SK0-005 Practice Test 9 — 10 Questions

Question 1

A system administrator configures full backups on Sunday evenings and differential backups on weekdays. On Thursday morning, a disk failure occurs. Which of the following sets of backups is necessary to completely restore the server's data with the fewest number of backup files?

Accepted Answer

Sunday full and Wednesday differential. A differential backup includes all changes since the last full backup. Therefore, only the most recent differential and the last full backup are needed for a complete restore. Using Sunday's full and Wednesday's differential requires just two files, whereas incremental backups would require the full plus every incremental since. Option A (full plus all four differentials) is unnecessary. Option C references a Thursday backup that hasn't occurred yet. Option D ignores all changes since Sunday.

Answer

Sunday full only

Answer

Sunday full, Monday differential, Tuesday differential, Wednesday differential

Answer

Sunday full and Thursday differential

Question 2

A company runs a popular public-facing e-commerce website hosted on a farm of five Windows Server 2019 web servers behind a hardware load balancer. Recently, users have been reporting intermittent '503 Service Unavailable' errors during peak shopping hours. The administrator checks the load balancer and finds that all servers are marked as healthy with low CPU and memory usage. However, when inspecting a sample server, the administrator notices a large number of TCP connections in the TIME_WAIT state, consuming all available ephemeral ports. The application is ASP.NET based and uses IIS. The server configuration is as follows: Windows Server 2019 Standard, 4 vCPUs, 16 GB RAM, default TCP/IP settings. The administrator needs to resolve the connectivity issues without making changes to the application code or altering the network architecture. Which of the following actions should the administrator take to fix the problem PERMANENTLY?

Accepted Answer

Increase the ephemeral port range using netsh, and consider reducing the TIME_WAIT delay via registry settings.. Option A is correct because ephemeral port exhaustion is the root cause. Increasing the ephemeral port range provides more ports, and reducing TIME_WAIT delay frees them faster. Option B adds servers, which is a temporary workaround and does not prevent port exhaustion on each server. Option C requires nightly restarts, causing brief outages and not solving the underlying issue. Option D limits concurrent connections but may degrade performance and does not address port exhaustion.

Answer

Add two additional web servers to the farm to distribute the load.

Answer

Schedule a nightly restart of the IIS application pools.

Answer

Reduce the maximum number of concurrent connections in the IIS application pool settings.

Question 3

A company performs annual disaster recovery tests. The last test revealed that the recovery time objective (RTO) was not met because the backup tapes were corrupted. The backup administrator proposes changes to the backup verification process. Which practice is MOST effective to ensure recoverability?

Accepted Answer

Implement automated integrity checks and periodic test restores.. Option B is correct because automated integrity checks and periodic test restores directly validate that backups are usable and meet recovery objectives, catching corruption early. Option A is wrong because increasing backup frequency does not verify that backups are error-free. Option C is wrong because verifying tapes before offsite storage reduces risk but does not guarantee ongoing media integrity; tapes can degrade over time. Option D is wrong because switching to disk-based backups avoids some tape-specific issues but still requires verification processes to ensure data is not corrupted.

Answer

Perform a full backup more frequently.

Answer

Switch to disk-based backups exclusively.

Answer

Store backup tapes offsite only after verification.

Question 4

A small law firm relies on a single server that hosts a document management system and email. The server is backed up nightly using differential backups to an external USB hard drive that remains connected to the server. One Monday morning, the office manager finds all files encrypted and a ransom note on the screen. The server’s event logs indicate that the encryption began at 2:00 AM on Saturday. The firm’s offsite backup policy rotates two sets of tapes, and the most recent set was taken offsite on Friday evening and is stored in a bank safe deposit box. The USB backup drive, still attached to the server, shows its files also encrypted. The firm does not have a cloud backup service for the server. The office manager wants to restore operations as quickly as possible with minimal data loss and zero risk of reinfection. What is the BEST course of action?

Accepted Answer

Reimage the server, then restore data from the Friday offsite tape backup.. A is correct. The offsite tape backup from Friday evening is air-gapped and predates the infection (Saturday 2:00 AM), ensuring it is clean. Reimaging the server provides a known-good operating system. Option B is risky because the USB drive’s backup likely contains infected files; even an antivirus scan might not detect all ransomware artifacts. Option C is not possible since there is no server cloud backup. Option D is not recommended and may not result in file recovery. Thus, A is the safest and most reliable method.

Answer

Restore the server from the firm's cloud backup service for email.

Answer

Scan the USB drive with antivirus, then restore the latest differential backup from it.

Answer

Pay the ransom to obtain the decryption key, then perform a full backup.

Question 5

A system administrator needs to apply critical security patches to a production web server that cannot be taken offline. The server runs a Linux operating system and hosts a high-availability website. The administrator wants to ensure that if the patches cause a failure, the server can be quickly rolled back to its previous state. Which of the following actions should the administrator take FIRST?

Accepted Answer

Take a snapshot of the server's virtual machine before applying patches.. Option B is correct because taking a snapshot provides a point-in-time state of the virtual machine, allowing quick rollback if the patches cause issues. Option A backs up user data but does not capture the system state needed for a full rollback. Option C is a procedural step but not the first technical action to enable recovery. Option D is reckless and provides no rollback capability.

Answer

Back up all user data to a network share.

Answer

Schedule a maintenance window and notify users of potential downtime.

Answer

Apply the patches during off-peak hours without any additional steps.

Question 6

A server has two NICs configured in a team using LACP. The server loses network connectivity when one NIC is physically disconnected, even though both links show as active in the teaming software before the failure. What is the most likely cause of the issue?

Accepted Answer

LACP is not correctly configured on the switch. For LACP to work properly, the switch must be explicitly configured to bundle the ports into a port channel. If the switch is not configured for LACP, it may not handle the failover correctly, causing a loss of connectivity when one link drops. NIC driver issues or STP are less likely to cause this specific symptom, and setting the team to Switch Independent would not use LACP.

Answer

The teaming mode is set to 'Switch Independent' instead of LACP

Answer

Spanning Tree Protocol is blocking the failover path

Answer

NIC driver version mismatch between the two adapters

Question 7

Refer to the exhibit. An administrator is reviewing logs after a server experienced performance issues and unexpected shutdowns. Based on the log entries, which component is MOST likely failing?

Accepted Answer

Hard disk drive. The log entries show multiple SCSI medium errors, unrecovered read errors, and auto-reallocation failures on device sda, which are classic signs of a failing hard disk drive (Option B). A RAID controller (A) would typically show different errors, RAM (C) would cause memory-related errors, and a power supply (D) would trigger power event logs.

Answer

RAID controller

Answer

RAM module

Answer

Power supply

Question 8

A server hosts a database that requires nightly backups. The backup strategy uses a full backup every Sunday and differential backups on other days. On Wednesday, the server fails. Which backup sets are required to restore to the most recent state?

Accepted Answer

Last full backup and the latest differential backup. A differential backup contains all changes since the last full backup. Therefore, only the last full backup and the latest differential are needed for a restore. Incremental backups would require all incrementals since the last full, but the scenario uses differential backups.

Answer

Last full backup and all differential backups since Sunday

Answer

Last full backup only

Answer

Last full backup and all incremental backups since Sunday

Question 9

A financial services firm requires a disaster recovery solution that provides a Recovery Point Objective (RPO) of near zero and a Recovery Time Objective (RTO) of less than 2 hours. Which of the following site types is MOST appropriate?

Accepted Answer

Hot site. Option D is correct because a hot site is fully equipped, with near real-time data replication, enabling the fastest recovery and minimal data loss. A cold site (Option A) has the longest recovery time. A warm site (Option B) has some equipment but data must be restored from backup, increasing RTO and RPO. Cloud-based backup with daily replication (Option C) does not meet near-zero RPO.

Answer

Cloud-based backup with daily replication

Answer

Cold site

Answer

Warm site

Question 10

A small business has a limited budget and can tolerate up to 72 hours of downtime in the event of a disaster. Which type of disaster recovery site would be most cost-effective?

Accepted Answer

Cloud-based DR with pay-as-you-go.. Option D is correct because a cloud-based DR site with pay-as-you-go model requires no upfront investment in hardware and can be spun up as needed, making it cost-effective for a business with a high downtime tolerance. Option A is wrong because a hot site is the most expensive, with real-time replication. Option B is wrong because a warm site requires pre-installed hardware that incurs ongoing costs, even if data is not up-to-date. Option C is wrong because a cold site still requires occasional maintenance and may have hidden costs; modern cloud DR can be cheaper and more flexible.

Answer

Cold site with no pre-configured hardware.

Answer

Hot site with real-time replication.

Answer

Warm site with pre-installed hardware but no data.