SK0-005 troubleshooting Practice Test 9 — 15 Questions

Question 1

A server administrator is troubleshooting a Windows Server 2019 that randomly reboots. The administrator suspects a hardware issue. Which two actions should the administrator take to gather evidence of the cause? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a memory dump and analyze it with WinDbg.. To diagnose random reboots, the administrator should first check the System event log for Event ID 41, which indicates an unclean shutdown and may include a bugcheck code. Additionally, configuring a memory dump and analyzing it with WinDbg provides detailed crash information, including the faulting driver or hardware component. These actions gather concrete evidence, unlike preventive measures or general system checks.

Answer

Update the BIOS and all device drivers to the latest versions.

Answer

Enable and review the Windows Memory Diagnostic results.

Answer

Run the sfc /scannow command to check for system file corruption.

Question 2

A server administrator is troubleshooting a Linux server that is experiencing intermittent network connectivity issues. Users report that connections to the server occasionally time out, but the server responds to pings most of the time. The administrator suspects a duplex mismatch on the network interface. Which two commands should the administrator use to verify the current speed and duplex settings of the interface? (Choose two.)

Accepted Answer

ethtool eth0. To confirm a duplex mismatch, the administrator needs to see the actual speed and duplex settings of the interface. ethtool and mii-tool both query the network interface card and report these parameters. The other commands provide statistics or IP configuration but not the negotiated duplex mode. Using either ethtool or mii-tool will reveal whether the interface is set to full or half duplex and at what speed.

Answer

ifconfig eth0

Answer

ip -s link show eth0

Answer

netstat -i

Question 3

A server administrator is troubleshooting a Windows Server 2019 that randomly reboots. The administrator suspects a hardware issue. Which two actions should the administrator take to gather evidence of the cause? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The boot order in the BIOS/UEFI settings.. When a server detects a hard drive but fails to boot with a no bootable device error, the boot order is the most likely culprit. The system may be trying to boot from a non-bootable device. Checking and adjusting the boot order in BIOS/UEFI is a quick first step.

Answer

The integrity of the operating system files.

Answer

The RAID controller configuration.

Answer

The physical connections of the hard drive.

Question 4

A server administrator is troubleshooting a Windows Server 2019 system that reports a stop error (blue screen) with the code CRITICAL_PROCESS_DIED. The server reboots automatically and then works normally for a few hours before the error recurs. The administrator has already updated all drivers and installed the latest Windows updates. Which action should the administrator take next to gather more detailed diagnostic information about the crashes?

Accepted Answer

Configure the system to write a kernel memory dump and analyze it with Windows Debugging Tools.. When a Windows server experiences recurring stop errors despite driver and OS updates, the administrator needs to capture and analyze a memory dump. The kernel memory dump contains the state of the kernel at the crash, including the call stack and loaded modules. Using Windows Debugging Tools (WinDbg) with the appropriate symbols allows the administrator to pinpoint the failing driver or process. Other options either do not capture crash-time state or address different problem classes.

Answer

Run the System File Checker (sfc /scannow) to repair corrupted system files.

Answer

Enable boot logging and restart the server in Safe Mode.

Answer

Use Performance Monitor to log memory and CPU usage over time.

Question 5

A server administrator is troubleshooting a Windows Server host that has been randomly losing connectivity to its iSCSI storage for the past week. The host has two dedicated NICs for iSCSI, each connected to a separate switch, and multipath I/O is configured. Event logs show intermittent path failures that recover within seconds. Switch port statistics show no errors, and both storage controllers report healthy. Which of the following should the administrator check FIRST to diagnose the intermittent path loss?

Accepted Answer

Review the host's TCP retransmission and timeout settings, and check for network congestion on the storage VLAN. Intermittent iSCSI path failures that recover within seconds, with clean switch port statistics and healthy storage controllers, point to packet loss or congestion on the storage network rather than a hardware fault. Reviewing TCP retransmission counters and timeout settings on the dedicated storage VLAN reveals whether frames are being dropped or delayed, which would cause the initiator to declare a path failed and then recover.

Answer

Replace the transceivers in both iSCSI NICs because intermittent link drops indicate failing optics

Answer

Confirm that the two iSCSI NICs are not participating in a team or spanning tree topology that introduces loops

Answer

Verify that the iSCSI initiator and target are configured with matching CHAP authentication secrets

Question 6

A server administrator is troubleshooting a Windows Server 2019 that randomly reboots. The administrator suspects a hardware issue. Which two actions should the administrator take to gather evidence of the cause? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The server's 802.1X supplicant credentials are incorrect or expired.. The switch logs showing repeated 802.1X authentication failures for the server's MAC address indicate that the server is not successfully authenticating. This is typically due to incorrect or expired credentials on the supplicant. When authentication fails, the switch may place the port in a guest VLAN or block traffic, leading to intermittent connectivity if the server occasionally succeeds or if the port is reset. Verifying and correcting the supplicant configuration is the appropriate fix.

Answer

The server's NIC driver is outdated and causing intermittent link drops.

Answer

The switch port is configured for half-duplex, causing collisions.

Answer

The switch port is configured for the wrong VLAN.

Question 7

A server administrator is troubleshooting a Windows Server that is experiencing intermittent network disconnections. The server has a single NIC connected to a switch. Users report that access to file shares drops for about 30 seconds several times a day. The administrator reviews the switch logs and sees no port flapping. Which Windows tool should the administrator use to determine if the NIC is repeatedly resetting or if a driver is causing the disconnections?

Accepted Answer

Event Viewer, specifically the System log for network adapter events.. Intermittent network disconnections on a Windows server can be caused by NIC driver resets or hardware faults. The System event log in Event Viewer captures driver-level events, including link down/up, resets, and error codes. By filtering for the network adapter source, the administrator can see if the NIC is repeatedly resetting and correlate the timestamps with user reports. Other tools provide live metrics or configuration details but lack the historical event logging needed to diagnose intermittent hardware or driver behavior.

Answer

Performance Monitor with the Network Interface counter set.

Answer

Resource Monitor, Network tab.

Answer

Device Manager, viewing the NIC's properties and driver details.

Question 8

A server administrator receives alerts that a file server's system volume is nearly full. The administrator runs a disk usage report and finds that a single log directory contains millions of small files consuming most of the free space. Users need the server to remain online while the issue is resolved. Which of the following should the administrator do to reclaim space with the LEAST disruption?

Accepted Answer

Archive or rotate the log files to another volume and delete or compress the older logs. The disk usage report identifies millions of accumulated log files as the cause of the near-full volume, so the direct, low-impact remedy is to archive or rotate those logs to another volume and remove or compress the old ones. This reclaims space immediately without taking the server offline or disrupting users, unlike scanning, defragmenting, or expanding the volume, which do not address the root cause.

Answer

Extend the system volume by adding a disk to the existing array and expanding the partition online

Answer

Perform an online defragmentation of the system volume to consolidate the small files

Answer

Run a full antivirus scan on the volume to remove infected files and quarantine them

Question 9

A server administrator is troubleshooting a server that is experiencing unexpected shutdowns. The administrator reviews the system logs and finds Event ID 6008 in the Windows System log, indicating an unexpected shutdown. The server has a redundant power supply configuration, and both power supplies are connected to different PDUs. The administrator checks the PDUs and finds no power outages. Which of the following is the MOST likely cause of the unexpected shutdowns?

Accepted Answer

The server's power supplies are not properly seated or are failing intermittently.. Event ID 6008 indicates an unexpected shutdown, which is often caused by a power loss. Even with redundant power supplies, if one supply is failing intermittently or not properly connected, the server may shut down if the remaining supply cannot handle the load or if there is a brief power interruption. Checking the power supply status and reseating them is a logical step. The lack of PDU outages rules out external power issues.

Answer

The PDUs are not providing enough power to the server, causing brownouts.

Answer

The server's BIOS is configured to shut down when a redundant power supply fails.

Answer

The server's operating system is missing a critical update, causing random reboots.

Question 10

A server administrator is troubleshooting a Windows Server 2019 that randomly reboots. The administrator suspects a hardware issue. Which two actions should the administrator take to gather evidence of the cause? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Performance Monitor (perfmon). iostat and Performance Monitor are both capable of providing detailed storage performance metrics. iostat is used on Linux systems to show disk utilization and I/O statistics, while Performance Monitor is used on Windows to track disk counters. Both can help identify if a storage bottleneck exists by showing high disk queue lengths or high average disk response times. Network tools like netstat, traceroute, and ifconfig are not suitable for this task.

Answer

traceroute

Answer

ifconfig

Answer

netstat

Question 11

A server administrator is investigating a performance problem on a Windows Server 2019 file server. Users report that large file copies to a data volume take far longer than expected, but small file operations are fine. The administrator opens Performance Monitor and observes that the PhysicalDisk\Avg. Disk sec/Write counter for the array hosting the data volume is consistently between 40 and 60 ms, while the same counter on the OS volume stays under 5 ms. Disk queue length on the data volume remains low. Which of the following is the MOST likely cause?

Accepted Answer

The write-back cache on the RAID controller has been disabled or the battery-backed cache unit has failed.. Elevated Avg. Disk sec/Write with a low queue length on a single array points to per-I/O latency rather than an overloaded queue. A failed battery-backed cache unit or disabled write-back cache forces the controller into write-through behavior, so each large write waits for physical media commit. This selectively penalizes large sequential writes while leaving small operations and the OS volume unaffected.

Answer

The data volume's partition is misaligned to the underlying RAID stripe.

Answer

The data volume is formatted with the ReFS file system instead of NTFS.

Answer

The server's NIC teaming configuration is using a standby adapter for the data path.

Question 12

A server administrator is investigating a production server that has been performing poorly for several days. Users report slow response times, and the administrator observes that CPU utilization stays near 100% even during off-peak hours. Task Manager shows the System process consuming most of the CPU. The administrator runs a performance counter capture and sees a sustained high rate of deferred procedure calls (DPCs). Which of the following is the MOST likely cause?

Accepted Answer

A failing storage controller driver generating excessive interrupts. Sustained high DPC time indicates a driver is spending excessive time in deferred procedure call routines, and the System process CPU usage reflects that kernel-level activity. Among the listed causes, only a failing storage controller driver would directly generate abnormal interrupt and DPC load. Memory leaks, thermal throttling, and DNS retries do not produce this specific performance counter pattern.

Answer

A memory leak in a user-mode application causing excessive paging

Answer

An overheating CPU throttling to a lower clock speed

Answer

A misconfigured DNS server causing repeated name resolution retries

Question 13

A server administrator is troubleshooting a Windows Server 2019 that randomly reboots. The administrator suspects a hardware issue. Which two actions should the administrator take to gather evidence of the cause? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A disk-intensive application or process is causing an I/O bottleneck.. The high disk queue length and near 100% disk active time are key indicators of an I/O bottleneck. When the disk subsystem is saturated with requests, the server becomes unresponsive to file share requests. The most likely cause is a process or application performing excessive disk operations, which can be identified using Resource Monitor or Performance Monitor, and then addressed by rescheduling or terminating the process.

Answer

The server has insufficient RAM, causing excessive paging.

Answer

The server's CPU is overheating and throttling performance.

Answer

The network adapter is faulty, causing dropped packets.

Question 14

A server administrator is troubleshooting a tower server that reports no video output on the local monitor, but the power LED is solid green and the fans spin at normal speed. The administrator connects to the baseboard management controller (BMC) over the network and sees a POST code of 'B4' with a message indicating USB device initialization. A USB flash drive is left in a rear port. Which of the following is the MOST likely cause of the missing video?

Accepted Answer

The USB flash drive is causing the POST process to stall before video initialization completes.. The POST code 'B4' with a USB initialization message is the key evidence: the server is hanging during USB device enumeration, which can prevent video initialization from completing. Removing the offending USB flash drive and rebooting is the correct remediation. The other causes either contradict the POST code or would not produce that specific code.

Answer

The BMC is redirecting the video output to its remote console, so the local monitor stays blank.

Answer

The video card has failed and must be replaced before the server will POST.

Answer

The monitor cable is connected to the wrong port on the server.

Question 15

A server administrator is troubleshooting a Linux web server that has become unresponsive to SSH and HTTP requests. The administrator connects through the out-of-band management console and finds the system load average extremely high, with a large number of processes in the D state. The administrator suspects an I/O bottleneck. Which of the following commands should the administrator use to identify the processes and devices contributing to the bottleneck? (Choose two.)

Accepted Answer

iotop -o. To diagnose an I/O bottleneck, the administrator needs both device-level and process-level visibility. iostat -x with an interval shows per-device utilization and queue metrics, while iotop -o shows which processes are actively performing I/O. Together they identify the saturated device and the workloads causing it. Memory, network, and service-status tools do not provide this combined view.

Answer

systemctl status httpd

Answer

free -m

Answer

netstat -tulpn