SK0-005 security-disaster-recovery Practice Test 7 — 15 Questions

Question 1

A small office has a single physical server running Windows Server 2022 that hosts a file share and a print server. The administrator wants to ensure that if the server's operating system becomes corrupted, the server can be restored quickly to a working state. Which backup type should the administrator use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Bare metal recovery backup. A bare metal recovery backup includes the operating system, applications, and data, enabling a complete restore even if the OS is corrupted. This meets the need to quickly return the server to a working state without a lengthy manual rebuild.

Answer

Volume shadow copy

Answer

System state backup

Answer

File-level backup of the file share only

Question 2

An administrator is configuring a server to use a hardware security module (HSM) for disk encryption key storage. The administrator wants to ensure that if the server is stolen, the encrypted disks cannot be decrypted even if the disks are moved to another system. Which statement best describes why the HSM supports this goal?

Accepted Answer

The HSM stores the encryption keys in a tamper-resistant device and releases them only to authorized systems, so removing the disks does not expose the keys.. An HSM protects keys in tamper-resistant hardware and releases them only to authorized systems after authentication. Because the keys never leave the HSM in usable form and are not stored on the disks, moving the disks to another system does not allow decryption. The other options either embed keys in the disks, expose them via cloud retrieval, or store them in plaintext.

Answer

The HSM stores the keys in a plaintext file on the boot volume so the operating system can load them at startup.

Answer

The HSM encrypts the disks with a key that is embedded in the disk firmware, so the key travels with the disks.

Answer

The HSM synchronizes keys to a cloud service so any server can retrieve them after authenticating with a user password.

Question 3

A systems administrator is configuring role-based access for a team of server operators. The operators need to restart services and view logs on production Linux servers, but they must not be able to edit configuration files or install packages. The administrator wants to implement this with the least privilege and avoid sharing the root password. Which of the following should the administrator configure?

Accepted Answer

Configure sudoers entries that allow each operator to run specific service management and log-reading commands without a password.. Least privilege for this team means granting only the specific commands they need while keeping individual accountability. Sudoers entries that permit named operators to run approved service management and log-reading commands achieve this without sharing root credentials. Shared accounts with full sudo, immutable attributes, and direct root SSH all either over-privilege the operators or fail to provide the required controlled access.

Answer

Deploy an SSH key pair for each operator and allow direct root login with the key.

Answer

Set the immutable attribute on configuration files and package directories so operators cannot modify them.

Answer

Create a shared operator account with a strong password and add it to the wheel group.

Question 4

A company performs a full backup every Sunday and incremental backups Monday through Saturday. On Wednesday, a database file becomes corrupted. The administrator needs to restore the most recent version of the file prior to corruption. Which backup sets must be restored?

Accepted Answer

The most recent full backup and all incremental backups since that full backup.. With an incremental backup scheme, each incremental contains only the changes since the previous backup. To restore the most recent version of a file, the administrator must restore the last full backup and then apply every incremental backup in sequence. This reconstructs the file to its state just before corruption. Restoring only a subset would result in missing data and potential inconsistency.

Answer

The most recent full backup and the most recent incremental backup only.

Answer

The most recent differential backup.

Answer

The most recent full backup only.

Question 5

A company is hardening a publicly reachable Linux web server that runs an SSH service for administration. The security team wants to reduce the attack surface and enforce stronger authentication. Which two actions BEST accomplish this? (Choose two.)

Accepted Answer

Require public key authentication and disable password-based SSH logins.. The strongest reductions in SSH attack surface come from removing weak authentication paths and eliminating shared, highly privileged logins. Requiring public keys with password authentication disabled blocks brute-force approaches, while forbidding direct root login enforces named accounts and per-user accountability. Together they harden authentication and limit the impact of a single compromised credential.

Answer

Install a host-based intrusion detection system that alerts on suspicious SSH login patterns.

Answer

Enable verbose logging of all SSH connection attempts to a remote syslog server.

Answer

Change the SSH service to listen on a non-standard port to hide it from scanners.

Question 6

A company has a recovery point objective (RPO) of 15 minutes for its database server. The database is 500 GB, and the nightly full backup takes 4 hours. Which backup strategy best meets the RPO while minimizing storage and backup window impact?

Accepted Answer

Perform transaction log backups every 15 minutes. The RPO of 15 minutes means no more than 15 minutes of data can be lost. Transaction log backups run every 15 minutes capture all changes since the previous log backup, are small and fast, and support point-in-time recovery. Full backups every 15 minutes are impossible given the 4-hour runtime, while differential and incremental backups are less efficient or less granular for database recovery.

Answer

Perform differential backups every 15 minutes

Answer

Perform a full backup every 15 minutes

Answer

Perform incremental backups every 15 minutes

Question 7

A system administrator is configuring a RAID array for a database server that requires high fault tolerance and improved read performance. The array will consist of six 1 TB drives. The administrator wants to maximize usable capacity while being able to survive a single drive failure. Which RAID level should the administrator choose?

Accepted Answer

RAID 5. RAID 5 provides fault tolerance by surviving one drive failure and maximizes usable capacity by using only one drive's worth of space for parity. With six drives, it yields 5 TB usable, which is higher than RAID 6 or RAID 1. It also offers better read performance than a single drive or mirror, meeting the database server's needs.

Answer

RAID 1

Answer

RAID 0

Answer

RAID 6

Question 8

A company has a primary data center and a warm site 50 miles away. The disaster recovery plan specifies a recovery time objective (RTO) of 4 hours and a recovery point objective (RPO) of 15 minutes. The administrator is reviewing the backup and replication strategy. Which combination best meets these objectives?

Accepted Answer

Asynchronous replication every 10 minutes to the warm site with automated failover. Asynchronous replication every 10 minutes keeps data loss within the 15-minute RPO, and automated failover to a warm site can achieve the 4-hour RTO. This combination balances cost and performance without requiring synchronous replication over a long distance.

Answer

Nightly full backups shipped to the warm site and restored during a disaster

Answer

Synchronous replication to the warm site with manual failover procedures

Answer

Daily differential backups to local storage and weekly full backups to tape stored offsite

Question 9

A company is drafting a disaster recovery plan for its primary data center. The plan must address both the maximum tolerable data loss and the maximum tolerable downtime for critical systems. Which of the following metrics should the plan explicitly define to meet these requirements? (Choose two.)

Accepted Answer

Recovery point objective (RPO). The two metrics that directly express maximum tolerable data loss and maximum tolerable downtime are the recovery point objective and the recovery time objective. RPO sets the acceptable data loss in time, and RTO sets the acceptable downtime. Reliability and repair averages such as MTBF and MTTR describe failure and repair behavior but do not define business tolerance for loss or downtime.

Answer

Recovery service level (RSL)

Answer

Mean time between failures (MTBF)

Answer

Mean time to repair (MTTR)

Question 10

A system administrator is configuring a backup strategy for a small business. The business requires that backups be stored offsite to protect against physical disasters, and that backup data be encrypted both in transit and at rest. Which of the following backup solutions BEST meets these requirements?

Accepted Answer

Use a cloud backup service that encrypts data with AES-256 before transmission and stores it encrypted in the cloud.. The cloud backup service with AES-256 encryption ensures data is encrypted both before transmission and while stored, satisfying the encryption requirements. It also provides offsite storage inherently, protecting against physical disasters. Other options either lack encryption in transit, do not provide true offsite protection, or rely on manual processes that may not be reliable.

Answer

Perform backups to a tape drive and store tapes in a remote vault, using hardware encryption on the tape drive.

Answer

Back up to a local external hard drive that is rotated weekly to a bank safe deposit box, using BitLocker encryption.

Answer

Configure a backup to a network-attached storage (NAS) device located in a different building on the same campus, using SMB signing.

Question 11

A company is designing a disaster recovery plan for a critical web application. The plan must ensure that the application can be recovered within a 4-hour recovery time objective (RTO) and that no more than 1 hour of data is lost. The application runs on virtual machines backed by a storage area network (SAN). Which two actions best support these objectives? (Choose two.)

Accepted Answer

Configure the virtual machines to replicate to a secondary host every 15 minutes using hypervisor-based replication.. Meeting a 1-hour RPO and 4-hour RTO requires a recent, ready-to-use copy of the data at a secondary location. SAN-based replication with a 1-hour RPO and hypervisor-based replication every 15 minutes both provide that. Nightly tape backups, primary-site snapshots, and local installation media either exceed the RPO or do not survive a site failure.

Answer

Perform nightly full backups to tape and store the tapes offsite.

Answer

Enable daily snapshots on the primary SAN and retain them for 30 days.

Answer

Store a copy of the application installation media in a locked cabinet at the primary site.

Question 12

A security administrator is hardening a Linux server that hosts a public web application. The server currently allows root login via SSH and uses default SSH port 22. The administrator wants to reduce the attack surface by implementing SSH best practices. Which two actions should the administrator take? (Choose two.)

Accepted Answer

Disable password authentication by setting PasswordAuthentication no and use SSH keys.. Disabling root login and disabling password authentication in favor of SSH keys are two fundamental SSH hardening practices. They reduce the attack surface by eliminating direct root access and removing the risk of password brute-force attacks. Changing the port is security through obscurity, enabling password authentication weakens security, and allowing SSH from any IP increases exposure. These two actions directly address the scenario's requirements.

Answer

Change the SSH port from 22 to a non-standard port, such as 2222.

Answer

Enable password authentication to ensure only authorized users can log in.

Answer

Allow SSH access from any IP address to ensure administrators can connect from anywhere.

Question 13

A security administrator is configuring a server to meet a requirement that all administrative access must use multifactor authentication and be encrypted in transit. The server runs Windows Server 2022. Which solution should the administrator implement?

Accepted Answer

Remote Desktop Gateway (RD Gateway) with multifactor authentication. The requirement is for administrative access that is both encrypted in transit and protected by multifactor authentication. Remote Desktop Gateway with MFA encrypts RDP sessions over HTTPS and enforces a second authentication factor, meeting both conditions. RDP with NLA lacks MFA, SSH with public key is single-factor, and VPN with preshared key is also single-factor, so none of those fully satisfy the requirements.

Answer

Secure Shell (SSH) with public key authentication

Answer

Virtual Private Network (VPN) with preshared key authentication

Answer

Remote Desktop Protocol (RDP) with Network Level Authentication (NLA)

Question 14

An administrator is designing physical security for a new server room that also houses the company's network core. Management wants to prevent an unauthorized visitor from plugging a laptop into an unused wall jack and capturing traffic. Which control BEST addresses this specific threat?

Accepted Answer

Enable 802.1X port-based network access control on all switch ports and configure unused ports to an unauthorized VLAN.. The threat is a rogue device gaining network access through a live wall jack. Port-based access control with 802.1X forces authentication before the port forwards traffic, and assigning unused ports to a quarantined VLAN limits what an unauthenticated device can reach. Physical entry controls, IPsec between servers, and port mirroring do not prevent a plugged-in laptop from joining the local segment.

Answer

Configure port mirroring on the core switch so the security team can monitor all traffic from the server room.

Answer

Deploy IPsec transport mode between all servers in the room and require certificate-based authentication for every session.

Answer

Install a mantrap at the server room entrance and require badge plus biometric authentication for entry.

Question 15

A technician is disposing of several decommissioned servers that previously stored customer financial records. The drives will leave the building. Which action BEST ensures the data cannot be recovered by anyone who obtains the drives?

Accepted Answer

Physically destroy the drives by shredding or degaussing them before disposal.. Because the drives contain regulated financial data and are leaving the facility, the disposal method must make recovery infeasible. Physical destruction through shredding or degaussing removes any possibility of reading the media, which is stronger than any software-based erasure and aligns with the requirement that the data cannot be recovered by a later holder.

Answer

Format each drive with the operating system's quick format option.

Answer

Move the drives to a locked storage room until a future disposal decision is made.

Answer

Delete all files and empty the recycle bin on each drive.