Troubleshooting security issues means systematically finding and fixing problems like unauthorised access or misconfigured servers after something goes wrong. Diagnostic tools such as ping, tracert, and Event Viewer help you locate the root cause quickly. For the Server+ SK0-005 exam, understanding how to use these tools together is essential because real-world breaches often hide behind simple network or logging failures.
Jump to a section
A simple way to picture Troubleshooting Security Issues and Using Diagnostic Tools
7 security cameras cover your office building, but only 3 are working. You hear a rumour that someone broke in last night, but you are not sure where or how. Your job is to figure out what happened and fix the gaps.
First, you check the camera feeds (event viewer). The working cameras show a person entering through the side door at 2am. But the side door camera is one of the broken ones – so you find an old logbook (system logs) that records the door sensor being disabled at that time. Next, you walk the path the intruder took (tracert). You follow the footprints from the side door to the server room, noticing they avoided the motion sensors in the main corridor. You then test the door locks (ping) – the side door lock functions, but the magnetic seal is loose, which allowed the intruder to push it open.
This analogy maps directly to server security troubleshooting. The cameras are your diagnostic tools: event viewer gives you recorded activity, ping checks if a service is reachable, and tracert shows the route data (or an intruder) took. The broken cameras represent misconfigured logging or disabled security features. Just as you use a combination of camera footage, logbooks, and physical inspection to solve the break-in, an IT professional uses event viewer, ping, and tracert to diagnose a security breach. Each tool covers a different layer – logs confirm what happened, ping verifies connectivity, and tracert traces the path of the attack. Without all three, you would miss critical evidence.
To troubleshoot security issues, you first need to understand what a security incident actually is. A security breach happens when someone – or something – gains unauthorised access to a system, data, or network. A misconfiguration is a setup error that makes the system vulnerable, like leaving a default password in place or opening a port that should be closed. Both breaches and misconfigurations can lead to data loss, downtime, or compliance violations.
Diagnostic tools are the instruments you use to investigate. The three most common tools covered in SK0-005 are ping, tracert (also called traceroute), and Event Viewer. Each serves a different purpose and gives you a different piece of the puzzle.
Ping is a command-line tool that sends a small data packet to a target computer and waits for a reply. It tests basic network connectivity. If you ping a server and get a response, you know the server is on the network and can communicate. If you get a timeout or no reply, the server might be down, the network might be broken, or a firewall might be blocking the traffic. Ping does not tell you why something is wrong – only whether a path exists. In security troubleshooting, ping helps you quickly check if a suspected compromised server is still reachable or if an attacker has disabled it.
Tracert (on Windows) or traceroute (on Linux and macOS) maps the route data takes from your computer to a destination. It lists every router (also called a hop) along the way. This is useful when you suspect an attacker has rerouted traffic through a malicious device, or when you need to find where a connection slows down or drops. For example, if a ping to your database server fails, tracert can show you that the traffic stops at a particular router – perhaps that router is misconfigured or under attack.
Event Viewer is a Windows tool that collects and displays logs – records of system, security, and application events. Security logs specifically record authentication attempts, permission changes, and other security-relevant actions. When you suspect a breach, you check Event Viewer for events like failed logins (Event ID 4625), successful logins outside business hours, or changes to user accounts (Event ID 4720). Event Viewer does not actively stop attacks; it gives you the historical record so you can reconstruct what happened.
These tools are rarely used in isolation. A typical troubleshooting workflow follows a logical sequence:
Identify the symptom: a user cannot access a file server, or an alert says a server is behaving oddly.
Isolate the scope: is it one user, one application, or the whole server? Ping the server to confirm it is reachable.
Trace the path: use tracert to see if the traffic takes an unusual route or stops at an unexpected device.
Check the logs: open Event Viewer and filter security logs for relevant time windows. Look for Event IDs that indicate unauthorised access attempts or privilege escalations.
Correlate findings: if ping fails and tracert shows a break at the firewall, the issue is likely a firewall rule. If ping succeeds but logs show multiple failed logins, you have a potential brute-force breach.
Why do you need all three? Imagine you run ping and it works – that tells you the server is alive. But it does not reveal that an attacker is inside the server reading files. Event Viewer would show you the attacker's logins. Tracert would show if the attacker came through a legitimate VPN or a suspicious external IP. No single tool gives the full picture. Combining them is like being a detective using phone records, CCTV footage, and witness statements together.
Other diagnostic tools you might encounter include nslookup (for DNS resolution), netstat (for active connections), and protocol analysers like Wireshark. However, SK0-005 specifically emphasises ping, tracert, and Event Viewer because they are built into most operating systems and require no extra software.
Misconfigurations that lead to security issues include leaving default accounts enabled, weak passwords, open network shares, and excessive permissions on user accounts. Diagnostic tools help you spot these: Event Viewer can show failed login attempts that indicate an attacker trying default credentials; ping can confirm that a formerly isolated management interface is suddenly reachable from the internet. Tracert can reveal that a misconfigured router is forwarding sensitive traffic to an unintended destination.
In short, troubleshooting security issues is a structured process. You start with the broadest tool (ping) to confirm connectivity, narrow down with tracert to find path problems, and finally use Event Viewer for detailed forensic evidence. Mastering these tools in combination is what the SK0-005 exam expects – and what makes a real server technician effective.
1. Identify the Symptom
Start by understanding exactly what is wrong. Is a user unable to access a file? Is a server not responding? Are there alerts from monitoring software? Write down the exact error message or behaviour. This prevents guessing and focuses your investigation.
2. Ping to Test Base Connectivity
Open a command prompt and ping the target server by hostname or IP address. If you get a reply, the server is on the network and the operating system is responding. If ping fails, it could be a network issue, a powered-down server, or a firewall blocking ICMP. Ping is the quickest way to rule out complete loss of connectivity.
3. Use Tracert to Trace the Path
If ping fails or you suspect an unusual route, run tracert to the target. This shows each router hop. Look for timed-out hops (asterisks) that indicate where traffic stops. A break at a specific router suggests that device is down or misconfigured. Tracert helps narrow down the problem location in the network.
4. Examine Event Viewer Logs
Remote into the server (if possible) and open Event Viewer. Check Windows Logs > Security for authentication events around the time of the issue. Filter by Event ID 4625 for failed logons. Look for patterns – many failures from one IP indicate a brute-force attack. Also check System logs for hardware or driver errors that might explain erratic behaviour.
5. Correlate Findings and Identify the Root Cause
Combine the data from all tools. For example, if ping works but Event Viewer shows multiple failed logins from an external IP, the root cause is likely a weak password that allowed a brute-force breach. If ping fails and tracert stops at the firewall, the root cause is a firewall ACL misconfiguration. Document your evidence before fixing.
6. Implement Remediation and Verify
Fix the identified issue – disable compromised accounts, change weak passwords, correct firewall rules, etc. Then repeat steps 2-4 to confirm the fix works. Ping the server again to ensure connectivity, check Event Viewer for new suspicious events, and run tracert to verify the path returns to normal. Record what you did for future reference.
Let us walk through a concrete scenario. You are the only IT person at a mid-sized legal firm with about 50 employees. The firm stores confidential client documents on a Windows file server named LEGALSERVER. One Monday morning, a paralegal calls you: she cannot access her shared folder. You start troubleshooting.
First, you open Command Prompt on your own workstation and ping LEGALSERVER. The ping succeeds – 4 replies in 40ms. So the server is on the network and responding. The problem is not a complete outage. Next, you check if other users have the same issue. You walk around and ask three colleagues – two can access shared folders, one cannot. The issue is isolated to specific users.
Now you suspect a permission misconfiguration or perhaps an account compromise. You remote into LEGALSERVER and open Event Viewer. You navigate to Windows Logs > Security. You filter for Event ID 4625 (failed logon) over the weekend. You find dozens of failed logon attempts for the paralegal’s account from an IP address you do not recognise – 203.0.113.45. This looks like a brute-force attack that eventually succeeded? You check Event ID 4624 (successful logon) and see a success at 3am Sunday from the same IP. That is a confirmed breach.
Now you need to understand how the attacker got in. You use tracert to trace the route from LEGALSERVER to 203.0.113.45. The output shows traffic goes through your main router, then to your ISP's router, then directly to the attacker's IP – no suspicious intermediate hops. That suggests the attack came from the internet, not from inside the office.
You then check the server’s local security policy. You find that the built-in Administrator account was renamed but still had a weak password – 'P@ssw0rd123'. The attacker likely guessed it. This is a classic misconfiguration: the password should have been strong and the account disabled.
Your remediation steps:
Immediately disable the compromised account and force the paralegal to change her password.
Change the Administrator account password to a 20-character random string.
Enable account lockout after 5 failed attempts.
Configure Event Viewer to alert you on Event ID 4625 thresholds.
Ping the server regularly to confirm it stays up; use tracert periodically to ensure no routing anomalies.
In a larger business, you might also deploy a Security Information and Event Management (SIEM) system that collects logs from multiple servers. However, for the SK0-005 exam, the expectation is that you can manually use ping, tracert, and Event Viewer to perform this level of analysis. The real world often involves the same basic tools before escalating to advanced solutions.
Another common scenario: a firewall misconfiguration. A web server behind a firewall suddenly becomes unreachable from the internet. You ping the public IP – no reply. You tracert from the internet to the public IP – the trace stops at the firewall. That tells you the firewall is dropping the traffic. You log into the firewall and find an access control list (ACL) rule that accidentally blocks inbound HTTP. You fix the rule, ping the server again – success. Event Viewer on the firewall (if available) would have shown the dropped packets.
These examples show that diagnostic tools are not just exam topics – they are the daily reality of server administration. Knowing which tool to use first saves hours of guesswork.
SK0-005 tests your ability to select the correct diagnostic tool for a given scenario and to interpret the output. The exam will not ask you to memorise command switches, but you need to understand what each tool does and when to use it.
Question types you will see:
Multiple-choice: 'A server is not responding to network requests. Which command should you use first to verify basic connectivity?' The answer is ping. The trap answer is often tracert, which is more specific and slower to run first.
Scenario-based: 'After a suspected breach, you need to see a list of failed login attempts. Which tool should you use?' Answer: Event Viewer (Security log). The trap is suggesting a network tool like ping when the question is about authentication events.
Output interpretation: They may show you a snippet of tracert output and ask which hop is failing. You need to recognise timeouts or asterisks (* * *) as signs of a broken route.
Troubleshooting sequences: 'What is the correct order to diagnose a server that is unreachable?' The pattern is ping first (broadest), then tracert (if ping fails), then Event Viewer (if you suspect security issues).
Key concepts the exam loves to test:
Event IDs in Security logs. Specifically 4624 (successful logon), 4625 (failed logon), 4634 (logoff), 4720 (user account created), 4728 (user added to security group). You do not need to memorise every ID, but you should recognise the most common ones.
Differences between ping and tracert. Ping uses ICMP Echo Request/Reply. Tracert uses ICMP with increasing Time-To-Live (TTL) values to map the route. Know that tracert can be slower than ping.
The concept of a 'hop' in tracert – each router in the path is one hop.
Log locations: Security logs under Windows Logs in Event Viewer. Application logs for software errors. System logs for driver and hardware events.
Common exam traps:
They ask 'Which tool reveals the path an attacker used?' Many candidates answer ping because it is familiar, but ping only tells you if the target is reachable – not the path. Tracert shows the path.
They describe a symptom like 'Users report slow access to a file server' and ask which tool to use. Beginners often pick Event Viewer, but the first step is to test network latency with ping -t (continuous ping) to see if packet loss or high latency exists. Event Viewer comes after you confirm the network is stable.
They might present a scenario where a single user cannot access a server while others can. The right answer is to check permissions or the user account in Event Viewer rather than running tracert.
Misconfigurations: They love to test default accounts and weak passwords. Know that disabling default accounts and using strong passwords are basic security measures that prevent many breaches.
To prepare, practise running ping, tracert, and Event Viewer on a real or virtual Windows machine. Look at the security logs after a failed login – you will see Event ID 4625. Run tracert to google.com and note the hops. Understand the output format: each line shows hop number, IP address, and response time (in ms). If you see 'Request timed out' for a hop, that router is not responding to ICMP, which is common (firewalls block ICMP). But if the trace completely stops after a hop, that indicates a network break.
Memorise the basic workflow: symptom -> ping -> tracert (if needed) -> Event Viewer -> correlate -> fix. That pattern is the skeleton of many exam questions.
Ping tests basic network connectivity but does not reveal security breaches or misconfigurations.
Tracert maps the network path from source to destination, helping to identify routing anomalies that may indicate a man-in-the-middle attack.
Event Viewer security logs record authentication events (Event IDs 4624, 4625, 4720) and are the first place to look after a suspected breach.
Always start troubleshooting with the simplest, broadest tool (ping) before moving to more specific tools (tracert, Event Viewer).
A misconfiguration (like weak passwords or open ports) is the most common root cause of server security incidents – not sophisticated malware.
No single diagnostic tool gives a complete picture; combining ping, tracert, and Event Viewer is essential for accurate troubleshooting.
Event Viewer logs are only as good as the auditing policies you configure – always verify that security auditing is enabled for critical events.
An attacker who bypasses the firewall will still leave traces in Event Viewer if auditing is on – logs are your best forensic evidence.
These come up on the exam all the time. Here's how to tell them apart.
Ping
Tests basic network connectivity by sending ICMP echo requests
Returns only whether the target is reachable and round-trip time
Fast and lightweight; suitable as a first diagnostic step
Tracert
Maps the entire route through each router hop using TTL
Returns a list of IP addresses with response times per hop
Slower because it probes each hop individually; used when ping fails or you need path details
Event Viewer (Security Log)
Records authentication events: logons, logoffs, account changes
Key Event IDs: 4624 (success), 4625 (failure), 4720 (user creation)
Used primarily for security incident investigation and auditing
Event Viewer (System Log)
Records system-level events: driver failures, hardware errors, service crashes
Key Event IDs: 1000 (application error), 41 (unexpected shutdown), 7036 (service state change)
Used primarily for diagnosing hardware or operating system problems
Security Breach
Unauthorised access achieved by an attacker through exploitation
Evidence includes failed logins followed by success, new accounts, or data theft
Requires containment, forensic analysis, and system restoration
Security Misconfiguration
A setup error that creates a vulnerability (e.g., default password, open port)
No active intrusion yet, but the potential for one exists
Requires configuration change (e.g., disable account, close port, enforce policy)
ICMP
Used by ping and tracert; no port numbers, no handshake
Connectionless – just send and expect a reply
Often blocked by firewalls for security reasons
TCP
Used by most application protocols (HTTP, SSH, FTP); requires a three-way handshake
Connection-oriented – guarantees delivery and ordering
Rarely fully blocked because it carries essential traffic; ports can be selectively filtered
Mistake
Ping is the only tool you need to check if a server is secure.
Correct
Ping only tests network connectivity; it tells you nothing about security. A server can respond to ping while being fully compromised.
Ping is simple and quick, so beginners over-rely on it. They do not realise that security requires examining logs and configurations, not just connectivity.
Mistake
Event Viewer shows every security event that happens on a server.
Correct
Event Viewer only shows events that auditing policies are configured to record. Many security incidents go unlogged if auditing is disabled or misconfigured.
Beginners assume logging is always enabled. In reality, many servers have minimal auditing by default due to performance concerns, so the log may have gaps.
Mistake
Tracert can identify the exact location (physical address) of an attacker.
Correct
Tracert shows IP addresses of routers along a path, but IP addresses rarely reveal physical location precisely. Attackers often use proxies or VPNs to hide their true IP.
Movies and TV shows make network tracing look like a GPS. Beginners expect tracert to be a tracking tool, but it is a routing diagnostic tool, not a geolocation service.
Mistake
If a ping reply returns quickly, the server is not under attack.
Correct
Ping response time does not indicate security health. An attacker can be actively exfiltrating data while ping responses remain fast.
People confuse performance with security. A server can be both fast and compromised. The two are independent, especially with modern stealthy malware.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
This often means your local router is configured to block ICMP traceroute requests while allowing ping. Tracert uses a different TTL mechanism that some routers treat differently. Try using ‘tracert -d’ to skip DNS resolution, or check your router’s security settings.
Open Event Viewer, expand Windows Logs, right-click on Security, and select ‘Filter Current Log’. In the filter dialog, enter 4625 (or a comma-separated list) in the Event IDs field. Click OK. Now only failed logon events will appear.
No. Tracert shows IP addresses of routers along the network path, but IP addresses are not tied to physical locations. Attackers often use VPNs, proxies, or compromised servers, so the IP you see may be a middle hop, not the attacker’s home address.
Ping sends a single packet and waits for a reply to test if a host is reachable. Tracert sends a series of packets with increasing TTL values to map every router hop along the path. Ping tells you if a host is alive; tracert tells you the route traffic takes to reach it.
It means security auditing is not enabled or the log was cleared. By default, Windows records many security events, but a group policy or administrative change may have turned off auditing. Check ‘Local Security Policy’ > ‘Advanced Audit Policy’ to enable auditing for logon events.
Yes, the exam expects you to recognise the most common ones: 4624 (successful logon), 4625 (failed logon), 4720 (user created), and 4648 (logon using explicit credentials). You do not need to memorise every ID, but these appear frequently in scenario questions.
You've finished Troubleshooting Security Issues and Using Diagnostic Tools. Continue through the SK0-005 study guide to build a complete picture of the exam.
Done with this chapter?