SK0-005 security-disaster-recovery Practice Test 9 — 15 Questions

Question 1

A datacenter administrator must protect a rack of dual-power-supply servers against a single PDU failure. The rack currently has two rack PDUs, each fed from a separate upstream branch circuit, and each server has both power supplies connected. The administrator wants to confirm that the configuration meets the intended redundancy level before adding more servers. Which action should the administrator take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Connect one power supply from each server to PDU A and the other power supply to PDU B, then verify that each PDU is fed from a different upstream branch circuit.. True rack-level power redundancy requires two independent paths from the server to the upstream power source. Each dual-corded server should have one supply on each PDU, and those PDUs must be fed from separate branch circuits. Otherwise a single breaker or feed failure can still interrupt both power supplies and cause an outage.

Answer

Connect only one power supply from each server and label the unused supply as reserved for future capacity, because dual-corded servers do not need both supplies connected.

Answer

Connect both power supplies from each server to the same PDU so that the load is balanced across one device, and rely on the second PDU as a cold spare.

Answer

Connect one power supply from each server to PDU A and the other to PDU B, but leave both PDUs connected to the same upstream branch circuit to simplify cabling.

Question 2

A company operates a primary datacenter and a cold standby site. The disaster recovery plan states that the standby site must be able to take over within 8 hours, but the current plan requires rebuilding servers from bare metal and restoring data from tape, which takes 3 days. Which change best aligns the standby site with the stated recovery time objective?

Accepted Answer

Convert the standby site to a warm site with pre-staged hardware and replicated data.. The gap is recovery time, not recovery point. A warm site with pre-staged hardware and replicated data removes the bare-metal rebuild step, bringing recovery within hours. Backup frequency, extra tape libraries, and documentation improvements address data freshness or process quality but leave the multi-day hardware rebuild in place.

Answer

Document the rebuild procedure in more detail and rehearse it quarterly.

Answer

Increase the frequency of tape backups from weekly to daily.

Answer

Add a second tape library at the cold site for parallel restores.

Question 3

A datacenter administrator is hardening a newly racked server that will host a public-facing application. The security policy requires that all administrative access to the server use encrypted protocols and that remote interactive logons be limited to the secure shell. Which action best meets these requirements?

Accepted Answer

Disable Telnet and enable SSH, then restrict the firewall to TCP port 22 for management traffic.. The policy names two conditions: encrypted administrative protocols and remote interactive logons limited to the secure shell. SSH meets both because it encrypts the session and is the secure shell itself, while disabling Telnet eliminates the cleartext option. Tightening the firewall to TCP 22 ensures no other remote interactive protocol can be used for management.

Answer

Disable Telnet and enable RDP, then restrict the firewall to TCP port 3389 for management traffic.

Answer

Keep Telnet enabled but require administrators to connect through a VPN, and restrict the firewall to TCP port 23 from the VPN subnet.

Answer

Disable both Telnet and SSH, enable a serial console server, and require administrators to use out-of-band access for all management.

Question 4

A datacenter administrator is preparing to decommission a rack of servers that stored customer financial records. Company policy requires that data be rendered unrecoverable before the servers leave the facility, and the servers will be resold to a third party. Which action best satisfies the policy?

Accepted Answer

Run the manufacturer's secure erase utility and verify completion on each drive.. The policy demands unrecoverable destruction of financial data while the hardware is resold. A manufacturer secure erase physically or cryptographically erases the media and can be verified, satisfying both goals. Quick formatting leaves recoverable data, locked storage does not destroy anything, and degaussing destroys the drives needed for resale.

Answer

Delete all partitions and format each drive with a quick format.

Answer

Remove the drives and store them in a locked cabinet on site.

Answer

Degauss the drives before returning them to the reseller.

Question 5

A server administrator is configuring a new file server that will store sensitive financial documents. The security policy requires that data be encrypted at rest and that the encryption keys be protected by the server's TPM. Which of the following should the administrator implement?

Accepted Answer

BitLocker Drive Encryption. The policy requires encryption at rest with keys protected by TPM. BitLocker provides full volume encryption and can seal keys to the TPM, ensuring the drive contents are inaccessible without proper authentication. IPsec, SMB signing, and NTFS permissions address network security or access control but do not encrypt data on the disk.

Answer

NTFS permissions

Answer

IPsec transport mode

Answer

SMB signing

Question 6

A datacenter administrator is reviewing physical security for a new colocation cage that houses servers containing regulated data. The cage has a locked mesh door, but the administrator must add a control that logs exactly which employee enters and exits, and when, without requiring a guard. Which solution BEST meets these requirements?

Accepted Answer

Install a biometric fingerprint reader on the cage door that records each authorized entry and exit in an audit log.. The requirement combines two needs: authenticate each individual and produce a timestamped record of entry and exit without human staffing. A biometric reader authenticates the specific person and writes each event to an audit log, so it satisfies both identity verification and automated logging. Mechanical keys, guards, and motion sensors each fail at least one of those needs in this colocation scenario.

Answer

Install a passive infrared motion sensor inside the cage that triggers an alert whenever movement is detected.

Answer

Replace the mesh door with a solid steel door and issue a mechanical key to each authorized employee.

Answer

Place a security guard at the cage entrance during all business hours to visually verify and log each person who enters.

Question 7

A datacenter administrator is reviewing physical security for a new server room. The company wants to ensure that only authorized personnel can access the racks and that any access attempts are logged. The room already has a locked door with a badge reader. Which of the following should the administrator implement to meet the requirements for rack-level security and auditing?

Accepted Answer

Install electronic rack locks with badge readers and audit logging.. Rack-level security requires controls that restrict and log access to each rack. Electronic rack locks with badge readers provide both physical prevention and an audit trail tied to individual racks. Room-level controls like biometrics, cameras, or mantraps do not satisfy the requirement for rack-level access control and logging.

Answer

Implement a mantrap at the entrance to the server room.

Answer

Install a biometric scanner on the server room door.

Answer

Place a security camera in the server room.

Question 8

A small business leases a single rack in a colocation facility. The owner wants a disaster recovery arrangement that provides a pre-configured alternate site with power, cooling, and network but where the company must supply and install its own servers after a disaster. Which type of site best matches this requirement?

Accepted Answer

Cold site. A cold site supplies only the physical environment and utilities, leaving hardware procurement and installation to the organization. Because the owner wants a pre-configured space but plans to install company-owned servers after a disaster, a cold site is the correct match. It offers the lowest cost at the expense of longer recovery time.

Answer

Hot site

Answer

Mobile site

Answer

Warm site

Question 9

A server administrator is hardening a newly deployed Linux web server that will be exposed to the internet. The security policy requires minimizing the attack surface and protecting authentication. Which two actions BEST align with that policy? (Choose two.)

Accepted Answer

Disable all unused network services and close their associated ports using the host firewall.. Hardening an internet-facing server means shrinking what is reachable and strengthening how administrators authenticate. Disabling unused services and closing their ports removes unnecessary entry points, while enforcing key-based SSH and disabling password authentication removes the easiest credential attack path. The other choices either expand the attack surface, weaken privileged access, or rely on an ineffective blocklist model.

Answer

Install a full desktop environment and remote GUI tools so administrators can avoid using the command line.

Answer

Configure SSH to permit direct root login with a strong password to simplify administration.

Answer

Set the firewall default policy to allow all inbound traffic, then block only known malicious source IP addresses.

Question 10

A datacenter administrator is hardening a new Windows Server 2022 host that will run a public-facing web application. The administrator needs to reduce the attack surface at the operating system level. Which two actions should the administrator take? (Choose two.)

Accepted Answer

Enable the Windows Defender Firewall and create inbound rules that allow only the required web and management ports.. Reducing the operating system attack surface means removing what is not needed and restricting what remains. Disabling unused roles and services removes exploitable code, while enabling the host firewall and limiting inbound rules controls network exposure. Together they shrink the set of reachable services and reduce the likelihood of a successful compromise.

Answer

Grant all domain users local Administrator rights so that support staff can troubleshoot quickly.

Answer

Disable Windows Update on the server so that unexpected patches do not interrupt the web application.

Answer

Install a full desktop experience with all optional Windows features enabled to simplify future administration.

Question 11

A system administrator must choose a backup method for a file server where the business requires that only files changed since the last backup are copied, and the backup window is very short. Which backup type should the administrator select?

Accepted Answer

Incremental backup. The requirement is to copy only files changed since the last backup while keeping the backup window short. An incremental backup captures exactly those changes, so each run is small and fast. Differential and full backups copy progressively more data, and a synthetic full produces a full image rather than a change-only copy.

Answer

Differential backup

Answer

Full backup

Answer

Synthetic full backup

Question 12

A datacenter operator is reviewing physical security for a server room that houses backup tapes and network core switches. The room has a single wooden door with a mechanical lock, and the key is shared among the facilities staff. Which change should the administrator recommend FIRST to improve access control?

Accepted Answer

Install an electronic access control system with individual credentials and an audit log. The fundamental weakness is that a single mechanical lock with a shared key provides no individual accountability and cannot be selectively revoked. An electronic access control system issues unique credentials and logs each entry, directly improving both prevention and audit. This is the first and most impactful change for protecting the tapes and core switches.

Answer

Add a second mechanical lock to the door to create two-key access

Answer

Install a security camera in the hallway outside the server room

Answer

Move the backup tapes to a locked cabinet inside the server room

Question 13

A small business runs a single file server that stores contracts and financial records. The owner wants an affordable way to recover individual files that users accidentally delete or overwrite, with the shortest possible recovery time. Which solution BEST fits this requirement?

Accepted Answer

Enable Volume Shadow Copy Service snapshots on the file server so users can restore previous versions themselves.. The need is fast, low-cost recovery of individual files after accidental deletion or overwrite. Volume Shadow Copy Service keeps scheduled point-in-time snapshots on the server and exposes them through Previous Versions, so a user can restore a file in moments without administrator help. Nightly backups or cloud replication restore only to the last run and take longer, while RAID addresses disk failure rather than logical deletion.

Answer

Replicate the file server to a cloud VM every night and restore files from the cloud copy when needed.

Answer

Implement a RAID 5 array across three disks so that deleted files can be recovered from parity.

Answer

Configure a nightly full backup to an external USB drive that is stored in the office safe.

Question 14

A company stores nightly database backups on a dedicated backup server in the same data center as the production database. The security team wants to ensure that a ransomware infection on the production network cannot encrypt or delete the backup copies. Which control should the administrator implement?

Accepted Answer

Configure immutable snapshots or WORM storage on the backup repository and restrict network access to the backup server.. To survive ransomware, backups must be both isolated from the production network and protected from modification. Immutable or WORM storage prevents deletion or encryption even if administrative credentials are compromised, and network restrictions reduce the chance of the repository being reached. Retention or replication alone does not stop a destructive attack.

Answer

Enable deduplication on the backup server to reduce storage consumption.

Answer

Increase the backup retention period from 30 days to 90 days on the existing backup server.

Answer

Add a second backup server in the same rack and replicate backups between the two servers.

Question 15

A company runs a critical SQL Server database on a physical server with a RAID 10 array. The database is backed up nightly to a local disk and replicated to a remote site every four hours. A ransomware attack encrypts the local database files and the local backup disk, but the remote replication target is unaffected. The administrator needs to restore service with the least data loss. Which recovery approach should the administrator use?

Accepted Answer

Restore the most recent replicated backup from the remote site to a clean server. The remote replication target survived the attack and contains the most recent clean data, so restoring from it to a clean server minimizes loss and avoids reinfection. Local backups and database files are compromised. Rebuilding RAID does not decrypt data, and permanent failover is an architectural change beyond the immediate recovery need.

Answer

Restore the nightly backup from the local backup disk after running antivirus scans

Answer

Fail over to the remote site and continue running production there permanently

Answer

Rebuild the RAID 10 array and restore the database from the encrypted local files