SK0-005 Hard Questions — 25 Difficult Questions

Question 1

A server administrator is troubleshooting a server that randomly reboots multiple times a day. The operating system is Windows Server 2019. The administrator has enabled memory dump collection and notices that no dump files are being created. Which of the following is the MOST likely cause?

Accepted Answer

The page file is too small or located on a different volume than the dump file path.. The correct answer is that the page file is too small or located on a different volume than the dump file path. Windows requires the page file to be on the system volume and large enough to hold the dump. If these conditions are not met, dump files will not be created. This is a frequent oversight when configuring memory dumps for troubleshooting random reboots.

Answer

The crash is caused by a hardware failure that bypasses the operating system's dump mechanism.

Answer

The dump file path is set to a network share that is unavailable during the crash.

Answer

The server's BIOS is outdated and does not support memory dump generation.

Question 2

A server administrator is configuring a new server that will host a high-traffic web application. The administrator needs to optimize the server's network performance. Which TWO of the following should be implemented? (Choose two.)

Accepted Answer

Configure NIC teaming for redundancy and load balancing.. Enabling jumbo frames and configuring NIC teaming are direct performance optimizations for a high-traffic web server. Jumbo frames reduce overhead for large transfers, while NIC teaming provides redundancy and load balancing. The other options either degrade performance or do not directly enhance it. These two together can significantly improve network throughput and reliability.

Answer

Assign a static IP address to the server.

Answer

Disable TCP offloading on the network adapter.

Answer

Set the network adapter to half-duplex mode.

Question 3

A company uses a two-node failover cluster for a critical application. The cluster nodes are located in the same data center, and the quorum configuration uses a file share witness on a separate server in the same data center. During a major power outage, both cluster nodes and the file share witness server lose power. What is the impact on cluster availability?

Accepted Answer

The cluster will be offline until one of the nodes or the witness comes back online.. With a two-node cluster plus a file share witness, quorum requires a majority of votes — 2 out of 3. When both nodes and the witness lose power simultaneously, no votes remain, so the cluster cannot achieve quorum and all clustered roles go offline. Availability is restored only when at least two of the three voting members (e.g., one node plus the witness, or both nodes) return.

Answer

The cluster will automatically fail over to a third site because the witness server is unavailable.

Answer

The cluster continues operating because the nodes can use a dynamic quorum and adjust the vote count.

Answer

The cluster remains online because the nodes can communicate directly and form quorum without the witness.

Question 4

A database server running on a Linux VM has started experiencing periodic crashes. The VM is hosted on an ESXi hypervisor. The system logs show entries: 'kernel: Out of memory: Kill process 12345 (mysqld) score 700 or sacrifice child'. The VM has 16GB RAM allocated and no memory overcommitment on the host. The DBA reports that the database workload hasn't increased. Which of the following actions should be taken FIRST to diagnose the issue?

Accepted Answer

Check the host's memory utilization for ballooning or swapping.. The OOM killer being invoked in a VM with stable workload suggests possible host-level memory constraints (e.g., ballooning, swapping) affecting the VM. Checking the host's memory utilization helps confirm whether the hypervisor is under memory pressure and causing the VM to think it's out of memory. Options A and D are configuration changes that might alleviate symptoms but don't diagnose root cause. B addresses database tuning, which is not indicated when the system reports OOM.

Answer

Add a memory reservation for the VM in ESXi.

Answer

Analyze the database query cache hit ratio and slow query logs.

Answer

Increase the VM's RAM allocation to 32GB.

Question 5

A server administrator is troubleshooting a server that is exhibiting slow disk performance. The server uses a hardware RAID controller with a write-back cache and battery backup unit (BBU). Performance monitoring shows high disk latency and low IOPS. The administrator suspects the RAID controller is the bottleneck. Which of the following should the administrator check? (Choose two.)

Accepted Answer

Verify that the BBU is healthy and the write-back cache is enabled.. The two most relevant checks are the BBU status and write-back cache policy, and the health of the physical disks. A failed BBU disables write-back caching, causing performance degradation, while failing disks cause latency. These directly address the suspected RAID controller bottleneck.

Answer

Update the RAID controller firmware to the latest version.

Answer

Increase the server's RAM to improve disk caching.

Answer

Reconfigure the RAID level from RAID 5 to RAID 0.

Question 6

A company has a small virtualized environment with two ESXi 7.0 hosts (HostA and HostB) managed by vCenter Server. They use a shared iSCSI storage array for all VMs. The network consists of a single physical switch that connects the hosts, storage, and management traffic using VLANs. Yesterday, the switch failed and was replaced with an identical model. After restoring the configuration from a backup, all VMs on HostA are working normally, but all VMs on HostB show 'network disconnected' in the vSphere console. The VMs on HostB are still running, but they cannot communicate with any other device on the network. HostB itself is reachable via its management IP and can access the storage array. The administrator has verified that the physical cables are correct and the NICs are up on HostB. The VLAN configuration on the new switch was restored for the ports connecting HostB, but the issue persists. Which of the following actions should the administrator perform FIRST to restore connectivity?

Accepted Answer

Check the VLAN configuration on the switch ports connected to HostB for the VM network uplinks.. Option B is correct. Since all other functions (management, storage) work and only VM traffic is affected, the most likely cause is incorrect VLAN tagging on the switch port carrying the VM traffic uplink. Restoring a switch config may have missed the exact VLAN trunk settings. Checking and correcting the VLAN configuration on the switch ports for HostB's VM network is the first targeted step. Options A and C are nondisruptive but don't address the immediate config issue. Option D involves rebooting the host without diagnosing, which is risky and may not fix the issue.

Answer

Reboot HostB to renegotiate the network configuration.

Answer

Restart the vCenter Server service on the vCenter appliance.

Answer

vMotion all affected VMs from HostB to HostA to confirm they work on HostA.

Question 7

A server administrator is troubleshooting a Windows Server 2019 that randomly reboots. The administrator suspects a hardware issue. Which two actions should the administrator take to gather evidence of the cause? (Choose two.)

Accepted Answer

Configure a memory dump and analyze it with WinDbg.. To diagnose random reboots, the administrator should first check the System event log for Event ID 41, which indicates an unclean shutdown and may include a bugcheck code. Additionally, configuring a memory dump and analyzing it with WinDbg provides detailed crash information, including the faulting driver or hardware component. These actions gather concrete evidence, unlike preventive measures or general system checks.

Answer

Update the BIOS and all device drivers to the latest versions.

Answer

Enable and review the Windows Memory Diagnostic results.

Answer

Run the sfc /scannow command to check for system file corruption.

Question 8

A server administrator is troubleshooting a Windows Server 2022 host that presents a RAID 10 array to the operating system as a single 2 TB volume. Users report that write performance to a database on this volume has degraded sharply over the past week, and the array's management utility shows all member drives as online with no rebuild in progress. Which of the following should the administrator check FIRST to identify the cause?

Accepted Answer

The RAID controller's write cache policy and battery/capacitor health status.. With all RAID 10 member drives online and no rebuild activity, the sudden write slowdown most likely originates at the controller level. A failed cache battery or capacitor causes the controller to switch from write-back to write-through, which removes the performance benefit of the cache and sharply increases write latency. The cache policy and module health are therefore the first things to verify.

Answer

The NTFS cluster size of the volume presented to the operating system.

Answer

The number of spare drives assigned to the array.

Answer

The stripe size configured on the RAID 10 array.

Question 9

A security administrator is configuring a Linux server to allow only SSH and HTTPS traffic from a specific management subnet while blocking all other inbound traffic. The server has two network interfaces: eth0 (public) and eth1 (management). Which command should the administrator use to view the current iptables rules with line numbers to identify the rule positions before modifying them?

Accepted Answer

iptables -L --line-numbers. The administrator needs to view the current iptables rules with line numbers to identify rule positions before making changes. The iptables -L --line-numbers command lists all rules with line numbers, allowing precise insertion or deletion. This is critical when reordering rules to ensure management subnet traffic is permitted before any default deny rule. Other commands either lack line numbers or are destructive.

Answer

iptables -F

Answer

iptables -L -n -v

Answer

iptables -S

Question 10

A server administrator is troubleshooting a newly installed 10 GbE network adapter that is not achieving expected throughput. The adapter is connected to a switch port configured for 10 Gbps full duplex. The administrator runs ethtool and sees that the link speed is reported as 1000 Mb/s. Which of the following is the MOST likely cause?

Accepted Answer

The cable is a Cat 5e cable that does not support 10 Gbps.. The most likely cause is that the cable does not support 10 Gbps. Cat 5e cables are limited to 1 Gbps, so the adapter negotiates at that speed. Upgrading to Cat 6 or higher is necessary for 10 GbE. Switch misconfiguration and faulty hardware are less likely given the scenario details.

Answer

The switch port is misconfigured for 1 Gbps.

Answer

The adapter driver needs to be updated.

Answer

The network adapter is faulty and needs replacement.

Question 11

A server administrator is diagnosing a newly installed server that intermittently reboots under heavy load. The server has redundant power supplies connected to separate PDUs. Which of the following should the administrator verify? (Choose two.)

Accepted Answer

The power supplies are fully seated and the power cords are secure.. Intermittent reboots under heavy load often stem from power delivery issues. Each redundant power supply must be able to handle the full server load, and physical connections must be secure to prevent momentary power loss. Verifying these two factors addresses the most likely causes before considering firmware or load-balancing settings.

Answer

The power supplies are operating in a load-balanced or active/active configuration.

Answer

The power supplies are connected to the same PDU for load balancing.

Answer

The power supply firmware is up to date.

Question 12

A system administrator manages a Windows Server 2019 environment with multiple physical servers. The administrator needs to implement a remote management solution that provides out-of-band access to the servers' console even when the operating system is unresponsive or powered off. The solution must also allow mounting virtual media for OS installation and support remote power cycling. Which TWO of the following should the administrator implement? (Choose two.)

Accepted Answer

Configure the servers' baseboard management controllers (BMCs) with dedicated network access.. Out-of-band management requires a baseboard management controller (BMC) or an integrated lights-out interface like iLO or iDRAC. These components operate independently of the operating system, providing console access, virtual media mounting, and remote power cycling even when the server is off or unresponsive. Configuring dedicated network access for the BMC ensures reliable connectivity. Other options like RDP or VPNs do not provide the required out-of-band capabilities.

Answer

Set up a VPN connection for administrators to access the server management network.

Answer

Enable Remote Desktop Protocol (RDP) on all servers and restrict access via firewall rules.

Answer

Deploy a terminal server and use it as a jump host for administrative connections.

Question 13

A company is designing a disaster recovery plan for its primary datacenter. The plan must include a warm site that can take over production within four hours and must verify that the recovery procedures actually work. Which two elements should be included? (Choose two.)

Accepted Answer

A tabletop exercise that walks stakeholders through the recovery steps and identifies gaps in the plan.. A workable disaster recovery plan for a four-hour warm site takeover needs measurable objectives and validation. Documented RTO and RPO values define the acceptable downtime and data loss, guiding the warm site design and replication schedule. A tabletop exercise validates the plan by walking stakeholders through the procedures, revealing gaps without risking production. The other options either describe a real outage, an inadequate cold site, or backups stored in a single failure domain, none of which support the stated recovery targets.

Answer

Biweekly incremental backups to tape stored only in the primary datacenter.

Answer

A full-scale failover test that shuts down the primary datacenter during business hours without notifying users.

Answer

A cold site with no pre-installed hardware or data replication, relying on emergency procurement during a disaster.

Question 14

A server administrator needs to configure a RAID array for a database server that requires high fault tolerance and performance. The server has six 300 GB SAS drives and a hardware RAID controller. Which RAID level should be used to meet these requirements while maximizing usable capacity?

Accepted Answer

RAID 10. RAID 10 is the best choice for a database server needing high fault tolerance and performance. It provides redundancy through mirroring and improved performance via striping. While usable capacity is lower than RAID 5, the enhanced write performance and faster rebuild times are critical for database operations. Other RAID levels either lack fault tolerance or have performance limitations.

Answer

RAID 1

Answer

RAID 0

Answer

RAID 5

Question 15

A server administrator is configuring a new Windows Server 2022 file server. The server has a RAID 5 array with three 4 TB SAS drives. The administrator needs to create a volume that provides fault tolerance and can be expanded in the future without taking the server offline. Which of the following should the administrator use?

Accepted Answer

Storage Spaces with a parity volume.. Storage Spaces with a parity volume provides fault tolerance and supports online expansion, allowing the administrator to add capacity without downtime. Disk Management mirrored volumes offer redundancy but cannot be expanded online, and spanned volumes lack fault tolerance. Simple volumes in Storage Spaces also lack redundancy.

Answer

Storage Spaces with a simple volume.

Answer

Disk Management with a spanned volume.

Answer

Disk Management with a mirrored volume.

Question 16

A company has a Windows Server 2022 server that hosts a critical database. The server has four network adapters. The administrator wants to ensure that the server remains accessible even if one network adapter fails, and also wants to aggregate bandwidth for better performance. The network switch supports link aggregation. Which of the following should the administrator implement?

Accepted Answer

Configure NIC teaming in LACP mode with Address Hash load balancing.. The administrator needs both fault tolerance and increased bandwidth. NIC teaming in LACP mode with Address Hash load balancing provides link aggregation and failover, and the switch supports LACP. Other modes either lack bandwidth aggregation or are not suitable for the workload.

Answer

Configure NIC teaming in Switch Independent mode with Dynamic load balancing.

Answer

Configure each network adapter with a separate IP address and enable DNS round-robin.

Answer

Configure NIC teaming in Switch Independent mode with Hyper-V Port load balancing.

Question 17

A company has a Linux server running a critical web application. The server has two network interfaces: eth0 connected to the internal network (192.168.1.0/24) and eth1 connected to a DMZ network (10.0.0.0/24). The web application must be accessible from the internet via the DMZ, but the internal network must not be directly accessible from the DMZ. The administrator needs to configure the server to route traffic between the two networks only for established connections initiated from the internal network. Which of the following should the administrator implement?

Accepted Answer

Enable IP forwarding and configure iptables with a rule to allow only established and related connections from eth0 to eth1.. The server must route traffic between the internal network and the DMZ, but only for connections initiated from the internal network. Enabling IP forwarding is necessary for routing. The iptables rule should allow established and related connections from the internal interface to the DMZ interface, which permits return traffic for internally initiated sessions while blocking new connections from the DMZ. This effectively prevents direct access from the DMZ to the internal network.

Answer

Disable IP forwarding and configure a static route between the two networks.

Answer

Enable IP forwarding and configure a firewall rule to drop all traffic from eth1 to eth0.

Answer

Enable IP forwarding and configure iptables with a rule to allow all traffic between eth0 and eth1.

Question 18

A security administrator is hardening a Linux server that hosts a public web application. The server must allow inbound HTTPS from anywhere, SSH only from the management subnet 192.168.10.0/24, and must block all other inbound traffic. The administrator decides to use the local firewall. Which of the following commands should the administrator run to apply this policy immediately and persistently?

Accepted Answer

iptables -A INPUT -p tcp --dport 443 -j ACCEPT; iptables -A INPUT -p tcp --dport 22 -s 192.168.10.0/24 -j ACCEPT; iptables -A INPUT -j DROP; iptables-save > /etc/iptables/rules.v4. The correct policy must accept HTTPS from anywhere, accept SSH only from the management subnet, and drop everything else, with rules in that order. Saving with iptables-save to /etc/iptables/rules.v4 ensures persistence across reboots on systems using iptables-persistent. The REJECT variant is less secure because it responds to blocked traffic, and the other options either misorder rules or fail to persist reliably.

Answer

iptables -A INPUT -p tcp --dport 22 -s 192.168.10.0/24 -j ACCEPT; iptables -A INPUT -p tcp --dport 443 -j ACCEPT; iptables -A INPUT -j DROP; service iptables save

Answer

iptables -A INPUT -p tcp --dport 443 -j ACCEPT; iptables -A INPUT -p tcp --dport 22 -s 192.168.10.0/24 -j ACCEPT; iptables -A INPUT -j REJECT; iptables-save > /etc/iptables/rules.v4

Answer

iptables -A INPUT -p tcp --dport 443 -j ACCEPT; iptables -A INPUT -p tcp --dport 22 -j ACCEPT; iptables -A INPUT -s 192.168.10.0/24 -j DROP; iptables -A INPUT -j DROP; iptables-save > /etc/iptables/rules.v4

Question 19

A server administrator is planning to install a new PCIe SSD into a server to improve database performance. The server has available PCIe 3.0 x8 slots. Which of the following should the administrator verify before installation? (Choose two.)

Accepted Answer

The server's firmware and driver support for the specific PCIe SSD model. The administrator must verify firmware/driver support and physical slot compatibility. Firmware and drivers ensure the SSD is recognized and functions correctly. Physical slot length and height ensure the card fits without obstruction. Other factors like power connectors or RAID cache battery are not relevant to PCIe SSD installation.

Answer

The availability of an empty memory slot for caching

Answer

The server's RAID controller cache battery status

Answer

The server's power supply wattage and available power connectors

Question 20

A security administrator is hardening a Linux web server that hosts a public-facing application. The server currently allows SSH access from any IP address and uses password authentication. The administrator wants to reduce the attack surface and implement defense in depth. Which two actions should the administrator take? (Choose two.)

Accepted Answer

Disable SSH password authentication and enforce public key authentication.. Limiting SSH access to a management subnet restricts who can attempt to connect, and enforcing public key authentication removes the vulnerability of password-based attacks. Together, these measures significantly harden SSH by implementing network-level and authentication-level controls, directly reducing the attack surface and adding defense in depth.

Answer

Enable root login over SSH to simplify administrative tasks.

Answer

Install a host-based intrusion detection system (HIDS) to monitor file integrity.

Answer

Change the SSH default port from 22 to a non-standard port.