SK0-005 security-disaster-recovery Practice Test 4 — 15 Questions

Question 1

A financial services firm requires a disaster recovery site that provides immediate failover with zero data loss. Which type of site should they implement?

Accepted Answer

A hot site with synchronous replication.. A hot site with synchronous replication ensures that data is written to both primary and secondary sites simultaneously, providing zero RPO and immediate failover. Option B (warm site) requires some time to bring systems online, leading to downtime and potential data loss. Option C (cold site) involves significant setup time and last-known-good backup restoration. Option D (cloud with daily snapshots) introduces an RPO of up to 24 hours, not zero data loss.

Answer

A warm site with asynchronous replication.

Answer

A cloud-based site with daily snapshots.

Answer

A cold site with tape restoration.

Question 2

An organization stores backup tapes at an offsite facility. The tapes contain sensitive customer data. A security audit revealed that tapes were stolen from the facility. Which combination of measures would have MOST effectively prevented unauthorized data access?

Accepted Answer

Encrypt all backup data with strong encryption and restrict decryption keys to authorized personnel.. Encrypting backup data with strong encryption and restricting decryption keys to authorized personnel (A) is the most effective control because it renders stolen tapes unreadable. Even if physical controls fail — as they did here — the data remains confidential without the keys. This is the principle of cryptographic protection as a last line of defense for data at rest.

Answer

Password-protect the tapes and keep them in a locked safe.

Answer

Store tapes in a fireproof safe and limit access to key personnel.

Answer

Use a bonded courier service for transportation.

Question 3

Refer to the exhibit. A Linux server's local firewall is configured as shown. The administrator is unable to perform backups to a network-attached storage (NAS) device using TCP port 10000. Which firewall rule is causing the issue?

Accepted Answer

The DROP all rule at the end blocks all traffic except SSH.. Option D is correct. The INPUT chain contains an explicit DROP all rule at the end, which blocks any traffic not explicitly allowed. The only allowed traffic is SSH on port 22. The backup traffic on port 10000 matches the DROP rule and is therefore dropped. Option A is incorrect because the policy ACCEPT is overridden by the explicit DROP. Option B allows SSH traffic but does not affect port 10000. Option C about subnets is irrelevant to the local firewall shown.

Answer

The INPUT policy is set to ACCEPT.

Answer

The NAS device uses a different subnet.

Answer

The SSH ACCEPT rule is allowing traffic.

Question 4

A database server hosts a critical application that requires a recovery point objective (RPO) of 4 hours. The company wants to minimize the impact on production performance during backups. Which backup strategy should be implemented?

Accepted Answer

A weekly full backup with hourly incremental backups.. Option C is correct because hourly incremental backups meet the 4-hour RPO while minimizing resource usage compared to more frequent full backups or continuous replication. Option A is wrong because differential backups grow in size and can still exceed the RPO window. Option B is wrong because nightly full backups would fail to meet the 4-hour RPO if a disaster occurs hours after the last backup. Option D is wrong because CDP with synchronous replication imposes high performance overhead and is unnecessary beyond the 4-hour RPO requirement.

Answer

Continuous data protection (CDP) with synchronous replication.

Answer

A weekly full backup with daily differential backups.

Answer

A nightly full backup.

Question 5

A small business has a limited budget and can tolerate up to 72 hours of downtime in the event of a disaster. Which type of disaster recovery site would be most cost-effective?

Accepted Answer

Cloud-based DR with pay-as-you-go.. Option D is correct because a cloud-based DR site with pay-as-you-go model requires no upfront investment in hardware and can be spun up as needed, making it cost-effective for a business with a high downtime tolerance. Option A is wrong because a hot site is the most expensive, with real-time replication. Option B is wrong because a warm site requires pre-installed hardware that incurs ongoing costs, even if data is not up-to-date. Option C is wrong because a cold site still requires occasional maintenance and may have hidden costs; modern cloud DR can be cheaper and more flexible.

Answer

Cold site with no pre-configured hardware.

Answer

Hot site with real-time replication.

Answer

Warm site with pre-installed hardware but no data.

Question 6

After an unexpected power outage, a server fails to boot and displays an error indicating a degraded RAID array. The server has a RAID 5 configuration with four disks. One disk has failed, but the hot spare did not automatically rebuild. The administrator needs to restore data availability as quickly as possible. Which action should the technician take FIRST?

Accepted Answer

Replace the failed disk and initiate a manual rebuild.. Option A is correct because replacing the failed disk and initiating a manual rebuild directly restores redundancy and availability using the existing parity data. Option B is wrong because the hot spare is not faulty; the rebuild did not trigger automatically, likely due to a configuration issue, and swapping it does not address the failed disk. Option C is wrong because while a bad battery or cache can cause rebuild failures, checking this is a later step; the immediate need is to replace the failed disk to restore redundancy. Option D is wrong because a backup restore is a last resort and may result in data loss; the array is degraded but still functional, so rebuilding is faster and less disruptive.

Answer

Restore the server from the latest backup.

Answer

Check the RAID controller battery and cache.

Answer

Replace the hot spare with a new disk.

Question 7

A company performs annual disaster recovery tests. The last test revealed that the recovery time objective (RTO) was not met because the backup tapes were corrupted. The backup administrator proposes changes to the backup verification process. Which practice is MOST effective to ensure recoverability?

Accepted Answer

Implement automated integrity checks and periodic test restores.. Option B is correct because automated integrity checks and periodic test restores directly validate that backups are usable and meet recovery objectives, catching corruption early. Option A is wrong because increasing backup frequency does not verify that backups are error-free. Option C is wrong because verifying tapes before offsite storage reduces risk but does not guarantee ongoing media integrity; tapes can degrade over time. Option D is wrong because switching to disk-based backups avoids some tape-specific issues but still requires verification processes to ensure data is not corrupted.

Answer

Perform a full backup more frequently.

Answer

Switch to disk-based backups exclusively.

Answer

Store backup tapes offsite only after verification.

Question 8

During a security incident, a server is suspected to be compromised by malware. The incident response team needs to preserve evidence and minimize impact. Which TWO actions should be taken FIRST? (Select TWO.)

Accepted Answer

Disconnect the server from the network.. Options B and C are correct. Disconnecting the server from the network (B) is an immediate containment step to prevent data exfiltration or spread. Capturing a forensic image of system memory (C) preserves volatile data such as running processes, network connections, and encryption keys before they are lost. Option A is wrong because powering off loses all volatile evidence. Option D is wrong because running an AV scan modifies files and could destroy forensic artifacts. Option E is wrong because rebooting erases memory and may trigger malware countermeasures.

Answer

Run an antivirus scan.

Answer

Reboot the server in safe mode.

Answer

Power off the server immediately.

Question 9

A company is creating a disaster recovery plan for its on-premises data center. Which THREE elements are essential to include in the DR plan? (Select THREE.)

Accepted Answer

Contact information for key personnel.. Options A, C, and E are correct. Contact information for key personnel (A) ensures that the recovery team can be reached during a crisis. RTO and RPO for each critical system (C) define the recovery goals and guide the technical implementation. The list of failover site addresses and access procedures (E) provides vital instructions for reaching and securing the secondary location. Option B is wrong because cleaning procedures are operational but not a core DR plan element. Option D is wrong because backup procedures are part of the backup policy, not the disaster recovery plan; the DR plan assumes backups exist and focuses on restoring from them.

Answer

Detailed instructions for cleaning server hardware.

Answer

Step-by-step procedures for performing backups.

Question 10

Refer to the exhibit. A server administrator is reviewing security logs after a suspected brute-force attack on the SSH service. The following excerpt from /var/log/secure is displayed. Which security control would have been MOST effective in preventing the successful login?

Accepted Answer

Implementing fail2ban or similar intrusion prevention.. Option B is correct because fail2ban or a similar intrusion prevention system monitors logs for repeated failures and blocks the attacker's IP address after a configurable number of attempts, stopping the attack before the correct password is guessed. Option A is wrong because a strong password policy might resist guessing for a long time, but the admin password was eventually guessed; it does not actively prevent repeated attempts. Option C is wrong because disabling root login would not have prevented the attack on the admin account, which was the one compromised. Option D is wrong because changing the SSH port is security through obscurity and does not prevent brute-force attempts once the port is discovered.

Answer

Disabling root login via SSH.

Answer

Enforcing a strong password policy.

Answer

Using a different SSH port.

Question 11

A network administrator needs to configure centralized authentication for network devices. The solution must provide encryption of the entire authentication process, support for multiple protocols, and accounting of user actions. Which protocol should be used?

Accepted Answer

TACACS+. TACACS+ encrypts the entire authentication process, offers granular control over authorization, and supports accounting. RADIUS (B) only encrypts the password, not the entire session. LDAP (A) is a directory service, not an encryption-focused authentication protocol. Kerberos (C) uses tickets and encryption but is primarily for single sign-on within a domain, not commonly used for network device administration.

Answer

Kerberos

Answer

RADIUS

Answer

LDAP

Question 12

A small business needs a disaster recovery site that can be brought online within 2 hours of a primary site failure. The business can tolerate minimal data loss. Which type of recovery site should they implement?

Accepted Answer

Hot site. A hot site maintains near-real-time data replication and preconfigured hardware, enabling failover within 2 hours and minimal data loss. A cold site (Option A) requires hardware setup and data restoration, taking days. A warm site (Option B) has pre-installed hardware but lacks current data, typically taking hours to a day to activate. A mobile site (Option D) is a portable solution with variable provisioning time and may not meet the 2-hour requirement consistently.

Answer

Cold site

Answer

Warm site

Answer

Mobile site

Question 13

A system administrator notices unusual file encryption activity on a file server. The activity appears to be rapidly spreading to other servers, and ransom notes are appearing. Which of the following should the administrator do FIRST?

Accepted Answer

Disconnect the affected servers from the network. The FIRST action in a suspected ransomware attack is to contain the spread by isolating affected systems. Disconnecting the servers from the network immediately stops the malware from encrypting additional files on other servers and prevents lateral movement. This aligns with the containment phase of incident response, which takes priority over notification, scanning, or recovery.

Answer

Notify law enforcement

Answer

Run antivirus scan on the affected servers

Answer

Restore the encrypted files from backup

Question 14

An organization wants to test its disaster recovery plan with minimal disruption to business operations and minimal cost. The test should verify the plan's effectiveness by discussing scenarios. Which type of test should they perform?

Accepted Answer

Tabletop exercise. A tabletop exercise is a discussion-based review of the plan steps with key stakeholders, requiring no system downtime and very low cost. A full interruption test (Option A) actually shuts down primary systems and fails over, causing disruption. A parallel test (Option B) runs systems at the DR site without cutting over but still involves significant resource allocation. A simulation test (Option D) may involve live drills or emulate components, often costing more than a tabletop.

Answer

Parallel test

Answer

Full interruption test

Answer

Simulation test

Question 15

A financial services firm requires zero data loss in the event of a primary data center failure. They operate two data centers 50 miles apart connected by a high-bandwidth, low-latency link. Which replication method should they use to meet this requirement?

Accepted Answer

Synchronous replication. Synchronous replication writes data to both sites before acknowledging the write to the application, ensuring zero data loss (RPO=0). Asynchronous replication (Option A) introduces a delay and can lose the latest transactions. Snapshot replication (Option C) is point-in-time and not continuous, leading to potential data loss between snapshots. Backup replication nightly (Option D) can lose up to a day's data.

Answer

Asynchronous replication every 15 minutes

Answer

Snapshot replication every hour

Answer

Backup replication nightly