SK0-005 security-disaster-recovery — Timed 20 Questions

Question 1

Refer to the exhibit. A backup job to a network share failed. The administrator reviews the backup log. What is the most likely cause of the failure?

Accepted Answer

The backup user account lacks appropriate permissions.. When a backup job to a network share fails, the most common and specific cause is that the account running the backup service lacks the necessary share and NTFS permissions on the destination. Backup logs typically show 'Access Denied' or 'Permission Denied' errors when the service account cannot write to the target path. Since the job reached the point of attempting to write, connectivity and server availability are already established, leaving permissions as the likely culprit.

Answer

The backup server is powered off.

Answer

The network link is down.

Answer

The backup file path exceeds the maximum length.

Question 2

A system administrator needs to configure secure remote access to servers in the data center. The current setup uses password-based SSH, but the security policy mandates multifactor authentication and prevention of brute-force attacks. Which solution best meets these requirements?

Accepted Answer

Deploy a VPN with certificate-based authentication and enable MFA.. It directly satisfies both the multifactor authentication (MFA) mandate and brute-force prevention. A VPN with certificate-based authentication provides a strong first factor (something you have), and enabling MFA adds a second factor (e.g., something you know or are), fully meeting the policy. Additionally, the VPN concentrator typically includes built-in brute-force protections like rate limiting and lockout, and it encrypts all traffic, which is ideal for secure remote access to data center servers.

Answer

Implement SSH key authentication only.

Answer

Use SSH with public key authentication and install fail2ban.

Answer

Enable RDP with network-level authentication.

Question 3

A small accounting firm has a single server that hosts their client database and financial applications. The server is backed up nightly using a full backup to an external USB hard drive, which is stored on a shelf next to the server. Last month, a fire broke out in the office, completely destroying the server and the backup drive. The company lost all data since their last offsite backup, which was six months old because they occasionally took a copy home. The business owner wants to prevent such a catastrophic data loss in the future but is concerned about cost and complexity. They have a limited IT budget and no dedicated IT staff. The firm operates 9-5 Monday to Friday, and can tolerate up to 24 hours of downtime and up to one day of data loss. After the fire, they had to rebuild their client records from paper files, which took weeks. The owner realizes the importance of an offsite backup routine but cannot afford an expensive cloud service or a second server. The firm's internet connection is a basic DSL line with limited upload bandwidth, making large cloud backups slow. The server has a single internal drive with enough free space to store additional copies. Which of the following backup strategies would best meet the firm’s recovery objectives while minimizing cost and complexity?

Accepted Answer

Continue nightly full backups to an external drive, but have an employee take the drive home every evening.. The firm needs an offsite copy to survive site-wide disasters, a maximum 24-hour RPO, and minimal cost/complexity with no IT staff. Having an employee take the nightly full backup drive home every evening ensures an offsite copy is created daily, meeting the 24-hour RPO, while reusing the existing USB drive and process — no new hardware, cloud subscription, or technical expertise required.

Answer

Buy a second external drive, alternate them, and keep one offsite at the owner’s house, rotating weekly.

Answer

Purchase a network-attached storage device and configure it to receive daily backups; place it in a different room in the building.

Answer

Subscribe to a cloud backup service and perform daily incremental backups over the internet.

Question 4

A regional hospital operates two data centers located 10 miles apart, with synchronous replication of critical patient record systems between them. The replication ensures that any write to the primary storage is immediately mirrored to the secondary site. The hospital also maintains weekly full backups to LTO-8 tapes, which are stored in a fireproof safe at an offsite warehouse 30 miles away. The IT team has not implemented storage snapshots or continuous data protection due to budget constraints. Last week, a ransomware attack encrypted all files on the primary site. The replication process promptly mirrored the encrypted data to the secondary site, rendering both copies inaccessible. The attackers demanded $500,000 in Bitcoin. The hospital's disaster recovery plan specifies an RPO of 1 hour and an RTO of 4 hours. The IT director must now choose a restoration strategy that minimizes data loss and downtime while ensuring a clean, malware-free environment. The backup tapes are confirmed to be unencrypted and free of ransomware. Which of the following actions should the IT director take first?

Accepted Answer

Wipe the secondary data center storage, restore from the latest clean tape backup at the secondary site, and then reverse replication to the primary.. The correct first action is to wipe the secondary data center storage, restore from the latest clean tape backup at the secondary site, and then reverse replication to the primary. This ensures a clean, malware-free environment because the tapes are confirmed unencrypted and free of ransomware, and it minimizes downtime by using the secondary site as the recovery point. Reversing replication after restoration prevents the re-infection of the primary site from the compromised secondary data.

Answer

Pay the ransom demand to obtain the decryption key and decrypt both sites.

Answer

Restore the most recent tape backup to the primary site and re-enable replication.

Answer

Fail over to the secondary data center and attempt to decrypt the ransomware using available tools.

Question 5

Refer to the exhibit. A backup administrator scheduled a nightly backup to a network share. The backup job fails with the error shown in the log. What is the most likely cause?

Accepted Answer

The service account lacks write permissions to the share. The “Access denied” message indicates a permissions issue, likely that the service account running the backup lacks write access to the share. The share being offline would likely show “network path not found,” a full disk would show “insufficient space,” and the software not installed would prevent the job from running at all.

Answer

The backup destination disk is full

Answer

The network share is offline

Answer

The backup software is not installed

Question 6

A small law firm has a single on-premises server running their case management software, email, and document storage. They perform a full backup each night at 11 PM to an external USB 4 TB drive, which is then stored on a shelf in the server room. The server room is located in the basement of their office building. Last week, an electrical fire started in the server room, completely destroying the server and the backup drive. The firm lost all data since the last backup, and it took two weeks to procure new hardware and restore from an older, off-site backup that was taken during a manual process three months ago. Their insurance company now requires a formal disaster recovery plan. The firm has a limited budget and minimal IT staff. They want to prevent data loss and minimize downtime in future disasters. What is the BEST course of action to improve their disaster recovery capabilities?

Accepted Answer

Subscribe to a cloud backup service that performs automatic daily backups to a remote data center.. Option B is correct because cloud backup automatically sends data to a remote location, satisfying the off-site requirement of the 3-2-1 backup rule, is cost-effective for a small firm, and requires little IT overhead. Option A is wrong because mirroring on-site still leaves them vulnerable to site-wide disasters like fire. Option C is wrong because a fireproof safe does not protect against all disaster types and keeps the backup on-site. Option D is wrong because it still stores the backup on-site, increasing cost and management without solving the off-site need.

Answer

Increase backup frequency to every hour and store the drive in a desk drawer in a different room on the same floor.

Answer

Purchase a fireproof safe for the server room and store the USB backup drive in it after each backup.

Answer

Install a second server on-site and configure real-time mirroring between the two servers.

Question 7

A mid-sized manufacturing company operates a primary data center with all critical servers. They have a warm standby site located 100 miles away. For databases, the primary SAN uses synchronous replication to the standby SAN; no tape backups are taken for databases. File and application servers are backed up to an on-premises tape library using nightly incrementals with a weekly full backup every Sunday. Tapes are shipped off-site every Monday morning. On Tuesday morning, a ransomware attack encrypts the entire primary SAN. Because of the real-time replication, the standby SAN is encrypted almost instantly. The on-site tape library is also connected to the network and its tapes, including Sunday's full and Monday's incremental, are encrypted by the attack. The most recent off-site shipment was the previous Monday (eleven days ago), meaning the off-site tapes contain a full backup from eleven days ago and daily incrementals up to that point. The company's RPO is 1 hour for databases and 24 hours for file servers; RTO is 8 hours. The IT director must decide the best immediate course of action to restore operations while adhering to the DR plan as closely as possible.

Accepted Answer

Restore all systems from the 11-day-old off-site tapes, accepting the loss of data generated during the last 11 days.. The off-site tapes from 11 days ago are the only known-good, unencrypted copies of the data, since the primary SAN, standby SAN, and on-site tape library were all compromised by the ransomware. Restoring from these tapes is the only viable DR action that recovers data without paying criminals or gambling on corrupted replicas. This aligns with the DR plan's reliance on off-site media as the last line of defense when replication and on-site backups fail simultaneously.

Answer

Rebuild all database servers from scratch and restore file servers from the most recent off-site tapes, accepting 11 days of data loss for file servers too.

Answer

Attempt to restore the databases from the replicated SAN by breaking replication and scanning for uncorrupted blocks.

Answer

Pay the ransom demand to the attackers in hopes of receiving the decryption key.

Question 8

A datacenter administrator is configuring a UPS to protect a rack of dual-power-supply servers. The UPS has a network management card, and the administrator wants each server to automatically begin a graceful shutdown when the UPS battery reaches 20 percent remaining capacity. Which action should the administrator take to meet this requirement?

Accepted Answer

Connect the UPS network management card to the same switch as the servers and enable SNMP traps on the UPS.. A UPS network management card can send SNMP traps to agents on each server, allowing them to initiate a graceful shutdown when battery capacity reaches a defined threshold. This approach scales to multiple servers and does not require individual serial or USB connections to the UPS.

Answer

Install a serial cable from the UPS to one server and configure that server to broadcast a shutdown command to the others.

Answer

Connect each server's power supply directly to the UPS and enable the UPS's built-in shutdown software on the management card.

Answer

Configure the servers' BIOS to shut down when AC power is lost, and rely on the UPS to provide runtime until the BIOS timer expires.

Question 9

A data center administrator is configuring a new backup strategy for a file server that stores 2 TB of active project data. The organization requires that backups complete within a 4-hour window each night, and that any single file can be restored without restoring the entire backup set. Which backup type should the administrator implement?

Accepted Answer

Synthetic full backup. A synthetic full backup synthesizes a full backup from existing backups, avoiding the need to read the entire 2 TB source each night, which helps meet the 4-hour window. It also produces a consolidated full backup set that allows individual file restores without chaining multiple incremental backups, satisfying the single-file restore requirement.

Answer

Incremental backup

Answer

Full backup

Answer

Differential backup

Question 10

A company's disaster recovery plan specifies a recovery point objective (RPO) of 15 minutes for its Microsoft SQL Server database. The database is 2 TB, and a full backup takes 6 hours to complete. Which backup strategy best meets the RPO while minimizing storage and restore complexity?

Accepted Answer

Weekly full backups with transaction log backups every 15 minutes. Meeting a 15-minute RPO for a large database requires frequent transaction log backups rather than frequent full backups. A weekly full backup plus 15-minute log backups captures all changes within the RPO window while avoiding the storage and performance cost of repeated full backups. The other strategies either exceed the RPO or sacrifice recoverability.

Answer

Weekly full backups with daily differential backups

Answer

Continuous replication to a secondary server with no local backups

Answer

Daily full backups with hourly transaction log backups

Question 11

An administrator needs to test the disaster recovery plan for a critical server environment. Management requires that the test involve actual failover to the DR site and running production workloads there, but with no impact to the primary site and minimal disruption. Which type of DR test should the administrator perform?

Accepted Answer

Full failover test. A full failover test is the only option that involves actually bringing up the DR site and running production workloads there while the primary site remains unaffected. This provides the most realistic validation of the DR plan and ensures that systems, data, and procedures work under real conditions. It meets the requirement of minimal disruption because the primary site continues to operate normally.

Answer

Tabletop exercise

Answer

Simulation test

Answer

Parallel test

Question 12

A small business has a single server that hosts both a database and a file share. The administrator needs to implement a backup strategy that minimizes backup window time while ensuring that the database can be restored to a consistent state. Which backup type should be used for the database?

Accepted Answer

Transaction log backup. For databases, transaction log backups are designed to capture changes at the transaction level, ensuring consistency and enabling point-in-time recovery. They are fast and can be run frequently, minimizing the backup window. Full, differential, and incremental backups may not guarantee transactional consistency without additional steps, making them less suitable for this requirement.

Answer

Full backup

Answer

Incremental backup

Answer

Differential backup

Question 13

A datacenter administrator needs to implement a physical security control that prevents an unauthorized person from following an employee through a secure door into the server room. Which control should the administrator implement?

Accepted Answer

Mantrap. Tailgating occurs when an unauthorized person follows an authorized employee through a secure door. A mantrap uses two interlocking doors and authentication to allow only one person through at a time, physically preventing the unauthorized entry. Bollards stop vehicles, cameras only record, and an access control vestibule is a less precise term for the same concept, making the mantrap the correct control.

Answer

Bollard

Answer

Camera

Answer

Access control vestibule

Question 14

A security administrator is hardening a Linux server that hosts a public web application. The server must allow inbound HTTPS from anywhere, SSH only from the management subnet 192.168.10.0/24, and must block all other inbound traffic. The administrator decides to use the local firewall. Which of the following commands should the administrator run to apply this policy immediately and persistently?

Accepted Answer

iptables -A INPUT -p tcp --dport 443 -j ACCEPT; iptables -A INPUT -p tcp --dport 22 -s 192.168.10.0/24 -j ACCEPT; iptables -A INPUT -j DROP; iptables-save > /etc/iptables/rules.v4. The correct policy must accept HTTPS from anywhere, accept SSH only from the management subnet, and drop everything else, with rules in that order. Saving with iptables-save to /etc/iptables/rules.v4 ensures persistence across reboots on systems using iptables-persistent. The REJECT variant is less secure because it responds to blocked traffic, and the other options either misorder rules or fail to persist reliably.

Answer

iptables -A INPUT -p tcp --dport 22 -s 192.168.10.0/24 -j ACCEPT; iptables -A INPUT -p tcp --dport 443 -j ACCEPT; iptables -A INPUT -j DROP; service iptables save

Answer

iptables -A INPUT -p tcp --dport 443 -j ACCEPT; iptables -A INPUT -p tcp --dport 22 -s 192.168.10.0/24 -j ACCEPT; iptables -A INPUT -j REJECT; iptables-save > /etc/iptables/rules.v4

Answer

iptables -A INPUT -p tcp --dport 443 -j ACCEPT; iptables -A INPUT -p tcp --dport 22 -j ACCEPT; iptables -A INPUT -s 192.168.10.0/24 -j DROP; iptables -A INPUT -j DROP; iptables-save > /etc/iptables/rules.v4

Question 15

A security administrator at a financial services company needs to harden an Ubuntu Server 22.04 LTS system that hosts a public-facing web application. The administrator must ensure that the SSH service is configured to prevent brute-force attacks by limiting authentication attempts and disabling direct root login. Which of the following actions should the administrator take to meet these requirements?

Accepted Answer

Edit /etc/ssh/sshd_config to set PermitRootLogin no and MaxAuthTries 3, then restart the sshd service.. The correct answer involves editing the SSH daemon configuration file to disable root login and restrict authentication attempts. These settings directly address the brute-force mitigation and root login prevention requirements. Restarting the service ensures the changes take effect. Other options either block all SSH access, use deprecated methods, or rely on external tools that do not fully meet the specific configuration requirements.

Answer

Run sudo ufw deny 22/tcp to block all SSH traffic, then configure a non-standard port for SSH access.

Answer

Modify /etc/pam.d/sshd to include pam_tally2.so deny=3 and set root login to disabled in /etc/passwd.

Answer

Install and configure fail2ban to monitor SSH logs and ban IP addresses after three failed attempts, and set PermitRootLogin to no in /etc/ssh/sshd_config.

Question 16

A security administrator is hardening a Linux web server that hosts a public-facing application. The server currently allows SSH access from any IP address and uses password authentication. The administrator wants to reduce the attack surface and implement defense in depth. Which two actions should the administrator take? (Choose two.)

Accepted Answer

Disable SSH password authentication and enforce public key authentication.. Limiting SSH access to a management subnet restricts who can attempt to connect, and enforcing public key authentication removes the vulnerability of password-based attacks. Together, these measures significantly harden SSH by implementing network-level and authentication-level controls, directly reducing the attack surface and adding defense in depth.

Answer

Enable root login over SSH to simplify administrative tasks.

Answer

Install a host-based intrusion detection system (HIDS) to monitor file integrity.

Answer

Change the SSH default port from 22 to a non-standard port.

Question 17

A datacenter administrator must dispose of twelve decommissioned servers that stored customer payment card data. The company's policy requires that no recoverable data leaves the building, and the drives will be resold to a third party. Which action BEST satisfies both the data destruction requirement and the resale plan?

Accepted Answer

Physically shred the drives to the vendor's specified particle size, then provide the reseller with the shredded material for recycling.. The requirement is absolute: no recoverable data may leave the facility, and the drives are being sold onward. Only physical destruction of the media guarantees that no remapped, cached, or reserved-area data survives, while the resulting material can still be recycled for value. Overwriting, degaussing, and key destruction each depend on assumptions about the media or leave the drive unusable or potentially readable.

Answer

Perform a cryptographic erase by destroying the drive's internal encryption key, then verify the drive reports as unreadable before resale.

Answer

Degauss each drive with a strong magnetic field before handing the drives to the reseller.

Answer

Run a single-pass overwrite on each drive using the vendor's disk utility, then ship the drives to the reseller.

Question 18

A company is designing a disaster recovery plan for its critical web application. The application runs on three servers: a web server, an application server, and a database server. The company wants to ensure that if the primary site fails, the application can be brought online at a secondary site with minimal data loss and within a 1-hour RTO. The secondary site currently has identical hardware but no software installed. Which of the following should be implemented to meet these requirements?

Accepted Answer

Warm site with replicated data and pre-staged servers. A warm site balances cost and recovery speed by having hardware and some software pre-installed, with data replication from the primary site. This allows the application to be operational within the 1-hour RTO and minimizes data loss. It is more practical than a hot site for the stated requirements and far faster than a cold or mobile site.

Answer

Cold site with nightly backups and manual restore

Answer

Mobile site with trailers and generators

Answer

Hot site with real-time replication and automatic failover

Question 19

A company is designing a disaster recovery plan for its critical SQL Server database. The recovery point objective (RPO) is 15 minutes, and the recovery time objective (RTO) is 1 hour. The database is 2 TB in size and experiences heavy transaction volume. Which combination of technologies should be implemented to meet these objectives with minimal data loss?

Accepted Answer

Always On availability groups with synchronous commit and automatic failover. To achieve a 15-minute RPO and 1-hour RTO for a heavily utilized SQL Server database, synchronous commit with automatic failover in Always On availability groups is ideal. It ensures zero data loss by committing on both replicas and enables fast failover. Other options either risk data loss or use deprecated technology.

Answer

Database mirroring in high-safety mode with automatic failover

Answer

Always On availability groups with asynchronous commit and automatic failover

Answer

Daily full backups and hourly transaction log backups

Question 20

A security administrator is reviewing physical security for a server room that houses domain controllers and backup tapes. The administrator wants to prevent unauthorized individuals from following an authorized employee through the door and to ensure that entry attempts are recorded for audit. Which of the following controls should the administrator implement?

Accepted Answer

Install a badge reader with an anti-passback and tailgating detection feature, and log all entry events.. The requirement is twofold: prevent unauthorized individuals from following an authorized person through the door, and record entry attempts for audit. A badge reader with anti-passback and tailgating detection provides both prevention and an electronic log. Mechanical locks, cameras alone, and a full mantrap either fail to prevent tailgating, fail to log, or exceed what the scenario requires.

Answer

Install a camera above the door that records continuously and store the footage for 24 hours.

Answer

Deploy a mantrap with two interlocking doors that requires a badge at both doors.

Answer

Replace the door lock with a mechanical keyed lock and issue keys only to authorized staff.

SK0-005 security-disaster-recovery — Timed 20 Questions

Exhibit

SK0-005 security-disaster-recovery — Timed 20 Questions

Exhibit