SK0-005 Timed Hard Questions — 25 Difficult Questions

Question 1

A technician is replacing a failed hard drive in a hot-swap RAID 5 array. After inserting the new drive, the RAID controller does not automatically rebuild. What should the technician do first?

Accepted Answer

Manually initiate a rebuild from the RAID controller utility. Many RAID controllers require manual initiation of the rebuild process. Rebooting may not trigger it. Replacing with a different model is unnecessary. Checking cabling is less likely since the drive is detected. The technician should use the controller utility to start the rebuild.

Answer

Check the SAS cable connection

Answer

Reboot the server

Answer

Replace the drive with a different model

Question 2

Your organization is migrating a Windows Server 2019 file server with 2 TB of shared data to a new server running Windows Server 2022. The migration must minimize user downtime and ensure file permissions are preserved. Users access files during business hours (8 AM to 6 PM) and the migration must be completed within a four-hour window starting at 10 PM on Saturday. You plan to use DFS Replication (DFSR) for initial data copy and then perform a final synchronization during the cutover. After setting up DFSR between the old and new servers, you realize that the initial replication will take approximately 12 hours due to the large number of files. What should you do to complete the migration within the allowed window?

Accepted Answer

Use robocopy to pre-stage the data from old to new server during off-hours before the cutover, then enable DFSR to replicate only changes made after pre-staging; during the cutover window, do a final DFSR sync. Option C is correct because pre-staging data using robocopy with appropriate flags (copying security and attributes) and then enabling DFSR for the delta changes is a best practice for large migrations. Option A is wrong because simply increasing DFSR bandwidth does not reduce the time needed for initial replication of 2 TB. Option B is wrong because using robocopy alone during the cutover window may not complete within four hours if you need to copy all data; pre-staging is required. Option D is wrong because performing a full backup and restore during the window is too time-consuming for 2 TB.

Answer

Disable DFSR and use robocopy with /MIR /COPYALL during the cutover window to copy all data

Answer

Perform a full backup of the old server and restore to the new server during the cutover window using Windows Backup

Answer

Increase the DFSR staging quota and bandwidth throttling to accelerate initial replication

Question 3

A company has a virtualized server environment with two physical hosts running VMware vSphere. Each host has 2 CPUs, 128GB RAM, and 6x 600GB SAS drives in RAID 10. Recently, host A experienced a power surge that caused it to shut down abruptly. After restarting, the host boots but the RAID controller reports that one of the drives in the RAID 10 array is missing. The administrator has a replacement drive of the same model. What should the administrator do first?

Accepted Answer

Check the RAID controller logs to determine if the drive is faulty or if it's a connection issue, and then reseat the drive or replace cables before replacing. The most appropriate first step is to troubleshoot the connection. The drive might be loose or the cable damaged due to the surge. Option C is correct because reseating or checking cables is non-invasive and could resolve the issue without replacing a working drive. Option A is incorrect because replacing immediately might be unnecessary if the drive is fine. Option B is incorrect because setting as hot spare won't help if the drive is not detected. Option D is incorrect because rebuilding the entire array is drastic and risks data loss.

Answer

Use the RAID controller utility to set the new drive as a hot spare and then reboot

Answer

Replace the missing drive with the new one and allow the RAID controller to automatically rebuild

Answer

Rebuild the entire RAID array after backing up data from the surviving drives

Question 4

A company operates a Windows Server 2019 machine that functions as a domain controller and file server. Over the past week, the server has randomly rebooted several times, often during periods of heavy file access. The administrator reviews the System event log and finds multiple Event ID 41 (Kernel-Power) entries with no preceding critical errors. The server is connected to an uninterruptible power supply (UPS) that reports stable input voltage. The server room temperature sensors indicate normal ambient temperature (22°C / 72°F). The server hardware is three years old and has not had any recent changes. The administrator has already run a full antivirus scan with no threats found. Which of the following should the administrator do NEXT to diagnose the issue?

Accepted Answer

Inspect and clean the CPU and chassis fans, and check for dust buildup. Option C is correct because random reboots with Kernel-Power 41 often indicate overheating due to failing fans or dust buildup, even if ambient temperature is normal. Option A is wrong because the power supply is likely not the issue given the UPS stability. Option B is wrong because a BIOS update is unlikely to solve hardware overheating. Option D is wrong because disabling automatic restart only hides the symptom and does not prevent the reboots.

Answer

Update the server's BIOS to the latest version

Answer

Replace the power supply unit

Answer

Disable the automatic restart feature in System Properties

Question 5

A company is migrating a legacy line-of-business application from Windows Server 2012 R2 to a new Windows Server 2022 server that is a member of an Active Directory domain. The application runs as a Windows service under a domain service account named CORP\svc_app. The service account has been granted the 'Log on as a service' user right on the old server, and the application is configured to listen on a static TCP port 8443. After installing the application on the new server and configuring it with the same service account and port, the application fails to start. The administrator checks the Windows Event Viewer and sees two errors in the System log: 'The CORP\svc_app service failed to start due to the following error: The service did not start due to a logon failure' and 'The service cannot bind to the designated port 8443'. The administrator has already verified that the service account's password is correct and has not expired, that the account is enabled, that the port 8443 is not being used by another service, and that the Windows Firewall has an inbound rule allowing traffic on port 8443. The application's configuration file correctly points to port 8443. What should the administrator do to resolve the issue?

Accepted Answer

Grant the 'Log on as a service' user right to the CORP\svc_app account via Local Security Policy or Group Policy.. The correct answer is B. The 'Log on as a service' user right is a security policy setting that must be explicitly assigned to a service account on each individual server. Even though the account had this right on the old server, it does not automatically carry over to the new server. Without this right, the service cannot start, and the 'logon failure' error is a classic symptom. Option A is incorrect because the password was already verified as correct. Option C is incorrect because the application requires a static port (port 8443) and changing to a dynamic port would break client connectivity. Option D is incorrect because restarting the server does not assign the missing user right and will not resolve the logon failure.

Answer

Restart the Windows Server 2022 server to apply any pending policy changes.

Answer

Configure the application to use a dynamic port instead of the static port 8443.

Answer

Reset the service account password and update the service configuration.

Question 6

A server administrator is restoring a file server from a full backup taken 7 days ago and incremental backups taken daily. The restoration fails with an error about missing catalog files. What is the most likely cause?

Accepted Answer

The incremental backup chain is broken. Restoring from incremental backups requires a complete chain from the last full backup. If any incremental backup in the chain is missing or corrupted, the restore will fail. Corrupted full backup media would cause a different error. OS compatibility issues would likely appear earlier. Hard drive failure would be a hardware error.

Answer

The hard drive on the file server has failed

Answer

The backup software is not compatible with the current OS version

Answer

The full backup media is corrupted

Question 7

A RAID 5 array is degraded due to a failed disk. What is the best practice for recovery?

Accepted Answer

Replace the failed disk and allow the array to rebuild automatically. Option C is correct because replacing the failed disk and allowing automatic rebuild utilizes the array's redundancy and minimizes downtime. Option A destroys the existing configuration. Option B and D are unnecessary if the array can rebuild.

Answer

Replace the failed disk and restore from backup

Answer

Replace the failed disk and perform a manual rebuild from backup

Answer

Delete the logical drive and recreate the array

Question 8

A medium-sized company uses a backup strategy that includes a full backup every Sunday at 2:00 AM and differential backups Monday through Saturday at 2:00 AM. The backups are written to a network-attached storage (NAS) device. On Thursday morning, the company experiences a ransomware attack that encrypts all data on the file server, including the NAS. The administrator needs to restore the file server with minimal data loss. The last successful full backup was from the previous Sunday, and differential backups were successful on Monday, Tuesday, and Wednesday. However, Thursday's differential was not completed because the attack occurred before the scheduled time. The administrator attempts to restore using the Sunday full backup and Thursday's differential, but the restore fails because the differential backup on the NAS is also encrypted. Which of the following is the best course of action?

Accepted Answer

Restore from the Sunday full backup and Wednesday's differential backup. The most recent clean backup set is Sunday's full plus Wednesday's differential, as both were taken before the ransomware attack. Restoring from these will recover data as of Wednesday's backup, minimizing data loss. Using only Wednesday's differential requires the full backup first. Paying the ransom is not recommended and may not work. Reinstalling the OS and restoring from cloud would not apply because cloud was not mentioned.

Answer

Pay the ransom to decrypt the differential backup

Answer

Reinstall the operating system and restore files from cloud storage

Answer

Restore using only Wednesday's differential backup

Question 9

A server administrator is troubleshooting a performance issue on a VMware vSphere host. The host has multiple VMs, and one VM is experiencing high latency on its virtual disk. The administrator checks the datastore and sees it is a RAID 5 array of 4 SAS drives with 50% utilization. Latency for the VM's virtual disk is reported as 200ms. Which action would most likely improve performance?

Accepted Answer

Migrate the VM to a different datastore with SSD storage.. High latency on a heavily utilized RAID 5 array of spinning disks suggests an I/O bottleneck. Migrating to SSD storage would significantly reduce latency. Option A addresses memory, not disk; B might help with allocation but not latency; C might increase capacity but not improve latency (RAID 6 has more overhead).

Answer

Add a second disk to the RAID 5 array (convert to RAID 6).

Answer

Increase the VM's memory allocation.

Answer

Change the virtual disk type from thin to thick.

Question 10

A technician is troubleshooting a server that fails to boot after a scheduled power outage. The server is connected to a UPS. Upon pressing the power button, the server powers on briefly (fans spin, lights flash) and then shuts down after 2 seconds. The POST does not complete. The server has a dual power supply with each connected to a separate PDU. Which of the following is the MOST likely cause?

Accepted Answer

A short circuit in the motherboard. Option C is correct because immediate power-off after a brief spin-up is a classic symptom of a short circuit, often on the motherboard. Option A is wrong because a failed power supply would typically prevent any power-on or cause beep codes, not a brief power-on. Option B is wrong because the UPS battery condition would not cause this behavior if the server is receiving utility power; also the server is receiving power momentarily. Option D is wrong because a dead CMOS battery would cause date/time loss but not prevent boot completely.

Answer

The UPS battery is depleted

Answer

One of the power supplies has failed

Answer

The CMOS battery is dead

Question 11

A large enterprise uses a centralized backup solution with a backup server running Commvault. Backups are stored on a deduplicated disk array and replicated to a secondary site for disaster recovery. The company's security team detects ransomware activity that has encrypted several file servers. The backup administrator checks the backup repository and finds that the backup data is also encrypted because the backup service account had permissions to modify backup files, and the ransomware propagated to the repository. The last known good backup is from two weeks ago, which is too old for the organization's RPO of 24 hours. The backup administrator is under pressure to restore operations quickly. Which of the following should the administrator implement to prevent this from recurring?

Accepted Answer

Immutable backup storage and a dedicated service account with least-privilege access.. The correct answer is A: Implement immutable backup storage and use a separate service account with write permissions only during backup windows. Immutable backups cannot be modified or deleted by any user or process, including ransomware. Option B is wrong because air-gapping alone does not prevent access if the backup server is compromised; immutable storage is more robust. Option C is wrong because while MFA is a good security practice, it does not protect backups that are already accessible with valid credentials. Option D is wrong because encryption of backup data protects it during transit or while stored, but does not prevent the ransomware from encrypting the files if the backup system is accessible.

Answer

Encrypt all backup data at rest and in transit.

Answer

Require multi-factor authentication for the backup service account.

Answer

Air-gap the backup repository by disconnecting it from the network except during backup windows.

Question 12

A company uses a two-node failover cluster for a critical application. The cluster nodes are located in the same data center, and the quorum configuration uses a file share witness on a separate server in the same data center. During a major power outage, both cluster nodes and the file share witness server lose power. What is the impact on cluster availability?

Accepted Answer

The cluster will be offline until one of the nodes or the witness comes back online.. In a two-node cluster with a file share witness, if both nodes and the witness are unavailable, the cluster cannot achieve quorum and will be offline. This is because the cluster requires a majority of votes to stay online. With only two nodes, the witness is needed to break ties. Without any votes, the cluster fails.

Answer

The cluster will automatically fail over to a third site because the witness server is unavailable.

Answer

The cluster continues operating because the nodes can use a dynamic quorum and adjust the vote count.

Answer

The cluster remains online because the nodes can communicate directly and form quorum without the witness.

Question 13

You are a server engineer for a financial services firm. The company recently deployed a new HP ProLiant DL380 Gen10 server running Windows Server 2022 with SQL Server 2019. The server has 2 Intel Xeon Gold processors, 128GB RAM, and a Smart Array P408i-p controller managing two RAID 1 arrays: one for OS (two 300GB 10K SAS) and one for data (four 600GB 10K SAS). After one month, the OS array reports a predictive failure on one drive. You replace the drive via hot-swap, and the RAID controller rebuilds. However, the server now experiences random system crashes with Event ID 1001 (BugCheck) and the SQL database occasionally becomes corrupt requiring restore from backup. The server's RAM has been tested with HP's diagnostic tool and passed, and the CPU temperature is normal. The RAID controller log shows no errors during the rebuild but occasional 'Parity errors' logged before the drive replacement. Which of the following is the MOST likely cause of the current instability?

Accepted Answer

The remaining original OS drive has bad sectors that were not detected.. Option C is correct because predictive failure on one drive may indicate that the entire mirrored pair has latent defects; the remaining original drive may have bad sectors that were not detected. The parity errors before replacement suggest data inconsistency, and after rebuild, the system relies on the remaining drive which can cause crashes and database corruption. Option A is wrong because the rebuild completed without errors, so the new drive is likely fine. Option B is wrong because a failed cache module would cause general errors, not specific parity issues. Option D is wrong because a faulty PCIe slot would cause intermittent disconnects of the controller, not these symptoms.

Answer

The new replacement drive is faulty.

Answer

The motherboard has a faulty PCIe slot for the RAID controller.

Answer

The RAID controller cache module has failed.

Question 14

A server in a virtualized environment is experiencing VM performance degradation. The host server has adequate resources. The hypervisor logs show excessive 'ready' time for the CPU. Which of the following is the BEST action to resolve this issue?

Accepted Answer

Reduce the number of VMs on the host. Reducing the number of VMs on the host reduces contention for CPU resources, decreasing ready time.

Answer

Disable hyper-threading on the host

Answer

Increase the number of vCPUs for the VM

Answer

Migrate the VM to a different host

Question 15

Refer to the exhibit. A technician is troubleshooting a server that is experiencing data corruption. What is the MOST likely cause?

Accepted Answer

Faulty RAID controller. Event ID 11 with a controller error typically indicates a faulty RAID controller or HBA, not a disk failure or cable issue.

Answer

Corrupted file system

Answer

Loose data cable

Answer

Failed hard disk drive

Question 16

A data center technician is troubleshooting a server that is overheating and shutting down intermittently. The server is a 2U rackmount with six fans at the front and a power supply with an integrated fan at the rear. The technician checks the ambient temperature (72°F) and verifies that the server intake temperature is normal. The server's system logs show 'CPU temperature threshold exceeded' before each shutdown. The technician has replaced the thermal paste on the CPU and reseated the heat sink, but the issue persists. Which of the following should the technician do NEXT?

Accepted Answer

Replace the chassis fans with high-static-pressure models. Option B is correct: the fans may be running but not at full speed due to a faulty fan controller or sensors. Option A is wrong because ambient temp is fine. Option C is wrong because CPU is already reseated. Option D is wrong because power supply is not indicated.

Answer

Move the server to a cooler location in the data center

Answer

Reinstall the CPU heat sink with more thermal paste

Answer

Replace the power supply unit

Question 17

A server has been randomly rebooting several times a day with no pattern. The administrator reviews the IPMI System Event Log and finds multiple 'Correctable ECC error' entries for DIMM slot B2. The server memory is configured with 16 DIMMs of the same type and manufacturer, all recently installed. What should the administrator do FIRST to resolve this issue?

Accepted Answer

Replace the DIMM in slot B2 with an identical spare.. Correctable ECC errors indicate a failing or marginal memory module. The first step is to replace the DIMM showing errors. Option A is wrong because reseating does not guarantee the errors will stop, and the DIMM is likely faulty. Option C is wrong because while increasing voltage might help with stability, it is not recommended as a first fix and could void warranty. Option D is wrong because disabling ECC removes error correction but does not fix the underlying hardware fault.

Answer

Disable ECC in the firmware to prevent the module from reporting errors.

Answer

Reseat the DIMM in slot B2 and run a memory diagnostic test.

Answer

Increase the DRAM voltage slightly in the BIOS/UEFI to improve stability.

Question 18

Refer to the exhibit. A server administrator runs a dmidecode command to check memory configuration and obtains the output shown. The system supports DDR4-2666, but all DIMMs are running at 1866 MT/s. Which action will allow the memory to run at the maximum supported speed?

Accepted Answer

Replace the DIMM in slot A1 with a DDR4-2666 registered module.. Correct: The slower 2133 MT/s DIMM in slot A1 limits all modules to its speed. Replacing it with a 2666 MT/s module allows the system to run at the highest common denominator. Option A is wrong because reordering slots won't change the speed limitation. Option C is wrong because XMP is for overclocking desktop memory, not typical on registered server DIMMs. Option D is wrong because clearing CMOS only resets BIOS settings, not memory speed mismatch.

Answer

Enable XMP profile in the BIOS to force all DIMMs to 2666 MT/s.

Answer

Clear the CMOS to reset the memory training data.

Answer

Move the DIMM from A1 to A2 and the DIMM from A2 to A1.

Question 19

A server configured with dual redundant power supplies unexpectedly shuts down when one power supply fails. Both power supplies are rated for the server's total load and were functioning before the failure. What is the MOST likely reason for the shutdown?

Accepted Answer

Redundant mode was not configured in the server management settings. If redundant mode is not enabled (Option B), the power supplies may operate in combined/load‑sharing mode, and failure of one can overload the other. Hot‑swap capability (A) allows replacement without shutdown but does not prevent an outage if the remaining PSU cannot handle the load. Wattage mismatch (C) is unlikely if both were working, and different vendors (D) do not normally cause shutdown if the PSUs are compatible.

Answer

The power supplies were not hot‑swappable

Answer

The failed power supply had a higher wattage rating than the remaining one

Answer

The power supplies were from different manufacturers

Question 20

Several users report sluggish performance from a database server. The server administrator notices that the CPU fans are running at maximum speed and the baseboard management controller (BMC) reports CPU temperatures of 85°C even at idle. The administrator already cleaned dust from the chassis and verified all fans are operational. Which of the following should the administrator do NEXT?

Accepted Answer

Reapply thermal paste on the CPU heat sinks.. High temperatures persist after cleaning and fan checks suggest poor heat conduction between the CPU and heatsink, typically caused by dried or inadequate thermal paste.

Answer

Add additional case fans to improve airflow.

Answer

Replace the CPU fans with higher RPM models.

Answer

Increase the fan speed thresholds in the BIOS.