SK0-005 security-disaster-recovery Practice Test 2 — 15 Questions

Question 1

A security administrator is hardening a Linux web server that hosts a public-facing application. The server currently allows SSH access from any IP address and uses password authentication. The administrator wants to reduce the attack surface and implement defense in depth. Which two actions should the administrator take? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disable SSH password authentication and enforce public key authentication.. Limiting SSH access to a management subnet restricts who can attempt to connect, and enforcing public key authentication removes the vulnerability of password-based attacks. Together, these measures significantly harden SSH by implementing network-level and authentication-level controls, directly reducing the attack surface and adding defense in depth.

Answer

Enable root login over SSH to simplify administrative tasks.

Answer

Install a host-based intrusion detection system (HIDS) to monitor file integrity.

Answer

Change the SSH default port from 22 to a non-standard port.

Question 2

A datacenter administrator must dispose of twelve decommissioned servers that stored customer payment card data. The company's policy requires that no recoverable data leaves the building, and the drives will be resold to a third party. Which action BEST satisfies both the data destruction requirement and the resale plan?

Accepted Answer

Physically shred the drives to the vendor's specified particle size, then provide the reseller with the shredded material for recycling.. The requirement is absolute: no recoverable data may leave the facility, and the drives are being sold onward. Only physical destruction of the media guarantees that no remapped, cached, or reserved-area data survives, while the resulting material can still be recycled for value. Overwriting, degaussing, and key destruction each depend on assumptions about the media or leave the drive unusable or potentially readable.

Answer

Perform a cryptographic erase by destroying the drive's internal encryption key, then verify the drive reports as unreadable before resale.

Answer

Degauss each drive with a strong magnetic field before handing the drives to the reseller.

Answer

Run a single-pass overwrite on each drive using the vendor's disk utility, then ship the drives to the reseller.

Question 3

A company is designing a disaster recovery plan for its critical web application. The application runs on three servers: a web server, an application server, and a database server. The company wants to ensure that if the primary site fails, the application can be brought online at a secondary site with minimal data loss and within a 1-hour RTO. The secondary site currently has identical hardware but no software installed. Which of the following should be implemented to meet these requirements?

Accepted Answer

Warm site with replicated data and pre-staged servers. A warm site balances cost and recovery speed by having hardware and some software pre-installed, with data replication from the primary site. This allows the application to be operational within the 1-hour RTO and minimizes data loss. It is more practical than a hot site for the stated requirements and far faster than a cold or mobile site.

Answer

Cold site with nightly backups and manual restore

Answer

Mobile site with trailers and generators

Answer

Hot site with real-time replication and automatic failover

Question 4

A company is designing a disaster recovery plan for its critical SQL Server database. The recovery point objective (RPO) is 15 minutes, and the recovery time objective (RTO) is 1 hour. The database is 2 TB in size and experiences heavy transaction volume. Which combination of technologies should be implemented to meet these objectives with minimal data loss?

Accepted Answer

Always On availability groups with synchronous commit and automatic failover. To achieve a 15-minute RPO and 1-hour RTO for a heavily utilized SQL Server database, synchronous commit with automatic failover in Always On availability groups is ideal. It ensures zero data loss by committing on both replicas and enables fast failover. Other options either risk data loss or use deprecated technology.

Answer

Database mirroring in high-safety mode with automatic failover

Answer

Always On availability groups with asynchronous commit and automatic failover

Answer

Daily full backups and hourly transaction log backups

Question 5

A security administrator is reviewing physical security for a server room that houses domain controllers and backup tapes. The administrator wants to prevent unauthorized individuals from following an authorized employee through the door and to ensure that entry attempts are recorded for audit. Which of the following controls should the administrator implement?

Accepted Answer

Install a badge reader with an anti-passback and tailgating detection feature, and log all entry events.. The requirement is twofold: prevent unauthorized individuals from following an authorized person through the door, and record entry attempts for audit. A badge reader with anti-passback and tailgating detection provides both prevention and an electronic log. Mechanical locks, cameras alone, and a full mantrap either fail to prevent tailgating, fail to log, or exceed what the scenario requires.

Answer

Install a camera above the door that records continuously and store the footage for 24 hours.

Answer

Deploy a mantrap with two interlocking doors that requires a badge at both doors.

Answer

Replace the door lock with a mechanical keyed lock and issue keys only to authorized staff.

Question 6

A small business has a single server that runs a critical application. The business wants to ensure that if the server's hard drive fails, they can recover the operating system, application, and data quickly. They have a limited budget and want the most cost-effective solution. Which of the following should they implement?

Accepted Answer

RAID 1. RAID 1 mirrors data across two drives, providing redundancy and allowing the server to continue operating if one drive fails. It is cost-effective for a small business because it requires only two drives and offers simple setup. RAID 0 has no redundancy, RAID 5 requires more drives and is more complex, and daily backups do not provide immediate recovery. RAID 1 directly addresses the need for quick recovery from a hard drive failure.

Answer

Daily full backups to an external drive

Answer

RAID 5

Answer

RAID 0

Question 7

A security administrator is reviewing physical security for a server room that houses critical infrastructure. The room currently has a standard lock-and-key door and no other controls. The administrator needs to implement measures to prevent unauthorized access and detect intrusion attempts. Which combination of controls should the administrator implement?

Accepted Answer

Install a badge reader on the door and a security camera inside the room.. A badge reader enforces access control and creates an audit trail of who enters, while a security camera inside the room provides visual monitoring and recording of activities. Together, they prevent unauthorized access through authentication and detect intrusions through surveillance, meeting both prevention and detection requirements.

Answer

Install a keypad lock on the door and a logbook at the entrance for visitors to sign.

Answer

Install a biometric scanner on the door and a door alarm that sounds when the door is opened.

Answer

Install a cipher lock on the door and a motion sensor in the hallway.

Question 8

A security administrator is implementing a defense-in-depth strategy for a new server that will host a database containing sensitive customer information. The administrator must ensure that data at rest is protected and that access to the database is restricted to authorized applications only. Which of the following should the administrator implement? (Choose two.)

Accepted Answer

Enable full disk encryption using TPM-backed BitLocker.. The two requirements are data-at-rest protection and restricting database access to authorized applications. Full disk encryption with TPM-backed BitLocker encrypts the entire volume, protecting data if drives are removed. A host-based firewall limiting connections to the application server's IP enforces least privilege. RAID 6, auditing, and TDE do not together satisfy both requirements; TDE covers encryption but not access restriction.

Answer

Enable database auditing to log all queries executed against the database.

Answer

Configure database transparent data encryption (TDE) for the sensitive tables.

Answer

Implement RAID 6 on the database server's storage volumes.

Question 9

A server administrator at a hospital replaces a failed drive in a RAID 5 array on a Windows Server 2022 file server. The replacement drive is a different model with a larger capacity than the remaining members of the array. Before the rebuild completes, a second drive in the same array fails, and the array goes offline. Which of the following should the administrator have verified BEFORE pulling the failed drive to reduce the risk of this outage?

Accepted Answer

That the replacement drive was on the hardware compatibility list and matched the capacity and rotational speed of the existing members. A RAID 5 array can tolerate only one failed member; during a rebuild it runs in a degraded state with no redundancy. Verifying that the replacement drive is compatible and matches capacity and rotational speed helps ensure a clean rebuild and avoids controller errors. The outage happened because a second drive failed before the rebuild finished, a risk that proper pre-replacement verification and monitoring should have mitigated.

Answer

That a full backup of the array had completed within the previous 24 hours

Answer

That the array's stripe size was set to 64KB to optimize rebuild throughput

Answer

That the controller's write-back cache was disabled to protect parity during the rebuild

Question 10

A datacenter administrator is hardening a Windows Server 2022 file server that stores HR records. Management requires that all access to the server be encrypted in transit, and clients must be able to verify the server's identity before sending credentials. The server has a valid certificate issued by the internal CA. Which action should the administrator take to meet these requirements?

Accepted Answer

Enable SMB encryption on the file server and require it for all shares.. The requirement is encryption in transit plus server identity verification for a Windows file server. SMB encryption uses the server's certificate to encrypt the whole SMB session and lets clients authenticate the server, meeting both goals with a native feature. Disk encryption, packet signing, and network-layer IPsec each address different concerns and leave the stated requirement unmet.

Answer

Enable SMB signing on the file server and require it on all clients.

Answer

Enable BitLocker on all volumes that host the HR records.

Answer

Configure IPsec transport mode between the server and all client subnets.

Question 11

A system administrator is designing a backup strategy for a database server that must have a recovery point objective (RPO) of 15 minutes and a recovery time objective (RTO) of 2 hours. The database is 4 TB and changes at a rate of about 200 GB per day. The backup window is only 4 hours each night. Which backup type should the administrator implement to meet the RPO while fitting the backup window?

Accepted Answer

Full backup weekly and transaction log backups every 15 minutes.. The 15-minute RPO demands a recovery method that captures changes at least every 15 minutes. Transaction log backups are designed for this granularity and are small enough to run frequently without a large backup window. Weekly full backups provide the baseline. Other options provide RPOs of 24 hours, 6 hours, or 1 hour, all of which fail the requirement.

Answer

Incremental backup every night and differential backups every 6 hours.

Answer

Snapshot the database volume every hour using storage array snapshots.

Answer

Full backup every night during the 4-hour window.

Question 12

A company is designing a backup strategy for a file server that stores 8 TB of active project data. The backup window is only four hours per night, and the business requires the ability to restore individual files from any day in the past 30 days. The administrator plans to use Windows Server Backup with a dedicated backup volume. Which two actions should the administrator take to meet these requirements? (Choose two.)

Accepted Answer

Enable Volume Shadow Copy Service (VSS) so open files are captured consistently during backup. Meeting both the four-hour window and 30-day file-level restore requires an efficient backup type and consistent capture of open files. Incremental backups during the week with a weekly full reduce nightly data volume, while VSS ensures open project files are included. Together they allow the job to complete on time and provide the required recovery points.

Answer

Set the backup target to a network share on a different server to avoid using local disk space

Answer

Configure the backup to run as a full backup every night to ensure all files are captured

Answer

Disable shadow copies on the source volume to improve backup performance

Question 13

A system administrator is configuring a backup job for a Windows Server 2022 file server that contains millions of small files. The backup window is only four hours, and the administrator wants to minimize the time required for future incremental backups while still allowing point-in-time restores. Which backup method should the administrator choose?

Accepted Answer

Incremental backup every night after an initial full backup. Incremental backups record only changes since the last backup, so nightly jobs remain small and complete quickly. This directly addresses the four-hour window and the large number of small files. Point-in-time restores are still available by restoring the initial full backup and then applying the incremental chain in order.

Answer

Copy backup every night after an initial full backup

Answer

Full backup every night

Answer

Differential backup every night after an initial full backup

Question 14

A company stores nightly full backups on tape in an on-site vault and replicates database transaction logs to a cloud bucket every 15 minutes. A ransomware incident encrypts the production database server and the on-site backup vault at 02:00. The most recent cloud log replication completed at 01:45. Which statement correctly describes the recoverable state?

Accepted Answer

The company can restore to 01:45 and will lose up to 15 minutes of committed transactions, because the cloud log replication is the only surviving copy.. The incident destroyed both the production server and the on-site backup vault, so the only surviving copy is the off-site cloud transaction log stream. Its last successful replication at 01:45 defines the recovery point, meaning committed transactions after that time are lost. Recovery is still possible by replaying those logs onto a clean base restore.

Answer

The company can restore to 02:00 with zero data loss, because the cloud replication interval guarantees the final 15 minutes are also in the cloud.

Answer

The company can restore to 01:45 but must first decrypt the on-site tape vault, because tape backups are immutable and unaffected by ransomware.

Answer

The company cannot recover the database at all, because the nightly full backup was on the encrypted tape vault and transaction logs alone are insufficient.

Question 15

A hospital's server room has a single rack containing two servers, each with dual redundant power supplies, plus a managed switch and a tape library. The facilities team installs a new 3000 VA online double-conversion UPS with a network management card. During a planned power maintenance window, utility power is cut and the UPS carries the load; the administrator notices the UPS runtime estimate drops from 22 minutes to 9 minutes within the first minute and the UPS logs a 'load segment overload' warning on one output group. Which action should the administrator take first to correct the problem?

Accepted Answer

Redistribute the equipment across the UPS output groups and verify that total connected load is within the UPS VA/watt rating, moving only one power supply from each server to the UPS.. An output-group overload with a sudden runtime drop is a load problem, not a monitoring problem. Because each server has dual power supplies, connecting only one supply per server to the UPS and spreading the remaining devices across the output groups brings the connected load inside the UPS rating while preserving protection for every server.

Answer

Enable Energy Saver mode on the UPS so it bypasses double conversion during low-load periods and extends runtime.

Answer

Replace the UPS network management card with a higher-throughput model so the runtime estimate recalculates correctly.

Answer

Add a second identical UPS and connect the remaining server power supplies to it, leaving the existing load distribution unchanged.