SK0-005 security-disaster-recovery Practice Test 8 — 15 Questions

Question 1

A company is implementing a disaster recovery plan and needs to determine the maximum acceptable amount of data loss measured in time. The business can tolerate losing up to 4 hours of transactions. Which metric should the administrator use to define this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Recovery Point Objective (RPO). The Recovery Point Objective (RPO) specifically quantifies the maximum tolerable data loss in terms of time. By stating that up to 4 hours of transactions can be lost, the business is defining an RPO of 4 hours. This metric directly drives backup frequency and replication intervals to ensure that no more than 4 hours of data is ever at risk.

Answer

Recovery Time Objective (RTO)

Answer

Mean Time Between Failures (MTBF)

Answer

Mean Time To Repair (MTTR)

Question 2

A small office has a single physical server running Windows Server 2022 that hosts a file share and a print server. The administrator wants to protect against a hard drive failure that would cause downtime. The server has four drive bays, all currently empty. The administrator needs a solution that provides redundancy and maximizes usable capacity while tolerating one drive failure. Which of the following should the administrator implement?

Accepted Answer

RAID 5 with four drives. RAID 5 with four drives provides single-drive fault tolerance and uses all four bays, yielding usable capacity equal to three drives. RAID 0 offers no redundancy, RAID 1 with two drives wastes two bays, and RAID 5 with three drives leaves a bay unused. Therefore, four-drive RAID 5 best satisfies both redundancy and capacity maximization.

Answer

RAID 1 with two drives

Answer

RAID 5 with three drives

Answer

RAID 0 with four drives

Question 3

A system administrator needs to implement a secure method for remote administrators to manage servers in a data center. The solution must provide encrypted communication, support multi-factor authentication, and allow centralized logging of all administrative sessions. Which solution should be implemented?

Accepted Answer

A jump server (bastion host) with SSH, MFA, and centralized session recording. A jump server with SSH, MFA, and centralized session recording provides encrypted access, enforces multi-factor authentication, and logs all administrative sessions in one place. This satisfies all requirements and is a common best practice for secure remote administration. Other options lack centralized session logging or are platform-specific.

Answer

Remote Desktop Protocol (RDP) with Network Level Authentication (NLA) and Group Policy

Answer

VPN with IPsec and RADIUS authentication

Answer

SSH with key-based authentication and session logging via auditd

Question 4

A network administrator is configuring a RAID array for a new file server that will store large media files. The server has six 4 TB SAS drives. The administrator needs to maximize storage capacity while providing fault tolerance against a single drive failure. Which RAID level should be implemented?

Accepted Answer

RAID 5. RAID 5 offers the best balance of capacity and fault tolerance for the given requirements. With six 4 TB drives, it provides 20 TB of usable space and can withstand one drive failure. RAID 6 offers more fault tolerance but less capacity, while RAID 0 lacks fault tolerance and RAID 10 sacrifices too much capacity. Therefore, RAID 5 is the correct choice.

Answer

RAID 10

Answer

RAID 0

Answer

RAID 6

Question 5

A company's backup policy sends nightly backups to a tape library in the same building as the production servers. A recent fire destroyed the server room, and the tapes were damaged by heat and water. Which change BEST addresses this single point of failure?

Accepted Answer

Ship a copy of each backup to an offsite location or replicate it to cloud storage outside the building.. The incident destroyed production and backup copies together because both lived in the same room. The most effective change is to keep at least one copy geographically separate, either by shipping tapes offsite or replicating to cloud storage. More frequent backups, a second in-room library, and tape parity all leave the site-level single point of failure intact.

Answer

Increase the backup frequency to every four hours so less data is lost between jobs.

Answer

Replicate the tape library to a second array in the same server room so backups exist on two media types.

Answer

Add parity to the tape library so a damaged tape can be reconstructed from the remaining tapes.

Question 6

A datacenter manager is reviewing physical security controls for a server room. Which two controls are considered preventive measures against unauthorized physical access? (Choose two.)

Accepted Answer

Biometric lock. Preventive controls actively stop unauthorized access before it occurs. A biometric lock and an access control vestibule both require authentication and physically block entry, making them preventive. Security cameras and log monitoring are detective controls that record or detect events, and a visitor sign-in sheet is an administrative control that documents but does not prevent access.

Answer

Security camera

Answer

Log monitoring

Answer

Visitor sign-in sheet

Question 7

A company is reviewing its disaster recovery plan. The plan currently states that a full backup is performed every Sunday and incremental backups are performed Monday through Saturday. A disaster destroys the primary server on Wednesday at 2:00 PM, after the Wednesday incremental backup has completed. The administrator needs to restore the server to the most recent state possible. Which of the following backup sets should the administrator restore?

Accepted Answer

The most recent full backup and all incremental backups since that full backup. Incremental backups record only changes since the last backup, so a restore requires the last full backup plus every incremental in order. Restoring the full plus all incrementals since that full recreates the data as of the last incremental. Using only the latest incremental or only the full would lose data, and differential backups are not part of this schedule.

Answer

The most recent full backup only

Answer

The most recent full backup and the most recent differential backup

Answer

The most recent full backup and the most recent incremental backup

Question 8

A company is implementing a disaster recovery plan and needs to determine the maximum acceptable amount of data loss measured in time. The business can tolerate losing up to 4 hours of transactions. Which metric should the administrator use to define this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy an uninterruptible power supply (UPS) for all critical servers and storage.. To ensure data integrity and availability during a site-wide power failure, a UPS provides immediate battery power for graceful shutdown or ride-through, while a generator with ATS supplies long-term power to keep systems operational. Together, they form a layered power protection strategy. Other options compromise data integrity or do not address power failure directly.

Answer

Schedule full backups to run only during business hours.

Answer

Enable write caching on all storage controllers without battery backup.

Answer

Configure RAID 0 on all database servers to improve performance.

Question 9

A company is implementing a disaster recovery plan and needs to determine the maximum acceptable amount of data loss measured in time. The business can tolerate losing up to 4 hours of transactions. Which metric should the administrator use to define this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use VMware vSphere Replication to replicate VMs to the secondary site and perform manual recovery when needed.. VMware vSphere Replication offers a cost-effective way to replicate VMs to a secondary site without requiring expensive storage arrays or SRM licensing. It supports manual recovery, which can meet a 4-hour RTO. Other options either incur high costs, rely on slow tape restoration, or require expensive network infrastructure. Therefore, vSphere Replication is the best fit.

Answer

Implement VMware Site Recovery Manager (SRM) with array-based replication and automated failover.

Answer

Set up a stretched vSphere cluster across both sites with synchronous replication.

Answer

Configure nightly backups to tape and transport them to the secondary site for restoration.

Question 10

A security team is hardening a fleet of Linux web servers that will be exposed to the internet. They want to reduce the attack surface and limit the impact of a compromised service account. Which two actions BEST support these goals? (Choose two.)

Accepted Answer

Configure the firewall to allow only ports 80 and 443 from any source and deny all other inbound traffic by default.. Reducing attack surface means exposing only necessary ports and removing unnecessary services, while limiting impact means confining what a compromised process can do. A default-deny firewall with only web ports open and running the service as a restricted non-privileged account with minimal file access both serve those goals. Disabling mandatory access control, granting passwordless sudo, and exposing credentials all increase risk.

Answer

Store database credentials in a world-readable configuration file so all administrators can access them during outages.

Answer

Grant the web service account sudo rights with no password so administrators can troubleshoot quickly during incidents.

Answer

Disable SELinux or AppArmor on the servers so that application updates do not fail during deployment.

Question 11

A junior administrator is asked to document the recovery point objective for a critical order-processing system. What does the recovery point objective define?

Accepted Answer

The maximum acceptable amount of data loss measured in time before the failure occurred.. The recovery point objective quantifies tolerable data loss as an amount of time, which then determines how often backups or replication must occur. The recovery time objective covers outage duration, cost tolerance is a budget constraint, and a declaration of resolution is an incident-management milestone. For order processing, the objective directly drives whether continuous replication is needed.

Answer

The total cost the organization is willing to spend to recover the system after an outage.

Answer

The maximum acceptable time for the system to be unavailable after a failure.

Answer

The point in the disaster recovery plan at which the incident commander declares the disaster resolved.

Question 12

A datacenter administrator is designing physical security for a new colocation cage that houses servers containing regulated customer data. The cage has a single door, and the administrator wants to ensure that entry is logged and that two authorized staff members must be present for the door to unlock. Which of the following should the administrator implement to meet these requirements?

Accepted Answer

A proximity card reader configured for dual custody with an audit trail. The two-person rule requires an access control method that will not unlock for a single credential. Dual custody configuration on a card reader requires two valid presentations and produces an audit trail, meeting both the presence and logging requirements. Other options either authenticate only one person, rely on shared secrets, or provide no reliable electronic logging.

Answer

A cipher lock with a shared PIN and a door position sensor

Answer

A biometric reader with a mantrap and a fail-safe electric strike

Answer

A mechanical key lock with a keyed access log maintained by the security desk

Question 13

A datacenter administrator manages a rack of servers that handle nightly batch processing. The company's security policy requires that all server hard drives be sanitized before disposal, and the drives previously contained customer PII. The administrator needs a method that renders the data unrecoverable and also allows the drives to be reused internally for non-sensitive test systems. Which of the following should the administrator use?

Accepted Answer

Use a software tool to overwrite every sector of each drive with a fixed pattern, then verify the overwrite.. The requirement is to sanitize drives that held PII while keeping them usable for non-sensitive purposes. Overwriting every sector with a fixed pattern and verifying the overwrite achieves both goals. Quick formatting leaves data intact, degaussing ruins the drives, and shredding platters destroys them, so only the overwrite method satisfies both sanitization and reuse.

Answer

Degauss each drive with a strong magnetic field and then relabel it for reuse.

Answer

Remove the platters from each drive and shred them, then install new drives in the test systems.

Answer

Perform a quick format on each drive using the operating system's disk management utility.

Question 14

A hospital's server room has a raised floor and a dedicated UPS circuit. During a scheduled power maintenance window, the facilities team must cut utility power to replace a breaker panel. The UPS must keep the two domain controllers and the electronic medical records (EMR) database server running for at least 20 minutes so they can be gracefully shut down. Which configuration should the administrator verify FIRST to meet this requirement?

Accepted Answer

The UPS battery runtime at the current load and the load percentage relative to UPS capacity. The deciding factor for surviving a planned utility cut is whether the UPS can supply the connected load for the required duration. Runtime depends on battery capacity and the actual load drawn by the domain controllers and EMR database server. Confirming runtime at current load is the only option that directly validates the 20-minute requirement before the maintenance window begins.

Answer

The UPS network management card's SNMP community string and trap destination

Answer

The redundant power supply configuration of the servers connected to the UPS

Answer

The automatic voltage regulation (AVR) settings on the UPS

Question 15

A small business runs a single physical server that hosts its accounting application and database. The owner wants a backup approach that allows recovery to any point within the last 14 days without restoring a full backup each time. Which backup type should the administrator implement?

Accepted Answer

Transaction log backups every 15 minutes. Point-in-time recovery to any moment in a 14-day window requires transaction log backups, which capture each committed transaction and can be replayed on top of a full backup. Full, differential, and incremental schemes provide at most one restore point per backup cycle and cannot reconstruct an arbitrary moment between backups.

Answer

Full backup every night

Answer

Differential backup every night

Answer

Incremental backup every night