SK0-005 security-disaster-recovery Practice Test 6 — 15 Questions

Question 1

A financial services company runs a single physical server hosting a customer-facing web application. The security team must ensure that if an attacker modifies system binaries, the server can detect the change during a forensic investigation. Which technology should be implemented to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

File integrity monitoring (FIM) using a tool such as Tripwire. The requirement is to detect unauthorized changes to system binaries for forensic purposes. File integrity monitoring establishes a cryptographic baseline and alerts on any deviation, providing clear evidence of tampering. Other options focus on prevention, log aggregation, or data-at-rest protection, none of which directly detect binary modification with forensic detail.

Answer

Security information and event management (SIEM) with log correlation

Answer

Host-based intrusion prevention system (HIPS) with signature-based detection

Answer

Full disk encryption (FDE) using TPM-backed BitLocker

Question 2

A security administrator at a financial services firm is implementing a defense-in-depth strategy for a new Windows Server 2022 file server that will host sensitive client data. The administrator needs to ensure that data at rest on the server's hard drives is protected in a way that does not require users to enter separate credentials and does not rely on the operating system's file permissions. Which technology should the administrator implement?

Accepted Answer

BitLocker Drive Encryption with TPM protector. BitLocker with a TPM protector provides full-disk encryption that is transparent to users and independent of file system permissions. The TPM stores the encryption key and releases it only during a verified boot process, so no separate credentials are needed. This directly addresses the need to protect data at rest on the server's drives without relying on NTFS.

Answer

Storage Spaces with thin provisioning

Answer

Encrypting File System (EFS) on all user data folders

Answer

NTFS permissions with inheritance enabled

Question 3

A company's datacenter is in a region prone to flooding. Management requires that a copy of nightly backups be stored where a regional flood cannot destroy both the production data and the backup copy, and that the copy be retrievable within 24 hours. Which strategy BEST meets these requirements?

Accepted Answer

Ship encrypted backup copies to an offsite vault in a different geographic region.. The requirement is geographic separation of a backup copy so that a single regional flood cannot destroy production data and its backup, plus retrieval within 24 hours. Offsite vaulting in a different region satisfies both the survivability and recovery-time requirements, and encryption keeps the media safe while it is outside the organization's control.

Answer

Increase the RAID level on the production servers from RAID 5 to RAID 6.

Answer

Replicate the backups to a tape library in a hardened rack in the same datacenter.

Answer

Configure an on-site disk-to-disk backup target and enable snapshots every four hours.

Question 4

A small business runs a single physical server that hosts a customer relationship management (CRM) application and its database. The owner wants a backup strategy that allows the server to be restored on different hardware if the original server fails completely. Which backup type should the administrator implement?

Accepted Answer

Bare-metal backup. The owner needs the server to be recoverable on different hardware after a complete failure. A bare-metal backup captures the operating system, system state, applications, and data, and its restore process can inject drivers for the new hardware, allowing the server to boot on dissimilar equipment. Full, differential, and incremental backups protect data but do not by themselves provide hardware-independent operating system recovery.

Answer

Incremental backup

Answer

Differential backup

Answer

Full backup

Question 5

A company's disaster recovery plan requires that a critical database server be restored at an alternate site within a recovery time objective (RTO) of 4 hours. The database is 2 TB in size, and the company has a 100 Mbps WAN link between the primary and alternate sites. The administrator needs to choose a replication method that meets the RTO without requiring manual intervention at the alternate site. Which solution should the administrator implement?

Accepted Answer

Asynchronous storage replication with automated failover. Asynchronous replication with automated failover balances the need for timely recovery with the constraints of a 100 Mbps WAN link. It avoids the latency-induced performance hit of synchronous replication while enabling the alternate site to activate the database without manual steps, satisfying the 4-hour RTO.

Answer

Log shipping with manual transaction log application

Answer

Daily full backups shipped to the alternate site on tape

Answer

Synchronous storage replication with manual failover

Question 6

A datacenter administrator must implement a backup strategy for a file server that holds 8 TB of active patient imaging data. The organization requires that a complete copy of the data be stored offsite weekly, and that the offsite copy be protected from accidental deletion or alteration for at least 30 days. The administrator has a 10 GbE connection to the remote site. Which of the following should the administrator configure to meet these requirements?

Accepted Answer

Configure a weekly full backup to a remote object storage bucket with a 30-day object lock in compliance mode.. The requirement is for an offsite weekly full copy that cannot be deleted or altered for 30 days. Object storage with a compliance-mode object lock provides WORM immutability that even privileged users cannot bypass until the retention period ends. The 10 GbE link is sufficient for the weekly 8 TB transfer, and the remote bucket satisfies the offsite condition.

Answer

Configure a weekly full backup to a remote iSCSI LUN and enable CHAP authentication on the target.

Answer

Configure a weekly full backup to a remote tape library and store the tapes in a secure offsite vault.

Answer

Configure a weekly full backup to a remote SMB share and enable versioning on the share.

Question 7

A data center administrator is hardening a newly racked Linux server that will host a customer-facing API. The security policy states that only HTTPS (TCP 443) should be reachable from the internet, and no other services should be exposed. The administrator wants the change to survive a reboot and be enforced by the kernel's packet filter. Which of the following should the administrator configure to meet these requirements?

Accepted Answer

Configure nftables with a persistent ruleset that allows established connections and TCP 443, then drops all other inbound traffic.. A kernel-level, persistent packet filter is needed so that only TCP 443 is reachable and the policy survives reboots. nftables is the modern Linux netfilter interface, and a saved ruleset with a default drop and an allow for established connections and TCP 443 meets the requirement. Host-based access files, SELinux alone, and fail2ban do not provide the same default-deny enforcement.

Answer

Add a rule to /etc/hosts.deny that blocks all services except HTTPS.

Answer

Install fail2ban and configure a jail that bans any IP address that connects to a port other than 443.

Answer

Set SELinux to enforcing mode and create a custom policy that only permits the httpd_t domain to bind to port 443.

Question 8

A security administrator is configuring disk encryption on a new file server that will store regulated data. The server has a TPM 2.0 chip and runs Windows Server 2022. The administrator wants to ensure that the encryption keys are protected and that the server can boot without requiring a USB key at every restart. Which configuration should the administrator use?

Accepted Answer

Enable BitLocker on the system volume and store the recovery key in Active Directory, using TPM-only protection.. BitLocker with TPM-only protection allows the server to start without user interaction because the TPM validates boot components and releases the key. Storing the recovery key in Active Directory ensures that administrators can recover access if the TPM changes or the volume becomes locked, satisfying both unattended boot and key protection.

Answer

Enable BitLocker with a startup PIN and store the PIN in a secure password vault.

Answer

Use EFS to encrypt the data folders instead of BitLocker, and back up the EFS certificate to a smart card.

Answer

Enable BitLocker with a USB startup key and keep the USB key plugged into the server at all times.

Question 9

A security team wants to reduce the impact of a compromised service account that is used by a scheduled backup application on a Windows server. The account currently has domain administrator rights. Which action BEST limits the blast radius while keeping backups functional?

Accepted Answer

Replace the domain administrator account with a dedicated service account granted only the required backup privileges.. Least privilege is the controlling principle: a service account used by a backup application should hold only the rights the application needs and nothing more. Swapping the domain administrator credential for a scoped service account keeps backups operational while ensuring a compromise yields limited, contained privileges instead of domain-wide control.

Answer

Configure a longer, more complex password on the existing domain administrator account.

Answer

Enable BitLocker on the backup server's system volume.

Answer

Move the scheduled backup jobs to run under the local SYSTEM account on each server.

Question 10

A security team is reviewing physical security controls for a data center that houses several CompTIA Server+ managed servers. The team wants to implement measures that specifically prevent unauthorized personnel from accessing server racks and deter tailgating. (Choose two.)

Accepted Answer

Deploy a mantrap or access vestibule at the entrance. Electronic badge readers and a mantrap directly address physical access control. Badge readers authenticate individuals at the entrance, while a mantrap enforces one-person-at-a-time entry to prevent tailgating. Together they provide layered physical security for the data center and server racks, meeting the requirement to deter unauthorized access.

Answer

Configure a VLAN for out-of-band management

Answer

Implement RAID 6 on all server storage arrays

Answer

Enable full-disk encryption with BitLocker on all servers

Question 11

A company is implementing a backup strategy for a critical database server. The backup window is limited, and the database must remain available during backups. The administrator needs to ensure that transaction log backups are performed and that the database can be restored to a point in time. Which two actions should the administrator take? (Choose two.)

Accepted Answer

Configure the database to use the full recovery model.. To support point-in-time restore and keep the database online, the administrator must use the full recovery model and schedule transaction log backups. The full recovery model preserves the log until it is backed up, and regular log backups capture changes and truncate the log, enabling restoration to a specific moment.

Answer

Set the database to the simple recovery model to minimize log growth.

Answer

Detach the database during backups to ensure consistency.

Answer

Perform only full backups during the backup window and skip log backups.

Question 12

A financial services company must retain backup data for seven years to satisfy regulatory requirements. The data is written once and never modified, and the company wants to minimize cost while ensuring the data cannot be altered or deleted before its retention period expires. Which storage solution best meets these requirements?

Accepted Answer

WORM tape or object storage with object lock. Regulatory retention with immutability requires media or services that physically or logically prevent modification and deletion. WORM tape and object storage with object lock provide this capability at low cost for infrequently accessed data. SAN snapshots, RAID arrays, and ordinary versioned file shares all allow deletion or alteration, so they cannot satisfy the requirement.

Answer

A high-performance SAN with daily snapshots

Answer

A RAID 6 array with monthly full backups

Answer

A cloud file share with versioning enabled

Question 13

A company stores nightly full backups on an external USB drive that is rotated weekly and kept in a locked cabinet in the same server room. A recent audit found that a fire in the server room would destroy both the production data and the backup drive. The company wants to improve the backup strategy so that a site-wide disaster does not eliminate all copies, while keeping costs low. Which of the following is the BEST change to meet these requirements?

Accepted Answer

Configure the backup software to write a copy to a cloud object storage bucket in a different region after each nightly job.. The audit finding is about the lack of an off-site copy, so the fix must move at least one backup copy to a different location. Writing a nightly copy to cloud object storage in another region provides geographic separation at low cost and aligns with the 3-2-1 backup principle. Additional local drives, RAID, and more frequent backups do not protect against a site-wide fire.

Answer

Enable RAID 6 on the server's internal disks so that two disk failures can be tolerated.

Answer

Add a second USB drive that is rotated daily but stored in the same locked cabinet.

Answer

Increase the backup frequency from nightly to hourly to reduce the recovery point objective.

Question 14

A security administrator is configuring a Linux server to allow only SSH and HTTPS traffic from a specific management subnet while blocking all other inbound traffic. The server has two network interfaces: eth0 (public) and eth1 (management). Which command should the administrator use to view the current iptables rules with line numbers to identify the rule positions before modifying them?

Accepted Answer

iptables -L --line-numbers. The administrator needs to view the current iptables rules with line numbers to identify rule positions before making changes. The iptables -L --line-numbers command lists all rules with line numbers, allowing precise insertion or deletion. This is critical when reordering rules to ensure management subnet traffic is permitted before any default deny rule. Other commands either lack line numbers or are destructive.

Answer

iptables -F

Answer

iptables -L -n -v

Answer

iptables -S

Question 15

An administrator must choose a physical security control for a new server room door that will allow staff to enter quickly during an emergency while still recording who entered and when. Which solution BEST fits?

Accepted Answer

Install a badge reader with an electronic audit log and a fail-safe release that unlocks on power loss.. The door needs both accountability and safe, fast passage during emergencies. An electronic badge reader with an audit log records entries, while a fail-safe release ensures the lock disengages when power is lost so people are not trapped. Together they meet the physical security and life-safety requirements stated.

Answer

Install a biometric reader that grants access based on fingerprint recognition only.

Answer

Install a badge reader configured as fail-secure so the door remains locked when power is lost.

Answer

Install a mechanical keyed lock with keys issued to each staff member.