SK0-005 Practice Question: A server administrator is troubleshooting a server that unexpectedly rebooted overnight

A server administrator is troubleshooting a server that unexpectedly rebooted overnight. The administrator reviews the system logs and finds Event ID 6008 in the Windows System log, indicating an unexpected shutdown. There are no corresponding events for a thermal trip or power failure. Which of the following should the administrator check FIRST to determine the cause?

⚠ Common exam trap

The trap here is assuming that an unexpected shutdown is always software-related and diving into OS logs, when hardware logs often hold the answer.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Check the server's out-of-band management controller logs for power or hardware events.

Event ID 6008 indicates an unexpected shutdown, which often stems from hardware or power issues. The out-of-band management controller logs are the best source for hardware-level events like power supply failures or thermal trips that are not visible to the OS. Reviewing these logs first can quickly identify or rule out hardware causes before moving to OS-level diagnostics.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Review the Windows Update history to see if a patch was installed that required a reboot.
Why it's wrong here
Restarts after Windows Update are planned: Windows logs them as a normal shutdown initiated by a process, Event ID 1074, not as an unexpected shutdown, Event ID 6008. Checking update history is reasonable when investigating planned restarts, but this event means the system stopped without shutting down cleanly, so hardware or power records are the more useful first source.
✓
Check the server's out-of-band management controller logs for power or hardware events.
Why this is correct
Because the operating system was not running cleanly when the server went down, its own logs may say nothing about the cause. The out-of-band management controller, such as iDRAC, iLO, XClarity or another BMC, runs independently of the OS and records power supply failures, voltage and temperature events, memory errors and watchdog resets. Checking its log is quick and often explains the reboot immediately.
✗
Run a memory diagnostic to check for faulty RAM.
Why it's wrong here
A memory diagnostic is a reasonable follow-up if the logs point to memory, but it requires downtime and takes time, and memory faults usually leave traces such as bug check events with memory dumps, or corrected and uncorrectable memory errors in the management controller's log. Checking those logs first is quicker and tells you whether memory testing is needed at all.
✗
Verify that the UPS is functioning correctly and has enough battery capacity.
Why it's wrong here
The UPS is worth checking if the logs suggest a power event, but the scenario says there are no power failure events, and the management controller would record power loss to the server as well. Checking the server's own hardware log first is quicker and more direct; the UPS logs are a secondary source if the controller shows the server lost input power.

Go deeper

SK0-005 Practice Question: A server administrator is troubleshooting a server that unexpectedly rebooted overnight

Why each option matters

Option-by-option breakdown

Related to this question

Similar SK0-005 questions