SK0-005 Timed Hard Questions — 25 Difficult Questions

Question 1

A medium-sized company uses a backup strategy that includes a full backup every Sunday at 2:00 AM and differential backups Monday through Saturday at 2:00 AM. The backups are written to a network-attached storage (NAS) device. On Thursday morning, the company experiences a ransomware attack that encrypts all data on the file server, including the NAS. The administrator needs to restore the file server with minimal data loss. The last successful full backup was from the previous Sunday, and differential backups were successful on Monday, Tuesday, and Wednesday. However, Thursday's differential was not completed because the attack occurred before the scheduled time. The administrator attempts to restore using the Sunday full backup and Thursday's differential, but the restore fails because the differential backup on the NAS is also encrypted. Which of the following is the best course of action?

Accepted Answer

Restore from the Sunday full backup and Wednesday's differential backup. The most recent clean backup set is Sunday's full plus Wednesday's differential, as both were taken before the ransomware attack. Restoring from these will recover data as of Wednesday's backup, minimizing data loss. Using only Wednesday's differential requires the full backup first. Paying the ransom is not recommended and may not work. Reinstalling the OS and restoring from cloud would not apply because cloud was not mentioned.

Answer

Pay the ransom to decrypt the differential backup

Answer

Reinstall the operating system and restore files from cloud storage

Answer

Restore using only Wednesday's differential backup

Question 2

Several users report sluggish performance from a database server. The server administrator notices that the CPU fans are running at maximum speed and the baseboard management controller (BMC) reports CPU temperatures of 85°C even at idle. The administrator already cleaned dust from the chassis and verified all fans are operational. Which of the following should the administrator do NEXT?

Accepted Answer

Reapply thermal paste on the CPU heat sinks.. High temperatures persist after cleaning and fan checks suggest poor heat conduction between the CPU and heatsink, typically caused by dried or inadequate thermal paste.

Answer

Add additional case fans to improve airflow.

Answer

Replace the CPU fans with higher RPM models.

Answer

Increase the fan speed thresholds in the BIOS.

Question 3

A server administrator needs to set up out-of-band management for a new server. Which THREE of the following are essential for successful configuration and remote access? (Choose three.)

Accepted Answer

A dedicated management network interface (e.g., iDRAC, iLO dedicated port).. Out-of-band management relies on a dedicated hardware controller (BMC), a separate network interface for remote access, and a client-side tool to interact with it.

Answer

A DHCP server configured to provide an IP to the management interface.

Answer

An installed operating system on the server.

Question 4

Refer to the exhibit. A Linux server is reporting slow I/O on the root filesystem. Which of the following actions should the administrator take to resolve the immediate storage bottleneck?

Accepted Answer

Move non-essential data from / to /backup.. Option B is correct because moving non-essential data from the nearly full root filesystem to /backup (which has ample space) quickly alleviates the space shortage and I/O pressure. Option A is wrong because resizing /dev/sda1 may require downtime and complex partitioning operations; it is not an immediate fix. Option C is wrong because deleting log files may free some space but might also delete valuable diagnostic data and may not be sufficient. Option D is wrong because changing the RAID level of /dev/sda is a fundamental hardware change that does not address the immediate space issue and could be destructive.

Answer

Delete log files in /var/log.

Answer

Resize /dev/sda1 to 30G.

Answer

Change the RAID level of /dev/sda.

Question 5

A MySQL database server on Linux is experiencing high CPU utilization during peak business hours. Upon investigation, the administrator finds that the query cache hit ratio is below 20%, and the query_cache_size is set to 0. The server has 64 GB of RAM and the database workload is primarily read-heavy. Which of the following actions should the administrator take FIRST to improve performance?

Accepted Answer

Set query_cache_size to an appropriate value, such as 256M, and monitor.. Option D is correct because the query cache is disabled (size 0). Enabling it and setting an appropriate size will increase cache hits and reduce CPU load. Option A adds RAM but does not address the misconfigured cache. Option B identifies queries but does not directly fix the cache. Option C rebuilds indexes, which may not impact query caching.

Answer

Add more RAM to the server.

Answer

Rebuild all indexes on the database tables.

Answer

Enable the slow query log to identify inefficient queries.

Question 6

Which THREE of the following are typically essential elements of a disaster recovery plan (DRP)? (Choose three.)

Accepted Answer

Emergency contact and communication plan. Options A, C, and E are correct. A business impact analysis (A) identifies critical functions and recovery priorities. An emergency contact and communication plan (C) ensures key personnel are reachable. A test and exercise schedule (E) validates the plan's effectiveness. Server hardware specifications (B) are operational details, not a core DRP element. A network topology diagram (D) supports recovery but is not always considered an essential DRP component; it is supplementary.

Answer

Server hardware specifications

Answer

Network topology diagram

Question 7

A database server with 64 GB of RAM and RAID 5 storage is experiencing intermittent performance degradation. System monitoring shows constant 95% memory utilization, high disk queue length, and frequent page faults. The server is running a critical application that cannot be restarted during business hours. Which action will provide the BEST permanent resolution?

Accepted Answer

Add more physical RAM. High memory utilization combined with frequent page faults indicates a memory bottleneck. Adding physical RAM eliminates the need for paging, permanently resolving the root cause. Increasing or moving the page file only mitigates the symptoms, while replacing RAID 5 with RAID 10 improves disk performance but does not address the underlying memory shortage.

Answer

Replace the RAID 5 array with RAID 10

Answer

Move the page file to a dedicated SSD

Answer

Increase the size of the page file

Question 8

A database server running on a Linux VM has started experiencing periodic crashes. The VM is hosted on an ESXi hypervisor. The system logs show entries: 'kernel: Out of memory: Kill process 12345 (mysqld) score 700 or sacrifice child'. The VM has 16GB RAM allocated and no memory overcommitment on the host. The DBA reports that the database workload hasn't increased. Which of the following actions should be taken FIRST to diagnose the issue?

Accepted Answer

Check the host's memory utilization for ballooning or swapping.. Option C is correct because the OOM killer being invoked in a VM with stable workload suggests possible host-level memory constraints (e.g., ballooning, swapping) affecting the VM. Checking the host's memory utilization helps confirm whether the hypervisor is under memory pressure and causing the VM to think it's out of memory. Options A and D are configuration changes that might alleviate symptoms but don't diagnose root cause. B addresses database tuning, which is not indicated when the system reports OOM.

Answer

Add a memory reservation for the VM in ESXi.

Answer

Analyze the database query cache hit ratio and slow query logs.

Answer

Increase the VM's RAM allocation to 32GB.

Question 9

A company has a small virtualized environment with two ESXi 7.0 hosts (HostA and HostB) managed by vCenter Server. They use a shared iSCSI storage array for all VMs. The network consists of a single physical switch that connects the hosts, storage, and management traffic using VLANs. Yesterday, the switch failed and was replaced with an identical model. After restoring the configuration from a backup, all VMs on HostA are working normally, but all VMs on HostB show 'network disconnected' in the vSphere console. The VMs on HostB are still running, but they cannot communicate with any other device on the network. HostB itself is reachable via its management IP and can access the storage array. The administrator has verified that the physical cables are correct and the NICs are up on HostB. The VLAN configuration on the new switch was restored for the ports connecting HostB, but the issue persists. Which of the following actions should the administrator perform FIRST to restore connectivity?

Accepted Answer

Check the VLAN configuration on the switch ports connected to HostB for the VM network uplinks.. Option B is correct. Since all other functions (management, storage) work and only VM traffic is affected, the most likely cause is incorrect VLAN tagging on the switch port carrying the VM traffic uplink. Restoring a switch config may have missed the exact VLAN trunk settings. Checking and correcting the VLAN configuration on the switch ports for HostB's VM network is the first targeted step. Options A and C are nondisruptive but don't address the immediate config issue. Option D involves rebooting the host without diagnosing, which is risky and may not fix the issue.

Answer

Reboot HostB to renegotiate the network configuration.

Answer

Restart the vCenter Server service on the vCenter appliance.

Answer

vMotion all affected VMs from HostB to HostA to confirm they work on HostA.

Question 10

A corporation's backup strategy currently involves a weekly full backup every Saturday night and daily differential backups Monday through Friday. The company has a 5 TB dataset with a daily change rate of about 10%. The full backup takes 12 hours and runs into Monday morning, impacting production performance. The backup window is from 10 PM to 6 AM. The company requires faster backups that can complete within the window, and they also want an offsite copy of the backups for disaster recovery. The existing backup server has direct-attached disk storage and a tape library. The network bandwidth to the offsite location is limited to 100 Mbps. The administrator is evaluating changes to the backup methodology and infrastructure to meet these requirements. Which of the following solutions best addresses the speed and offsite requirements?

Accepted Answer

Implement a disk-to-disk-to-cloud solution using changed block tracking for daily incrementals and replication to the cloud. Option D is correct because it uses changed block tracking to perform incremental backups quickly, stores them on disk (fast), and replicates to cloud, which achieves offsite copy despite limited bandwidth by sending only changed blocks. Option A is wrong because synthetic full backups still require reading all data to synthesize, and offsite copy is not addressed. Option B is wrong because multiple tape drives increase throughput but do not directly reduce the amount of data backed up daily, and offsite tape handling is manual. Option C is wrong because daily differentials will still grow each day and may exceed the window, and offsite is not specified.

Answer

Upgrade the tape library to use multiple tape drives for parallel backups and rotate tapes offsite daily

Answer

Switch to synthetic full backups combined with incremental forever; store backups locally on disk

Answer

Continue weekly fulls but perform daily incremental backups instead of differentials; keep tapes on-site

Question 11

A server configured with dual redundant power supplies unexpectedly shuts down when one power supply fails. Both power supplies are rated for the server's total load and were functioning before the failure. What is the MOST likely reason for the shutdown?

Accepted Answer

Redundant mode was not configured in the server management settings. If redundant mode is not enabled (Option B), the power supplies may operate in combined/load‑sharing mode, and failure of one can overload the other. Hot‑swap capability (A) allows replacement without shutdown but does not prevent an outage if the remaining PSU cannot handle the load. Wattage mismatch (C) is unlikely if both were working, and different vendors (D) do not normally cause shutdown if the PSUs are compatible.

Answer

The power supplies were not hot‑swappable

Answer

The failed power supply had a higher wattage rating than the remaining one

Answer

The power supplies were from different manufacturers

Question 12

A small business relies on a tower server that acts as a file and print server for 15 employees. The server has a single Intel Xeon E-2300 series processor, four 16GB DDR4 ECC RDIMMs installed in dual-channel configuration, and two 2TB 7200 RPM SATA hard drives in a hardware RAID 1 mirror. The power supply unit (PSU) is a 500W 80+ Bronze unit that is about four years old. Recently, the server has started experiencing random, intermittent crashes resulting in a blue screen, typically during periods of heavy disk I/O, such as when multiple users access large files. Event Viewer logs show occasional corrected memory errors (ECC events) but no uncorrected errors. The administrator runs MemTest86+ on all four DIMMs for multiple passes, and no errors are detected. The server room ambient temperature is normal, and all fans are operating. The crashes are becoming more frequent. Which of the following actions would MOST likely resolve the underlying issue?

Accepted Answer

Upgrade the power supply to a higher wattage, 80+ Gold unit. Option B is correct. Intermittent crashes under heavy load, combined with ECC corrected errors but passing memory tests, can indicate a power supply that is failing or inadequate under peak load. A 500W PSU may be marginal, especially with aging capacitors, causing voltage drops that lead to memory and system instability. Option A: Replacing the motherboard is premature, as no clear evidence points to a faulty memory controller. Option C: Reseating RAM may help if a connection issue, but given MemTest passes and errors are corrected, physical seating is less likely. Option D: Replacing HDDs with SSDs would reduce I/O load but does not address the likely power instability causing memory errors and crashes.

Answer

Reseat all memory modules and clean the DIMM slots

Answer

Replace the hard drives with solid-state drives (SSDs)

Answer

Replace the motherboard, as the memory controller is likely failing

Question 13

A server administrator is restoring a file server from a full backup taken 7 days ago and incremental backups taken daily. The restoration fails with an error about missing catalog files. What is the most likely cause?

Accepted Answer

The incremental backup chain is broken. Restoring from incremental backups requires a complete chain from the last full backup. If any incremental backup in the chain is missing or corrupted, the restore will fail. Corrupted full backup media would cause a different error. OS compatibility issues would likely appear earlier. Hard drive failure would be a hardware error.

Answer

The hard drive on the file server has failed

Answer

The backup software is not compatible with the current OS version

Answer

The full backup media is corrupted

Question 14

A server administrator is troubleshooting a performance issue on a VMware vSphere host. The host has multiple VMs, and one VM is experiencing high latency on its virtual disk. The administrator checks the datastore and sees it is a RAID 5 array of 4 SAS drives with 50% utilization. Latency for the VM's virtual disk is reported as 200ms. Which action would most likely improve performance?

Accepted Answer

Migrate the VM to a different datastore with SSD storage.. High latency on a heavily utilized RAID 5 array of spinning disks suggests an I/O bottleneck. Migrating to SSD storage would significantly reduce latency. Option A addresses memory, not disk; B might help with allocation but not latency; C might increase capacity but not improve latency (RAID 6 has more overhead).

Answer

Add a second disk to the RAID 5 array (convert to RAID 6).

Answer

Increase the VM's memory allocation.

Answer

Change the virtual disk type from thin to thick.

Question 15

A company uses a two-node failover cluster for a critical application. The cluster nodes are located in the same data center, and the quorum configuration uses a file share witness on a separate server in the same data center. During a major power outage, both cluster nodes and the file share witness server lose power. What is the impact on cluster availability?

Accepted Answer

The cluster will be offline until one of the nodes or the witness comes back online.. In a two-node cluster with a file share witness, if both nodes and the witness are unavailable, the cluster cannot achieve quorum and will be offline. This is because the cluster requires a majority of votes to stay online. With only two nodes, the witness is needed to break ties. Without any votes, the cluster fails.

Answer

The cluster will automatically fail over to a third site because the witness server is unavailable.

Answer

The cluster continues operating because the nodes can use a dynamic quorum and adjust the vote count.

Answer

The cluster remains online because the nodes can communicate directly and form quorum without the witness.

Question 16

A technician is replacing a failed hard drive in a hot-swap RAID 5 array. After inserting the new drive, the RAID controller does not automatically rebuild. What should the technician do first?

Accepted Answer

Manually initiate a rebuild from the RAID controller utility. Many RAID controllers require manual initiation of the rebuild process. Rebooting may not trigger it. Replacing with a different model is unnecessary. Checking cabling is less likely since the drive is detected. The technician should use the controller utility to start the rebuild.

Answer

Check the SAS cable connection

Answer

Reboot the server

Answer

Replace the drive with a different model

Question 17

A RAID 5 array is degraded due to a failed disk. What is the best practice for recovery?

Accepted Answer

Replace the failed disk and allow the array to rebuild automatically. Option C is correct because replacing the failed disk and allowing automatic rebuild utilizes the array's redundancy and minimizes downtime. Option A destroys the existing configuration. Option B and D are unnecessary if the array can rebuild.

Answer

Replace the failed disk and restore from backup

Answer

Replace the failed disk and perform a manual rebuild from backup

Answer

Delete the logical drive and recreate the array

Question 18

You are a server engineer for a financial services firm. The company recently deployed a new HP ProLiant DL380 Gen10 server running Windows Server 2022 with SQL Server 2019. The server has 2 Intel Xeon Gold processors, 128GB RAM, and a Smart Array P408i-p controller managing two RAID 1 arrays: one for OS (two 300GB 10K SAS) and one for data (four 600GB 10K SAS). After one month, the OS array reports a predictive failure on one drive. You replace the drive via hot-swap, and the RAID controller rebuilds. However, the server now experiences random system crashes with Event ID 1001 (BugCheck) and the SQL database occasionally becomes corrupt requiring restore from backup. The server's RAM has been tested with HP's diagnostic tool and passed, and the CPU temperature is normal. The RAID controller log shows no errors during the rebuild but occasional 'Parity errors' logged before the drive replacement. Which of the following is the MOST likely cause of the current instability?

Accepted Answer

The remaining original OS drive has bad sectors that were not detected.. Option C is correct because predictive failure on one drive may indicate that the entire mirrored pair has latent defects; the remaining original drive may have bad sectors that were not detected. The parity errors before replacement suggest data inconsistency, and after rebuild, the system relies on the remaining drive which can cause crashes and database corruption. Option A is wrong because the rebuild completed without errors, so the new drive is likely fine. Option B is wrong because a failed cache module would cause general errors, not specific parity issues. Option D is wrong because a faulty PCIe slot would cause intermittent disconnects of the controller, not these symptoms.

Answer

The new replacement drive is faulty.

Answer

The motherboard has a faulty PCIe slot for the RAID controller.

Answer

The RAID controller cache module has failed.

Question 19

A data center technician is troubleshooting a server that is overheating and shutting down intermittently. The server is a 2U rackmount with six fans at the front and a power supply with an integrated fan at the rear. The technician checks the ambient temperature (72°F) and verifies that the server intake temperature is normal. The server's system logs show 'CPU temperature threshold exceeded' before each shutdown. The technician has replaced the thermal paste on the CPU and reseated the heat sink, but the issue persists. Which of the following should the technician do NEXT?

Accepted Answer

Replace the chassis fans with high-static-pressure models. Option B is correct: the fans may be running but not at full speed due to a faulty fan controller or sensors. Option A is wrong because ambient temp is fine. Option C is wrong because CPU is already reseated. Option D is wrong because power supply is not indicated.

Answer

Move the server to a cooler location in the data center

Answer

Reinstall the CPU heat sink with more thermal paste

Answer

Replace the power supply unit

Question 20

A system administrator is configuring a backup schedule for a critical database server that must be available 24/7. The company's recovery point objective (RPO) is 1 hour and recovery time objective (RTO) is 4 hours. The database files change frequently, but the operating system and application binaries rarely change. Which of the following backup strategies would BEST meet these requirements while minimizing storage and backup window impact?

Accepted Answer

Full backup daily, incremental backup every hour. Option D is correct because daily full backups provide a recent recovery base, and hourly incremental backups are small and fast, meeting the 1-hour RPO with minimal backup window. Restoration applies at most 24 incrementals to the latest full, which fits within the 4-hour RTO. Option A is wrong because weekly full backups with hourly incrementals may require restoring too many incrementals, risking the RTO. Option B is wrong because hourly differential backups grow in size throughout the day, increasing backup time and storage. Option C is wrong because weekly fulls with hourly differentials cause exponential growth in differential size over the week.

Answer

Full backup daily, differential backup every hour

Answer

Full backup weekly, differential backup every hour

Answer

Full backup weekly, incremental backup every hour