SK0-005 security-disaster-recovery — All Questions With Answers

Question 1mediummultiple choice

Read the full security-disaster-recovery explanation →

Refer to the exhibit. A backup job to a network share failed. The administrator reviews the backup log. What is the most likely cause of the failure?

Exhibit

Backup started at 02:00:00
Connecting to backup repository \backupserver\data...
Error: Access is denied.
Backup failed.

Question 2mediummultiple choice

Read the full security-disaster-recovery explanation →

A system administrator needs to configure secure remote access to servers in the data center. The current setup uses password-based SSH, but the security policy mandates multifactor authentication and prevention of brute-force attacks. Which solution best meets these requirements?

Question 3easyScenario

Read the full security-disaster-recovery explanation →

A small accounting firm has a single server that hosts their client database and financial applications. The server is backed up nightly using a full backup to an external USB hard drive, which is stored on a shelf next to the server. Last month, a fire broke out in the office, completely destroying the server and the backup drive. The company lost all data since their last offsite backup, which was six months old because they occasionally took a copy home. The business owner wants to prevent such a catastrophic data loss in the future but is concerned about cost and complexity. They have a limited IT budget and no dedicated IT staff. The firm operates 9-5 Monday to Friday, and can tolerate up to 24 hours of downtime and up to one day of data loss. After the fire, they had to rebuild their client records from paper files, which took weeks. The owner realizes the importance of an offsite backup routine but cannot afford an expensive cloud service or a second server. The firm's internet connection is a basic DSL line with limited upload bandwidth, making large cloud backups slow. The server has a single internal drive with enough free space to store additional copies. Which of the following backup strategies would best meet the firm’s recovery objectives while minimizing cost and complexity?

Question 4mediumScenario

Read the full security-disaster-recovery explanation →

A regional hospital operates two data centers located 10 miles apart, with synchronous replication of critical patient record systems between them. The replication ensures that any write to the primary storage is immediately mirrored to the secondary site. The hospital also maintains weekly full backups to LTO-8 tapes, which are stored in a fireproof safe at an offsite warehouse 30 miles away. The IT team has not implemented storage snapshots or continuous data protection due to budget constraints. Last week, a ransomware attack encrypted all files on the primary site. The replication process promptly mirrored the encrypted data to the secondary site, rendering both copies inaccessible. The attackers demanded $500,000 in Bitcoin. The hospital's disaster recovery plan specifies an RPO of 1 hour and an RTO of 4 hours. The IT director must now choose a restoration strategy that minimizes data loss and downtime while ensuring a clean, malware-free environment. The backup tapes are confirmed to be unencrypted and free of ransomware. Which of the following actions should the IT director take first?

Question 5easymultiple choice

Read the full security-disaster-recovery explanation →

Refer to the exhibit. A backup administrator scheduled a nightly backup to a network share. The backup job fails with the error shown in the log. What is the most likely cause?

Exhibit

[ERROR] Backup failed: Unable to mount network share \\192.168.1.100\backups. Access denied.

Question 6easyScenario

Read the full security-disaster-recovery explanation →

A small law firm has a single on-premises server running their case management software, email, and document storage. They perform a full backup each night at 11 PM to an external USB 4 TB drive, which is then stored on a shelf in the server room. The server room is located in the basement of their office building. Last week, an electrical fire started in the server room, completely destroying the server and the backup drive. The firm lost all data since the last backup, and it took two weeks to procure new hardware and restore from an older, off-site backup that was taken during a manual process three months ago. Their insurance company now requires a formal disaster recovery plan. The firm has a limited budget and minimal IT staff. They want to prevent data loss and minimize downtime in future disasters. What is the BEST course of action to improve their disaster recovery capabilities?

Question 7mediumScenario

Read the full security-disaster-recovery explanation →

A mid-sized manufacturing company operates a primary data center with all critical servers. They have a warm standby site located 100 miles away. For databases, the primary SAN uses synchronous replication to the standby SAN; no tape backups are taken for databases. File and application servers are backed up to an on-premises tape library using nightly incrementals with a weekly full backup every Sunday. Tapes are shipped off-site every Monday morning. On Tuesday morning, a ransomware attack encrypts the entire primary SAN. Because of the real-time replication, the standby SAN is encrypted almost instantly. The on-site tape library is also connected to the network and its tapes, including Sunday's full and Monday's incremental, are encrypted by the attack. The most recent off-site shipment was the previous Monday (eleven days ago), meaning the off-site tapes contain a full backup from eleven days ago and daily incrementals up to that point. The company's RPO is 1 hour for databases and 24 hours for file servers; RTO is 8 hours. The IT director must decide the best immediate course of action to restore operations while adhering to the DR plan as closely as possible.

Question 8mediummultiple choice

Read the full security-disaster-recovery explanation →

A datacenter administrator is configuring a UPS to protect a rack of dual-power-supply servers. The UPS has a network management card, and the administrator wants each server to automatically begin a graceful shutdown when the UPS battery reaches 20 percent remaining capacity. Which action should the administrator take to meet this requirement?

Question 9mediummultiple choice

Read the full security-disaster-recovery explanation →

A data center administrator is configuring a new backup strategy for a file server that stores 2 TB of active project data. The organization requires that backups complete within a 4-hour window each night, and that any single file can be restored without restoring the entire backup set. Which backup type should the administrator implement?

Question 10mediummultiple choice

Read the full security-disaster-recovery explanation →

A company's disaster recovery plan specifies a recovery point objective (RPO) of 15 minutes for its Microsoft SQL Server database. The database is 2 TB, and a full backup takes 6 hours to complete. Which backup strategy best meets the RPO while minimizing storage and restore complexity?

Question 11mediummultiple choice

Read the full security-disaster-recovery explanation →

An administrator needs to test the disaster recovery plan for a critical server environment. Management requires that the test involve actual failover to the DR site and running production workloads there, but with no impact to the primary site and minimal disruption. Which type of DR test should the administrator perform?

Question 12easymultiple choice

Read the full security-disaster-recovery explanation →

A small business has a single server that hosts both a database and a file share. The administrator needs to implement a backup strategy that minimizes backup window time while ensuring that the database can be restored to a consistent state. Which backup type should be used for the database?

Question 13mediummultiple choice

Read the full security-disaster-recovery explanation →

A datacenter administrator needs to implement a physical security control that prevents an unauthorized person from following an employee through a secure door into the server room. Which control should the administrator implement?

Question 14hardmultiple choice

Review the full subnetting walkthrough →

A security administrator is hardening a Linux server that hosts a public web application. The server must allow inbound HTTPS from anywhere, SSH only from the management subnet 192.168.10.0/24, and must block all other inbound traffic. The administrator decides to use the local firewall. Which of the following commands should the administrator run to apply this policy immediately and persistently?

Question 15mediummultiple choice

Read the full security-disaster-recovery explanation →

A security administrator at a financial services company needs to harden an Ubuntu Server 22.04 LTS system that hosts a public-facing web application. The administrator must ensure that the SSH service is configured to prevent brute-force attacks by limiting authentication attempts and disabling direct root login. Which of the following actions should the administrator take to meet these requirements?

Question 16hardmulti select

Read the full security-disaster-recovery explanation →

A security administrator is hardening a Linux web server that hosts a public-facing application. The server currently allows SSH access from any IP address and uses password authentication. The administrator wants to reduce the attack surface and implement defense in depth. Which two actions should the administrator take? (Choose two.)

Question 17mediummultiple choice

Read the full security-disaster-recovery explanation →

A datacenter administrator must dispose of twelve decommissioned servers that stored customer payment card data. The company's policy requires that no recoverable data leaves the building, and the drives will be resold to a third party. Which action BEST satisfies both the data destruction requirement and the resale plan?

Question 18mediummultiple choice

Read the full security-disaster-recovery explanation →

A company is designing a disaster recovery plan for its critical web application. The application runs on three servers: a web server, an application server, and a database server. The company wants to ensure that if the primary site fails, the application can be brought online at a secondary site with minimal data loss and within a 1-hour RTO. The secondary site currently has identical hardware but no software installed. Which of the following should be implemented to meet these requirements?

Question 19hardmultiple choice

Read the full security-disaster-recovery explanation →

A company is designing a disaster recovery plan for its critical SQL Server database. The recovery point objective (RPO) is 15 minutes, and the recovery time objective (RTO) is 1 hour. The database is 2 TB in size and experiences heavy transaction volume. Which combination of technologies should be implemented to meet these objectives with minimal data loss?

Question 20mediummultiple choice

Read the full security-disaster-recovery explanation →

A security administrator is reviewing physical security for a server room that houses domain controllers and backup tapes. The administrator wants to prevent unauthorized individuals from following an authorized employee through the door and to ensure that entry attempts are recorded for audit. Which of the following controls should the administrator implement?

Question 21easymultiple choice

Read the full security-disaster-recovery explanation →

A small business has a single server that runs a critical application. The business wants to ensure that if the server's hard drive fails, they can recover the operating system, application, and data quickly. They have a limited budget and want the most cost-effective solution. Which of the following should they implement?

Question 22hardmultiple choice

Read the full security-disaster-recovery explanation →

A security administrator is reviewing physical security for a server room that houses critical infrastructure. The room currently has a standard lock-and-key door and no other controls. The administrator needs to implement measures to prevent unauthorized access and detect intrusion attempts. Which combination of controls should the administrator implement?

Question 23hardmulti select

Read the full security-disaster-recovery explanation →

A security administrator is implementing a defense-in-depth strategy for a new server that will host a database containing sensitive customer information. The administrator must ensure that data at rest is protected and that access to the database is restricted to authorized applications only. Which of the following should the administrator implement? (Choose two.)

Question 24mediummultiple choice

Read the full security-disaster-recovery explanation →

A server administrator at a hospital replaces a failed drive in a RAID 5 array on a Windows Server 2022 file server. The replacement drive is a different model with a larger capacity than the remaining members of the array. Before the rebuild completes, a second drive in the same array fails, and the array goes offline. Which of the following should the administrator have verified BEFORE pulling the failed drive to reduce the risk of this outage?

Question 25mediummultiple choice

Read the full security-disaster-recovery explanation →

A datacenter administrator is hardening a Windows Server 2022 file server that stores HR records. Management requires that all access to the server be encrypted in transit, and clients must be able to verify the server's identity before sending credentials. The server has a valid certificate issued by the internal CA. Which action should the administrator take to meet these requirements?

Question 26hardmultiple choice

Read the full security-disaster-recovery explanation →

A system administrator is designing a backup strategy for a database server that must have a recovery point objective (RPO) of 15 minutes and a recovery time objective (RTO) of 2 hours. The database is 4 TB and changes at a rate of about 200 GB per day. The backup window is only 4 hours each night. Which backup type should the administrator implement to meet the RPO while fitting the backup window?

Question 27hardmulti select

Read the full security-disaster-recovery explanation →

A company is designing a backup strategy for a file server that stores 8 TB of active project data. The backup window is only four hours per night, and the business requires the ability to restore individual files from any day in the past 30 days. The administrator plans to use Windows Server Backup with a dedicated backup volume. Which two actions should the administrator take to meet these requirements? (Choose two.)

Question 28hardmultiple choice

Read the full security-disaster-recovery explanation →

A system administrator is configuring a backup job for a Windows Server 2022 file server that contains millions of small files. The backup window is only four hours, and the administrator wants to minimize the time required for future incremental backups while still allowing point-in-time restores. Which backup method should the administrator choose?

Question 29hardmultiple choice

Read the full security-disaster-recovery explanation →

A company stores nightly full backups on tape in an on-site vault and replicates database transaction logs to a cloud bucket every 15 minutes. A ransomware incident encrypts the production database server and the on-site backup vault at 02:00. The most recent cloud log replication completed at 01:45. Which statement correctly describes the recoverable state?

Question 30mediummultiple choice

Read the full security-disaster-recovery explanation →

A hospital's server room has a single rack containing two servers, each with dual redundant power supplies, plus a managed switch and a tape library. The facilities team installs a new 3000 VA online double-conversion UPS with a network management card. During a planned power maintenance window, utility power is cut and the UPS carries the load; the administrator notices the UPS runtime estimate drops from 22 minutes to 9 minutes within the first minute and the UPS logs a 'load segment overload' warning on one output group. Which action should the administrator take first to correct the problem?

Question 31hardmulti select

Read the full security-disaster-recovery explanation →

A server administrator is implementing a disaster recovery plan for a small business. The plan must include measures to ensure that critical servers can be recovered in the event of a site-wide power failure. The business has a limited budget and wants to minimize downtime. Which of the following should the administrator implement? (Choose two.)

Question 32mediummultiple choice

Read the full security-disaster-recovery explanation →

A datacenter administrator for a healthcare provider is hardening a Windows Server 2022 host that stores electronic protected health information (ePHI). The security policy requires that any attempt to access a protected file be recorded with the user identity, timestamp, and result, and that the log entries be resistant to tampering by local administrators. The server hosts a single NTFS volume. Which action should the administrator take?

Question 33mediummulti select

Read the full security-disaster-recovery explanation →

A datacenter administrator is implementing physical security controls for a new server room that houses regulated customer data. The security policy requires layered controls that detect unauthorized entry and limit the time an intruder can remain unnoticed. Which two controls best meet these requirements? (Choose two.)

Question 34hardmultiple choice

Read the full security-disaster-recovery explanation →

A server administrator is designing backup retention for a database server that must satisfy a policy requiring recovery points from any day within the past 30 days, while keeping storage costs reasonable. Full backups are large, and the database changes constantly. Which backup scheme BEST meets the policy?

Question 35hardmultiple choice

Read the full security-disaster-recovery explanation →

A company's disaster recovery plan requires that a critical virtual machine be restarted at a secondary site within 30 minutes of a primary site failure. The secondary site has compatible hardware and network connectivity but no pre-staged virtual machine. Which recovery strategy best meets the requirement?

Question 36hardmultiple choice

Read the full security-disaster-recovery explanation →

A server administrator is restoring a file server from a full backup taken 7 days ago and incremental backups taken daily. The restoration fails with an error about missing catalog files. What is the most likely cause?

Question 37hardScenario

Read the full security-disaster-recovery explanation →

A medium-sized company uses a backup strategy that includes a full backup every Sunday at 2:00 AM and differential backups Monday through Saturday at 2:00 AM. The backups are written to a network-attached storage (NAS) device. On Thursday morning, the company experiences a ransomware attack that encrypts all data on the file server, including the NAS. The administrator needs to restore the file server with minimal data loss. The last successful full backup was from the previous Sunday, and differential backups were successful on Monday, Tuesday, and Wednesday. However, Thursday's differential was not completed because the attack occurred before the scheduled time. The administrator attempts to restore using the Sunday full backup and Thursday's differential, but the restore fails because the differential backup on the NAS is also encrypted. Which of the following is the best course of action?

Question 38easyScenario

Read the full security-disaster-recovery explanation →

A small business has a single file server running Windows Server 2019. The server uses two internal SATA drives in a RAID 1 mirror for the operating system and data. The company's backup solution performs a full backup every night to an external USB hard drive, which is stored in the server room. The IT administrator recently noticed that the server's system volume is running low on space and decides to migrate the data to a larger drive. During the migration, the server crashes and will not boot. The administrator attempts to restore from the latest backup but finds that the backup drive is corrupted and cannot be read. The company has no offsite backups. What should the administrator have done to prevent this situation?

Question 39mediumScenario

Read the full security-disaster-recovery explanation →

A medium-sized company runs an e-commerce platform on a cluster of three physical servers hosting virtual machines. The disaster recovery plan includes daily backups to a remote data center using Veeam Backup & Replication. The company's annual disaster recovery drill is scheduled for next week. During the drill, the IT team plans to simulate a complete site failure by powering off the primary data center. The recovery time objective (RTO) is 4 hours, and the recovery point objective (RPO) is 1 hour. The team successfully restores the VMs at the remote site, but the application experiences significant performance degradation and many transactions fail due to database inconsistency. Investigation reveals that the backup was taken at 2:00 AM, but the failure occurred at 10:00 AM, and the application's database had transactions between 2:00 AM and 10:00 AM that were not captured. What should the IT team do to improve the recovery process?

Question 40hardScenario

Read the full security-disaster-recovery explanation →

A large enterprise uses a centralized backup solution with a backup server running Commvault. Backups are stored on a deduplicated disk array and replicated to a secondary site for disaster recovery. The company's security team detects ransomware activity that has encrypted several file servers. The backup administrator checks the backup repository and finds that the backup data is also encrypted because the backup service account had permissions to modify backup files, and the ransomware propagated to the repository. The last known good backup is from two weeks ago, which is too old for the organization's RPO of 24 hours. The backup administrator is under pressure to restore operations quickly. Which of the following should the administrator implement to prevent this from recurring?

Question 41hardmultiple choice

Read the full security-disaster-recovery explanation →

A company uses a two-node failover cluster for a critical application. The cluster nodes are located in the same data center, and the quorum configuration uses a file share witness on a separate server in the same data center. During a major power outage, both cluster nodes and the file share witness server lose power. What is the impact on cluster availability?

Question 42mediummultiple choice

Read the full security-disaster-recovery explanation →

A server administrator is responsible for protecting sensitive data. The backup process copies files to a network share daily. Which of the following should the administrator do to BEST ensure the confidentiality of the backup data both during transfer and at rest?

Question 43mediummultiple choice

Read the full security-disaster-recovery explanation →

Refer to the exhibit. An administrator is reviewing logs after a server experienced performance issues and unexpected shutdowns. Based on the log entries, which component is MOST likely failing?

Exhibit

[12345.678] sd 0:0:0:0: [sda] Unhandled sense code
[12345.678] sd 0:0:0:0: [sda] Result: hostbyte=DID_OK driverbyte=DRIVER_SENSE
[12345.678] sd 0:0:0:0: [sda] Sense Key : Medium Error [current]
[12345.678] sd 0:0:0:0: [sda] Add. Sense: Unrecovered read error - auto reallocate failed
[12345.678] end_request: I/O error, dev sda, sector 123456

Question 44mediummultiple choice

Read the full security-disaster-recovery explanation →

An organization requires a disaster recovery site that can be operational within 24 hours after a disaster declaration, with critical data replicated on a regular basis, but not necessarily real-time. Which type of site should they implement?

Question 45easymultiple choice

Read the full security-disaster-recovery explanation →

A company performs a full backup on Sunday and incremental backups Monday through Saturday. A server fails on Thursday at 10:00 AM. Which sequence correctly restores the data?

Question 46mediummultiple choice

Read the full security-disaster-recovery explanation →

A financial services firm requires a disaster recovery site that provides immediate failover with zero data loss. Which type of site should they implement?

Question 47hardmultiple choice

Read the full security-disaster-recovery explanation →

An organization stores backup tapes at an offsite facility. The tapes contain sensitive customer data. A security audit revealed that tapes were stolen from the facility. Which combination of measures would have MOST effectively prevented unauthorized data access?

Question 48hardmultiple choice

Read the full security-disaster-recovery explanation →

Refer to the exhibit. A Linux server's local firewall is configured as shown. The administrator is unable to perform backups to a network-attached storage (NAS) device using TCP port 10000. Which firewall rule is causing the issue?

Network Topology

Question 49easymultiple choice

Read the full security-disaster-recovery explanation →

A database server hosts a critical application that requires a recovery point objective (RPO) of 4 hours. The company wants to minimize the impact on production performance during backups. Which backup strategy should be implemented?

Question 50easymultiple choice

Read the full security-disaster-recovery explanation →

A small business has a limited budget and can tolerate up to 72 hours of downtime in the event of a disaster. Which type of disaster recovery site would be most cost-effective?

Question 51mediummultiple choice

Read the full security-disaster-recovery explanation →

After an unexpected power outage, a server fails to boot and displays an error indicating a degraded RAID array. The server has a RAID 5 configuration with four disks. One disk has failed, but the hot spare did not automatically rebuild. The administrator needs to restore data availability as quickly as possible. Which action should the technician take FIRST?

Question 52hardmultiple choice

Read the full security-disaster-recovery explanation →

A company performs annual disaster recovery tests. The last test revealed that the recovery time objective (RTO) was not met because the backup tapes were corrupted. The backup administrator proposes changes to the backup verification process. Which practice is MOST effective to ensure recoverability?

Question 53easymulti select

Read the full security-disaster-recovery explanation →

During a security incident, a server is suspected to be compromised by malware. The incident response team needs to preserve evidence and minimize impact. Which TWO actions should be taken FIRST? (Select TWO.)

Question 54mediummulti select

Read the full security-disaster-recovery explanation →

A company is creating a disaster recovery plan for its on-premises data center. Which THREE elements are essential to include in the DR plan? (Select THREE.)

Question 55hardmultiple choice

Read the full security-disaster-recovery explanation →

Refer to the exhibit. A server administrator is reviewing security logs after a suspected brute-force attack on the SSH service. The following excerpt from /var/log/secure is displayed. Which security control would have been MOST effective in preventing the successful login?

Exhibit

Apr 25 03:14:22 server sshd[1234]: Failed password for root from 192.168.1.100 port 22 ssh2
Apr 25 03:14:23 server sshd[1234]: Failed password for root from 192.168.1.100 port 22 ssh2
Apr 25 03:14:24 server sshd[1234]: Failed password for root from 192.168.1.100 port 22 ssh2
Apr 25 03:14:25 server sshd[1234]: Failed password for root from 192.168.1.100 port 22 ssh2
Apr 25 03:14:26 server sshd[1234]: Failed password for admin from 192.168.1.100 port 22 ssh2
Apr 25 03:14:27 server sshd[1234]: Failed password for admin from 192.168.1.100 port 22 ssh2
Apr 25 03:14:28 server sshd[1234]: Accepted password for admin from 192.168.1.100 port 22 ssh2
Apr 25 03:14:29 server sshd[1234]: Failed password for root from 192.168.1.101 port 22 ssh2

Question 56hardmultiple choice

Read the full security-disaster-recovery explanation →

A network administrator needs to configure centralized authentication for network devices. The solution must provide encryption of the entire authentication process, support for multiple protocols, and accounting of user actions. Which protocol should be used?

Question 57easymultiple choice

Read the full security-disaster-recovery explanation →

A small business needs a disaster recovery site that can be brought online within 2 hours of a primary site failure. The business can tolerate minimal data loss. Which type of recovery site should they implement?

Question 58hardmultiple choice

Read the full security-disaster-recovery explanation →

A system administrator notices unusual file encryption activity on a file server. The activity appears to be rapidly spreading to other servers, and ransom notes are appearing. Which of the following should the administrator do FIRST?

Question 59easymultiple choice

Read the full security-disaster-recovery explanation →

An organization wants to test its disaster recovery plan with minimal disruption to business operations and minimal cost. The test should verify the plan's effectiveness by discussing scenarios. Which type of test should they perform?

Question 60mediummultiple choice

Read the full security-disaster-recovery explanation →

A financial services firm requires zero data loss in the event of a primary data center failure. They operate two data centers 50 miles apart connected by a high-bandwidth, low-latency link. Which replication method should they use to meet this requirement?

Question 61hardScenario

Read the full security-disaster-recovery explanation →

A mid-sized e-commerce company experienced a ransomware attack that encrypted all on-premises servers and their locally attached backup storage. The attack occurred on a Friday evening; the company was closed over the weekend. By Monday morning, the IT team discovered the encryption and found a ransom note demanding $500,000 in Bitcoin. The company has a disaster recovery plan that calls for restoring from daily tape backups stored offsite. However, the most recent offsite tape was taken home by a backup operator for the weekend and has not been returned. The tape contains full backups from Wednesday. The IT team has clean installation media and application software available. The company's RPO is 24 hours, and RTO is 48 hours. Management wants to minimize data loss and avoid paying the ransom. Based on this scenario, which of the following should the IT team do to recover the business operations?

Question 62mediumScenario

Read the full security-disaster-recovery explanation →

A healthcare provider is reviewing its disaster recovery strategy. They have two data centers: one primary in City A and a secondary in City B, 200 miles apart. Currently, they perform daily backups that are replicated to City B each night. In the event of a primary site failure, they can fail over to City B, but there is a 4-hour RTO due to manual processes. Their new RTO target is 2 hours, with an RPO of 15 minutes. The IT team is considering various replication technologies. The provider runs a mix of Windows and Linux servers hosting electronic health records (EHR), PACS imaging, and billing applications. Their current backup scheme is a full backup each night, with transaction logs backed up every 6 hours, but these are not immediately shipped offsite. They have experienced power outages in City A, prompting the review. The IT director is concerned about data consistency and quick recovery. The secondary site currently has sufficient hardware to run all critical applications, but data is only updated nightly. The link between data centers has 100 Mbps bandwidth and 10 ms latency, and upgrading it would cost $50,000. The existing staff can script failover procedures. Which solution best meets the new RPO and RTO while staying within budget?

Question 63hardScenario

Read the full security-disaster-recovery explanation →

A large financial services company must comply with federal regulations mandating quarterly disaster recovery tests. Their primary data center in New York hosts all trading applications, and a hot site in Chicago is maintained with real-time data replication via synchronous mirroring. During the last DR test, the IT team successfully failed over network and storage within 8 minutes, meeting the 15-minute RTO for connectivity. However, they encountered a major issue: the hot site's firewalls, intrusion detection systems, and application-level access controls were not configured to match the primary environment. The security team had to manually create firewall rules, update IDS signatures, and reconfigure access policies based on documentation, which took over 4 hours. As a result, the total system readiness exceeded 4.5 hours, causing a significant gap in trading operations. The regulatory auditor noted this deficiency and required a corrective action plan. The company must ensure that the next DR test achieves full operational readiness, including security controls, within the 15-minute RTO. The IT budget is already allocated for the current fiscal year, so large capital expenditures are not possible, but the team can leverage existing tools and automation. Which of the following is the BEST approach to address this issue?

Question 64mediummultiple choice

Read the full security-disaster-recovery explanation →

A company performs full backups every Sunday and differential backups daily. After a ransomware attack, they discover that both the production data and all attached backup media were encrypted. They need to ensure data can be recovered in the future. Which of the following is the BEST change to their backup strategy?

Question 65mediummultiple choice

Read the full security-disaster-recovery explanation →

An organization's disaster recovery plan specifies an RPO of 4 hours. Their current backup schedule performs a full backup at midnight and incremental backups every 2 hours from 8:00 AM to 8:00 PM. A server failure occurs at 3:00 AM, and data created after 8:00 PM the previous day is permanently lost. Which of the following is the MOST likely reason?

Question 66easymultiple choice

Read the full security-disaster-recovery explanation →

A financial services firm requires a disaster recovery solution that provides a Recovery Point Objective (RPO) of near zero and a Recovery Time Objective (RTO) of less than 2 hours. Which of the following site types is MOST appropriate?

Question 67hardmultiple choice

Read the full security-disaster-recovery explanation →

An organization uses a cloud-based backup solution with immutable storage to protect against ransomware. However, after a recent attack, an attacker with stolen administrator credentials was able to delete the backup data. Which of the following BEST explains why the backups were deleted?

Question 68hardmulti select

Read the full security-disaster-recovery explanation →

Which THREE of the following are typically essential elements of a disaster recovery plan (DRP)? (Choose three.)

Question 69hardmultiple choice

Read the full security-disaster-recovery explanation →

Refer to the exhibit. A disaster recovery test reveals the following timeline for a critical application. The business requires an RTO of 2 hours. Which of the following actions would MOST effectively reduce the RTO to meet the requirement?

Exhibit

Task                        | Duration (minutes)
-----------------------------------------------
Provision virtual machines   | 60
Restore database from backup | 120
Application validation       | 60
-----------------------------------------------
Total RTO                    | 240

Question 70mediummultiple choice

Read the full security-disaster-recovery explanation →

A system administrator configures full backups on Sunday evenings and differential backups on weekdays. On Thursday morning, a disk failure occurs. Which of the following sets of backups is necessary to completely restore the server's data with the fewest number of backup files?

Question 71hardScenario

Read the full security-disaster-recovery explanation →

A medium-sized e-commerce company operates three critical servers: a web front-end, a database server, and a file server. Currently, a full backup of all servers is performed every Sunday starting at 11:00 PM and completes in about 6 hours. Differential backups run each weekday at 11:00 PM, taking roughly 2 hours. On a Wednesday at 10:00 AM, a ransomware attack encrypts all data on all servers. The IT team’s incident response plan requires restoration with an RPO of 4 hours and an RTO of 8 hours. The latest clean backup is Tuesday’s differential, resulting in approximately 10 hours of data loss. Future attacks could occur at any time. Management is willing to spend up to $200 per month to improve the backup strategy but cannot afford new hardware or a dedicated hot site. The team needs a solution that reduces both RPO and RTO within budget while maintaining simplicity for a small IT staff of two. Which of the following backup strategies should be implemented to best meet these requirements?

Question 72easyScenario

Read the full security-disaster-recovery explanation →

A small law firm relies on a single server that hosts a document management system and email. The server is backed up nightly using differential backups to an external USB hard drive that remains connected to the server. One Monday morning, the office manager finds all files encrypted and a ransom note on the screen. The server’s event logs indicate that the encryption began at 2:00 AM on Saturday. The firm’s offsite backup policy rotates two sets of tapes, and the most recent set was taken offsite on Friday evening and is stored in a bank safe deposit box. The USB backup drive, still attached to the server, shows its files also encrypted. The firm does not have a cloud backup service for the server. The office manager wants to restore operations as quickly as possible with minimal data loss and zero risk of reinfection. What is the BEST course of action?

Question 73easymultiple choice

Read the full security-disaster-recovery explanation →

A datacenter manager must protect a file server's data against a single hard disk failure while maximizing usable capacity. The server has four 4 TB drives and a hardware RAID controller. Which RAID level should be implemented?

Question 74hardmulti select

Read the full security-disaster-recovery explanation →

A company is designing a disaster recovery plan for its primary datacenter. The plan must include a warm site that can take over production within four hours and must verify that the recovery procedures actually work. Which two elements should be included? (Choose two.)

Question 75easymultiple choice

Read the full security-disaster-recovery explanation →

A small accounting firm runs a single physical server that hosts all of its line-of-business applications. The owner wants a backup strategy that allows the entire server, including the operating system, applications, and data, to be restored to dissimilar hardware after a catastrophic failure. Which backup type should the administrator implement?

Question 76mediummultiple choice

Read the full security-disaster-recovery explanation →

A financial services company runs a single physical server hosting a customer-facing web application. The security team must ensure that if an attacker modifies system binaries, the server can detect the change during a forensic investigation. Which technology should be implemented to meet this requirement?

Question 77mediummultiple choice

Read the full security-disaster-recovery explanation →

A security administrator at a financial services firm is implementing a defense-in-depth strategy for a new Windows Server 2022 file server that will host sensitive client data. The administrator needs to ensure that data at rest on the server's hard drives is protected in a way that does not require users to enter separate credentials and does not rely on the operating system's file permissions. Which technology should the administrator implement?

Question 78mediummultiple choice

Read the full security-disaster-recovery explanation →

A company's datacenter is in a region prone to flooding. Management requires that a copy of nightly backups be stored where a regional flood cannot destroy both the production data and the backup copy, and that the copy be retrievable within 24 hours. Which strategy BEST meets these requirements?

Question 79easymultiple choice

Read the full security-disaster-recovery explanation →

A small business runs a single physical server that hosts a customer relationship management (CRM) application and its database. The owner wants a backup strategy that allows the server to be restored on different hardware if the original server fails completely. Which backup type should the administrator implement?

Question 80hardmultiple choice

Read the full security-disaster-recovery explanation →

A company's disaster recovery plan requires that a critical database server be restored at an alternate site within a recovery time objective (RTO) of 4 hours. The database is 2 TB in size, and the company has a 100 Mbps WAN link between the primary and alternate sites. The administrator needs to choose a replication method that meets the RTO without requiring manual intervention at the alternate site. Which solution should the administrator implement?

Question 81mediummultiple choice

Read the full security-disaster-recovery explanation →

A datacenter administrator must implement a backup strategy for a file server that holds 8 TB of active patient imaging data. The organization requires that a complete copy of the data be stored offsite weekly, and that the offsite copy be protected from accidental deletion or alteration for at least 30 days. The administrator has a 10 GbE connection to the remote site. Which of the following should the administrator configure to meet these requirements?

Question 82mediummultiple choice

Read the full security-disaster-recovery explanation →

A data center administrator is hardening a newly racked Linux server that will host a customer-facing API. The security policy states that only HTTPS (TCP 443) should be reachable from the internet, and no other services should be exposed. The administrator wants the change to survive a reboot and be enforced by the kernel's packet filter. Which of the following should the administrator configure to meet these requirements?

Question 83hardmultiple choice

Read the full security-disaster-recovery explanation →

A security administrator is configuring disk encryption on a new file server that will store regulated data. The server has a TPM 2.0 chip and runs Windows Server 2022. The administrator wants to ensure that the encryption keys are protected and that the server can boot without requiring a USB key at every restart. Which configuration should the administrator use?

Question 84hardmultiple choice

Study the full AAA explanation →

A security team wants to reduce the impact of a compromised service account that is used by a scheduled backup application on a Windows server. The account currently has domain administrator rights. Which action BEST limits the blast radius while keeping backups functional?

Question 85mediummulti select

Read the full security-disaster-recovery explanation →

A security team is reviewing physical security controls for a data center that houses several CompTIA Server+ managed servers. The team wants to implement measures that specifically prevent unauthorized personnel from accessing server racks and deter tailgating. (Choose two.)

Question 86mediummulti select

Read the full security-disaster-recovery explanation →

A company is implementing a backup strategy for a critical database server. The backup window is limited, and the database must remain available during backups. The administrator needs to ensure that transaction log backups are performed and that the database can be restored to a point in time. Which two actions should the administrator take? (Choose two.)

Question 87hardmultiple choice

Read the full security-disaster-recovery explanation →

A financial services company must retain backup data for seven years to satisfy regulatory requirements. The data is written once and never modified, and the company wants to minimize cost while ensuring the data cannot be altered or deleted before its retention period expires. Which storage solution best meets these requirements?

Question 88hardmultiple choice

Read the full security-disaster-recovery explanation →

A company stores nightly full backups on an external USB drive that is rotated weekly and kept in a locked cabinet in the same server room. A recent audit found that a fire in the server room would destroy both the production data and the backup drive. The company wants to improve the backup strategy so that a site-wide disaster does not eliminate all copies, while keeping costs low. Which of the following is the BEST change to meet these requirements?

Question 89hardmultiple choice

Review the full subnetting walkthrough →

A security administrator is configuring a Linux server to allow only SSH and HTTPS traffic from a specific management subnet while blocking all other inbound traffic. The server has two network interfaces: eth0 (public) and eth1 (management). Which command should the administrator use to view the current iptables rules with line numbers to identify the rule positions before modifying them?

Question 90mediummultiple choice

Read the full security-disaster-recovery explanation →

An administrator must choose a physical security control for a new server room door that will allow staff to enter quickly during an emergency while still recording who entered and when. Which solution BEST fits?

Question 91easymultiple choice

Read the full security-disaster-recovery explanation →

A small office has a single physical server running Windows Server 2022 that hosts a file share and a print server. The administrator wants to ensure that if the server's operating system becomes corrupted, the server can be restored quickly to a working state. Which backup type should the administrator use?

Question 92mediummultiple choice

Read the full security-disaster-recovery explanation →

An administrator is configuring a server to use a hardware security module (HSM) for disk encryption key storage. The administrator wants to ensure that if the server is stolen, the encrypted disks cannot be decrypted even if the disks are moved to another system. Which statement best describes why the HSM supports this goal?

Question 93mediummultiple choice

Read the full security-disaster-recovery explanation →

A systems administrator is configuring role-based access for a team of server operators. The operators need to restart services and view logs on production Linux servers, but they must not be able to edit configuration files or install packages. The administrator wants to implement this with the least privilege and avoid sharing the root password. Which of the following should the administrator configure?

Question 94mediummultiple choice

Read the full security-disaster-recovery explanation →

A company performs a full backup every Sunday and incremental backups Monday through Saturday. On Wednesday, a database file becomes corrupted. The administrator needs to restore the most recent version of the file prior to corruption. Which backup sets must be restored?

Question 95hardmulti select

Read the full security-disaster-recovery explanation →

A company is hardening a publicly reachable Linux web server that runs an SSH service for administration. The security team wants to reduce the attack surface and enforce stronger authentication. Which two actions BEST accomplish this? (Choose two.)

Question 96mediummultiple choice

Read the full security-disaster-recovery explanation →

A company has a recovery point objective (RPO) of 15 minutes for its database server. The database is 500 GB, and the nightly full backup takes 4 hours. Which backup strategy best meets the RPO while minimizing storage and backup window impact?

Question 97easymultiple choice

Read the full security-disaster-recovery explanation →

A system administrator is configuring a RAID array for a database server that requires high fault tolerance and improved read performance. The array will consist of six 1 TB drives. The administrator wants to maximize usable capacity while being able to survive a single drive failure. Which RAID level should the administrator choose?

Question 98hardmultiple choice

Read the full security-disaster-recovery explanation →

A company has a primary data center and a warm site 50 miles away. The disaster recovery plan specifies a recovery time objective (RTO) of 4 hours and a recovery point objective (RPO) of 15 minutes. The administrator is reviewing the backup and replication strategy. Which combination best meets these objectives?

Question 99hardmulti select

Read the full security-disaster-recovery explanation →

A company is drafting a disaster recovery plan for its primary data center. The plan must address both the maximum tolerable data loss and the maximum tolerable downtime for critical systems. Which of the following metrics should the plan explicitly define to meet these requirements? (Choose two.)

Question 100easymultiple choice

Read the full security-disaster-recovery explanation →

A system administrator is configuring a backup strategy for a small business. The business requires that backups be stored offsite to protect against physical disasters, and that backup data be encrypted both in transit and at rest. Which of the following backup solutions BEST meets these requirements?

Question 101hardmulti select

Read the full security-disaster-recovery explanation →

A company is designing a disaster recovery plan for a critical web application. The plan must ensure that the application can be recovered within a 4-hour recovery time objective (RTO) and that no more than 1 hour of data is lost. The application runs on virtual machines backed by a storage area network (SAN). Which two actions best support these objectives? (Choose two.)

Question 102hardmulti select

Read the full security-disaster-recovery explanation →

A security administrator is hardening a Linux server that hosts a public web application. The server currently allows root login via SSH and uses default SSH port 22. The administrator wants to reduce the attack surface by implementing SSH best practices. Which two actions should the administrator take? (Choose two.)

Question 103hardmultiple choice

Read the full security-disaster-recovery explanation →

A security administrator is configuring a server to meet a requirement that all administrative access must use multifactor authentication and be encrypted in transit. The server runs Windows Server 2022. Which solution should the administrator implement?

Question 104hardmultiple choice

Read the full security-disaster-recovery explanation →

An administrator is designing physical security for a new server room that also houses the company's network core. Management wants to prevent an unauthorized visitor from plugging a laptop into an unused wall jack and capturing traffic. Which control BEST addresses this specific threat?

Question 105easymultiple choice

Read the full security-disaster-recovery explanation →

A technician is disposing of several decommissioned servers that previously stored customer financial records. The drives will leave the building. Which action BEST ensures the data cannot be recovered by anyone who obtains the drives?

Question 106mediummultiple choice

Read the full security-disaster-recovery explanation →

A company is implementing a disaster recovery plan and needs to determine the maximum acceptable amount of data loss measured in time. The business can tolerate losing up to 4 hours of transactions. Which metric should the administrator use to define this requirement?

Question 107easymultiple choice

Read the full security-disaster-recovery explanation →

A small office has a single physical server running Windows Server 2022 that hosts a file share and a print server. The administrator wants to protect against a hard drive failure that would cause downtime. The server has four drive bays, all currently empty. The administrator needs a solution that provides redundancy and maximizes usable capacity while tolerating one drive failure. Which of the following should the administrator implement?

Question 108mediummultiple choice

Read the full security-disaster-recovery explanation →

A system administrator needs to implement a secure method for remote administrators to manage servers in a data center. The solution must provide encrypted communication, support multi-factor authentication, and allow centralized logging of all administrative sessions. Which solution should be implemented?

Question 109mediummultiple choice

Read the full security-disaster-recovery explanation →

A network administrator is configuring a RAID array for a new file server that will store large media files. The server has six 4 TB SAS drives. The administrator needs to maximize storage capacity while providing fault tolerance against a single drive failure. Which RAID level should be implemented?

Question 110mediummultiple choice

Read the full security-disaster-recovery explanation →

A company's backup policy sends nightly backups to a tape library in the same building as the production servers. A recent fire destroyed the server room, and the tapes were damaged by heat and water. Which change BEST addresses this single point of failure?

Question 111mediummulti select

Read the full security-disaster-recovery explanation →

A datacenter manager is reviewing physical security controls for a server room. Which two controls are considered preventive measures against unauthorized physical access? (Choose two.)

Question 112mediummultiple choice

Read the full security-disaster-recovery explanation →

A company is reviewing its disaster recovery plan. The plan currently states that a full backup is performed every Sunday and incremental backups are performed Monday through Saturday. A disaster destroys the primary server on Wednesday at 2:00 PM, after the Wednesday incremental backup has completed. The administrator needs to restore the server to the most recent state possible. Which of the following backup sets should the administrator restore?

Question 113hardmulti select

Read the full security-disaster-recovery explanation →

A company is implementing a disaster recovery plan for its on-premises data center. The plan must include measures to ensure data integrity and availability during a site-wide power failure. Which two actions should be included in the plan? (Choose two.)

Question 114hardmultiple choice

Read the full security-disaster-recovery explanation →

A company is implementing a disaster recovery strategy for its on-premises VMware vSphere environment. The IT manager wants to ensure that virtual machines can be recovered at a secondary site within 4 hours of a primary site failure. The secondary site has identical hardware but no active VMs. The company has a limited budget and wants to minimize ongoing costs. Which of the following solutions BEST meets these requirements?

Question 115hardmulti select

Read the full security-disaster-recovery explanation →

A security team is hardening a fleet of Linux web servers that will be exposed to the internet. They want to reduce the attack surface and limit the impact of a compromised service account. Which two actions BEST support these goals? (Choose two.)

Question 116easymultiple choice

Read the full security-disaster-recovery explanation →

A junior administrator is asked to document the recovery point objective for a critical order-processing system. What does the recovery point objective define?

Question 117hardmultiple choice

Read the full security-disaster-recovery explanation →

A datacenter administrator is designing physical security for a new colocation cage that houses servers containing regulated customer data. The cage has a single door, and the administrator wants to ensure that entry is logged and that two authorized staff members must be present for the door to unlock. Which of the following should the administrator implement to meet these requirements?

Question 118mediummultiple choice

Read the full security-disaster-recovery explanation →

A datacenter administrator manages a rack of servers that handle nightly batch processing. The company's security policy requires that all server hard drives be sanitized before disposal, and the drives previously contained customer PII. The administrator needs a method that renders the data unrecoverable and also allows the drives to be reused internally for non-sensitive test systems. Which of the following should the administrator use?

Question 119mediummultiple choice

Read the full security-disaster-recovery explanation →

A hospital's server room has a raised floor and a dedicated UPS circuit. During a scheduled power maintenance window, the facilities team must cut utility power to replace a breaker panel. The UPS must keep the two domain controllers and the electronic medical records (EMR) database server running for at least 20 minutes so they can be gracefully shut down. Which configuration should the administrator verify FIRST to meet this requirement?

Question 120easymultiple choice

Read the full security-disaster-recovery explanation →

A small business runs a single physical server that hosts its accounting application and database. The owner wants a backup approach that allows recovery to any point within the last 14 days without restoring a full backup each time. Which backup type should the administrator implement?

Question 121mediummultiple choice

Read the full security-disaster-recovery explanation →

A datacenter administrator must protect a rack of dual-power-supply servers against a single PDU failure. The rack currently has two rack PDUs, each fed from a separate upstream branch circuit, and each server has both power supplies connected. The administrator wants to confirm that the configuration meets the intended redundancy level before adding more servers. Which action should the administrator take?

Question 122hardmultiple choice

Read the full security-disaster-recovery explanation →

A company operates a primary datacenter and a cold standby site. The disaster recovery plan states that the standby site must be able to take over within 8 hours, but the current plan requires rebuilding servers from bare metal and restoring data from tape, which takes 3 days. Which change best aligns the standby site with the stated recovery time objective?

Question 123mediummultiple choice

Read the full security-disaster-recovery explanation →

A datacenter administrator is hardening a newly racked server that will host a public-facing application. The security policy requires that all administrative access to the server use encrypted protocols and that remote interactive logons be limited to the secure shell. Which action best meets these requirements?

Question 124mediummultiple choice

Read the full security-disaster-recovery explanation →

A datacenter administrator is preparing to decommission a rack of servers that stored customer financial records. Company policy requires that data be rendered unrecoverable before the servers leave the facility, and the servers will be resold to a third party. Which action best satisfies the policy?

Question 125easymultiple choice

Read the full security-disaster-recovery explanation →

A server administrator is configuring a new file server that will store sensitive financial documents. The security policy requires that data be encrypted at rest and that the encryption keys be protected by the server's TPM. Which of the following should the administrator implement?

Question 126mediummultiple choice

Read the full security-disaster-recovery explanation →

A datacenter administrator is reviewing physical security for a new colocation cage that houses servers containing regulated data. The cage has a locked mesh door, but the administrator must add a control that logs exactly which employee enters and exits, and when, without requiring a guard. Which solution BEST meets these requirements?

Question 127mediummultiple choice

Read the full security-disaster-recovery explanation →

A datacenter administrator is reviewing physical security for a new server room. The company wants to ensure that only authorized personnel can access the racks and that any access attempts are logged. The room already has a locked door with a badge reader. Which of the following should the administrator implement to meet the requirements for rack-level security and auditing?

Question 128easymultiple choice

Read the full security-disaster-recovery explanation →

A small business leases a single rack in a colocation facility. The owner wants a disaster recovery arrangement that provides a pre-configured alternate site with power, cooling, and network but where the company must supply and install its own servers after a disaster. Which type of site best matches this requirement?

Question 129hardmulti select

Read the full security-disaster-recovery explanation →

A server administrator is hardening a newly deployed Linux web server that will be exposed to the internet. The security policy requires minimizing the attack surface and protecting authentication. Which two actions BEST align with that policy? (Choose two.)

Question 130mediummulti select

Read the full security-disaster-recovery explanation →

A datacenter administrator is hardening a new Windows Server 2022 host that will run a public-facing web application. The administrator needs to reduce the attack surface at the operating system level. Which two actions should the administrator take? (Choose two.)

Question 131easymultiple choice

Read the full security-disaster-recovery explanation →

A system administrator must choose a backup method for a file server where the business requires that only files changed since the last backup are copied, and the backup window is very short. Which backup type should the administrator select?

Question 132mediummultiple choice

Read the full security-disaster-recovery explanation →

A datacenter operator is reviewing physical security for a server room that houses backup tapes and network core switches. The room has a single wooden door with a mechanical lock, and the key is shared among the facilities staff. Which change should the administrator recommend FIRST to improve access control?

Question 133easymultiple choice

Read the full security-disaster-recovery explanation →

A small business runs a single file server that stores contracts and financial records. The owner wants an affordable way to recover individual files that users accidentally delete or overwrite, with the shortest possible recovery time. Which solution BEST fits this requirement?

Question 134mediummultiple choice

Read the full security-disaster-recovery explanation →

A company stores nightly database backups on a dedicated backup server in the same data center as the production database. The security team wants to ensure that a ransomware infection on the production network cannot encrypt or delete the backup copies. Which control should the administrator implement?

Question 135hardmultiple choice

Read the full security-disaster-recovery explanation →

A company runs a critical SQL Server database on a physical server with a RAID 10 array. The database is backed up nightly to a local disk and replicated to a remote site every four hours. A ransomware attack encrypts the local database files and the local backup disk, but the remote replication target is unaffected. The administrator needs to restore service with the least data loss. Which recovery approach should the administrator use?

Question 136mediummultiple choice

Read the full security-disaster-recovery explanation →

A company operates a rack of servers in a shared datacenter. Management wants to ensure that if a malicious actor gains physical access to the rack, they cannot simply remove a hard drive and read the data on another system. Which control BEST addresses this risk?

Question 137hardmultiple choice

Read the full security-disaster-recovery explanation →

A datacenter administrator is planning a disaster recovery site for a critical application. The business requires that the application be able to resume within 15 minutes of a primary site failure, but the application can tolerate up to 30 minutes of data loss. Which combination of metrics and site strategy best fits these requirements?

Question 138hardmultiple choice

Read the full security-disaster-recovery explanation →

A research institute stores regulated genomic data on a Windows Server 2022 file server. The IT director wants data at rest encrypted so that a stolen drive cannot be read, but the lab's instrument control software writes directly to the volume and cannot tolerate any interruption during long sequencing runs. The server has a TPM 2.0 module and a separate recovery appliance. Which solution should the administrator implement?

Question 139hardmultiple choice

Read the full security-disaster-recovery explanation →

A retail company runs its order-processing database on a physical server in a colocation facility. Management has approved a hot site contract for disaster recovery. During a tabletop exercise, the CIO asks the administrator to explain what the hot site contract actually provides on day one of a declared disaster. Which statement is accurate?

Question 140mediummulti select

Read the full security-disaster-recovery explanation →

A company operates a single data center with 40 physical servers and no secondary site. Management has approved a project to improve disaster recovery posture and wants the ability to restore critical workloads after a total site loss. The budget is limited, and the company already owns a large tape library and an offsite vault contract. Which two components should the administrator include in the solution? (Choose two.)

Question 141mediummulti select

Read the full security-disaster-recovery explanation →

A systems administrator is designing the backup strategy for a Windows Server 2022 file server that holds the company's only copy of active project data. The business requires that a single accidental deletion of a folder be recoverable quickly without a full restore, and that a ransomware event that encrypts the volume still leave a usable copy of the data. Which two actions should the administrator take to meet both requirements? (Choose two.)

Question 142easymultiple choice

Read the full security-disaster-recovery explanation →

A small business runs a Windows Server 2022 domain controller and a member file server. The administrator must ensure that if a server's system disk fails, the server can be rebuilt quickly with its operating system, roles, and settings intact. Backups are currently taken with Windows Server Backup to a dedicated backup volume on the same server. Which change should the administrator make?

Question 143easymultiple choice

Read the full security-disaster-recovery explanation →

A datacenter technician is asked to physically destroy the storage media from a set of decommissioned servers that held customer records. The company's policy requires that the media be rendered unreadable and that a certificate of destruction be retained. Which action best satisfies this requirement?

Question 144hardmultiple choice

Read the full security-disaster-recovery explanation →

An administrator manages a Linux-based server hosting a database that contains regulated customer records. The security policy requires that when the server reaches end of life, all data on its solid-state drives be rendered unrecoverable before the drives leave the building. The server will be repurposed to a non-production test role within the same company rather than destroyed. Which action should the administrator take?

Question 145hardmultiple choice

Read the full security-disaster-recovery explanation →

An administrator manages a two-node Windows Server 2022 cluster that hosts a critical SQL Server instance. The cluster uses shared storage on a SAN. During a failover test, the administrator observes that the SQL Server role takes several minutes to come online on the surviving node, exceeding the recovery time objective. The application team confirms the database itself starts quickly once the disk resources are available. Which factor should the administrator investigate first?