SK0-005 security-disaster-recovery Practice Test 1 — 15 Questions

Question 1

Refer to the exhibit. A backup job to a network share failed. The administrator reviews the backup log. What is the most likely cause of the failure?

Accepted Answer

The backup user account lacks appropriate permissions.. When a backup job to a network share fails, the most common and specific cause is that the account running the backup service lacks the necessary share and NTFS permissions on the destination. Backup logs typically show 'Access Denied' or 'Permission Denied' errors when the service account cannot write to the target path. Since the job reached the point of attempting to write, connectivity and server availability are already established, leaving permissions as the likely culprit.

Answer

The backup server is powered off.

Answer

The network link is down.

Answer

The backup file path exceeds the maximum length.

Question 2

A system administrator needs to configure secure remote access to servers in the data center. The current setup uses password-based SSH, but the security policy mandates multifactor authentication and prevention of brute-force attacks. Which solution best meets these requirements?

Accepted Answer

Deploy a VPN with certificate-based authentication and enable MFA.. It directly satisfies both the multifactor authentication (MFA) mandate and brute-force prevention. A VPN with certificate-based authentication provides a strong first factor (something you have), and enabling MFA adds a second factor (e.g., something you know or are), fully meeting the policy. Additionally, the VPN concentrator typically includes built-in brute-force protections like rate limiting and lockout, and it encrypts all traffic, which is ideal for secure remote access to data center servers.

Answer

Implement SSH key authentication only.

Answer

Use SSH with public key authentication and install fail2ban.

Answer

Enable RDP with network-level authentication.

Question 3

A small accounting firm has a single server that hosts their client database and financial applications. The server is backed up nightly using a full backup to an external USB hard drive, which is stored on a shelf next to the server. Last month, a fire broke out in the office, completely destroying the server and the backup drive. The company lost all data since their last offsite backup, which was six months old because they occasionally took a copy home. The business owner wants to prevent such a catastrophic data loss in the future but is concerned about cost and complexity. They have a limited IT budget and no dedicated IT staff. The firm operates 9-5 Monday to Friday, and can tolerate up to 24 hours of downtime and up to one day of data loss. After the fire, they had to rebuild their client records from paper files, which took weeks. The owner realizes the importance of an offsite backup routine but cannot afford an expensive cloud service or a second server. The firm's internet connection is a basic DSL line with limited upload bandwidth, making large cloud backups slow. The server has a single internal drive with enough free space to store additional copies. Which of the following backup strategies would best meet the firm’s recovery objectives while minimizing cost and complexity?

Accepted Answer

Continue nightly full backups to an external drive, but have an employee take the drive home every evening.. The firm needs an offsite copy to survive site-wide disasters, a maximum 24-hour RPO, and minimal cost/complexity with no IT staff. Having an employee take the nightly full backup drive home every evening ensures an offsite copy is created daily, meeting the 24-hour RPO, while reusing the existing USB drive and process — no new hardware, cloud subscription, or technical expertise required.

Answer

Buy a second external drive, alternate them, and keep one offsite at the owner’s house, rotating weekly.

Answer

Purchase a network-attached storage device and configure it to receive daily backups; place it in a different room in the building.

Answer

Subscribe to a cloud backup service and perform daily incremental backups over the internet.

Question 4

A regional hospital operates two data centers located 10 miles apart, with synchronous replication of critical patient record systems between them. The replication ensures that any write to the primary storage is immediately mirrored to the secondary site. The hospital also maintains weekly full backups to LTO-8 tapes, which are stored in a fireproof safe at an offsite warehouse 30 miles away. The IT team has not implemented storage snapshots or continuous data protection due to budget constraints. Last week, a ransomware attack encrypted all files on the primary site. The replication process promptly mirrored the encrypted data to the secondary site, rendering both copies inaccessible. The attackers demanded $500,000 in Bitcoin. The hospital's disaster recovery plan specifies an RPO of 1 hour and an RTO of 4 hours. The IT director must now choose a restoration strategy that minimizes data loss and downtime while ensuring a clean, malware-free environment. The backup tapes are confirmed to be unencrypted and free of ransomware. Which of the following actions should the IT director take first?

Accepted Answer

Wipe the secondary data center storage, restore from the latest clean tape backup at the secondary site, and then reverse replication to the primary.. The correct first action is to wipe the secondary data center storage, restore from the latest clean tape backup at the secondary site, and then reverse replication to the primary. This ensures a clean, malware-free environment because the tapes are confirmed unencrypted and free of ransomware, and it minimizes downtime by using the secondary site as the recovery point. Reversing replication after restoration prevents the re-infection of the primary site from the compromised secondary data.

Answer

Pay the ransom demand to obtain the decryption key and decrypt both sites.

Answer

Restore the most recent tape backup to the primary site and re-enable replication.

Answer

Fail over to the secondary data center and attempt to decrypt the ransomware using available tools.

Question 5

Refer to the exhibit. A backup administrator scheduled a nightly backup to a network share. The backup job fails with the error shown in the log. What is the most likely cause?

Accepted Answer

The service account lacks write permissions to the share. The “Access denied” message indicates a permissions issue, likely that the service account running the backup lacks write access to the share. The share being offline would likely show “network path not found,” a full disk would show “insufficient space,” and the software not installed would prevent the job from running at all.

Answer

The backup destination disk is full

Answer

The network share is offline

Answer

The backup software is not installed

Question 6

A small law firm has a single on-premises server running their case management software, email, and document storage. They perform a full backup each night at 11 PM to an external USB 4 TB drive, which is then stored on a shelf in the server room. The server room is located in the basement of their office building. Last week, an electrical fire started in the server room, completely destroying the server and the backup drive. The firm lost all data since the last backup, and it took two weeks to procure new hardware and restore from an older, off-site backup that was taken during a manual process three months ago. Their insurance company now requires a formal disaster recovery plan. The firm has a limited budget and minimal IT staff. They want to prevent data loss and minimize downtime in future disasters. What is the BEST course of action to improve their disaster recovery capabilities?

Accepted Answer

Subscribe to a cloud backup service that performs automatic daily backups to a remote data center.. Option B is correct because cloud backup automatically sends data to a remote location, satisfying the off-site requirement of the 3-2-1 backup rule, is cost-effective for a small firm, and requires little IT overhead. Option A is wrong because mirroring on-site still leaves them vulnerable to site-wide disasters like fire. Option C is wrong because a fireproof safe does not protect against all disaster types and keeps the backup on-site. Option D is wrong because it still stores the backup on-site, increasing cost and management without solving the off-site need.

Answer

Increase backup frequency to every hour and store the drive in a desk drawer in a different room on the same floor.

Answer

Purchase a fireproof safe for the server room and store the USB backup drive in it after each backup.

Answer

Install a second server on-site and configure real-time mirroring between the two servers.

Question 7

A mid-sized manufacturing company operates a primary data center with all critical servers. They have a warm standby site located 100 miles away. For databases, the primary SAN uses synchronous replication to the standby SAN; no tape backups are taken for databases. File and application servers are backed up to an on-premises tape library using nightly incrementals with a weekly full backup every Sunday. Tapes are shipped off-site every Monday morning. On Tuesday morning, a ransomware attack encrypts the entire primary SAN. Because of the real-time replication, the standby SAN is encrypted almost instantly. The on-site tape library is also connected to the network and its tapes, including Sunday's full and Monday's incremental, are encrypted by the attack. The most recent off-site shipment was the previous Monday (eleven days ago), meaning the off-site tapes contain a full backup from eleven days ago and daily incrementals up to that point. The company's RPO is 1 hour for databases and 24 hours for file servers; RTO is 8 hours. The IT director must decide the best immediate course of action to restore operations while adhering to the DR plan as closely as possible.

Accepted Answer

Restore all systems from the 11-day-old off-site tapes, accepting the loss of data generated during the last 11 days.. The off-site tapes from 11 days ago are the only known-good, unencrypted copies of the data, since the primary SAN, standby SAN, and on-site tape library were all compromised by the ransomware. Restoring from these tapes is the only viable DR action that recovers data without paying criminals or gambling on corrupted replicas. This aligns with the DR plan's reliance on off-site media as the last line of defense when replication and on-site backups fail simultaneously.

Answer

Rebuild all database servers from scratch and restore file servers from the most recent off-site tapes, accepting 11 days of data loss for file servers too.

Answer

Attempt to restore the databases from the replicated SAN by breaking replication and scanning for uncorrupted blocks.

Answer

Pay the ransom demand to the attackers in hopes of receiving the decryption key.

Question 8

A datacenter administrator is configuring a UPS to protect a rack of dual-power-supply servers. The UPS has a network management card, and the administrator wants each server to automatically begin a graceful shutdown when the UPS battery reaches 20 percent remaining capacity. Which action should the administrator take to meet this requirement?

Accepted Answer

Connect the UPS network management card to the same switch as the servers and enable SNMP traps on the UPS.. A UPS network management card can send SNMP traps to agents on each server, allowing them to initiate a graceful shutdown when battery capacity reaches a defined threshold. This approach scales to multiple servers and does not require individual serial or USB connections to the UPS.

Answer

Install a serial cable from the UPS to one server and configure that server to broadcast a shutdown command to the others.

Answer

Connect each server's power supply directly to the UPS and enable the UPS's built-in shutdown software on the management card.

Answer

Configure the servers' BIOS to shut down when AC power is lost, and rely on the UPS to provide runtime until the BIOS timer expires.

Question 9

A data center administrator is configuring a new backup strategy for a file server that stores 2 TB of active project data. The organization requires that backups complete within a 4-hour window each night, and that any single file can be restored without restoring the entire backup set. Which backup type should the administrator implement?

Accepted Answer

Synthetic full backup. A synthetic full backup synthesizes a full backup from existing backups, avoiding the need to read the entire 2 TB source each night, which helps meet the 4-hour window. It also produces a consolidated full backup set that allows individual file restores without chaining multiple incremental backups, satisfying the single-file restore requirement.

Answer

Incremental backup

Answer

Full backup

Answer

Differential backup

Question 10

A company's disaster recovery plan specifies a recovery point objective (RPO) of 15 minutes for its Microsoft SQL Server database. The database is 2 TB, and a full backup takes 6 hours to complete. Which backup strategy best meets the RPO while minimizing storage and restore complexity?

Accepted Answer

Weekly full backups with transaction log backups every 15 minutes. Meeting a 15-minute RPO for a large database requires frequent transaction log backups rather than frequent full backups. A weekly full backup plus 15-minute log backups captures all changes within the RPO window while avoiding the storage and performance cost of repeated full backups. The other strategies either exceed the RPO or sacrifice recoverability.

Answer

Weekly full backups with daily differential backups

Answer

Continuous replication to a secondary server with no local backups

Answer

Daily full backups with hourly transaction log backups

Question 11

An administrator needs to test the disaster recovery plan for a critical server environment. Management requires that the test involve actual failover to the DR site and running production workloads there, but with no impact to the primary site and minimal disruption. Which type of DR test should the administrator perform?

Accepted Answer

Full failover test. A full failover test is the only option that involves actually bringing up the DR site and running production workloads there while the primary site remains unaffected. This provides the most realistic validation of the DR plan and ensures that systems, data, and procedures work under real conditions. It meets the requirement of minimal disruption because the primary site continues to operate normally.

Answer

Tabletop exercise

Answer

Simulation test

Answer

Parallel test

Question 12

A small business has a single server that hosts both a database and a file share. The administrator needs to implement a backup strategy that minimizes backup window time while ensuring that the database can be restored to a consistent state. Which backup type should be used for the database?

Accepted Answer

Transaction log backup. For databases, transaction log backups are designed to capture changes at the transaction level, ensuring consistency and enabling point-in-time recovery. They are fast and can be run frequently, minimizing the backup window. Full, differential, and incremental backups may not guarantee transactional consistency without additional steps, making them less suitable for this requirement.

Answer

Full backup

Answer

Incremental backup

Answer

Differential backup

Question 13

A datacenter administrator needs to implement a physical security control that prevents an unauthorized person from following an employee through a secure door into the server room. Which control should the administrator implement?

Accepted Answer

Mantrap. Tailgating occurs when an unauthorized person follows an authorized employee through a secure door. A mantrap uses two interlocking doors and authentication to allow only one person through at a time, physically preventing the unauthorized entry. Bollards stop vehicles, cameras only record, and an access control vestibule is a less precise term for the same concept, making the mantrap the correct control.

Answer

Bollard

Answer

Camera

Answer

Access control vestibule

Question 14

A security administrator is hardening a Linux server that hosts a public web application. The server must allow inbound HTTPS from anywhere, SSH only from the management subnet 192.168.10.0/24, and must block all other inbound traffic. The administrator decides to use the local firewall. Which of the following commands should the administrator run to apply this policy immediately and persistently?

Accepted Answer

iptables -A INPUT -p tcp --dport 443 -j ACCEPT; iptables -A INPUT -p tcp --dport 22 -s 192.168.10.0/24 -j ACCEPT; iptables -A INPUT -j DROP; iptables-save > /etc/iptables/rules.v4. The correct policy must accept HTTPS from anywhere, accept SSH only from the management subnet, and drop everything else, with rules in that order. Saving with iptables-save to /etc/iptables/rules.v4 ensures persistence across reboots on systems using iptables-persistent. The REJECT variant is less secure because it responds to blocked traffic, and the other options either misorder rules or fail to persist reliably.

Answer

iptables -A INPUT -p tcp --dport 22 -s 192.168.10.0/24 -j ACCEPT; iptables -A INPUT -p tcp --dport 443 -j ACCEPT; iptables -A INPUT -j DROP; service iptables save

Answer

iptables -A INPUT -p tcp --dport 443 -j ACCEPT; iptables -A INPUT -p tcp --dport 22 -s 192.168.10.0/24 -j ACCEPT; iptables -A INPUT -j REJECT; iptables-save > /etc/iptables/rules.v4

Answer

iptables -A INPUT -p tcp --dport 443 -j ACCEPT; iptables -A INPUT -p tcp --dport 22 -j ACCEPT; iptables -A INPUT -s 192.168.10.0/24 -j DROP; iptables -A INPUT -j DROP; iptables-save > /etc/iptables/rules.v4

Question 15

A security administrator at a financial services company needs to harden an Ubuntu Server 22.04 LTS system that hosts a public-facing web application. The administrator must ensure that the SSH service is configured to prevent brute-force attacks by limiting authentication attempts and disabling direct root login. Which of the following actions should the administrator take to meet these requirements?

Accepted Answer

Edit /etc/ssh/sshd_config to set PermitRootLogin no and MaxAuthTries 3, then restart the sshd service.. The correct answer involves editing the SSH daemon configuration file to disable root login and restrict authentication attempts. These settings directly address the brute-force mitigation and root login prevention requirements. Restarting the service ensures the changes take effect. Other options either block all SSH access, use deprecated methods, or rely on external tools that do not fully meet the specific configuration requirements.

Answer

Run sudo ufw deny 22/tcp to block all SSH traffic, then configure a non-standard port for SSH access.

Answer

Modify /etc/pam.d/sshd to include pam_tally2.so deny=3 and set root login to disabled in /etc/passwd.

Answer

Install and configure fail2ban to monitor SSH logs and ban IP addresses after three failed attempts, and set PermitRootLogin to no in /etc/ssh/sshd_config.

SK0-005 security-disaster-recovery Practice Test 1 — 15 Questions

Exhibit

SK0-005 security-disaster-recovery Practice Test 1 — 15 Questions

Exhibit