SK0-005 Practice Test 9 — 10 Questions

Question 1

A company performs annual disaster recovery tests. The last test revealed that the recovery time objective (RTO) was not met because the backup tapes were corrupted. The backup administrator proposes changes to the backup verification process. Which practice is MOST effective to ensure recoverability?

Accepted Answer

Implement automated integrity checks and periodic test restores.. Option B is correct because automated integrity checks and periodic test restores directly validate that backups are usable and meet recovery objectives, catching corruption early. Option A is wrong because increasing backup frequency does not verify that backups are error-free. Option C is wrong because verifying tapes before offsite storage reduces risk but does not guarantee ongoing media integrity; tapes can degrade over time. Option D is wrong because switching to disk-based backups avoids some tape-specific issues but still requires verification processes to ensure data is not corrupted.

Answer

Perform a full backup more frequently.

Answer

Switch to disk-based backups exclusively.

Answer

Store backup tapes offsite only after verification.

Question 2

A virtualized server running multiple VMs experiences a sudden performance degradation during peak hours. Storage latency spikes and CPU ready time increases significantly. The hypervisor shows high memory overcommitment but no swapping. Which action would most likely resolve the issue without adding hardware?

Accepted Answer

Migrate one or more VMs to another host. Migrating VMs reduces resource contention on the host, lowering CPU ready time and potentially alleviating storage I/O pressure. Option A would only address memory pressure, not CPU ready. Option C is already enabled by default and would not resolve high ready time. Option D might help CPU contention but could degrade application performance and does not address storage latency directly.

Answer

Reduce the number of vCPUs assigned to each VM

Answer

Increase memory reservation for all VMs

Answer

Enable transparent page sharing

Question 3

A network administrator needs to configure centralized authentication for network devices. The solution must provide encryption of the entire authentication process, support for multiple protocols, and accounting of user actions. Which protocol should be used?

Accepted Answer

TACACS+. TACACS+ encrypts the entire authentication process, offers granular control over authorization, and supports accounting. RADIUS (B) only encrypts the password, not the entire session. LDAP (A) is a directory service, not an encryption-focused authentication protocol. Kerberos (C) uses tickets and encryption but is primarily for single sign-on within a domain, not commonly used for network device administration.

Answer

Kerberos

Answer

RADIUS

Answer

LDAP

Question 4

A small business needs a disaster recovery site that can be brought online within 2 hours of a primary site failure. The business can tolerate minimal data loss. Which type of recovery site should they implement?

Accepted Answer

Hot site. A hot site maintains near-real-time data replication and preconfigured hardware, enabling failover within 2 hours and minimal data loss. A cold site (Option A) requires hardware setup and data restoration, taking days. A warm site (Option B) has pre-installed hardware but lacks current data, typically taking hours to a day to activate. A mobile site (Option D) is a portable solution with variable provisioning time and may not meet the 2-hour requirement consistently.

Answer

Cold site

Answer

Warm site

Answer

Mobile site

Question 5

A mid-sized e-commerce company experienced a ransomware attack that encrypted all on-premises servers and their locally attached backup storage. The attack occurred on a Friday evening; the company was closed over the weekend. By Monday morning, the IT team discovered the encryption and found a ransom note demanding $500,000 in Bitcoin. The company has a disaster recovery plan that calls for restoring from daily tape backups stored offsite. However, the most recent offsite tape was taken home by a backup operator for the weekend and has not been returned. The tape contains full backups from Wednesday. The IT team has clean installation media and application software available. The company's RPO is 24 hours, and RTO is 48 hours. Management wants to minimize data loss and avoid paying the ransom. Based on this scenario, which of the following should the IT team do to recover the business operations?

Accepted Answer

Rebuild the servers from scratch using clean media, restore the latest offsite tape if available, and apply available transaction logs from the on-premises backup server that was encrypted (attempting to recover unencrypted logs).. It follows the existing DR plan by restoring from the available offsite tape (even though a few days old) and builds clean servers to avoid reinfection. It also attempts to salvage any unencrypted transaction logs from the compromised environment to minimize data loss beyond Wednesday. Paying the ransom (Option B) is against best practices and may not guarantee full recovery. Waiting for the operator to return the tape (Option C) delays action and may still result in significant data loss; the operator's return is uncertain. Manually re-entering transactions (Option D) is highly labor-intensive, error-prone, and could exceed the 48-hour RTO.

Answer

Pay the ransom to obtain the decryption key, then restore the environment, and implement better security controls.

Answer

Rebuild the servers from scratch using clean media, and manually re-enter transactions since the last good backup based on paper records and customer emails.

Answer

Wait for the backup operator to return the tape, then restore from that tape, accepting data loss since Wednesday.

Question 6

Refer to the exhibit. A server administrator is reviewing security logs after a suspected brute-force attack on the SSH service. The following excerpt from /var/log/secure is displayed. Which security control would have been MOST effective in preventing the successful login?

Accepted Answer

Implementing fail2ban or similar intrusion prevention.. Option B is correct because fail2ban or a similar intrusion prevention system monitors logs for repeated failures and blocks the attacker's IP address after a configurable number of attempts, stopping the attack before the correct password is guessed. Option A is wrong because a strong password policy might resist guessing for a long time, but the admin password was eventually guessed; it does not actively prevent repeated attempts. Option C is wrong because disabling root login would not have prevented the attack on the admin account, which was the one compromised. Option D is wrong because changing the SSH port is security through obscurity and does not prevent brute-force attempts once the port is discovered.

Answer

Disabling root login via SSH.

Answer

Enforcing a strong password policy.

Answer

Using a different SSH port.

Question 7

After an unexpected power outage, a server fails to boot and displays an error indicating a degraded RAID array. The server has a RAID 5 configuration with four disks. One disk has failed, but the hot spare did not automatically rebuild. The administrator needs to restore data availability as quickly as possible. Which action should the technician take FIRST?

Accepted Answer

Replace the failed disk and initiate a manual rebuild.. Option A is correct because replacing the failed disk and initiating a manual rebuild directly restores redundancy and availability using the existing parity data. Option B is wrong because the hot spare is not faulty; the rebuild did not trigger automatically, likely due to a configuration issue, and swapping it does not address the failed disk. Option C is wrong because while a bad battery or cache can cause rebuild failures, checking this is a later step; the immediate need is to replace the failed disk to restore redundancy. Option D is wrong because a backup restore is a last resort and may result in data loss; the array is degraded but still functional, so rebuilding is faster and less disruptive.

Answer

Restore the server from the latest backup.

Answer

Check the RAID controller battery and cache.

Answer

Replace the hot spare with a new disk.

Question 8

A server administrator is restoring a file server from a full backup taken 7 days ago and incremental backups taken daily. The restoration fails with an error about missing catalog files. What is the most likely cause?

Accepted Answer

The incremental backup chain is broken. Incremental backups depend on a chain that starts with a full backup and then each subsequent incremental backup references the previous one. If any link in the chain is missing, corrupted, or the catalog that tracks the chain is damaged, the restore fails with an error about missing catalog files. The most likely cause is that the incremental backup chain is broken, meaning the backup software cannot locate the required incremental sets to reconstruct the file server state.

Answer

The hard drive on the file server has failed

Answer

The backup software is not compatible with the current OS version

Answer

The full backup media is corrupted

Question 9

You are the lead server administrator for a mid-sized e-commerce company. The web application is hosted on a farm of four Linux servers running Apache, fronted by a hardware load balancer. The load balancer currently uses a round-robin algorithm. Recently, the customer support team has received numerous complaints about slow page load times and occasional timeouts during checkout. You log into the server monitoring console and observe that one of the web servers, web03, has a CPU utilization consistently above 95%, while the other three servers are at around 30-40%. You connect via SSH to web03 and run the 'top' command, identifying a process named 'imagick' consuming 99% CPU. Further investigation reveals that this process is related to image resizing for product thumbnails, and it appears to have entered an infinite loop due to a malformed image file. Meanwhile, the load balancer continues to send requests to all servers equally, including the overloaded web03, causing some requests to time out. You need to restore performance immediately and prevent recurrence. Which of the following actions should you take?

Accepted Answer

Kill the 'imagick' process on web03, change the load balancer algorithm to least connections, and clear the malformed image.. It directly addresses both issues: the runaway process (killing it stops the CPU drain) and the load balancer algorithm (switching to least connections prevents sending traffic to an already overloaded server). Additionally, clearing the malformed image addresses the root cause of the loop. Option A (adding servers) may temporarily hide the problem but does not fix the load distribution or the looping process; the overloaded server would still exist. Option C (rebooting all servers) is unnecessarily disruptive and does not address the root cause; the malformed image could trigger the loop again after reboot. Option D (increasing RAM) misidentifies the issue as memory-related when it is clearly CPU-bound; more RAM would not stop the infinite loop.

Answer

Reboot all four web servers to clear any stuck processes.

Answer

Increase RAM on web03 to handle the high CPU process better.

Answer

Add two more servers to the farm and keep the round-robin algorithm.

Question 10

A company performs full backups every Sunday and differential backups daily. After a ransomware attack, they discover that both the production data and all attached backup media were encrypted. They need to ensure data can be recovered in the future. Which of the following is the BEST change to their backup strategy?

Accepted Answer

Store backups on an air-gapped or offline system.. Air-gapped backups are physically isolated and cannot be reached by ransomware, ensuring recoverability. Option A increases backup frequency but doesn't protect against ransomware that encrypts attached media. Option B changes backup type but still leaves backups online and vulnerable. Option C protects data at rest but if the encryption keys are on the same system, they can be compromised, and encryption itself doesn't prevent deletion/encryption by ransomware.

Answer

Encrypt the backup data using AES-256.

Answer

Perform full backups daily instead of weekly.

Answer

Switch from differential to incremental daily backups.