Question 7

A server administrator is assembling a new high-performance server using a Supermicro X12 motherboard, two Intel Xeon Gold 5317 processors (LGA 4189 socket), and 16x 32GB DDR4-3200 ECC LRDIMMs for a total of 512GB of memory. The chassis has redundant 1600W power supplies. After assembling all components, the administrator powers on the server. All fans start spinning at full speed, and the front panel LEDs illuminate. However, the server does not POST, there are no beep codes, and no video output is displayed. The motherboard has a two-digit hexadecimal POST code LED display, which shows '00' and does not change. The motherboard manual states that code '00' indicates the CPU is not detected or has failed. The processors are confirmed to be the correct socket type and stepping as required by the motherboard. What should the technician do FIRST?

Accepted Answer

Reseat both processors and inspect the CPU sockets for bent pins. The POST code '00' typically indicates a CPU initialization failure. The first and least invasive step is to reseat the processors, checking for bent socket pins, debris, or improper mounting. This resolves a majority of such issues. Option A (replace both CPUs) is extreme and should only be done after ruling out physical installation issues. Option C (clear CMOS) may help if the BIOS was misconfigured for a previous CPU, but physical reseating is more direct. Option D (update BIOS) is not possible if the system cannot POST to enter the update utility; furthermore, if the CPUs are supported by the current BIOS version, updating is unnecessary.

Answer

Replace both processors as they are likely faulty

Answer

Clear the CMOS using the jumper or button on the motherboard

Answer

Update the BIOS to the latest version using the IPMI interface

Question 8

A server administrator is troubleshooting a Windows Server 2019 system that reports a stop error (blue screen) with the code CRITICAL_PROCESS_DIED. The server reboots automatically and then works normally for a few hours before the error recurs. The administrator has already updated all drivers and installed the latest Windows updates. Which action should the administrator take next to gather more detailed diagnostic information about the crashes?

Accepted Answer

Configure the system to write a kernel memory dump and analyze it with Windows Debugging Tools.. When a Windows server experiences recurring stop errors despite driver and OS updates, the administrator needs to capture and analyze a memory dump. The kernel memory dump contains the state of the kernel at the crash, including the call stack and loaded modules. Using Windows Debugging Tools (WinDbg) with the appropriate symbols allows the administrator to pinpoint the failing driver or process. Other options either do not capture crash-time state or address different problem classes.

Answer

Run the System File Checker (sfc /scannow) to repair corrupted system files.

Answer

Enable boot logging and restart the server in Safe Mode.

Answer

Use Performance Monitor to log memory and CPU usage over time.

Question 9

A company uses a two-node failover cluster for a critical application. The cluster nodes are located in the same data center, and the quorum configuration uses a file share witness on a separate server in the same data center. During a major power outage, both cluster nodes and the file share witness server lose power. What is the impact on cluster availability?

Accepted Answer

The cluster will be offline until one of the nodes or the witness comes back online.. With a two-node cluster plus a file share witness, quorum requires a majority of votes — 2 out of 3. When both nodes and the witness lose power simultaneously, no votes remain, so the cluster cannot achieve quorum and all clustered roles go offline. Availability is restored only when at least two of the three voting members (e.g., one node plus the witness, or both nodes) return.

Answer

The cluster will automatically fail over to a third site because the witness server is unavailable.

Answer

The cluster continues operating because the nodes can use a dynamic quorum and adjust the vote count.

Answer

The cluster remains online because the nodes can communicate directly and form quorum without the witness.

Question 10

A technician is preparing to add four new hot-swap SAS drives to a running server that uses a hardware RAID controller. Before inserting the drives, which of the following actions should the technician take? (Choose two.)

Accepted Answer

Confirm the drives are on the RAID controller's compatibility list. Before adding hot-swap drives, the technician must confirm the drives are supported by the RAID controller and that the chosen bays are free of existing array membership. Compatibility prevents rejection or dropout, and confirming empty bays prevents an accidental rebuild that would overwrite the newly inserted drive.

Answer

Set each new drive's SAS address to match the controller's expected value

Answer

Install the drives while the server is powered off to avoid damaging the backplane

Answer

Update the RAID controller firmware to the latest release immediately before insertion

Question 11

A server administrator is troubleshooting a server that is unable to connect to the network. The administrator checks the NIC and sees that the link light is off. Which of the following is the FIRST thing the administrator should check?

Accepted Answer

The network cable connection at both the server and the switch.. When a NIC link light is off, the problem is at the physical layer. The first step is to verify the cable is properly connected to both the server and the switch, and that the switch port is enabled. This simple check resolves many connectivity issues. Only after confirming physical connectivity should the administrator investigate IP, DNS, or firewall configurations.

Answer

The firewall rules on the server.

Answer

The IP address configuration on the server.

Answer

The DNS server settings on the server.

Question 12

A small business has purchased a new server to function as a file server for 25 employees. The server is equipped with four 1TB SATA hard disk drives and no hardware RAID controller; the operating system supports software RAID. The business owner's primary requirements are data redundancy to protect against a single drive failure and maximum usable storage capacity, while keeping costs low. The IT technician is tasked with configuring the storage. The technician evaluates the following options: RAID 0 striping across all four drives; RAID 1 mirroring using two pairs (drives 1+2 mirrored, drives 3+4 mirrored), providing two separate volumes; RAID 5 with parity across all four drives; and RAID 10 combining mirroring and striping. The technician needs to recommend the configuration that best meets the requirements. Which of the following should the technician implement?

Accepted Answer

Configure RAID 5 to stripe data and parity across all four drives, providing 3TB of usable storage with single-drive fault tolerance.. RAID 5 stripes data and parity across all four drives, providing 3TB of usable storage (4TB raw minus 1TB for parity) and can tolerate a single drive failure. This meets the requirements for data redundancy against a single drive failure and maximum usable storage capacity while keeping costs low, as it uses all four drives efficiently without additional hardware.

Answer

Configure RAID 10 by mirroring two pairs and striping across them, providing 2TB of storage with high performance and redundancy.

Answer

Configure RAID 0 to stripe across all four drives for maximum 4TB storage and performance.

Answer

Configure RAID 1 with two mirrored pairs, providing 2TB of total storage across two volumes, ensuring redundancy.

Question 13

A database server running on a Linux VM has started experiencing periodic crashes. The VM is hosted on an ESXi hypervisor. The system logs show entries: 'kernel: Out of memory: Kill process 12345 (mysqld) score 700 or sacrifice child'. The VM has 16GB RAM allocated and no memory overcommitment on the host. The DBA reports that the database workload hasn't increased. Which of the following actions should be taken FIRST to diagnose the issue?

Accepted Answer

Check the host's memory utilization for ballooning or swapping.. The OOM killer being invoked in a VM with stable workload suggests possible host-level memory constraints (e.g., ballooning, swapping) affecting the VM. Checking the host's memory utilization helps confirm whether the hypervisor is under memory pressure and causing the VM to think it's out of memory. Options A and D are configuration changes that might alleviate symptoms but don't diagnose root cause. B addresses database tuning, which is not indicated when the system reports OOM.

Answer

Add a memory reservation for the VM in ESXi.

Answer

Analyze the database query cache hit ratio and slow query logs.

Answer

Increase the VM's RAM allocation to 32GB.

Question 14

A server configured with RAID 5 has two failed drives. The array is offline and critical data is inaccessible. The administrator has replacement drives available. What should the administrator do to restore the data and array with minimal data loss?

Accepted Answer

Replace both failed drives and restore from backup.. RAID 5 can survive a single drive failure, but with two failed drives, the array is completely broken and cannot be rebuilt. Restoring from backup is the only reliable method to recover the data. Options B and C incorrectly assume the array can still rebuild, and option D would worsen data integrity.

Answer

Reconfigure the RAID to RAID 0 using the remaining good drives.

Answer

Replace both failed drives and initiate a full array rebuild.

Answer

Replace one failed drive, allow rebuild, then replace the second.

Question 15

A technician is installing a used 2U rack server that was pulled from another rack. The server's rail kit is rated for a maximum load of 35 kg, and the chassis weighs 32 kg with no drives installed. Before sliding the chassis onto the rails, which of the following should the technician do FIRST?

Accepted Answer

Verify the rail kit's load rating against the fully populated chassis weight, and use a mechanical lift or a second technician if needed.. Rail kits are rated for a maximum supported weight, and the chassis must be evaluated at its fully populated weight, not just its shipping weight. When the empty chassis already approaches the rail rating, adding drives and adapters can exceed it, so the technician should confirm the rating and arrange a lift or helper before mounting.

Answer

Mount the chassis on the rails alone first, then add the drives afterward to keep the initial lift weight low.

Answer

Remove the server's top cover to reduce weight and improve grip while sliding the chassis onto the rails.

Answer

Install all drives and PCIe cards into the chassis to reach final operating weight before mounting.

Question 16

A company has a small virtualized environment with two ESXi 7.0 hosts (HostA and HostB) managed by vCenter Server. They use a shared iSCSI storage array for all VMs. The network consists of a single physical switch that connects the hosts, storage, and management traffic using VLANs. Yesterday, the switch failed and was replaced with an identical model. After restoring the configuration from a backup, all VMs on HostA are working normally, but all VMs on HostB show 'network disconnected' in the vSphere console. The VMs on HostB are still running, but they cannot communicate with any other device on the network. HostB itself is reachable via its management IP and can access the storage array. The administrator has verified that the physical cables are correct and the NICs are up on HostB. The VLAN configuration on the new switch was restored for the ports connecting HostB, but the issue persists. Which of the following actions should the administrator perform FIRST to restore connectivity?

Accepted Answer

Check the VLAN configuration on the switch ports connected to HostB for the VM network uplinks.. Option B is correct. Since all other functions (management, storage) work and only VM traffic is affected, the most likely cause is incorrect VLAN tagging on the switch port carrying the VM traffic uplink. Restoring a switch config may have missed the exact VLAN trunk settings. Checking and correcting the VLAN configuration on the switch ports for HostB's VM network is the first targeted step. Options A and C are nondisruptive but don't address the immediate config issue. Option D involves rebooting the host without diagnosing, which is risky and may not fix the issue.

Answer

Reboot HostB to renegotiate the network configuration.

Answer

Restart the vCenter Server service on the vCenter appliance.

Answer

vMotion all affected VMs from HostB to HostA to confirm they work on HostA.

Question 17

A server administrator is troubleshooting a Windows Server 2019 that randomly reboots. The administrator suspects a hardware issue. Which two actions should the administrator take to gather evidence of the cause? (Choose two.)

Accepted Answer

Configure a memory dump and analyze it with WinDbg.. To diagnose random reboots, the administrator should first check the System event log for Event ID 41, which indicates an unclean shutdown and may include a bugcheck code. Additionally, configuring a memory dump and analyzing it with WinDbg provides detailed crash information, including the faulting driver or hardware component. These actions gather concrete evidence, unlike preventive measures or general system checks.

Answer

Update the BIOS and all device drivers to the latest versions.

Answer

Enable and review the Windows Memory Diagnostic results.

Answer

Run the sfc /scannow command to check for system file corruption.

Question 18

A technician is preparing to install a new rack-mount server that will host a database requiring high random read performance. The server's chassis supports up to eight 2.5-inch drive bays, and the technician must choose a drive technology that provides the lowest latency and highest IOPS. Which of the following drive types should the technician select?

Accepted Answer

NVMe solid-state drives. NVMe drives attach directly to PCIe lanes, bypassing the SATA and SAS controller layers and supporting deep parallel command queues. That architecture delivers the lowest latency and highest random IOPS of the listed media, which directly matches the database's high random read requirement, while mechanical and SATA-based options are limited by either moving parts or interface overhead.

Answer

SATA 7200 RPM mechanical hard disk drives

Answer

SAS 15,000 RPM mechanical hard disk drives

Answer

SATA solid-state drives

Question 19

A server administrator receives alerts that a production Linux server is unresponsive. After connecting via out-of-band management, the administrator sees a message indicating a kernel panic. The system was recently updated with a new storage driver. Which of the following should the administrator do FIRST to troubleshoot this issue?

Accepted Answer

Reboot the server and select the previous kernel version from the boot loader menu.. The kernel panic appeared right after a storage driver update, making that change the prime suspect. Booting the previous kernel version is a quick, reversible test that confirms whether the new driver is at fault. If the system boots, the administrator can then roll back the driver or obtain a fixed version. Other options involve unnecessary hardware replacement, lengthy tests, or destructive reinstallation.

Answer

Run a full memory diagnostic test to check for faulty RAM.

Answer

Replace the storage controller card with a known-good spare.

Answer

Reinstall the operating system from scratch to ensure a clean state.

Question 20

A system administrator is setting up a new server and needs to ensure that the server's time is synchronized with an external time source. Which protocol should be used?

Accepted Answer

NTP. NTP is the correct protocol for synchronizing server time with external sources. It is specifically designed for this purpose and is widely supported. Other protocols listed serve different functions and cannot synchronize time. Accurate time is essential for security protocols, logging, and scheduled tasks.

Answer

SNMP

Answer

LDAP

Answer

SMTP