SK0-005 Multiple Select — 10 Questions

Question 1

During a security incident, a server is suspected to be compromised by malware. The incident response team needs to preserve evidence and minimize impact. Which TWO actions should be taken FIRST? (Select TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disconnect the server from the network.. Options B and C are correct. Disconnecting the server from the network (B) is an immediate containment step to prevent data exfiltration or spread. Capturing a forensic image of system memory (C) preserves volatile data such as running processes, network connections, and encryption keys before they are lost. Option A is wrong because powering off loses all volatile evidence. Option D is wrong because running an AV scan modifies files and could destroy forensic artifacts. Option E is wrong because rebooting erases memory and may trigger malware countermeasures.

Answer

Run an antivirus scan.

Answer

Reboot the server in safe mode.

Answer

Power off the server immediately.

Question 2

A server administrator is configuring a new server that will host a high-traffic web application. The administrator needs to optimize the server's network performance. Which TWO of the following should be implemented? (Choose two.)

Accepted Answer

Configure NIC teaming for redundancy and load balancing.. Enabling jumbo frames and configuring NIC teaming are direct performance optimizations for a high-traffic web server. Jumbo frames reduce overhead for large transfers, while NIC teaming provides redundancy and load balancing. The other options either degrade performance or do not directly enhance it. These two together can significantly improve network throughput and reliability.

Answer

Assign a static IP address to the server.

Answer

Disable TCP offloading on the network adapter.

Answer

Set the network adapter to half-duplex mode.

Question 3

A company is creating a disaster recovery plan for its on-premises data center. Which THREE elements are essential to include in the DR plan? (Select THREE.)

Accepted Answer

Contact information for key personnel.. Options A, C, and E are correct. Contact information for key personnel (A) ensures that the recovery team can be reached during a crisis. RTO and RPO for each critical system (C) define the recovery goals and guide the technical implementation. The list of failover site addresses and access procedures (E) provides vital instructions for reaching and securing the secondary location. Option B is wrong because cleaning procedures are operational but not a core DR plan element. Option D is wrong because backup procedures are part of the backup policy, not the disaster recovery plan; the DR plan assumes backups exist and focuses on restoring from them.

Answer

Detailed instructions for cleaning server hardware.

Answer

Step-by-step procedures for performing backups.

Question 4

A technician is preparing to add four new hot-swap SAS drives to a running server that uses a hardware RAID controller. Before inserting the drives, which of the following actions should the technician take? (Choose two.)

Accepted Answer

Confirm the drives are on the RAID controller's compatibility list. Before adding hot-swap drives, the technician must confirm the drives are supported by the RAID controller and that the chosen bays are free of existing array membership. Compatibility prevents rejection or dropout, and confirming empty bays prevents an accidental rebuild that would overwrite the newly inserted drive.

Answer

Set each new drive's SAS address to match the controller's expected value

Answer

Install the drives while the server is powered off to avoid damaging the backplane

Answer

Update the RAID controller firmware to the latest release immediately before insertion

Question 5

A server administrator is troubleshooting a Windows Server 2019 that randomly reboots. The administrator suspects a hardware issue. Which two actions should the administrator take to gather evidence of the cause? (Choose two.)

Accepted Answer

Configure a memory dump and analyze it with WinDbg.. To diagnose random reboots, the administrator should first check the System event log for Event ID 41, which indicates an unclean shutdown and may include a bugcheck code. Additionally, configuring a memory dump and analyzing it with WinDbg provides detailed crash information, including the faulting driver or hardware component. These actions gather concrete evidence, unlike preventive measures or general system checks.

Answer

Update the BIOS and all device drivers to the latest versions.

Answer

Enable and review the Windows Memory Diagnostic results.

Answer

Run the sfc /scannow command to check for system file corruption.

Question 6

A server administrator is troubleshooting intermittent network connectivity issues on a server. Users report that connections to the server sometimes time out, and the administrator notices that the server's link LED on the switch occasionally goes dark. The administrator has already replaced the patch cable from the server to the wall jack. Which of the following should the administrator check NEXT? (Choose two.)

Accepted Answer

Verify the integrity of the structured cabling between the wall jack and the patch panel.. Intermittent link loss after replacing the patch cable points to the structured cabling or the switch port. Checking the permanent link between the wall jack and patch panel, and reviewing switch port statistics for errors or flapping, are the next logical diagnostic steps to isolate the fault.

Answer

Update the NIC driver to the latest version from the vendor's website.

Answer

Reconfigure the switch port to use a fixed speed and duplex instead of auto-negotiation.

Answer

Replace the server's network interface card with a known-good spare.

Question 7

A system administrator manages a Windows Server 2019 environment with multiple physical servers. The administrator needs to implement a remote management solution that provides out-of-band access to the servers' console even when the operating system is unresponsive or powered off. The solution must also allow mounting virtual media for OS installation and support remote power cycling. Which TWO of the following should the administrator implement? (Choose two.)

Accepted Answer

Configure the servers' baseboard management controllers (BMCs) with dedicated network access.. Out-of-band management requires a baseboard management controller (BMC) or an integrated lights-out interface like iLO or iDRAC. These components operate independently of the operating system, providing console access, virtual media mounting, and remote power cycling even when the server is off or unresponsive. Configuring dedicated network access for the BMC ensures reliable connectivity. Other options like RDP or VPNs do not provide the required out-of-band capabilities.

Answer

Set up a VPN connection for administrators to access the server management network.

Answer

Enable Remote Desktop Protocol (RDP) on all servers and restrict access via firewall rules.

Answer

Deploy a terminal server and use it as a jump host for administrative connections.

Question 8

A company is designing a disaster recovery plan for its primary datacenter. The plan must include a warm site that can take over production within four hours and must verify that the recovery procedures actually work. Which two elements should be included? (Choose two.)

Accepted Answer

A tabletop exercise that walks stakeholders through the recovery steps and identifies gaps in the plan.. A workable disaster recovery plan for a four-hour warm site takeover needs measurable objectives and validation. Documented RTO and RPO values define the acceptable downtime and data loss, guiding the warm site design and replication schedule. A tabletop exercise validates the plan by walking stakeholders through the procedures, revealing gaps without risking production. The other options either describe a real outage, an inadequate cold site, or backups stored in a single failure domain, none of which support the stated recovery targets.

Answer

Biweekly incremental backups to tape stored only in the primary datacenter.

Answer

A full-scale failover test that shuts down the primary datacenter during business hours without notifying users.

Answer

A cold site with no pre-installed hardware or data replication, relying on emergency procurement during a disaster.

Question 9

A server administrator is troubleshooting a physical server that reports a predictive failure on a drive in a hardware RAID 5 array. The array is still online and functioning. The administrator wants to replace the failing drive while minimizing risk to the data. Which of the following steps should the administrator perform? (Choose two.)

Accepted Answer

Identify the physical bay of the failing drive using the RAID controller management utility or locator LED before removal.. Replacing a member of a degraded RAID 5 array safely requires two things: a validated backup in case the rebuild fails or another drive dies, and positive identification of the correct physical bay so the wrong drive is never removed. Both steps directly reduce the risk of catastrophic data loss during the swap.

Answer

Delete the array and recreate it from scratch to ensure a clean rebuild.

Answer

Force the failing drive offline immediately so the controller begins rebuilding onto a spare.

Answer

Power down the server and remove the drive while the system is offline to avoid hot-swap risk.

Question 10

A company is hardening a publicly reachable Linux web server that runs an SSH service for administration. The security team wants to reduce the attack surface and enforce stronger authentication. Which two actions BEST accomplish this? (Choose two.)

Accepted Answer

Require public key authentication and disable password-based SSH logins.. The strongest reductions in SSH attack surface come from removing weak authentication paths and eliminating shared, highly privileged logins. Requiring public keys with password authentication disabled blocks brute-force approaches, while forbidding direct root login enforces named accounts and per-user accountability. Together they harden authentication and limit the impact of a single compromised credential.

Answer

Install a host-based intrusion detection system that alerts on suspicious SSH login patterns.

Answer

Enable verbose logging of all SSH connection attempts to a remote syslog server.

Answer

Change the SSH service to listen on a non-standard port to hide it from scanners.