SK0-005 security-disaster-recovery Practice Test 5 — 15 Questions

Question 1

A mid-sized e-commerce company experienced a ransomware attack that encrypted all on-premises servers and their locally attached backup storage. The attack occurred on a Friday evening; the company was closed over the weekend. By Monday morning, the IT team discovered the encryption and found a ransom note demanding $500,000 in Bitcoin. The company has a disaster recovery plan that calls for restoring from daily tape backups stored offsite. However, the most recent offsite tape was taken home by a backup operator for the weekend and has not been returned. The tape contains full backups from Wednesday. The IT team has clean installation media and application software available. The company's RPO is 24 hours, and RTO is 48 hours. Management wants to minimize data loss and avoid paying the ransom. Based on this scenario, which of the following should the IT team do to recover the business operations?

Accepted Answer

Rebuild the servers from scratch using clean media, restore the latest offsite tape if available, and apply available transaction logs from the on-premises backup server that was encrypted (attempting to recover unencrypted logs).. It follows the existing DR plan by restoring from the available offsite tape (even though a few days old) and builds clean servers to avoid reinfection. It also attempts to salvage any unencrypted transaction logs from the compromised environment to minimize data loss beyond Wednesday. Paying the ransom (Option B) is against best practices and may not guarantee full recovery. Waiting for the operator to return the tape (Option C) delays action and may still result in significant data loss; the operator's return is uncertain. Manually re-entering transactions (Option D) is highly labor-intensive, error-prone, and could exceed the 48-hour RTO.

Answer

Pay the ransom to obtain the decryption key, then restore the environment, and implement better security controls.

Answer

Rebuild the servers from scratch using clean media, and manually re-enter transactions since the last good backup based on paper records and customer emails.

Answer

Wait for the backup operator to return the tape, then restore from that tape, accepting data loss since Wednesday.

Question 2

A healthcare provider is reviewing its disaster recovery strategy. They have two data centers: one primary in City A and a secondary in City B, 200 miles apart. Currently, they perform daily backups that are replicated to City B each night. In the event of a primary site failure, they can fail over to City B, but there is a 4-hour RTO due to manual processes. Their new RTO target is 2 hours, with an RPO of 15 minutes. The IT team is considering various replication technologies. The provider runs a mix of Windows and Linux servers hosting electronic health records (EHR), PACS imaging, and billing applications. Their current backup scheme is a full backup each night, with transaction logs backed up every 6 hours, but these are not immediately shipped offsite. They have experienced power outages in City A, prompting the review. The IT director is concerned about data consistency and quick recovery. The secondary site currently has sufficient hardware to run all critical applications, but data is only updated nightly. The link between data centers has 100 Mbps bandwidth and 10 ms latency, and upgrading it would cost $50,000. The existing staff can script failover procedures. Which solution best meets the new RPO and RTO while staying within budget?

Accepted Answer

Implement asynchronous block-level replication with a 15-minute lag, and automate failover scripts to reduce RTO.. Asynchronous block-level replication with a 15-minute lag directly meets the RPO, and combining it with automated failover scripts can achieve the 2-hour RTO without requiring a costly bandwidth upgrade. Option B would meet the requirements but the link upgrade and synchronous replication infrastructure exceed the budget. Option C fails the RPO (4-hour backups are too infrequent) and RTO (manual failover is 4 hours). Option D uses application log shipping that is not comprehensive (misses other servers) and manual failover would not meet the RTO.

Answer

Use application-level log shipping from the primary databases to secondary with a 5-minute delay, and manually failover.

Answer

Increase backup frequency to every 4 hours and use a warm site with pre-staged hardware, keeping the manual failover process.

Answer

Upgrade the inter-site link to 1 Gbps and implement synchronous replication for all critical VMs.

Question 3

A large financial services company must comply with federal regulations mandating quarterly disaster recovery tests. Their primary data center in New York hosts all trading applications, and a hot site in Chicago is maintained with real-time data replication via synchronous mirroring. During the last DR test, the IT team successfully failed over network and storage within 8 minutes, meeting the 15-minute RTO for connectivity. However, they encountered a major issue: the hot site's firewalls, intrusion detection systems, and application-level access controls were not configured to match the primary environment. The security team had to manually create firewall rules, update IDS signatures, and reconfigure access policies based on documentation, which took over 4 hours. As a result, the total system readiness exceeded 4.5 hours, causing a significant gap in trading operations. The regulatory auditor noted this deficiency and required a corrective action plan. The company must ensure that the next DR test achieves full operational readiness, including security controls, within the 15-minute RTO. The IT budget is already allocated for the current fiscal year, so large capital expenditures are not possible, but the team can leverage existing tools and automation. Which of the following is the BEST approach to address this issue?

Accepted Answer

Implement a configuration management tool that automatically synchronizes firewall rules, IDS signatures, and access controls to the hot site in near real-time.. The core issue is that security controls at the hot site were not synchronized with the primary site, causing a 4-hour manual reconfiguration that blew the 15-minute RTO. A configuration management tool that automatically synchronizes firewall rules, IDS signatures, and access controls in near real-time directly addresses this root cause by eliminating manual intervention during failover. This leverages existing tooling and automation, aligning with the budget constraint while ensuring security parity between sites.

Answer

Develop detailed runbooks for the security team to manually configure devices during failover; then conduct quarterly drills to reduce configuration time.

Answer

Re-evaluate the RTO to extend it to 4 hours and inform regulators of a realistic capability.

Answer

Replace the existing firewalls and IDS at the hot site with identical hardware from the same vendors as the primary site.

Question 4

A company performs full backups every Sunday and differential backups daily. After a ransomware attack, they discover that both the production data and all attached backup media were encrypted. They need to ensure data can be recovered in the future. Which of the following is the BEST change to their backup strategy?

Accepted Answer

Store backups on an air-gapped or offline system.. Air-gapped backups are physically isolated and cannot be reached by ransomware, ensuring recoverability. Option A increases backup frequency but doesn't protect against ransomware that encrypts attached media. Option B changes backup type but still leaves backups online and vulnerable. Option C protects data at rest but if the encryption keys are on the same system, they can be compromised, and encryption itself doesn't prevent deletion/encryption by ransomware.

Answer

Encrypt the backup data using AES-256.

Answer

Perform full backups daily instead of weekly.

Answer

Switch from differential to incremental daily backups.

Question 5

An organization's disaster recovery plan specifies an RPO of 4 hours. Their current backup schedule performs a full backup at midnight and incremental backups every 2 hours from 8:00 AM to 8:00 PM. A server failure occurs at 3:00 AM, and data created after 8:00 PM the previous day is permanently lost. Which of the following is the MOST likely reason?

Accepted Answer

There is a gap in the backup schedule overnight that exceeds the RPO.. Option C is correct because the backup schedule has no coverage from 8:00 PM to 8:00 AM the next morning (except full at midnight), creating a 12-hour gap overnight that exceeds the 4-hour RPO. Data created after 8:00 PM and before the failure at 3:00 AM is lost because no backup captured it. Option A is incorrect because RPO is a requirement, not the cause. Option B is speculative. Option D refers to synthetic fulls, which are not relevant to this gap.

Answer

The incremental backups were not synthetically rolled into the full backup.

Answer

The RPO was set too low for the business requirements.

Answer

The backup media became corrupted.

Question 6

A financial services firm requires a disaster recovery solution that provides a Recovery Point Objective (RPO) of near zero and a Recovery Time Objective (RTO) of less than 2 hours. Which of the following site types is MOST appropriate?

Accepted Answer

Hot site. A hot site is fully equipped, with near real-time data replication, enabling the fastest recovery and minimal data loss. A cold site (Option A) has the longest recovery time. A warm site (Option B) has some equipment but data must be restored from backup, increasing RTO and RPO. Cloud-based backup with daily replication (Option C) does not meet near-zero RPO.

Answer

Cloud-based backup with daily replication

Answer

Cold site

Answer

Warm site

Question 7

An organization uses a cloud-based backup solution with immutable storage to protect against ransomware. However, after a recent attack, an attacker with stolen administrator credentials was able to delete the backup data. Which of the following BEST explains why the backups were deleted?

Accepted Answer

The immutable storage policy was not configured correctly or had a retention lock that was not enabled.. True immutable storage prevents any deletion or modification, even by administrators, for a specified retention period. The fact that an admin could delete it indicates the immutability feature was misconfigured or not properly locked. Option B describes encryption at the source, but that would not allow deletion of existing backups. Option C is irrelevant to deletion. Option D: versioning helps but does not prevent deletion if immutability is not configured.

Answer

The backup solution did not support versioning.

Answer

The attacker used ransomware to encrypt the backup data at the source before it was sent.

Answer

The backup data was stored in a different geographic region than production.

Question 8

Which THREE of the following are typically essential elements of a disaster recovery plan (DRP)? (Choose three.)

Accepted Answer

Emergency contact and communication plan. Option A (Emergency contact and communication plan) is essential because a DRP must define who to notify, how to reach them, and the escalation paths during an incident, ensuring coordinated response across staff, management, and vendors. Option C (Test and exercise schedule) is essential because a DRP is only reliable if it is validated through regular drills, tabletop exercises, and simulations that reveal gaps and keep recovery time objectives (RTOs) and recovery point objectives (RPOs) achievable. Option E (Business impact analysis (BIA)) is essential because it identifies critical business functions, dependencies, and acceptable downtime, providing the foundation for recovery priorities and strategy selection within the DRP. Option B (Server hardware specifications) is not a core DRP element; hardware details belong to asset inventories or build documentation and are too granular for the plan itself. Option D (Network topology diagram) is also not essential to the DRP; while useful as a supporting reference, the plan focuses on roles, procedures, priorities, and validation rather than detailed technical diagrams.

Answer

Server hardware specifications

Answer

Network topology diagram

Question 9

Refer to the exhibit. A disaster recovery test reveals the following timeline for a critical application. The business requires an RTO of 2 hours. Which of the following actions would MOST effectively reduce the RTO to meet the requirement?

Accepted Answer

Implement database replication to eliminate the database restore time.. The exhibit timeline shows the database restore phase consuming the largest portion of recovery time. Implementing database replication (e.g., log shipping, Always On availability groups, or storage-level replication) keeps a standby copy continuously synchronized, so failover replaces a lengthy restore-from-backup with a near-instant switchover. This directly attacks the dominant contributor to RTO, bringing total recovery within the 2-hour business requirement.

Answer

Add more network bandwidth to speed up VM provisioning.

Answer

Use a warm site with pre-configured storage.

Answer

Automate application validation to reduce that phase by half.

Question 10

A system administrator configures full backups on Sunday evenings and differential backups on weekdays. On Thursday morning, a disk failure occurs. Which of the following sets of backups is necessary to completely restore the server's data with the fewest number of backup files?

Accepted Answer

Sunday full and Wednesday differential. A differential backup includes all changes since the last full backup. Therefore, only the most recent differential and the last full backup are needed for a complete restore. Using Sunday's full and Wednesday's differential requires just two files, whereas incremental backups would require the full plus every incremental since. Option A (full plus all four differentials) is unnecessary. Option C references a Thursday backup that hasn't occurred yet. Option D ignores all changes since Sunday.

Answer

Sunday full only

Answer

Sunday full, Monday differential, Tuesday differential, Wednesday differential

Answer

Sunday full and Thursday differential

Question 11

A medium-sized e-commerce company operates three critical servers: a web front-end, a database server, and a file server. Currently, a full backup of all servers is performed every Sunday starting at 11:00 PM and completes in about 6 hours. Differential backups run each weekday at 11:00 PM, taking roughly 2 hours. On a Wednesday at 10:00 AM, a ransomware attack encrypts all data on all servers. The IT team’s incident response plan requires restoration with an RPO of 4 hours and an RTO of 8 hours. The latest clean backup is Tuesday’s differential, resulting in approximately 10 hours of data loss. Future attacks could occur at any time. Management is willing to spend up to $200 per month to improve the backup strategy but cannot afford new hardware or a dedicated hot site. The team needs a solution that reduces both RPO and RTO within budget while maintaining simplicity for a small IT staff of two. Which of the following backup strategies should be implemented to best meet these requirements?

Accepted Answer

Implement hourly incremental backups with daily full backups to a cloud backup service, costing $50/month.. B is correct. Hourly incremental backups with daily fulls to a cloud service gives a maximum data loss of about one hour (if failure right before an incremental), meeting the 4-hour RPO. Daily full backups ensure faster restoration since only the last full and up to a few incrementals need to be applied, likely achieving an 8-hour RTO. The $50/month cost is within budget. Option A (daily full to NAS) extends the backup window to 8 hours and may not meet RPO if an attack occurs between backups. Option C (more frequent differentials) will cause backup times to grow, potentially exceeding the window, and still may have a 4-hour RPO gap if scheduled every 4 hours but an attack occurs after the last. Option D is cost-prohibitive. Thus, B is feasible and effective.

Answer

Switch to daily full backups to a local NAS, which takes 8 hours.

Answer

Adopt real-time replication to a hot site located offsite.

Answer

Continue the current strategy but increase the frequency of differential backups to every 4 hours.

Question 12

A small law firm relies on a single server that hosts a document management system and email. The server is backed up nightly using differential backups to an external USB hard drive that remains connected to the server. One Monday morning, the office manager finds all files encrypted and a ransom note on the screen. The server’s event logs indicate that the encryption began at 2:00 AM on Saturday. The firm’s offsite backup policy rotates two sets of tapes, and the most recent set was taken offsite on Friday evening and is stored in a bank safe deposit box. The USB backup drive, still attached to the server, shows its files also encrypted. The firm does not have a cloud backup service for the server. The office manager wants to restore operations as quickly as possible with minimal data loss and zero risk of reinfection. What is the BEST course of action?

Accepted Answer

Reimage the server, then restore data from the Friday offsite tape backup.. A is correct. The offsite tape backup from Friday evening is air-gapped and predates the infection (Saturday 2:00 AM), ensuring it is clean. Reimaging the server provides a known-good operating system. Option B is risky because the USB drive’s backup likely contains infected files; even an antivirus scan might not detect all ransomware artifacts. Option C is not possible since there is no server cloud backup. Option D is not recommended and may not result in file recovery. Thus, A is the safest and most reliable method.

Answer

Restore the server from the firm's cloud backup service for email.

Answer

Scan the USB drive with antivirus, then restore the latest differential backup from it.

Answer

Pay the ransom to obtain the decryption key, then perform a full backup.

Question 13

A datacenter manager must protect a file server's data against a single hard disk failure while maximizing usable capacity. The server has four 4 TB drives and a hardware RAID controller. Which RAID level should be implemented?

Accepted Answer

RAID 5. The requirement is to survive one disk failure while maximizing usable capacity on four 4 TB drives. RAID 5 stripes both data and single parity across all members, so one drive's worth of capacity is lost to parity, yielding roughly 12 TB usable. It tolerates exactly one disk failure, matching the requirement, and provides more usable space than mirroring or double parity. RAID 0 offers no redundancy, so it fails the fault-tolerance condition.

Answer

RAID 0

Answer

RAID 1

Answer

RAID 6

Question 14

A company is designing a disaster recovery plan for its primary datacenter. The plan must include a warm site that can take over production within four hours and must verify that the recovery procedures actually work. Which two elements should be included? (Choose two.)

Accepted Answer

A tabletop exercise that walks stakeholders through the recovery steps and identifies gaps in the plan.. A workable disaster recovery plan for a four-hour warm site takeover needs measurable objectives and validation. Documented RTO and RPO values define the acceptable downtime and data loss, guiding the warm site design and replication schedule. A tabletop exercise validates the plan by walking stakeholders through the procedures, revealing gaps without risking production. The other options either describe a real outage, an inadequate cold site, or backups stored in a single failure domain, none of which support the stated recovery targets.

Answer

Biweekly incremental backups to tape stored only in the primary datacenter.

Answer

A full-scale failover test that shuts down the primary datacenter during business hours without notifying users.

Answer

A cold site with no pre-installed hardware or data replication, relying on emergency procurement during a disaster.

Question 15

A small accounting firm runs a single physical server that hosts all of its line-of-business applications. The owner wants a backup strategy that allows the entire server, including the operating system, applications, and data, to be restored to dissimilar hardware after a catastrophic failure. Which backup type should the administrator implement?

Accepted Answer

Bare-metal backup. A bare-metal backup is the only listed method that captures the full server, including the OS, applications, and data, in a form that can be restored to dissimilar hardware. File-level, differential, and database-specific backups each omit critical system components, so they cannot satisfy the requirement for a complete server recovery on different hardware.

Answer

Differential backup

Answer

Database dump

Answer

File-level incremental backup