SK0-005 troubleshooting Practice Test 2 — 15 Questions

Question 1

Refer to the exhibit. The Print Spooler service on a critical Windows Server 2019 fails to start at every boot. The server was recently updated with the latest cumulative patch. Which of the following is the MOST likely cause?

Accepted Answer

A service on which the Print Spooler depends is not starting. Event ID 7000 with a timeout error strongly suggests a dependency service is not starting correctly. The Print Spooler depends on the Remote Procedure Call (RPC) service among others; a recent patch may have altered the startup configuration of a dependency. The Print Spooler runs under the LocalSystem account, so password expiration is not a factor. A corrupt driver usually causes the service to crash after starting, not a timeout. Insufficient disk space would generate a different error.

Answer

The system drive has insufficient free space

Answer

A recent printer driver update is corrupted

Answer

The password for the service account has expired

Question 2

After applying a Windows security patch, a server fails to boot and displays 'Bootmgr is missing'. The server is UEFI-based. Which of the following is the MOST efficient way to resolve the issue?

Accepted Answer

Use the recovery environment to repair the boot loader.. 'Bootmgr is missing' on a UEFI system indicates the boot loader or its configuration (BCD/EFI boot entry) is damaged or missing, typically after a patch modifies boot files. The most efficient fix is to boot into the Windows Recovery Environment (WinRE) and run bootrec /fixboot, bootrec /rebuildbcd, or bcdboot to repair the EFI boot loader and BCD store. This addresses the root cause directly without data loss or hardware replacement.

Answer

Reset the BIOS to factory settings.

Answer

Replace the hard drive and restore from backup.

Answer

Boot from the installation media and run chkdsk.

Question 3

A company uses a two-node failover cluster for a critical database application. The cluster consists of Node A and Node B, with shared storage connected via SAS. During a routine check, the administrator discovers that Node A has failed and the cluster resources did not fail over to Node B. The cluster service is running on Node B, but the database resource remains offline. Node B can successfully ping Node A's management IP address but not the dedicated cluster heartbeat IP. The shared storage appears in the operating system on Node B, but attempts to bring the disks online fail. The administrator must restore database service as quickly as possible. Which of the following actions should the administrator take FIRST?

Accepted Answer

Check and repair connectivity to the shared storage from Node B. The first action should be to check and repair connectivity to the shared storage from Node B. The shared storage appears in the OS but disks cannot be brought online, indicating a storage connectivity or configuration issue. Since Node B can ping Node A's management IP but not the heartbeat IP, the cluster may have lost quorum or the storage path is broken. Restoring storage access is critical to bringing the database resource online.

Answer

Run the cluster validation wizard

Answer

Force a quorum on Node B using the /forcequorum switch

Answer

Reboot Node A

Question 4

A server technician has just replaced a failed hard drive in a RAID 5 array. After inserting the new drive, the array begins rebuilding, but after 10 minutes, the rebuild fails and the array status shows 'degraded' again. Which of the following is the MOST likely cause?

Accepted Answer

The new drive is larger than the other drives in the array.. RAID 5 requires all member drives to be the same size (or the array treats each drive as the size of the smallest member). When a larger replacement drive is inserted, the controller cannot use the extra capacity and, depending on the controller, may reject the drive during rebuild because it does not match the expected geometry, causing the rebuild to fail and the array to return to degraded state.

Answer

The new drive has a higher rotational speed.

Answer

The new drive has a different firmware version than the other drives.

Answer

The new drive is not hot-swappable and was inserted while the server was on.

Question 5

A file server running Windows Server 2016 is critical for a department's daily operations. For the past two weeks, it has been crashing with a blue screen every 1–2 days. The IT team collects minidump files and opens the latest one in WinDbg. After running '!analyze -v', they obtain the following output:
```
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses.
Arguments:
Arg1: fffff80012345678, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff80abcde1234, address which referenced memory
Debugging Details:
...
PROCESS_NAME:  fileserver.exe
SYMBOL_NAME:  NetAdapterCx.sys!NetAdapterCxSetLinkState+0x1234
IMAGE_NAME:  NetAdapterCx.sys
...
```
The server has 64GB ECC RAM, two Intel Xeon processors, and a Broadcom NetXtreme quad-port 10GbE NIC. The NIC driver was updated from version 7.12.6 to 7.14.8 two weeks ago as part of patch management. The BSODs started occurring immediately after that driver update; prior to the update, the server had been stable for over six months. The driver was obtained from the server manufacturer's support site and installed without error. The administrator wants to restore stability with minimal downtime and risk. Which action should the administrator take FIRST?

Accepted Answer

Boot into Safe Mode and roll back the network adapter driver to the previous version (7.12.6).. The WinDbg output identifies NetAdapterCx.sys as the faulting module, and the timeline shows BSODs began immediately after the NIC driver was updated from 7.12.6 to 7.14.8. Rolling back to the previous known-good driver in Safe Mode is the fastest, lowest-risk remediation that directly addresses the root cause without hardware changes or OS reinstallation. This restores stability with minimal downtime.

Answer

Replace the Broadcom NIC with a different brand network adapter and disable the onboard NIC in the BIOS.

Answer

Reinstall Windows Server 2016 and restore data from backups to eliminate any corrupted system files.

Answer

Run Windows Memory Diagnostic overnight to check for hardware memory errors that might corrupt driver loading.

Question 6

A server administrator is troubleshooting a server that randomly reboots multiple times a day. The operating system is Windows Server 2019. The administrator has enabled memory dump collection and notices that no dump files are being created. Which of the following is the MOST likely cause?

Accepted Answer

The page file is too small or located on a different volume than the dump file path.. The correct answer is that the page file is too small or located on a different volume than the dump file path. Windows requires the page file to be on the system volume and large enough to hold the dump. If these conditions are not met, dump files will not be created. This is a frequent oversight when configuring memory dumps for troubleshooting random reboots.

Answer

The crash is caused by a hardware failure that bypasses the operating system's dump mechanism.

Answer

The dump file path is set to a network share that is unavailable during the crash.

Answer

The server's BIOS is outdated and does not support memory dump generation.

Question 7

A server administrator is troubleshooting a server that randomly reboots. The administrator suspects a hardware issue. Which of the following should the administrator check to help identify the cause? (Choose two.)

Accepted Answer

Run a memory diagnostic tool to test for faulty RAM.. Random reboots often stem from hardware issues. WHEA-Logger events in Windows event logs provide detailed hardware error information, such as CPU or memory faults. Memory diagnostic tests can identify faulty RAM, another common cause. Together, these two steps efficiently narrow down the problem. BIOS updates, disk space checks, and power circuit verification are not primary diagnostic actions for random reboots.

Answer

Update the server's BIOS to the latest version available from the vendor.

Answer

Verify that the server's power supplies are connected to separate circuits.

Answer

Check the disk usage on the system partition to ensure there is free space.

Question 8

A server administrator is troubleshooting a Windows Server 2019 that randomly reboots. Event Viewer shows Event ID 41 (Kernel-Power) with no bugcheck code. The administrator has already updated all drivers and firmware. Which tool should the administrator use next to diagnose the issue?

Accepted Answer

Event Viewer with power events filtered. The correct answer is to use Event Viewer with power events filtered. Event ID 41 with no bugcheck code suggests a power-related issue. By filtering for power events, the administrator can correlate the reboot with other events like unexpected shutdowns or thermal warnings. This targeted approach provides more specific information than general performance or memory tools.

Answer

Windows Memory Diagnostic

Answer

Performance Monitor

Answer

Reliability Monitor

Question 9

A server administrator is troubleshooting a physical server that randomly reboots several times a day. The administrator has already verified that the UPS is functioning correctly and that all internal power connections are secure. The server's iDRAC log shows no thermal or voltage events. Which of the following should the administrator check NEXT to identify the cause?

Accepted Answer

Check the firmware versions and update the BIOS.. Random reboots with no thermal or voltage events in the iDRAC log suggest a firmware or software issue rather than a hardware failure. Updating the BIOS and other firmware is a logical next step to address potential bugs or compatibility problems. Power and memory issues are less likely because they would typically generate log entries or other symptoms.

Answer

Review the ECC memory error logs in the iDRAC.

Answer

Replace the power supply units.

Answer

Run a full memory diagnostic test.

Question 10

A server administrator is troubleshooting a Windows Server 2019 that has become unresponsive. The administrator suspects a memory leak in a third-party service. Which tool should the administrator use to view real-time memory usage per process and identify the leaking process?

Accepted Answer

Task Manager. Task Manager provides an immediate, sortable view of memory usage per process, making it the fastest tool to identify a memory leak in a live, unresponsive server. While Performance Monitor and Resource Monitor offer deeper metrics, they require more time and configuration. Event Viewer only logs events and cannot show current memory consumption, so it is not suitable for this scenario.

Answer

Event Viewer

Answer

Performance Monitor

Answer

Resource Monitor

Question 11

A server administrator is troubleshooting a newly installed 10 GbE network adapter that is not achieving expected throughput. The adapter is connected to a switch port configured for 10 Gbps full duplex. The administrator runs ethtool and sees that the link speed is reported as 1000 Mb/s. Which of the following is the MOST likely cause?

Accepted Answer

The cable is a Cat 5e cable that does not support 10 Gbps.. The most likely cause is that the cable does not support 10 Gbps. Cat 5e cables are limited to 1 Gbps, so the adapter negotiates at that speed. Upgrading to Cat 6 or higher is necessary for 10 GbE. Switch misconfiguration and faulty hardware are less likely given the scenario details.

Answer

The switch port is misconfigured for 1 Gbps.

Answer

The adapter driver needs to be updated.

Answer

The network adapter is faulty and needs replacement.

Question 12

A server administrator is troubleshooting a Linux server that is experiencing intermittent network connectivity issues. The administrator suspects a problem with the network interface card (NIC). Which command should the administrator use to view the number of dropped packets and errors on the NIC?

Accepted Answer

ethtool -S eth0. ethtool -S eth0 provides the most detailed NIC statistics, including dropped packets and various error counters specific to the network interface driver. This level of detail is crucial for diagnosing intermittent connectivity issues that may be caused by hardware faults. While other commands show basic error and drop counts, ethtool -S offers the granular view needed to confirm a NIC problem.

Answer

netstat -i

Answer

ip -s link show eth0

Answer

ifconfig -a

Question 13

A server administrator receives reports that a newly installed 10 GbE network adapter in a database server is only achieving about 1 Gbps throughput. The adapter is connected to a 10 GbE switch port. The administrator runs ethtool on the Linux server and sees the link speed is reported as 1000 Mb/s. The cable in use is a Cat 5e patch cord that was previously used for a 1 GbE connection. Which of the following is the MOST likely cause of the reduced throughput?

Accepted Answer

The Cat 5e cable cannot support 10GBASE-T and is limiting the link to 1 GbE.. The link speed reported by ethtool indicates a physical layer negotiation. Cat 5e cable is not certified for 10GBASE-T beyond 45 meters and often will not support 10G at all. Since the cable was previously used for 1 GbE, it is the most likely component preventing 10G negotiation. Replacing it with Cat 6a or Cat 6 will likely resolve the issue.

Answer

The server's PCIe slot is only capable of 1 Gbps throughput.

Answer

The switch port is configured for 1 GbE and must be manually set to 10 GbE.

Answer

The adapter driver needs to be updated to support 10 GbE speeds.

Question 14

A server administrator is troubleshooting a server that is exhibiting slow disk performance. The server uses a hardware RAID controller with a write-back cache and battery backup unit (BBU). Performance monitoring shows high disk latency and low IOPS. The administrator suspects the RAID controller is the bottleneck. Which of the following should the administrator check? (Choose two.)

Accepted Answer

Verify that the BBU is healthy and the write-back cache is enabled.. The two most relevant checks are the BBU status and write-back cache policy, and the health of the physical disks. A failed BBU disables write-back caching, causing performance degradation, while failing disks cause latency. These directly address the suspected RAID controller bottleneck.

Answer

Update the RAID controller firmware to the latest version.

Answer

Increase the server's RAM to improve disk caching.

Answer

Reconfigure the RAID level from RAID 5 to RAID 0.

Question 15

A server administrator is troubleshooting a RAID 5 array that has become degraded. The array is managed by a hardware RAID controller. The administrator wants to identify the failed drive and prepare for replacement. Which two actions should the administrator take to safely identify the failed physical drive? (Choose two.)

Accepted Answer

Check the controller's event log to confirm the drive's serial number and slot assignment.. To safely replace a failed drive in a hardware RAID array, the administrator must positively identify the failed physical drive without disturbing others. The controller management utility can report the failed drive's slot and blink its LED, and the event log provides the serial number and slot assignment for cross-checking. These two actions together ensure the correct drive is targeted. Removing drives blindly or rebooting unnecessarily introduces risk and downtime.

Answer

Reboot the server and enter the RAID controller BIOS to view the array status.

Answer

Remove each drive one at a time until the degraded status changes.

Answer

Run a file system check on the mounted volume to force the controller to re-scan the drives.

SK0-005 troubleshooting Practice Test 2 — 15 Questions

Exhibit

SK0-005 troubleshooting Practice Test 2 — 15 Questions

Exhibit