SK0-005 security-disaster-recovery — Timed 15 Questions

Question 1

A server administrator is restoring a file server from a full backup taken 7 days ago and incremental backups taken daily. The restoration fails with an error about missing catalog files. What is the most likely cause?

Accepted Answer

The incremental backup chain is broken. Restoring from incremental backups requires a complete chain from the last full backup. If any incremental backup in the chain is missing or corrupted, the restore will fail. Corrupted full backup media would cause a different error. OS compatibility issues would likely appear earlier. Hard drive failure would be a hardware error.

Answer

The hard drive on the file server has failed

Answer

The backup software is not compatible with the current OS version

Answer

The full backup media is corrupted

Question 2

A medium-sized company uses a backup strategy that includes a full backup every Sunday at 2:00 AM and differential backups Monday through Saturday at 2:00 AM. The backups are written to a network-attached storage (NAS) device. On Thursday morning, the company experiences a ransomware attack that encrypts all data on the file server, including the NAS. The administrator needs to restore the file server with minimal data loss. The last successful full backup was from the previous Sunday, and differential backups were successful on Monday, Tuesday, and Wednesday. However, Thursday's differential was not completed because the attack occurred before the scheduled time. The administrator attempts to restore using the Sunday full backup and Thursday's differential, but the restore fails because the differential backup on the NAS is also encrypted. Which of the following is the best course of action?

Accepted Answer

Restore from the Sunday full backup and Wednesday's differential backup. The most recent clean backup set is Sunday's full plus Wednesday's differential, as both were taken before the ransomware attack. Restoring from these will recover data as of Wednesday's backup, minimizing data loss. Using only Wednesday's differential requires the full backup first. Paying the ransom is not recommended and may not work. Reinstalling the OS and restoring from cloud would not apply because cloud was not mentioned.

Answer

Pay the ransom to decrypt the differential backup

Answer

Reinstall the operating system and restore files from cloud storage

Answer

Restore using only Wednesday's differential backup

Question 3

A small business has a single file server running Windows Server 2019. The server uses two internal SATA drives in a RAID 1 mirror for the operating system and data. The company's backup solution performs a full backup every night to an external USB hard drive, which is stored in the server room. The IT administrator recently noticed that the server's system volume is running low on space and decides to migrate the data to a larger drive. During the migration, the server crashes and will not boot. The administrator attempts to restore from the latest backup but finds that the backup drive is corrupted and cannot be read. The company has no offsite backups. What should the administrator have done to prevent this situation?

Accepted Answer

Regularly test backup restorations to verify data integrity.. The correct answer is D: Regularly test backup restorations to verify data integrity. The administrator assumed backups were valid without verification. Option A is wrong because RAID 1 provides redundancy but does not protect against corruption or accidental deletion; the issue here is backup corruption. Option B is wrong because cloud backup is a good practice but not strictly required; the root cause is lack of backup testing. Option C is wrong because while documentation is helpful, it would not prevent data loss from a corrupted backup drive.

Answer

Implement a RAID 5 array instead of RAID 1 for better redundancy.

Answer

Document the backup procedure and create a disaster recovery plan.

Answer

Use a cloud-based backup service with offsite storage.

Question 4

A medium-sized company runs an e-commerce platform on a cluster of three physical servers hosting virtual machines. The disaster recovery plan includes daily backups to a remote data center using Veeam Backup & Replication. The company's annual disaster recovery drill is scheduled for next week. During the drill, the IT team plans to simulate a complete site failure by powering off the primary data center. The recovery time objective (RTO) is 4 hours, and the recovery point objective (RPO) is 1 hour. The team successfully restores the VMs at the remote site, but the application experiences significant performance degradation and many transactions fail due to database inconsistency. Investigation reveals that the backup was taken at 2:00 AM, but the failure occurred at 10:00 AM, and the application's database had transactions between 2:00 AM and 10:00 AM that were not captured. What should the IT team do to improve the recovery process?

Accepted Answer

Enable log shipping with point-in-time recovery for the database.. The correct answer is B: Implement log shipping with point-in-time recovery for the database. The RPO of 1 hour is not being met because the backup schedule is daily. Option A is wrong because while a faster WAN can reduce backup time, the core issue is the backup frequency, not bandwidth. Option C is wrong because the issue is not data redundancy but recovery granularity; RAID protects against drive failure but not data loss from missing transactions. Option D is wrong because increasing RTO does not solve the RPO violation; the goal is to reduce data loss, not relax the time target.

Answer

Configure RAID 10 on all database servers to improve disk performance.

Answer

Upgrade the WAN connection between sites to reduce backup transfer times.

Answer

Adjust the RTO to 8 hours to allow for more comprehensive backups.

Question 5

A large enterprise uses a centralized backup solution with a backup server running Commvault. Backups are stored on a deduplicated disk array and replicated to a secondary site for disaster recovery. The company's security team detects ransomware activity that has encrypted several file servers. The backup administrator checks the backup repository and finds that the backup data is also encrypted because the backup service account had permissions to modify backup files, and the ransomware propagated to the repository. The last known good backup is from two weeks ago, which is too old for the organization's RPO of 24 hours. The backup administrator is under pressure to restore operations quickly. Which of the following should the administrator implement to prevent this from recurring?

Accepted Answer

Immutable backup storage and a dedicated service account with least-privilege access.. The correct answer is A: Implement immutable backup storage and use a separate service account with write permissions only during backup windows. Immutable backups cannot be modified or deleted by any user or process, including ransomware. Option B is wrong because air-gapping alone does not prevent access if the backup server is compromised; immutable storage is more robust. Option C is wrong because while MFA is a good security practice, it does not protect backups that are already accessible with valid credentials. Option D is wrong because encryption of backup data protects it during transit or while stored, but does not prevent the ransomware from encrypting the files if the backup system is accessible.

Answer

Encrypt all backup data at rest and in transit.

Answer

Require multi-factor authentication for the backup service account.

Answer

Air-gap the backup repository by disconnecting it from the network except during backup windows.

Question 6

A company uses a two-node failover cluster for a critical application. The cluster nodes are located in the same data center, and the quorum configuration uses a file share witness on a separate server in the same data center. During a major power outage, both cluster nodes and the file share witness server lose power. What is the impact on cluster availability?

Accepted Answer

The cluster will be offline until one of the nodes or the witness comes back online.. In a two-node cluster with a file share witness, if both nodes and the witness are unavailable, the cluster cannot achieve quorum and will be offline. This is because the cluster requires a majority of votes to stay online. With only two nodes, the witness is needed to break ties. Without any votes, the cluster fails.

Answer

The cluster will automatically fail over to a third site because the witness server is unavailable.

Answer

The cluster continues operating because the nodes can use a dynamic quorum and adjust the vote count.

Answer

The cluster remains online because the nodes can communicate directly and form quorum without the witness.

Question 7

A server administrator is responsible for protecting sensitive data. The backup process copies files to a network share daily. Which of the following should the administrator do to BEST ensure the confidentiality of the backup data both during transfer and at rest?

Accepted Answer

Encrypt the backup files before transfer using a tool like GPG, and store them encrypted.. Encrypting the backup files before transfer (Option B) ensures data confidentiality during transit and while stored on the backup server. Option A provides network segmentation but no encryption. Option C encrypts only the transfer, not the data at rest. Option D is a physical security measure and does not encrypt the data.

Answer

Configure the network share with SMB encryption only.

Answer

Use a dedicated NIC for backup traffic on an isolated VLAN.

Answer

Place the backup server in a physically locked cage with restricted access.

Question 8

Refer to the exhibit. An administrator is reviewing logs after a server experienced performance issues and unexpected shutdowns. Based on the log entries, which component is MOST likely failing?

Accepted Answer

Hard disk drive. The log entries show multiple SCSI medium errors, unrecovered read errors, and auto-reallocation failures on device sda, which are classic signs of a failing hard disk drive (Option B). A RAID controller (A) would typically show different errors, RAM (C) would cause memory-related errors, and a power supply (D) would trigger power event logs.

Answer

RAID controller

Answer

RAM module

Answer

Power supply

Question 9

An organization requires a disaster recovery site that can be operational within 24 hours after a disaster declaration, with critical data replicated on a regular basis, but not necessarily real-time. Which type of site should they implement?

Accepted Answer

Warm site. Option A is correct because a warm site provides pre-installed hardware and network infrastructure, along with data backups that can be loaded and activated within a day. Hot sites offer immediate failover but are more expensive and not necessary here. Cold sites are empty space and take weeks. An alternate processing site is a vague term.

Answer

Alternate processing site

Answer

Cold site

Answer

Hot site

Question 10

A company performs a full backup on Sunday and incremental backups Monday through Saturday. A server fails on Thursday at 10:00 AM. Which sequence correctly restores the data?

Accepted Answer

Restore Sunday full, then Monday, Tuesday, and Wednesday incrementals.. Option C is correct because an incremental backup captures only changes since the last backup, requiring the last full backup and all subsequent incrementals up to the point of failure. Options A and D are wrong because they skip Monday’s incremental (A) or both Monday and Tuesday (D). Option B is wrong because it restores out of order, which would not apply the data correctly.

Answer

Restore Sunday full, then Tuesday and Wednesday incrementals.

Answer

Restore Sunday full and Wednesday incremental only.

Answer

Restore Wednesday's incremental, then Sunday full.

Question 11

A financial services firm requires a disaster recovery site that provides immediate failover with zero data loss. Which type of site should they implement?

Accepted Answer

A hot site with synchronous replication.. Option A is correct because a hot site with synchronous replication ensures that data is written to both primary and secondary sites simultaneously, providing zero RPO and immediate failover. Option B (warm site) requires some time to bring systems online, leading to downtime and potential data loss. Option C (cold site) involves significant setup time and last-known-good backup restoration. Option D (cloud with daily snapshots) introduces an RPO of up to 24 hours, not zero data loss.

Answer

A warm site with asynchronous replication.

Answer

A cloud-based site with daily snapshots.

Answer

A cold site with tape restoration.

Question 12

An organization stores backup tapes at an offsite facility. The tapes contain sensitive customer data. A security audit revealed that tapes were stolen from the facility. Which combination of measures would have MOST effectively prevented unauthorized data access?

Accepted Answer

Encrypt all backup data with strong encryption and restrict decryption keys to authorized personnel.. Option D is correct because encrypting the backup data and restricting decryption keys ensures that even if the tapes are physically stolen, the data remains unintelligible without the keys. Option A (password protection) can often be bypassed and does not secure the data itself. Option B only secures transport, not storage. Option C provides physical security but would not deter a determined thief and does not protect the data if the safe is compromised.

Answer

Password-protect the tapes and keep them in a locked safe.

Answer

Store tapes in a fireproof safe and limit access to key personnel.

Answer

Use a bonded courier service for transportation.

Question 13

Refer to the exhibit. A backup job to a network share failed. The administrator reviews the backup log. What is the most likely cause of the failure?

Accepted Answer

The backup user account lacks appropriate permissions.. Option B is correct. The 'Access is denied' error clearly indicates a permissions problem—the backup user account does not have the necessary rights to write to the share. Option A would present a 'network path not found' or 'host unreachable' error. Option C would also indicate network unreachable, not access denied. Option D would typically produce a 'path too long' error, not access denied.

Answer

The backup server is powered off.

Answer

The network link is down.

Answer

The backup file path exceeds the maximum length.

Question 14

Refer to the exhibit. A Linux server's local firewall is configured as shown. The administrator is unable to perform backups to a network-attached storage (NAS) device using TCP port 10000. Which firewall rule is causing the issue?

Accepted Answer

The DROP all rule at the end blocks all traffic except SSH.. Option D is correct. The INPUT chain contains an explicit DROP all rule at the end, which blocks any traffic not explicitly allowed. The only allowed traffic is SSH on port 22. The backup traffic on port 10000 matches the DROP rule and is therefore dropped. Option A is incorrect because the policy ACCEPT is overridden by the explicit DROP. Option B allows SSH traffic but does not affect port 10000. Option C about subnets is irrelevant to the local firewall shown.

Answer

The INPUT policy is set to ACCEPT.

Answer

The NAS device uses a different subnet.

Answer

The SSH ACCEPT rule is allowing traffic.

Question 15

A database server hosts a critical application that requires a recovery point objective (RPO) of 4 hours. The company wants to minimize the impact on production performance during backups. Which backup strategy should be implemented?

Accepted Answer

A weekly full backup with hourly incremental backups.. Option C is correct because hourly incremental backups meet the 4-hour RPO while minimizing resource usage compared to more frequent full backups or continuous replication. Option A is wrong because differential backups grow in size and can still exceed the RPO window. Option B is wrong because nightly full backups would fail to meet the 4-hour RPO if a disaster occurs hours after the last backup. Option D is wrong because CDP with synchronous replication imposes high performance overhead and is unnecessary beyond the 4-hour RPO requirement.

Answer

Continuous data protection (CDP) with synchronous replication.

Answer

A weekly full backup with daily differential backups.

Answer

A nightly full backup.