SK0-005 security-disaster-recovery Practice Test 3 — 15 Questions

Question 1

A server administrator is implementing a disaster recovery plan for a small business. The plan must include measures to ensure that critical servers can be recovered in the event of a site-wide power failure. The business has a limited budget and wants to minimize downtime. Which of the following should the administrator implement? (Choose two.)

Accepted Answer

Configure servers to automatically power on after power restoration.. The two measures that directly address power failure on a limited budget are UPS units for critical racks and automatic power-on after restoration. UPS units bridge short outages and allow graceful shutdown, while auto power-on brings servers back without manual intervention. Redundant PSUs, generators, and Wake-on-LAN either do not address site-wide power loss or are too costly or ineffective.

Answer

Implement a redundant power supply in each server.

Answer

Deploy a diesel generator for the entire datacenter.

Answer

Enable Wake-on-LAN for all servers.

Question 2

A datacenter administrator for a healthcare provider is hardening a Windows Server 2022 host that stores electronic protected health information (ePHI). The security policy requires that any attempt to access a protected file be recorded with the user identity, timestamp, and result, and that the log entries be resistant to tampering by local administrators. The server hosts a single NTFS volume. Which action should the administrator take?

Accepted Answer

Enable the Audit File System policy under Advanced Audit Policy Configuration and set a global object access audit entry on the ePHI folder.. File access auditing on Windows Server 2022 requires two coordinated pieces: the Advanced Audit Policy subcategory Audit File System must be enabled, and a system access control list entry must be placed on the folder or files to be monitored. Together they produce Security log events containing the account name, the object path, the access type, and success or failure. Forwarding those events to a centralized collector prevents a local administrator from erasing the trail.

Answer

Configure a Data Collector Set in Performance Monitor that captures disk I/O counters for the ePHI volume.

Answer

Enable the Object Access auditing policy and rely on the default inherited audit entries on the volume root.

Answer

Turn on Encrypting File System for the ePHI folder and enable the System Integrity event log.

Question 3

A datacenter administrator is implementing physical security controls for a new server room that houses regulated customer data. The security policy requires layered controls that detect unauthorized entry and limit the time an intruder can remain unnoticed. Which two controls best meet these requirements? (Choose two.)

Accepted Answer

Place motion-activated cameras inside the room that record continuously and alert security on movement.. The policy asks for layered controls that detect entry and shorten the time an intruder goes unnoticed. Badge-reader access control with audit logging records and restricts entry, while motion-activated cameras detect presence and alert security in real time. Together they provide detection and response, whereas rack locks, signage, and airflow improvements do not.

Answer

Install a raised floor with perforated tiles to improve airflow across the server racks.

Answer

Post a visible sign at the entrance stating that the area is restricted to authorized personnel only.

Answer

Install a locked rack with a keyed front door on each server cabinet.

Question 4

A server administrator is designing backup retention for a database server that must satisfy a policy requiring recovery points from any day within the past 30 days, while keeping storage costs reasonable. Full backups are large, and the database changes constantly. Which backup scheme BEST meets the policy?

Accepted Answer

Perform a weekly full backup plus daily differential backups, retaining four weeks of sets.. The policy needs a usable recovery point for each of the last 30 days at reasonable cost. Weekly fulls combined with daily differentials deliver exactly that: each day's differential pairs with its week's full, so any day is recoverable, while only four full sets are stored instead of thirty. Nightly fulls are wasteful, incremental-only chains are unrestorable, and monthly fulls with logs are fragile.

Answer

Perform a monthly full backup and rely on database transaction logs for all recovery within the month.

Answer

Perform a full backup every night and retain 30 copies on disk.

Answer

Perform only daily incremental backups with no periodic full backup, retaining 30 days of incrementals.

Question 5

A company's disaster recovery plan requires that a critical virtual machine be restarted at a secondary site within 30 minutes of a primary site failure. The secondary site has compatible hardware and network connectivity but no pre-staged virtual machine. Which recovery strategy best meets the requirement?

Accepted Answer

Restore the virtual machine from the most recent backup to the secondary site hardware and start it.. The environment has compatible hardware and connectivity at the secondary site but no pre-staged virtual machine, and the target is 30 minutes. Restoring the virtual machine from a current backup onto that hardware and starting it fits the constraints and the time objective. Continuous replication exceeds the requirement, while in-site clustering and physical relocation cannot meet a secondary-site recovery within 30 minutes.

Answer

Rely on the primary site's high-availability cluster to restart the virtual machine on another host.

Answer

Ship the physical server hosting the virtual machine to the secondary site and reconnect it there.

Answer

Maintain a continuously replicated virtual machine at the secondary site with automated failover.

Question 6

A server administrator is restoring a file server from a full backup taken 7 days ago and incremental backups taken daily. The restoration fails with an error about missing catalog files. What is the most likely cause?

Accepted Answer

The incremental backup chain is broken. Incremental backups depend on a chain that starts with a full backup and then each subsequent incremental backup references the previous one. If any link in the chain is missing, corrupted, or the catalog that tracks the chain is damaged, the restore fails with an error about missing catalog files. The most likely cause is that the incremental backup chain is broken, meaning the backup software cannot locate the required incremental sets to reconstruct the file server state.

Answer

The hard drive on the file server has failed

Answer

The backup software is not compatible with the current OS version

Answer

The full backup media is corrupted

Question 7

A medium-sized company uses a backup strategy that includes a full backup every Sunday at 2:00 AM and differential backups Monday through Saturday at 2:00 AM. The backups are written to a network-attached storage (NAS) device. On Thursday morning, the company experiences a ransomware attack that encrypts all data on the file server, including the NAS. The administrator needs to restore the file server with minimal data loss. The last successful full backup was from the previous Sunday, and differential backups were successful on Monday, Tuesday, and Wednesday. However, Thursday's differential was not completed because the attack occurred before the scheduled time. The administrator attempts to restore using the Sunday full backup and Thursday's differential, but the restore fails because the differential backup on the NAS is also encrypted. Which of the following is the best course of action?

Accepted Answer

Restore from the Sunday full backup and Wednesday's differential backup. Differential backups capture all changes since the last full backup, so Wednesday's differential contains everything modified since Sunday. Restoring the Sunday full backup followed by Wednesday's differential recovers all data up to Wednesday night, which is the most recent uncorrupted recovery point available. Thursday's differential is encrypted and unusable, so Wednesday is the correct fallback.

Answer

Pay the ransom to decrypt the differential backup

Answer

Reinstall the operating system and restore files from cloud storage

Answer

Restore using only Wednesday's differential backup

Question 8

A small business has a single file server running Windows Server 2019. The server uses two internal SATA drives in a RAID 1 mirror for the operating system and data. The company's backup solution performs a full backup every night to an external USB hard drive, which is stored in the server room. The IT administrator recently noticed that the server's system volume is running low on space and decides to migrate the data to a larger drive. During the migration, the server crashes and will not boot. The administrator attempts to restore from the latest backup but finds that the backup drive is corrupted and cannot be read. The company has no offsite backups. What should the administrator have done to prevent this situation?

Accepted Answer

Regularly test backup restorations to verify data integrity.. The correct answer is D: Regularly test backup restorations to verify data integrity. The administrator assumed backups were valid without verification. Option A is wrong because RAID 1 provides redundancy but does not protect against corruption or accidental deletion; the issue here is backup corruption. Option B is wrong because cloud backup is a good practice but not strictly required; the root cause is lack of backup testing. Option C is wrong because while documentation is helpful, it would not prevent data loss from a corrupted backup drive.

Answer

Implement a RAID 5 array instead of RAID 1 for better redundancy.

Answer

Document the backup procedure and create a disaster recovery plan.

Answer

Use a cloud-based backup service with offsite storage.

Question 9

A medium-sized company runs an e-commerce platform on a cluster of three physical servers hosting virtual machines. The disaster recovery plan includes daily backups to a remote data center using Veeam Backup & Replication. The company's annual disaster recovery drill is scheduled for next week. During the drill, the IT team plans to simulate a complete site failure by powering off the primary data center. The recovery time objective (RTO) is 4 hours, and the recovery point objective (RPO) is 1 hour. The team successfully restores the VMs at the remote site, but the application experiences significant performance degradation and many transactions fail due to database inconsistency. Investigation reveals that the backup was taken at 2:00 AM, but the failure occurred at 10:00 AM, and the application's database had transactions between 2:00 AM and 10:00 AM that were not captured. What should the IT team do to improve the recovery process?

Accepted Answer

Enable log shipping with point-in-time recovery for the database.. The correct answer is B: Implement log shipping with point-in-time recovery for the database. The RPO of 1 hour is not being met because the backup schedule is daily. Option A is wrong because while a faster WAN can reduce backup time, the core issue is the backup frequency, not bandwidth. Option C is wrong because the issue is not data redundancy but recovery granularity; RAID protects against drive failure but not data loss from missing transactions. Option D is wrong because increasing RTO does not solve the RPO violation; the goal is to reduce data loss, not relax the time target.

Answer

Configure RAID 10 on all database servers to improve disk performance.

Answer

Upgrade the WAN connection between sites to reduce backup transfer times.

Answer

Adjust the RTO to 8 hours to allow for more comprehensive backups.

Question 10

A large enterprise uses a centralized backup solution with a backup server running Commvault. Backups are stored on a deduplicated disk array and replicated to a secondary site for disaster recovery. The company's security team detects ransomware activity that has encrypted several file servers. The backup administrator checks the backup repository and finds that the backup data is also encrypted because the backup service account had permissions to modify backup files, and the ransomware propagated to the repository. The last known good backup is from two weeks ago, which is too old for the organization's RPO of 24 hours. The backup administrator is under pressure to restore operations quickly. Which of the following should the administrator implement to prevent this from recurring?

Accepted Answer

Immutable backup storage and a dedicated service account with least-privilege access.. The correct answer is A: Implement immutable backup storage and use a separate service account with write permissions only during backup windows. Immutable backups cannot be modified or deleted by any user or process, including ransomware. Option B is wrong because air-gapping alone does not prevent access if the backup server is compromised; immutable storage is more robust. Option C is wrong because while MFA is a good security practice, it does not protect backups that are already accessible with valid credentials. Option D is wrong because encryption of backup data protects it during transit or while stored, but does not prevent the ransomware from encrypting the files if the backup system is accessible.

Answer

Encrypt all backup data at rest and in transit.

Answer

Require multi-factor authentication for the backup service account.

Answer

Air-gap the backup repository by disconnecting it from the network except during backup windows.

Question 11

A company uses a two-node failover cluster for a critical application. The cluster nodes are located in the same data center, and the quorum configuration uses a file share witness on a separate server in the same data center. During a major power outage, both cluster nodes and the file share witness server lose power. What is the impact on cluster availability?

Accepted Answer

The cluster will be offline until one of the nodes or the witness comes back online.. With a two-node cluster plus a file share witness, quorum requires a majority of votes — 2 out of 3. When both nodes and the witness lose power simultaneously, no votes remain, so the cluster cannot achieve quorum and all clustered roles go offline. Availability is restored only when at least two of the three voting members (e.g., one node plus the witness, or both nodes) return.

Answer

The cluster will automatically fail over to a third site because the witness server is unavailable.

Answer

The cluster continues operating because the nodes can use a dynamic quorum and adjust the vote count.

Answer

The cluster remains online because the nodes can communicate directly and form quorum without the witness.

Question 12

A server administrator is responsible for protecting sensitive data. The backup process copies files to a network share daily. Which of the following should the administrator do to BEST ensure the confidentiality of the backup data both during transfer and at rest?

Accepted Answer

Encrypt the backup files before transfer using a tool like GPG, and store them encrypted.. Encrypting the backup files before transfer (Option B) ensures data confidentiality during transit and while stored on the backup server. Option A provides network segmentation but no encryption. Option C encrypts only the transfer, not the data at rest. Option D is a physical security measure and does not encrypt the data.

Answer

Configure the network share with SMB encryption only.

Answer

Use a dedicated NIC for backup traffic on an isolated VLAN.

Answer

Place the backup server in a physically locked cage with restricted access.

Question 13

Refer to the exhibit. An administrator is reviewing logs after a server experienced performance issues and unexpected shutdowns. Based on the log entries, which component is MOST likely failing?

Accepted Answer

Hard disk drive. The log entries show multiple SCSI medium errors, unrecovered read errors, and auto-reallocation failures on device sda, which are classic signs of a failing hard disk drive (Option B). A RAID controller (A) would typically show different errors, RAM (C) would cause memory-related errors, and a power supply (D) would trigger power event logs.

Answer

RAID controller

Answer

RAM module

Answer

Power supply

Question 14

An organization requires a disaster recovery site that can be operational within 24 hours after a disaster declaration, with critical data replicated on a regular basis, but not necessarily real-time. Which type of site should they implement?

Accepted Answer

Warm site. A warm site provides pre-installed hardware and network infrastructure, along with data backups that can be loaded and activated within a day. Hot sites offer immediate failover but are more expensive and not necessary here. Cold sites are empty space and take weeks. An alternate processing site is a vague term.

Answer

Alternate processing site

Answer

Cold site

Answer

Hot site

Question 15

A company performs a full backup on Sunday and incremental backups Monday through Saturday. A server fails on Thursday at 10:00 AM. Which sequence correctly restores the data?

Accepted Answer

Restore Sunday full, then Monday, Tuesday, and Wednesday incrementals.. Option C is correct because an incremental backup captures only changes since the last backup, requiring the last full backup and all subsequent incrementals up to the point of failure. Options A and D are wrong because they skip Monday’s incremental (A) or both Monday and Tuesday (D). Option B is wrong because it restores out of order, which would not apply the data correctly.

Answer

Restore Sunday full, then Tuesday and Wednesday incrementals.

Answer

Restore Sunday full and Wednesday incremental only.

Answer

Restore Wednesday's incremental, then Sunday full.