Courseiva

CompTIA Server+ SK0-005 (SK0-005) — Questions 1–75

414 questions total · 6 pages · All types, answers revealed

Take a mock examExam hub

Page 1 of 6

Page 2
1
MCQeasy

A server administrator notices that a recently installed PCIe network card is not being recognized by the operating system. The server is running Windows Server 2019. The administrator has verified that the card is securely seated and that the slot is enabled in the BIOS. Which of the following should the administrator try FIRST to resolve the issue?

A.Check the Hardware Compatibility List (HCL) for Windows Server 2019.
B.Replace the network card with a known-good card.
C.Reseat the network card in a different PCIe slot.
D.Update the server BIOS to the latest version.
AnswerA

Ensuring the hardware is on the HCL verifies driver support, which is the most logical first step before further hardware or software changes.

Why this answer

Option B is correct because the first step when a newly installed device is not recognized should be to verify hardware compatibility with the operating system (checking the Hardware Compatibility List). This ensures the device has supported drivers. Options A and C are physical steps that have already been considered (secure seating, slot enabled), and D (updating BIOS) is a later step after confirming compatibility.

Full explanation →
2
MCQeasy

A technician is installing a new server in a rack. The server's rail kit includes both a static rail and a sliding rail option. The server will be frequently accessed for maintenance, and the technician needs to pull it out of the rack to service internal components. Which of the following rail types should the technician use?

A.Static rails
B.Cable management arm
C.Sliding rails
D.Tool-less rails
AnswerC

Sliding rails allow the server to be pulled out of the rack like a drawer, providing easy access to internal components for maintenance. This is ideal for servers that require frequent servicing. Static rails do not allow the server to slide out, making access more difficult. Therefore, sliding rails are the correct choice for this scenario.

Why this answer

Sliding rails are designed to allow the server to be extended out of the rack for easy access to internal components. This is essential when frequent maintenance is required. Static rails would require complete removal of the server, which is impractical.

Tool-less rails and cable management arms serve different purposes and do not provide the sliding capability needed.

Exam trap

The trap here is confusing tool-less rails with sliding rails; tool-less refers to installation ease, not the ability to slide the server out.

Full explanation →
3
MCQmedium

An administrator needs to configure a critical web service on a Linux server to automatically restart if it crashes unexpectedly. The server uses systemd. Which of the following best accomplishes this goal?

A.Set the service to run under inetd so it starts on demand
B.Write a cron job to check the service status every minute and start it if stopped
C.Configure the service's systemd unit file with Restart=always
D.Create an init.d script that loops and re-executes the service if it exits
AnswerC

Restart=always tells systemd to restart the service whenever it stops, which is the proper and most reliable way to ensure automatic recovery.

Why this answer

Option C is correct because setting Restart=always in the systemd unit file ensures the service restarts regardless of exit code, which is the proper systemd method. Option A is wrong because a cron job introduces a potential delay and is less reliable than built-in service supervision. Option B is wrong because an init.d script with a loop is an outdated approach and not recommended with systemd.

Option D is wrong because inetd starts services on demand, not for persistent daemons.

Full explanation →
4
MCQhard

A server administrator is replacing a failed hot-swap SAS drive in a RAID 5 array. The drive bay is labeled with the failed drive's slot number, and the array is currently degraded. The administrator pulls the drive but realizes the replacement drive is a 4TB SAS drive while the failed unit was 2TB, and the remaining drives in the array are 2TB. The controller supports online capacity expansion but the array is not configured for it. Which of the following should the administrator do?

A.Insert the 4TB drive and then run an offline capacity expansion to grow the array
B.Insert the 4TB drive and let the controller rebuild the array at 4TB capacity
C.Insert a 2TB SAS drive matching the existing members and allow the array to rebuild
D.Replace all remaining 2TB drives with 4TB drives simultaneously to match the new drive
AnswerC

RAID 5 requires all member drives to contribute equal capacity, so a matching 2TB SAS drive rebuilds the array correctly and restores redundancy. The controller will reconstruct the missing data from parity on the surviving drives. Using an equal-or-larger drive is acceptable, but a matching drive avoids unused capacity and any expansion steps, making it the cleanest resolution for a degraded array.

Why this answer

In a RAID 5 array every member drive contributes the same amount of usable capacity, and the array size is bounded by the smallest drive. A matching 2TB SAS replacement rebuilds the missing data from parity and restores redundancy without unused space or unsupported expansion steps. Larger drives can be used, but only if capacity expansion is configured and performed after the rebuild completes.

Exam trap

The trap here is believing a larger replacement drive automatically increases array capacity, when RAID 5 capacity is set by the smallest member.

Full explanation →
5
MCQmedium

A server administrator is troubleshooting a Linux server that is experiencing slow disk performance. The administrator runs `iostat -x 1` and sees that the `%util` value for `/dev/sda` is consistently above 98%, while the `await` for write requests is over 500 ms. The server hosts a database that performs many small random writes. Which of the following is the MOST likely cause?

A.The disk is failing and needs to be replaced immediately.
B.The filesystem is corrupted, causing the kernel to repeatedly attempt repairs.
C.The server's RAM is insufficient, causing excessive swapping to disk.
D.The disk is experiencing a high number of I/O operations, and the storage subsystem cannot keep up with the demand.
AnswerD

The `%util` metric indicates the percentage of time the device spent servicing I/O requests. A value consistently near 100% means the disk is saturated, and high `await` (average time per request) confirms that requests are queuing. This matches the symptom of slow performance under a random-write workload that exceeds the disk's IOPS capability.

Why this answer

The `iostat` output shows the disk is saturated (`%util` near 100%) and requests are waiting (`await` over 500 ms). For a database with many small random writes, this indicates the storage cannot deliver the required IOPS. The correct answer identifies the disk as the bottleneck due to excessive I/O demand.

Exam trap

The trap here is assuming that high `await` always means a failing disk, when it can simply indicate a saturated but healthy disk under heavy load.

Full explanation →
6
MCQmedium

A company runs a critical application on a physical server with four 15,000 RPM SAS drives in a hardware RAID 5 array. Users report that write performance has degraded significantly during peak hours. Performance monitoring shows high disk queue length. The administrator wants to improve write performance without sacrificing redundancy or adding more drives. Which of the following should the administrator implement?

A.Change the RAID level to RAID 0 to eliminate parity overhead.
B.Increase the RAID stripe size to 256 KB.
C.Enable disk defragmentation on the server's data volume.
D.Configure the RAID controller to use write-back caching with a battery-backed cache module.
AnswerD

Write-back caching with a battery-backed module allows the controller to acknowledge writes immediately after they are cached, significantly improving write performance. The battery protects cached data during power loss, maintaining redundancy. This directly addresses high disk queue length without adding drives or changing RAID level, and preserves fault tolerance.

Why this answer

RAID 5 suffers from a write penalty because each write requires reading old data and parity, calculating new parity, and writing both. Write-back caching with a battery-backed module allows the controller to buffer writes and acknowledge them quickly, dramatically improving write throughput while preserving redundancy. The battery ensures data is not lost if power fails before the cache is flushed to disk.

Exam trap

The trap here is assuming that RAID 0 or larger stripe sizes will fix write performance without considering the need for redundancy, or that defragmentation addresses write bottlenecks.

Full explanation →
7
MCQmedium

A company is implementing a disaster recovery plan and needs to determine the maximum acceptable amount of data loss measured in time. The business can tolerate losing up to 4 hours of transactions. Which metric should the administrator use to define this requirement?

A.Recovery Point Objective (RPO)
B.Recovery Time Objective (RTO)
C.Mean Time Between Failures (MTBF)
D.Mean Time To Repair (MTTR)
AnswerA

RPO defines the maximum acceptable amount of data loss measured in time. It indicates how far back in time a recovery must go, effectively determining backup frequency. A 4-hour RPO means backups or replication must occur at least every 4 hours to meet the business requirement.

Why this answer

The Recovery Point Objective (RPO) specifically quantifies the maximum tolerable data loss in terms of time. By stating that up to 4 hours of transactions can be lost, the business is defining an RPO of 4 hours. This metric directly drives backup frequency and replication intervals to ensure that no more than 4 hours of data is ever at risk.

Exam trap

The trap here is confusing RPO with RTO; RPO is about data loss (how much data you can afford to lose), while RTO is about downtime (how long you can afford to be offline).

Full explanation →
8
MCQmedium

A technician needs to install a PCIe 4.0 x16 network adapter into a server that has a single physical CPU. The server has three PCIe 4.0 x16 slots: slot 1 is connected directly to the CPU, slots 2 and 3 are connected through the chipset. The adapter requires maximum bandwidth and low latency. Which slot should the technician use?

A.Any of the three slots will provide identical performance.
B.Slot 1
C.Slot 3
D.Slot 2
AnswerB

Slot 1 is directly attached to the CPU, providing the lowest latency and full bandwidth without chipset arbitration. For a high-performance PCIe 4.0 x16 adapter that requires maximum throughput and minimal delay, the CPU-attached slot is optimal. Using a chipset-attached slot would introduce additional latency and potential bandwidth sharing with other chipset devices, which could degrade performance.

Why this answer

The CPU-attached PCIe slot provides the most direct path to memory and the processor, minimizing latency and maximizing available bandwidth. Chipset-attached slots route traffic through the chipset, which can add latency and may share bandwidth with other devices. For a high-performance network adapter that requires maximum throughput and low latency, the CPU-attached slot is the correct choice.

Exam trap

The trap here is assuming that all PCIe x16 slots perform identically because they have the same physical size, ignoring the electrical lane routing differences between CPU-attached and chipset-attached slots.

Full explanation →
9
MCQhard

A server administrator is configuring a Linux server that runs a custom application. The application must start automatically at boot and be restarted if it crashes. The administrator creates a systemd service unit file. After enabling the service, it fails to start, and journalctl shows 'status=203/EXEC'. What is the most likely cause?

A.The ExecStart path points to a non-existent or non-executable file.
B.SELinux is blocking the service from accessing its log file.
C.The service unit file has the wrong permissions.
D.The service is missing a [Install] section in the unit file.
AnswerA

Status 203/EXEC means systemd could not execute the binary specified in ExecStart. This occurs if the path is wrong, the file lacks execute permissions, or the interpreter is missing. The administrator should verify the path and permissions of the executable. This is the most common cause of this specific error.

Why this answer

The 203/EXEC status code indicates that systemd failed to execute the command specified in ExecStart. This is typically due to an incorrect path, missing execute permission, or a missing interpreter. The administrator should check that the file exists, is executable, and has a proper shebang if it is a script.

Other options do not produce this exact error.

Exam trap

The trap here is confusing a service startup failure with a configuration error like missing [Install], when the specific error code points directly to an execution problem.

Full explanation →
10
MCQmedium

A technician is adding a second CPU to a dual-socket 2U server that previously ran with a single processor. After installing the matching CPU and heatsink, the server POSTs but the operating system only reports half of the newly installed memory, and the BIOS memory map shows several DIMM slots as unpopulated. Which of the following is the MOST likely cause?

A.The DIMMs installed on the second CPU's memory channels are not seated or are in the wrong slots.
B.The second CPU requires a BIOS firmware update before memory can be enabled.
C.The new CPU is not on the server's hardware compatibility list.
D.The memory controller interleave setting was disabled in the BIOS.
AnswerA

Each socket owns a distinct set of memory channels and slots. When a CPU is added, the DIMMs must be populated in the slots assigned to that socket following the vendor population order. DIMMs left in the first CPU's slots or seated poorly cause the BIOS to mark those channels as unpopulated, so the OS sees only half the memory even though POST succeeds.

Why this answer

Adding a processor activates a second set of memory channels, each with its own required slot population order. If the DIMMs are not moved into the slots owned by the new socket, those channels train as unpopulated and the OS sees only the memory attached to the original CPU. Verifying the server's population table and reseating DIMMs in the correct slots resolves the missing capacity.

Exam trap

The trap here is assuming a POST-successful CPU upgrade automatically activates all installed memory, when memory is actually partitioned per socket and must be populated in that socket's designated slots.

Full explanation →
11
MCQmedium

A server administrator is replacing a failed hot-swap SAS hard drive in a production server that uses a hardware RAID controller. The drive is part of a RAID 5 array. After physically swapping the drive, the administrator notices the drive activity LED is blinking green but the array status still shows 'degraded' in the management software. Which of the following is the MOST likely cause?

A.The drive was inserted into the wrong bay, so the controller cannot map it to the array.
B.The RAID 5 array requires a manual rebuild command to be issued from the controller BIOS.
C.The RAID controller is performing a rebuild but the management software has not yet updated the status.
D.The replacement drive is not a certified spare and must be manually added to the array.
AnswerC

When a hot-swap drive is inserted into a RAID 5 array, the controller often automatically starts a rebuild. The blinking green LED indicates drive activity, which is consistent with an ongoing rebuild. The management software may not immediately reflect the new status due to polling intervals or cache delays. The array will show 'degraded' until the rebuild completes and the status updates.

Why this answer

The blinking green LED indicates the drive is active, which is consistent with an automatic rebuild in progress. RAID controllers often start rebuilding immediately upon insertion of a replacement drive, but the management software may lag in updating the array status. The array remains 'degraded' until the rebuild completes, so the administrator should monitor the rebuild progress rather than assuming a failure.

Exam trap

The trap here is assuming that a blinking LED means the drive is faulty or not recognized, when it actually indicates normal rebuild activity.

Full explanation →
12
MCQhard

A database server running on a Linux VM has started experiencing periodic crashes. The VM is hosted on an ESXi hypervisor. The system logs show entries: 'kernel: Out of memory: Kill process 12345 (mysqld) score 700 or sacrifice child'. The VM has 16GB RAM allocated and no memory overcommitment on the host. The DBA reports that the database workload hasn't increased. Which of the following actions should be taken FIRST to diagnose the issue?

A.Add a memory reservation for the VM in ESXi.
B.Check the host's memory utilization for ballooning or swapping.
C.Analyze the database query cache hit ratio and slow query logs.
D.Increase the VM's RAM allocation to 32GB.
AnswerB

Host memory pressure can force balloon driver activity or swapping, causing the VM to see less available RAM and triggering OOM. This is the correct first diagnostic step.

Why this answer

Option C is correct because the OOM killer being invoked in a VM with stable workload suggests possible host-level memory constraints (e.g., ballooning, swapping) affecting the VM. Checking the host's memory utilization helps confirm whether the hypervisor is under memory pressure and causing the VM to think it's out of memory. Options A and D are configuration changes that might alleviate symptoms but don't diagnose root cause.

B addresses database tuning, which is not indicated when the system reports OOM.

Full explanation →
13
MCQmedium

A systems administrator is configuring a new server that will host a mission-critical database. The server has two redundant power supplies. The organization's data center has two separate power circuits, each backed by a different UPS. Which of the following power configurations provides the BEST redundancy?

A.Connect each power supply to a different power circuit.
B.Connect both power supplies to a single, high-capacity UPS.
C.Use a single power supply and keep the second as a cold spare.
D.Connect both power supplies to the same circuit to balance load.
AnswerA

This is the best practice for power redundancy. It ensures that the server remains powered even if one entire circuit or UPS fails.

Why this answer

Connecting each power supply to a different power circuit ensures that if one circuit or UPS fails, the server continues to receive power from the other source. Option B is correct because it eliminates single points of failure in the power path. Option A is incorrect because connecting both to the same circuit creates a single point of failure; a circuit trip would take down the server.

Option C is incorrect because using a single live PSU with a cold spare does not provide automatic failover and would cause downtime if the active PSU fails. Option D is incorrect because a single high-capacity UPS is still a single point of failure, and does not protect against UPS failure or circuit issues.

Full explanation →
14
MCQmedium

A Linux server administrator notices that the /var partition is 95% full. To free space quickly, the administrator decides to delete old log files. Which of the following commands should the administrator use to find and delete log files older than 30 days in the /var/log directory?

A.rm /var/log/*.log -30
B.ls -l /var/log/*.log | grep "30" | rm
C.grep -R "30 days" /var/log | xargs rm
D.find /var/log -name "*.log" -mtime +30 -exec rm {} \\;
AnswerD

This command correctly identifies and removes log files older than 30 days without exceeding command-line limits.

Why this answer

Option A is correct. The `find` command with `-mtime +30` locates files modified more than 30 days ago, and `-exec rm {} \;` safely deletes each file. Option B is syntactically invalid.

Option C incorrectly pipes `ls` output through `grep` and then to `rm`, which does not accept piped input. Option D searches file contents for the text '30 days' rather than file age.

Full explanation →
15
MCQmedium

A server administrator is troubleshooting a Linux server that boots normally but takes over 20 minutes to reach a login prompt, while CPU, memory, and disk utilization remain low after boot. Running systemd-analyze blame shows a single unit consuming 18 minutes. Which of the following commands will BEST identify what that unit is waiting on?

A.systemctl status <unit-name> and journalctl -u <unit-name> -b
B.systemd-analyze critical-chain and systemd-analyze plot > boot.svg
C.iostat -x 5 3 and vmstat 1 10
D.dmesg | grep -i error and check /var/log/messages
AnswerA

Querying the unit's current state with systemctl status and reviewing its boot-time journal entries with journalctl -u <unit-name> -b reveals the dependency or timeout that consumed 18 minutes, such as a failed network mount or a service waiting on a device that never appears. This directly targets the slow unit identified by systemd-analyze blame rather than guessing at hardware.

Why this answer

Because systemd-analyze blame already isolated one unit consuming 18 minutes, the next diagnostic step is to inspect that unit directly. systemctl status reveals its state and dependencies, while journalctl -u <unit-name> -b shows the boot-session messages explaining the delay, such as a network mount timeout. Resource-monitoring and general log tools do not attribute boot latency to a specific unit.

Exam trap

The trap here is assuming a slow boot must be a hardware or resource bottleneck and jumping to iostat or vmstat instead of interrogating the specific unit systemd already flagged.

Full explanation →
16
MCQhard

An organization uses a cloud-based backup solution with immutable storage to protect against ransomware. However, after a recent attack, an attacker with stolen administrator credentials was able to delete the backup data. Which of the following BEST explains why the backups were deleted?

A.The backup solution did not support versioning.
B.The immutable storage policy was not configured correctly or had a retention lock that was not enabled.
C.The attacker used ransomware to encrypt the backup data at the source before it was sent.
D.The backup data was stored in a different geographic region than production.
AnswerB

Without a properly configured retention lock, even immutable storage may allow administrative deletions, defeating the purpose.

Why this answer

Option A is correct because true immutable storage prevents any deletion or modification, even by administrators, for a specified retention period. The fact that an admin could delete it indicates the immutability feature was misconfigured or not properly locked. Option B describes encryption at the source, but that would not allow deletion of existing backups.

Option C is irrelevant to deletion. Option D: versioning helps but does not prevent deletion if immutability is not configured.

Full explanation →
17
MCQmedium

A system administrator manages a collection of Linux web servers that store custom application configurations in /etc/app/config. The configuration changes frequently, and the admin needs to implement an automated daily backup solution that captures the directory at 1 AM, compresses it with gzip, and retains the last 5 days of backups on a central NFS-mounted backup volume /mnt/backups. The solution should be simple and use standard tools. Which approach best meets these requirements?

A.Create a cron job that runs `tar -czf /mnt/backups/config-$(date +%Y%m%d).tar.gz /etc/app/config` at 1 AM, and another cron job at 2 AM that runs `find /mnt/backups -name "config-*.tar.gz" -mtime +5 -delete`.
B.Use Windows Server Backup scheduled to back up the Linux server's directory via SMB share.
C.Create a cron job that runs `rsync -avz /etc/app/config /mnt/backups/` at 1 AM, with a separate cron job to delete old rsync snapshots using `find /mnt/backups -type d -mtime +5 -exec rm -rf {} \;`.
D.Write a shell script that uses `zip -r /mnt/backups/config.zip /etc/app/config`, schedule it via cron at 1 AM, and rely on the NFS server's built-in snapshot feature for retention.
AnswerA

This solution correctly creates a compressed, date-stamped archive and removes archives older than 5 days, meeting all specified requirements simply.

Why this answer

Option B is correct because it uses tar with gzip compression and a dated filename to create daily compressed archives, and a separate cron job using find to delete files older than 5 days, fulfilling all requirements simply. Option A uses rsync which does not create a single compressed archive file and the retention method using find on directories is less suitable for daily snapshot rotation. Option C uses zip which does not easily support date-stamped filenames and relies on external NFS snapshots, which is not a self-contained solution.

Option D uses Windows Server Backup on Linux, which is unsupported and inappropriate.

Full explanation →
18
MCQmedium

A security administrator at a financial services firm is implementing a defense-in-depth strategy for a new Windows Server 2022 file server that will host sensitive client data. The administrator needs to ensure that data at rest on the server's hard drives is protected in a way that does not require users to enter separate credentials and does not rely on the operating system's file permissions. Which technology should the administrator implement?

A.Storage Spaces with thin provisioning
B.Encrypting File System (EFS) on all user data folders
C.BitLocker Drive Encryption with TPM protector
D.NTFS permissions with inheritance enabled
AnswerC

BitLocker with a TPM protector encrypts the entire volume and automatically unlocks the drive during boot using the TPM, requiring no user interaction. This protects data at rest even if the physical drive is stolen, and it operates independently of NTFS permissions, satisfying the requirement for transparent, OS-independent protection.

Why this answer

BitLocker with a TPM protector provides full-disk encryption that is transparent to users and independent of file system permissions. The TPM stores the encryption key and releases it only during a verified boot process, so no separate credentials are needed. This directly addresses the need to protect data at rest on the server's drives without relying on NTFS.

Exam trap

The trap here is assuming that NTFS permissions or EFS alone can protect data at rest when the physical drive is removed from the server.

Full explanation →
19
MCQmedium

A server administrator is troubleshooting a server that is experiencing unexpected shutdowns. The administrator reviews the system logs and finds Event ID 6008 in the Windows System log, indicating an unexpected shutdown. The server has a redundant power supply configuration, and both power supplies are connected to different PDUs. The administrator checks the PDUs and finds no power outages. Which of the following is the MOST likely cause of the unexpected shutdowns?

A.The PDUs are not providing enough power to the server, causing brownouts.
B.The server's power supplies are not properly seated or are failing intermittently.
C.The server's BIOS is configured to shut down when a redundant power supply fails.
D.The server's operating system is missing a critical update, causing random reboots.
AnswerB

Event ID 6008 indicates an unexpected shutdown, which often points to a hardware issue such as a faulty power supply. Even with redundant power supplies, if one is failing intermittently or not properly seated, it can cause the server to lose power if the other supply cannot handle the full load or if there is a brief interruption. Checking the power supply status LEDs and reseating them is a good first step. The lack of PDU outages suggests the issue is within the server's power subsystem.

Why this answer

Event ID 6008 indicates an unexpected shutdown, which is often caused by a power loss. Even with redundant power supplies, if one supply is failing intermittently or not properly connected, the server may shut down if the remaining supply cannot handle the load or if there is a brief power interruption. Checking the power supply status and reseating them is a logical step.

The lack of PDU outages rules out external power issues.

Exam trap

The trap here is assuming that redundant power supplies eliminate all power-related shutdowns, when in fact a faulty supply or a loose connection can still cause an unexpected shutdown.

Full explanation →
20
MCQmedium

A server administrator is configuring RAID for a new file server that will store large media files. The server has six 4TB SAS drives and a hardware RAID controller with 1GB cache and battery backup. The administrator needs a RAID level that provides fault tolerance for up to two drive failures and maximizes usable capacity. Which of the following should the administrator choose?

A.RAID 5
B.RAID 10
C.RAID 6
D.RAID 0
AnswerC

RAID 6 uses double parity, allowing the array to survive two simultaneous drive failures. With six 4TB drives, usable capacity is 16TB (4 drives worth of data), which is higher than RAID 10. It balances fault tolerance and capacity, making it suitable for large media storage where capacity and reliability are important.

Why this answer

RAID 6 is the correct choice because it provides double parity, allowing the array to continue operating after two drive failures. It also offers better usable capacity than RAID 10 with the same number of drives. RAID 5 only tolerates one failure, and RAID 0 offers no redundancy, so neither meets the requirement.

Exam trap

The trap here is assuming RAID 10 can survive any two drive failures, when it can only survive one failure per mirrored pair, and it reduces usable capacity.

Full explanation →
21
MCQhard

A server administrator is installing a new internal tape drive into a server that will be used for backups. The server has an available parallel SCSI (SPI) interface on the motherboard. The administrator connects the tape drive to the SCSI bus but forgets to install a terminator on the last device. Which of the following is the MOST likely result?

A.The tape drive will operate at reduced speed but without errors.
B.The tape drive will not be detected by the operating system.
C.The SCSI bus will experience signal reflection and data corruption.
D.The server will fail to POST.
AnswerC

Proper termination absorbs signal reflections at the ends of the SCSI bus. Without a terminator, signals reflect, causing data corruption, parity errors, and unreliable operation. This is a classic symptom of missing termination on a parallel SCSI bus.

Why this answer

Missing termination on a parallel SCSI bus causes signal reflection, leading to data corruption and errors. Termination is required at both ends of the bus to maintain signal integrity. The tape drive may be detected but will likely experience intermittent failures during backups.

Exam trap

The trap here is assuming that missing termination only affects the new device or prevents boot, when it actually corrupts the entire SCSI bus's signals.

Full explanation →
22
MCQhard

A Linux server administrator notices that a server's root filesystem is running out of space. The administrator runs 'df -h' and sees that / is 100% full, but 'du -sh /*' shows that the total size of all directories is only 20 GB, while the filesystem is 100 GB. Which of the following is the MOST likely cause?

A.The root filesystem is actually a logical volume that is not properly resized.
B.There are many small files that du is not counting due to a bug.
C.A large file has been deleted but is still held open by a running process.
D.The filesystem has suffered corruption, causing df to report incorrect usage.
AnswerC

When a file is deleted while still open by a process, the disk space is not reclaimed until the process closes the file. The file no longer appears in directory listings, so du does not count it, but df still reports the blocks as used. This perfectly explains the discrepancy between df and du.

Why this answer

The discrepancy between df and du is typically caused by deleted files that are still held open by running processes. These files no longer have directory entries, so du does not see them, but the kernel keeps the blocks allocated until the file descriptors are closed. The administrator can identify such files using lsof +L1 or by checking /proc/*/fd.

Exam trap

The trap here is assuming filesystem corruption or du bugs when the classic symptom of deleted-but-open files is present.

Full explanation →
23
MCQmedium

A company's datacenter is in a region prone to flooding. Management requires that a copy of nightly backups be stored where a regional flood cannot destroy both the production data and the backup copy, and that the copy be retrievable within 24 hours. Which strategy BEST meets these requirements?

A.Increase the RAID level on the production servers from RAID 5 to RAID 6.
B.Ship encrypted backup copies to an offsite vault in a different geographic region.
C.Replicate the backups to a tape library in a hardened rack in the same datacenter.
D.Configure an on-site disk-to-disk backup target and enable snapshots every four hours.
AnswerB

Storing encrypted copies at an offsite vault in another region ensures that a flood affecting the primary datacenter cannot destroy the backup media, and vault retrieval can be completed within the 24-hour window management requires. Encryption protects confidentiality while the media is in transit and at the vault.

Why this answer

The requirement is geographic separation of a backup copy so that a single regional flood cannot destroy production data and its backup, plus retrieval within 24 hours. Offsite vaulting in a different region satisfies both the survivability and recovery-time requirements, and encryption keeps the media safe while it is outside the organization's control.

Exam trap

The trap here is assuming that any redundant copy, such as RAID or a local disk target, counts as an offsite backup when it actually shares the same failure domain.

Full explanation →
24
MCQhard

A research institute stores regulated genomic data on a Windows Server 2022 file server. The IT director wants data at rest encrypted so that a stolen drive cannot be read, but the lab's instrument control software writes directly to the volume and cannot tolerate any interruption during long sequencing runs. The server has a TPM 2.0 module and a separate recovery appliance. Which solution should the administrator implement?

A.BitLocker with XTS-AES 256-bit encryption on the data volume, TPM protector plus a numerical password protector, and recovery keys escrowed to Active Directory.
B.Encrypting File System (EFS) applied to the top-level folder with a data recovery agent configured for the lab group.
C.NTFS permissions tightened to Administrators only, combined with auditing of all write operations to the volume.
D.Storage Spaces Direct with ReFS integrity streams enabled on the data volume and cluster shared volume encryption.
AnswerA

BitLocker encrypts the volume transparently below the file system, so the instrument software continues writing normally with no interruption. TPM plus a numerical password protector allows unattended boot while still providing an out-of-band recovery path, and escrowing the recovery key to Active Directory satisfies the requirement to recover data if the drive is moved to another system.

Why this answer

Full volume encryption is required, not file-level protection, because the threat is physical theft of the drive. BitLocker operates transparently beneath the file system, so the instrument software is unaffected, while TPM plus numerical password protectors and Active Directory escrow provide both unattended operation and a documented recovery path for regulated data.

Exam trap

The trap here is choosing a file-level or permission-based control when the stated threat is someone reading a drive after physically removing it from the server.

Full explanation →
25
MCQhard

A server administrator is restoring a file server from a full backup taken 7 days ago and incremental backups taken daily. The restoration fails with an error about missing catalog files. What is the most likely cause?

A.The hard drive on the file server has failed
B.The backup software is not compatible with the current OS version
C.The full backup media is corrupted
D.The incremental backup chain is broken
AnswerD

Incremental backups depend on every prior increment plus the full backup; a missing or corrupt link in that chain leaves catalog references unresolvable. The restoration therefore fails with missing catalog files, matching a broken incremental chain.

Why this answer

Incremental backups depend on a chain that starts with a full backup and then each subsequent incremental backup references the previous one. If any link in the chain is missing, corrupted, or the catalog that tracks the chain is damaged, the restore fails with an error about missing catalog files. The most likely cause is that the incremental backup chain is broken, meaning the backup software cannot locate the required incremental sets to reconstruct the file server state.

Exam trap

SK0-005 often tests backup types and chain dependencies; candidates focus on physical media corruption or hardware failure, but the specific 'missing catalog' error points to a broken incremental chain.

How to eliminate wrong answers

Option A is wrong because a failed hard drive on the file server would cause the server to be unavailable or data loss at the source, but the error specifically mentions missing catalog files during restore, which points to the backup chain, not the source disk. Option B is wrong because backup software incompatibility with the OS version would typically cause the backup job to fail at creation time or produce a different error, not a missing catalog during restore. Option C is wrong because a corrupted full backup media would cause a read error or checksum failure on the full backup itself, not a missing catalog file error; the catalog is a separate index of the backup chain.

Full explanation →
26
MCQhard

Refer to the exhibit. A disaster recovery test reveals the following timeline for a critical application. The business requires an RTO of 2 hours. Which of the following actions would MOST effectively reduce the RTO to meet the requirement?

A.Implement database replication to eliminate the database restore time.
B.Add more network bandwidth to speed up VM provisioning.
C.Use a warm site with pre-configured storage.
D.Automate application validation to reduce that phase by half.
AnswerA

Database replication keeps a standby copy continuously current, so failover removes the lengthy restore step from the recovery timeline. This directly attacks the dominant contributor to the RTO, satisfying the two-hour requirement more effectively than restoring from backup.

Why this answer

The exhibit timeline shows the database restore phase consuming the largest portion of recovery time. Implementing database replication (e.g., log shipping, Always On availability groups, or storage-level replication) keeps a standby copy continuously synchronized, so failover replaces a lengthy restore-from-backup with a near-instant switchover. This directly attacks the dominant contributor to RTO, bringing total recovery within the 2-hour business requirement.

Exam trap

The trap here is fixating on secondary timeline phases (validation, provisioning, bandwidth) instead of identifying the single dominant time consumer — candidates must read the exhibit and target the largest phase, not the easiest one to 'improve.'

How to eliminate wrong answers

Option B is wrong because network bandwidth affects VM provisioning transfer speed only marginally and does nothing to eliminate the multi-hour database restore that dominates the timeline. Option C is wrong because a warm site with pre-configured storage still requires restoring or rehydrating the database from backups, leaving the largest time sink intact. Option D is wrong because halving application validation only trims a small secondary phase and cannot compensate for the database restore time that pushes recovery past the 2-hour RTO.

Full explanation →
27
MCQhard

A company runs a critical SQL Server database on a physical server with a RAID 10 array. The database is backed up nightly to a local disk and replicated to a remote site every four hours. A ransomware attack encrypts the local database files and the local backup disk, but the remote replication target is unaffected. The administrator needs to restore service with the least data loss. Which recovery approach should the administrator use?

A.Restore the nightly backup from the local backup disk after running antivirus scans
B.Fail over to the remote site and continue running production there permanently
C.Rebuild the RAID 10 array and restore the database from the encrypted local files
D.Restore the most recent replicated backup from the remote site to a clean server
AnswerD

The remote replication target is unaffected by the ransomware, so it holds the most recent clean copy of the database, up to four hours old. Restoring it to a clean server avoids reinfection and minimizes data loss compared to older or compromised local copies. This directly addresses the least data loss requirement while ensuring a trusted source.

Why this answer

The remote replication target survived the attack and contains the most recent clean data, so restoring from it to a clean server minimizes loss and avoids reinfection. Local backups and database files are compromised. Rebuilding RAID does not decrypt data, and permanent failover is an architectural change beyond the immediate recovery need.

Exam trap

The trap here is assuming that RAID or a local backup provides protection against ransomware, when encryption of the files defeats both and only an isolated copy remains trustworthy.

Full explanation →
28
MCQmedium

An organization requires a disaster recovery site that can be operational within 24 hours after a disaster declaration, with critical data replicated on a regular basis, but not necessarily real-time. Which type of site should they implement?

A.Warm site
B.Alternate processing site
C.Cold site
D.Hot site
AnswerA

A warm site provides pre-installed hardware and network connectivity but lacks real-time replication, allowing activation within 24 hours. This satisfies the stem's recovery time objective while matching the requirement for regular, non-real-time data replication, unlike a hot site's continuous mirroring or a cold site's lengthy build-out.

Why this answer

Option A is correct because a warm site provides pre-installed hardware and network infrastructure, along with data backups that can be loaded and activated within a day. Hot sites offer immediate failover but are more expensive and not necessary here. Cold sites are empty space and take weeks.

An alternate processing site is a vague term.

Full explanation →
29
MCQhard

A system administrator is configuring a backup schedule for a critical database server that must be available 24/7. The company's recovery point objective (RPO) is 1 hour and recovery time objective (RTO) is 4 hours. The database files change frequently, but the operating system and application binaries rarely change. Which of the following backup strategies would BEST meet these requirements while minimizing storage and backup window impact?

A.Full backup daily, differential backup every hour
B.Full backup weekly, differential backup every hour
C.Full backup daily, incremental backup every hour
D.Full backup weekly, incremental backup every hour
AnswerC

Daily fulls ensure fast recovery, while small hourly incrementals meet the 1-hour RPO with minimal impact on the backup window and storage.

Why this answer

Option D is correct because daily full backups provide a recent recovery base, and hourly incremental backups are small and fast, meeting the 1-hour RPO with minimal backup window. Restoration applies at most 24 incrementals to the latest full, which fits within the 4-hour RTO. Option A is wrong because weekly full backups with hourly incrementals may require restoring too many incrementals, risking the RTO.

Option B is wrong because hourly differential backups grow in size throughout the day, increasing backup time and storage. Option C is wrong because weekly fulls with hourly differentials cause exponential growth in differential size over the week.

Full explanation →
30
MCQhard

A server administrator is configuring a RAID array on a new server with six 4 TB SAS drives. The server will host a large email archive that requires maximum usable capacity and can tolerate the loss of up to two drives without data loss. Write performance is not critical, but read performance should be adequate. Which RAID level should the administrator choose?

A.RAID 0
B.RAID 6
C.RAID 5
D.RAID 10
AnswerB

RAID 6 uses dual parity, allowing the array to survive two simultaneous drive failures. It provides usable capacity of n-2 drives, which for six 4 TB drives is 16 TB. This meets the requirements for maximum usable capacity (compared to RAID 10) and tolerance of two drive failures, while read performance is adequate for an email archive.

Why this answer

RAID 6 provides dual parity, allowing the array to survive two simultaneous drive failures while offering usable capacity of n-2 drives. With six 4 TB drives, that yields 16 TB, which is greater than RAID 10's 12 TB. RAID 5 can only survive one failure, and RAID 0 offers no redundancy, so RAID 6 is the correct choice for this scenario.

Exam trap

The trap here is assuming RAID 10 always provides the best redundancy, but it uses 50% capacity and may not survive two failures if they occur in the same mirror.

Full explanation →
31
MCQmedium

An administrator is configuring a server to use a hardware security module (HSM) for disk encryption key storage. The administrator wants to ensure that if the server is stolen, the encrypted disks cannot be decrypted even if the disks are moved to another system. Which statement best describes why the HSM supports this goal?

A.The HSM stores the keys in a plaintext file on the boot volume so the operating system can load them at startup.
B.The HSM encrypts the disks with a key that is embedded in the disk firmware, so the key travels with the disks.
C.The HSM synchronizes keys to a cloud service so any server can retrieve them after authenticating with a user password.
D.The HSM stores the encryption keys in a tamper-resistant device and releases them only to authorized systems, so removing the disks does not expose the keys.
AnswerD

An HSM protects cryptographic keys in tamper-resistant hardware and releases them only after authentication and authorization. When disks are moved to another system, the attacker lacks access to the HSM and its keys, so the data remains unreadable. This directly supports the goal of preventing decryption after theft.

Why this answer

An HSM protects keys in tamper-resistant hardware and releases them only to authorized systems after authentication. Because the keys never leave the HSM in usable form and are not stored on the disks, moving the disks to another system does not allow decryption. The other options either embed keys in the disks, expose them via cloud retrieval, or store them in plaintext.

Exam trap

The trap here is assuming that disk encryption alone protects data, when the real protection depends on where the keys are stored and whether they travel with the disks.

Full explanation →
32
MCQmedium

A data center technician is installing a new 2U server that will host a virtualized environment. The server supports hot-swappable 2.5-inch NVMe drives in the front bays, but the operating system does not detect any drives after installation. The technician confirms the drives are properly seated and the backplane is connected to the motherboard. Which of the following is the MOST likely cause?

A.The NVMe drives require a U.2 to M.2 adapter to be recognized by the backplane.
B.The drives must be initialized in the RAID controller BIOS before they appear to the operating system.
C.The drives are not compatible with the backplane because they are SATA instead of NVMe.
D.The backplane's NVMe ports are not connected to the motherboard's PCIe lanes or the correct HBA/RAID controller.
AnswerD

NVMe drives require a direct PCIe connection. In many servers, the backplane uses SAS/SGPIO or OCuLink cables to connect to specific PCIe ports on the motherboard or a tri-mode RAID controller. If these cables are missing or connected to SATA-only ports, the drives will not be detected. This is a common oversight during installation and matches the symptoms.

Why this answer

NVMe drives communicate over PCIe, and in a hot-swap backplane, the backplane must be cabled to PCIe lanes on the motherboard or a compatible controller. If those cables are missing or misconnected, the drives receive power but no data path, so they are invisible to the OS. Verifying the backplane cabling is the critical step before assuming drive or controller failure.

Exam trap

The trap here is assuming that because the drives are seated and the backplane is powered, the data connection is automatically correct.

Full explanation →
33
MCQhard

A virtualized server running multiple VMs experiences a sudden performance degradation during peak hours. Storage latency spikes and CPU ready time increases significantly. The hypervisor shows high memory overcommitment but no swapping. Which action would most likely resolve the issue without adding hardware?

A.Reduce the number of vCPUs assigned to each VM
B.Increase memory reservation for all VMs
C.Migrate one or more VMs to another host
D.Enable transparent page sharing
AnswerC

Moving VMs to another host spreads the workload, decreasing CPU contention and storage I/O load on the original host.

Why this answer

Option B is correct because migrating VMs reduces resource contention on the host, lowering CPU ready time and potentially alleviating storage I/O pressure. Option A would only address memory pressure, not CPU ready. Option C is already enabled by default and would not resolve high ready time.

Option D might help CPU contention but could degrade application performance and does not address storage latency directly.

Full explanation →
34
PBQhard

You are the lead server administrator for a mid-sized e-commerce company. The web application is hosted on a farm of four Linux servers running Apache, fronted by a hardware load balancer. The load balancer currently uses a round-robin algorithm. Recently, the customer support team has received numerous complaints about slow page load times and occasional timeouts during checkout. You log into the server monitoring console and observe that one of the web servers, web03, has a CPU utilization consistently above 95%, while the other three servers are at around 30-40%. You connect via SSH to web03 and run the 'top' command, identifying a process named 'imagick' consuming 99% CPU. Further investigation reveals that this process is related to image resizing for product thumbnails, and it appears to have entered an infinite loop due to a malformed image file. Meanwhile, the load balancer continues to send requests to all servers equally, including the overloaded web03, causing some requests to time out. You need to restore performance immediately and prevent recurrence. Which of the following actions should you take?

A.Kill the 'imagick' process on web03, change the load balancer algorithm to least connections, and clear the malformed image.
B.Reboot all four web servers to clear any stuck processes.
C.Increase RAM on web03 to handle the high CPU process better.
D.Add two more servers to the farm and keep the round-robin algorithm.
AnswerA

Why this answer

Option B is correct because it directly addresses both issues: the runaway process (killing it stops the CPU drain) and the load balancer algorithm (switching to least connections prevents sending traffic to an already overloaded server). Additionally, clearing the malformed image addresses the root cause of the loop. Option A (adding servers) may temporarily hide the problem but does not fix the load distribution or the looping process; the overloaded server would still exist.

Option C (rebooting all servers) is unnecessarily disruptive and does not address the root cause; the malformed image could trigger the loop again after reboot. Option D (increasing RAM) misidentifies the issue as memory-related when it is clearly CPU-bound; more RAM would not stop the infinite loop.

Full explanation →
35
MCQmedium

A server administrator is troubleshooting a server that intermittently reboots without warning. The server is running Windows Server 2019 and hosts a critical application. The administrator checks the event logs and finds Event ID 41 (Kernel-Power). Which of the following should the administrator check first?

A.The power supply unit (PSU)
B.The memory (RAM) modules
C.The hard drive for bad sectors
D.The CPU temperature
AnswerA

Event ID 41 indicates that the system rebooted without cleanly shutting down first, often due to power loss. A faulty or insufficient PSU is a common cause. Checking the PSU's wattage and health is the first step in diagnosing power-related reboots.

Why this answer

Event ID 41 (Kernel-Power) indicates that the system rebooted without a clean shutdown, often due to power interruption. The most likely hardware cause is the power supply unit. Checking the PSU's capacity and health is the logical first step.

Exam trap

The trap here is assuming that any hardware failure causes Event ID 41, but it specifically points to power-related issues.

Full explanation →
36
Multi-Selecthard

A company is designing a disaster recovery plan for its primary datacenter. The plan must include a warm site that can take over production within four hours and must verify that the recovery procedures actually work. Which two elements should be included? (Choose two.)

Select 2 answers
A.A tabletop exercise that walks stakeholders through the recovery steps and identifies gaps in the plan.
B.A documented recovery time objective (RTO) of four hours and a recovery point objective (RPO) aligned with the replication schedule.
C.Biweekly incremental backups to tape stored only in the primary datacenter.
D.A full-scale failover test that shuts down the primary datacenter during business hours without notifying users.
E.A cold site with no pre-installed hardware or data replication, relying on emergency procurement during a disaster.
AnswersA, B

A tabletop exercise gathers stakeholders to discuss and walk through the disaster recovery plan step by step without disrupting production. It validates roles, communication paths, dependencies, and decision points, and it surfaces gaps such as missing contact information or unclear escalation procedures. Because the scenario requires verifying that recovery procedures work, a tabletop exercise is a low-risk, high-value validation method that complements the documented objectives.

Why this answer

A workable disaster recovery plan for a four-hour warm site takeover needs measurable objectives and validation. Documented RTO and RPO values define the acceptable downtime and data loss, guiding the warm site design and replication schedule. A tabletop exercise validates the plan by walking stakeholders through the procedures, revealing gaps without risking production.

The other options either describe a real outage, an inadequate cold site, or backups stored in a single failure domain, none of which support the stated recovery targets.

Exam trap

The trap here is treating any form of testing as acceptable, when an unannounced production shutdown is an actual outage rather than a safe validation, and confusing a cold site's capabilities with those of a warm site.

Full explanation →
37
PBQeasy

A technician receives an urgent alert that a critical file server at a remote branch office has gone offline and is unreachable over the network. The server is accessible via out-of-band IPMI, which indicates that chassis power is present, but the power LED on the server is blinking amber instead of steady green. The IPMI system event log reports "System board voltage regulator failure" as the last critical event before the failure. Attempts to use the remote KVM show no video output, and Wake-on-LAN commands have no effect. The branch office has no on-site IT personnel; the only staff are general office workers with minimal technical training. The earliest a field technician can travel to the site is 48 hours. The main office has an identically configured spare server and a backup image of the file server's system disk. The branch office staff can follow simple plug-and-play instructions if provided. Which of the following is the BEST immediate course of action to restore the file services with minimal downtime?

A.Order a replacement system board and express ship it to the branch for a technician to install later.
B.Ship the spare server and a pre-configured backup image to the branch office for local staff to swap.
C.Instruct a non-technical employee at the branch to reseat the power supply and clear the error log.
D.Dispatch a technician with a replacement voltage regulator module for on-site repair.
AnswerB

Why this answer

Given the voltage regulator failure on the system board, the server is not repairable remotely. Shipping the pre-configured spare server allows non-technical staff to swap the entire unit by following simple cabling instructions, restoring service quickly without waiting for a technician. Option A is correct because it minimizes downtime by leveraging available resources.

Option B is incorrect because voltage regulator modules are rarely field-replaceable; they are integrated into the motherboard, and dispatching a technician would take 48 hours plus repair time. Option C is incorrect because reseating the power supply is unlikely to fix a system board voltage regulator fault, and could cause further confusion for untrained staff. Option D is incorrect because ordering a replacement board and waiting for a technician to install it would take even longer, extending downtime unnecessarily.

Full explanation →
38
MCQeasy

A technician is preparing to rack a new server and needs to confirm the cabinet can support its weight and power draw. The server's documentation lists a maximum of 750W and a fully loaded weight of 30 kg. Which of the following should the technician verify FIRST?

A.The server's acoustic noise rating and the data center's ambient humidity
B.The cabinet's static and dynamic load ratings and the available PDU circuit capacity
C.The operating system version the server will host and its licensing tier
D.The color of the server's front bezel and the rack's U numbering scheme
AnswerB

This is correct because the cabinet must physically support the chassis weight, including when rails are extended, and the PDU must supply the server's 750W maximum without overloading the branch circuit. Confirming both ratings before installation prevents structural failure and electrical overcurrent, which are prerequisites for a safe racking procedure.

Why this answer

Before racking a server, the technician must confirm the cabinet can support its weight, including during rail extension, and that the PDU and branch circuit can deliver the documented maximum draw. These structural and electrical checks are prerequisites. Bezel color, OS licensing, and noise or humidity ratings are secondary considerations that do not prevent physical or electrical failure.

Exam trap

The trap here is skipping straight to software or cosmetic details and overlooking that a cabinet's load rating and circuit capacity are hard physical limits.

Full explanation →
39
MCQmedium

A system administrator is notified that a server with a RAID 5 array of four 2TB drives has a single failed drive. The server uses hot-swappable drives and a hardware RAID controller. Which of the following actions should the administrator perform FIRST?

A.Replace all four drives with larger capacity drives to expand storage.
B.Reboot the server and enter the RAID controller BIOS to mark the drive as offline.
C.Replace the failed drive and allow the array to rebuild.
D.Perform a full backup of the array before taking any action.
AnswerC

Immediate replacement allows the rebuild process to start, restoring redundancy. Hot-swap capability makes this a quick, non-disruptive first step.

Why this answer

Option A (Replace the failed drive and allow the array to rebuild) is correct because with a hot-spare, the array can rebuild automatically after replacing the failed drive, minimizing data vulnerability. Option B (Perform a full backup) is prudent but not immediate; the array is still functional in degraded mode. Option C (Reboot the server and access the RAID controller BIOS) delays recovery and may cause unnecessary downtime.

Option D (Replace all drives to increase storage) is unnecessary and wasteful.

Full explanation →
40
MCQmedium

A server administrator is troubleshooting a server that intermittently loses network connectivity. The server is connected to a managed switch, and the administrator notices that the switch port shows a high number of CRC errors. Which of the following is the MOST likely cause?

A.The network cable is damaged or poorly terminated.
B.The server's network adapter driver is outdated.
C.The switch is experiencing a broadcast storm.
D.The switch port is configured for the wrong duplex setting.
AnswerA

CRC errors indicate that frames are being corrupted in transit, often due to physical layer issues such as damaged cables, poor connectors, or interference. Replacing or re-terminating the cable is the first step. High CRC errors are a classic symptom of cabling problems, making this the most likely cause.

Why this answer

CRC errors on a switch port almost always indicate a physical layer problem, such as a bad cable or connector. Intermittent connectivity with high CRC errors strongly suggests the cable is damaged or poorly terminated. Other options like duplex mismatch or driver issues do not typically produce CRC errors.

Exam trap

The trap here is attributing CRC errors to logical configuration issues like duplex or drivers, when they are actually physical layer errors.

Full explanation →
41
MCQhard

A company has a primary data center and a warm site 50 miles away. The disaster recovery plan specifies a recovery time objective (RTO) of 4 hours and a recovery point objective (RPO) of 15 minutes. The administrator is reviewing the backup and replication strategy. Which combination best meets these objectives?

A.Asynchronous replication every 10 minutes to the warm site with automated failover
B.Nightly full backups shipped to the warm site and restored during a disaster
C.Synchronous replication to the warm site with manual failover procedures
D.Daily differential backups to local storage and weekly full backups to tape stored offsite
AnswerA

Replication every 10 minutes meets the 15-minute RPO because at most 10 minutes of data is lost. Automated failover to the warm site can bring systems online within the 4-hour RTO, making this combination appropriate for the stated objectives.

Why this answer

Asynchronous replication every 10 minutes keeps data loss within the 15-minute RPO, and automated failover to a warm site can achieve the 4-hour RTO. This combination balances cost and performance without requiring synchronous replication over a long distance.

Exam trap

The trap here is equating synchronous replication with a better RPO without considering distance and latency, or assuming manual failover can meet a 4-hour RTO.

Full explanation →
42
MCQmedium

A server administrator is investigating a production server that has been performing poorly for several days. Users report slow response times, and the administrator observes that CPU utilization stays near 100% even during off-peak hours. Task Manager shows the System process consuming most of the CPU. The administrator runs a performance counter capture and sees a sustained high rate of deferred procedure calls (DPCs). Which of the following is the MOST likely cause?

A.A memory leak in a user-mode application causing excessive paging
B.An overheating CPU throttling to a lower clock speed
C.A failing storage controller driver generating excessive interrupts
D.A misconfigured DNS server causing repeated name resolution retries
AnswerC

Excessive DPC time typically indicates a driver, often a storage or network driver, is spending too long in deferred procedure call routines. A failing or outdated storage controller driver can generate abnormal interrupt loads, driving up DPC time and CPU usage. This matches the sustained high DPC rate and System process CPU consumption described in the scenario.

Why this answer

Sustained high DPC time indicates a driver is spending excessive time in deferred procedure call routines, and the System process CPU usage reflects that kernel-level activity. Among the listed causes, only a failing storage controller driver would directly generate abnormal interrupt and DPC load. Memory leaks, thermal throttling, and DNS retries do not produce this specific performance counter pattern.

Exam trap

The trap here is assuming any high System process CPU usage points to a user-mode application or malware rather than a kernel-mode driver generating excessive interrupts.

Full explanation →
43
MCQhard

An organization stores backup tapes at an offsite facility. The tapes contain sensitive customer data. A security audit revealed that tapes were stolen from the facility. Which combination of measures would have MOST effectively prevented unauthorized data access?

A.Encrypt all backup data with strong encryption and restrict decryption keys to authorized personnel.
B.Password-protect the tapes and keep them in a locked safe.
C.Store tapes in a fireproof safe and limit access to key personnel.
D.Use a bonded courier service for transportation.
AnswerA

Encryption renders stolen tape contents unreadable, directly defeating the unauthorised access the audit exposed. Restricting decryption keys to authorised personnel ensures the physical theft yields no usable customer data, satisfying the sensitive-data confidentiality constraint that physical offsite controls alone could not.

Why this answer

Encrypting backup data with strong encryption and restricting decryption keys to authorized personnel (A) is the most effective control because it renders stolen tapes unreadable. Even if physical controls fail — as they did here — the data remains confidential without the keys. This is the principle of cryptographic protection as a last line of defense for data at rest.

Exam trap

SK0-005 often tests the difference between physical controls (safes, couriers, locks) and cryptographic controls — candidates pick physical measures that fail once the media is in the attacker's hands.

How to eliminate wrong answers

Option B is wrong because password-protecting tapes and locking them in a safe are physical/access controls that were already defeated in this scenario; password protection on tape is often weak or vendor-specific and does not provide strong cryptographic assurance. Option C is wrong because a fireproof safe and limited access address physical threats (fire, theft) but not the confidentiality of data if the safe is breached — it does not protect data at rest. Option D is wrong because a bonded courier reduces transit risk but does nothing to protect data if the tapes are stolen at the destination facility, which is exactly what happened.

Full explanation →
44
MCQhard

A server administrator is troubleshooting a Linux server that becomes unresponsive during nightly backup jobs. The administrator runs top and observes that the wa (I/O wait) value is consistently above 40%, while user and system CPU usage remain below 10%. The backup job writes to a locally attached RAID 5 array. Which of the following is the MOST likely cause of the high I/O wait?

A.The server's CPU is throttling due to excessive heat, causing processes to wait on I/O.
B.The RAID controller cache is disabled or the battery-backed write cache is in a failed state.
C.The backup application is using a compression algorithm that is CPU-intensive.
D.The network interface card is dropping packets, causing retransmissions and disk writes to stall.
AnswerB

A RAID controller without a functional write cache forces all writes to go directly to disk, dramatically increasing I/O wait during heavy write workloads like backups. If the battery-backed cache unit has failed or cache is disabled, write performance degrades severely. This matches the symptom of high I/O wait with low CPU usage during backup jobs.

Why this answer

High I/O wait with low CPU usage during write-heavy operations points to a storage bottleneck. A RAID controller with a disabled or failed write cache cannot buffer writes, forcing synchronous disk access and increasing I/O wait. Verifying the RAID controller cache status and battery condition is the most likely fix.

Exam trap

The trap here is attributing high I/O wait to CPU or network problems, when the low CPU usage and local storage target clearly indicate a storage subsystem bottleneck.

Full explanation →
45
MCQeasy

Refer to the exhibit. A server in a well-maintained data center has triggered upper critical and non-recoverable temperature alerts for CPU1. The server's chassis fans are operating at full speed, and the data center ambient temperature is normal. Which of the following is the FIRST action the administrator should take?

A.Open the chassis and verify that the CPU air baffle/duct is in place.
B.Check for failure of the liquid cooling system for CPU1.
C.Replace CPU1 because the high temperature indicates an internal short.
D.Install additional high-speed fans to increase static pressure.
AnswerA

Air baffles direct airflow over the CPU heatsinks; if missing or displaced during a previous service, the CPU can overheat even with fans at full speed.

Why this answer

Correct: Missing or improperly installed air baffles/ducts are a common cause of CPU overheating, especially after maintenance. Option A is wrong because if other components are fine, a liquid cooling failure is less likely and more invasive. Option C is wrong because adding extra fans doesn't address the root cause if airflow path is broken.

Option D is wrong because a failed CPU almost never causes overheating; a failing CPU usually causes crashes, not thermal runaway.

Full explanation →
46
MCQhard

A server in a virtualized environment is experiencing VM performance degradation. The host server has adequate resources. The hypervisor logs show excessive 'ready' time for the CPU. Which of the following is the BEST action to resolve this issue?

A.Disable hyper-threading on the host
B.Increase the number of vCPUs for the VM
C.Reduce the number of VMs on the host
D.Migrate the VM to a different host
AnswerC

Excessive CPU ready time indicates VMs are queuing for physical CPU despite adequate host resources, meaning the host is overcommitted on vCPU allocation. Reducing the number of VMs lowers contention, satisfying the stem's constraint that host resources are otherwise sufficient.

Why this answer

Reducing the number of VMs on the host reduces contention for CPU resources, decreasing ready time.

Full explanation →
47
Multi-Selecthard

A company is drafting a disaster recovery plan for its primary data center. The plan must address both the maximum tolerable data loss and the maximum tolerable downtime for critical systems. Which of the following metrics should the plan explicitly define to meet these requirements? (Choose two.)

Select 2 answers
A.Recovery service level (RSL)
B.Recovery point objective (RPO)
C.Mean time between failures (MTBF)
D.Mean time to repair (MTTR)
E.Recovery time objective (RTO)
AnswersB, E

RPO defines the maximum acceptable amount of data loss measured in time, such as one hour or fifteen minutes. It directly answers how much data the business can afford to lose and drives backup frequency and replication design. Including RPO in the disaster recovery plan ensures that the backup and replication strategy matches the tolerable data loss for critical systems.

Why this answer

The two metrics that directly express maximum tolerable data loss and maximum tolerable downtime are the recovery point objective and the recovery time objective. RPO sets the acceptable data loss in time, and RTO sets the acceptable downtime. Reliability and repair averages such as MTBF and MTTR describe failure and repair behavior but do not define business tolerance for loss or downtime.

Exam trap

The trap here is confusing reliability averages like MTBF and MTTR with the business-defined objectives RPO and RTO.

Full explanation →
48
MCQeasy

A server administrator is troubleshooting a server that is unable to connect to the network. The server's NIC link light is off. The administrator verifies that the switch port is enabled and the cable is connected to both the server and the switch. Which of the following should the administrator check NEXT?

A.The cable is faulty or not properly seated.
B.The switch port is configured for the wrong VLAN.
C.The cable is a crossover cable and needs to be replaced with a straight-through cable.
D.The NIC driver version and update if necessary.
AnswerA

A link light off indicates no physical link between the NIC and the switch. Even if the cable appears connected, it could be faulty or not fully seated. Testing with a known-good cable or reseating both ends is a logical next step. This is a common cause of a missing link light.

Why this answer

When the NIC link light is off, the issue is almost always physical layer: cable, port, or NIC hardware. Since the switch port is enabled and the cable is connected, the next step is to verify the cable's integrity and seating. Trying a different cable or reseating the existing one can quickly resolve the problem.

Other options address higher-layer issues that would not cause the link light to be off.

Exam trap

The trap here is jumping to configuration issues like VLAN or drivers when the link light being off points directly to a physical layer problem.

Full explanation →
49
MCQeasy

A system administrator is setting up a new server and needs to ensure that the server's time is synchronized with an external time source. Which protocol should be used?

A.NTP
B.SNMP
C.LDAP
D.SMTP
AnswerA

NTP (Network Time Protocol) is designed to synchronize clocks over a network. It uses UDP port 123 and can achieve millisecond accuracy. Configuring the server to use external NTP servers ensures accurate time, which is critical for logging, authentication, and distributed applications. It is the standard protocol for time synchronization.

Why this answer

NTP is the correct protocol for synchronizing server time with external sources. It is specifically designed for this purpose and is widely supported. Other protocols listed serve different functions and cannot synchronize time.

Accurate time is essential for security protocols, logging, and scheduled tasks.

Exam trap

The trap here is confusing network management or directory protocols with time synchronization protocols.

Full explanation →
50
MCQmedium

A datacenter administrator is reviewing physical security for a new server room. The company wants to ensure that only authorized personnel can access the racks and that any access attempts are logged. The room already has a locked door with a badge reader. Which of the following should the administrator implement to meet the requirements for rack-level security and auditing?

A.Implement a mantrap at the entrance to the server room.
B.Install electronic rack locks with badge readers and audit logging.
C.Install a biometric scanner on the server room door.
D.Place a security camera in the server room.
AnswerB

Electronic rack locks with badge readers provide per-rack access control and generate logs of who accessed which rack and when. This directly meets the requirements for rack-level security and auditing. It integrates with existing badge systems and provides a clear audit trail for compliance.

Why this answer

Rack-level security requires controls that restrict and log access to each rack. Electronic rack locks with badge readers provide both physical prevention and an audit trail tied to individual racks. Room-level controls like biometrics, cameras, or mantraps do not satisfy the requirement for rack-level access control and logging.

Exam trap

The trap here is choosing a stronger room-level control and assuming it covers rack-level requirements, when the scenario explicitly asks for rack-level security and auditing.

Full explanation →
51
MCQhard

A server administrator is adding a second CPU to a dual-socket server that currently has one CPU installed. The server boots with one CPU but fails to POST after the second CPU is installed. The administrator verifies the CPU is seated correctly and the socket is clean. Which of the following is the most likely cause?

A.The second CPU is not on the motherboard's qualified vendor list for dual-socket operation.
B.The server's power supply wattage is insufficient for two CPUs.
C.The second CPU requires a different heatsink than the first CPU.
D.The server requires memory to be installed in the slots associated with the second CPU before it will POST.
AnswerD

On dual-socket motherboards, each CPU has its own memory channels and slots. If no memory is populated in the slots mapped to the second socket, the system will fail to POST because that CPU cannot initialize its memory controller. Installing at least one DIMM per memory channel for the second CPU is required for a successful dual-socket boot.

Why this answer

Dual-socket motherboards assign separate memory slots to each processor. When a second CPU is installed, the system expects memory in that CPU's associated slots; without it, the CPU cannot initialize and the server will not POST. Checking that each populated socket has memory in its corresponding channels is the key step for this scenario.

Exam trap

The trap here is focusing on CPU seating or power while overlooking that each processor on a dual-socket board requires its own memory population to complete POST.

Full explanation →
52
MCQmedium

A server administrator receives alerts that a production Linux server is unresponsive. After connecting via out-of-band management, the administrator sees a message indicating a kernel panic. The system was recently updated with a new storage driver. Which of the following should the administrator do FIRST to troubleshoot this issue?

A.Reboot the server and select the previous kernel version from the boot loader menu.
B.Run a full memory diagnostic test to check for faulty RAM.
C.Replace the storage controller card with a known-good spare.
D.Reinstall the operating system from scratch to ensure a clean state.
AnswerA

Booting into the previous kernel isolates whether the recently updated storage driver caused the panic. If the system boots successfully with the older kernel, the new driver is the likely culprit, allowing the administrator to roll back or update the driver. This is a non-destructive first step that quickly confirms or eliminates the suspected change.

Why this answer

The kernel panic appeared right after a storage driver update, making that change the prime suspect. Booting the previous kernel version is a quick, reversible test that confirms whether the new driver is at fault. If the system boots, the administrator can then roll back the driver or obtain a fixed version.

Other options involve unnecessary hardware replacement, lengthy tests, or destructive reinstallation.

Exam trap

The trap here is assuming a kernel panic always indicates hardware failure, when a recent software change is the more likely cause.

Full explanation →
53
MCQhard

A Linux server running Ubuntu Server 22.04 hosts a PostgreSQL database. The administrator notices that the database performs well in the morning but becomes progressively slower throughout the day, and free memory drops steadily. Running free -h shows that available memory is nearly exhausted, but the swap partition is barely used. Which command should the administrator use to identify the process consuming the most memory?

A.vmstat 1 10
B.top -o %MEM
C.iostat -x 5
D.sar -r 1 5
AnswerB

Running top with the -o %MEM option sorts processes by memory usage in descending order, immediately highlighting the process consuming the most RAM. This directly addresses the symptom of steadily decreasing free memory and identifies the likely culprit. The command is available by default on Ubuntu Server 22.04 and provides real-time updates, making it ideal for this scenario.

Why this answer

The top command with the -o %MEM option sorts running processes by memory consumption, directly identifying the process responsible for the steady memory decline. Other tools like vmstat, iostat, and sar provide system-wide statistics but lack per-process detail. For a Linux server experiencing memory pressure, top is the most efficient first step to isolate the offending process.

Exam trap

The trap here is choosing a system-wide monitoring tool that reports memory statistics but does not attribute usage to a specific process.

Full explanation →
54
MCQhard

A server administrator is troubleshooting a performance issue on a VMware vSphere host. The host has multiple VMs, and one VM is experiencing high latency on its virtual disk. The administrator checks the datastore and sees it is a RAID 5 array of 4 SAS drives with 50% utilization. Latency for the VM's virtual disk is reported as 200ms. Which action would most likely improve performance?

A.Add a second disk to the RAID 5 array (convert to RAID 6).
B.Migrate the VM to a different datastore with SSD storage.
C.Increase the VM's memory allocation.
D.Change the virtual disk type from thin to thick.
AnswerB

The RAID 5 SAS datastore is the bottleneck, delivering 200ms latency. Migrating the VM to SSD-backed storage removes the spinning-disk seek penalty, directly addressing the high virtual disk latency constraint rather than merely shifting load.

Why this answer

A virtual disk latency of 200ms on a RAID 5 SAS datastore at only 50% utilization strongly indicates a storage I/O bottleneck rather than capacity or memory pressure. Migrating the VM to an SSD-backed datastore dramatically reduces latency because SSDs deliver sub-millisecond random I/O versus mechanical SAS drives. This directly addresses the root cause without altering RAID geometry or VM configuration.

Exam trap

The trap is assuming that adding disks or changing RAID levels improves performance, when the real bottleneck is the mechanical latency of SAS drives—SSD migration is the direct fix.

How to eliminate wrong answers

Option A is wrong because converting RAID 5 to RAID 6 adds double parity, which increases write penalty and reduces usable capacity—it would likely worsen latency, not improve it. Option C is wrong because increasing VM memory does not address disk I/O latency; it only helps if the bottleneck were memory paging or cache misses. Option D is wrong because changing thin to thick provisioning only affects space allocation and possibly initial write performance, not the underlying storage latency of 200ms.

Full explanation →
55
Multi-Selectmedium

A server administrator is troubleshooting a Windows Server 2019 machine whose system event log repeatedly shows unexpected shutdowns with no bugcheck code. The hardware is suspected of causing the reboots. Which of the following should the administrator check to identify a hardware-related cause? (Choose two.)

Select 2 answers
A.Update the NIC firmware to the latest vendor release.
B.Check the power supply units and review the chassis intrusion and fan status indicators.
C.Examine the Windows Memory Diagnostic results for failing RAM modules.
D.Run sfc /scannow to repair corrupted Windows system files.
E.Review the baseboard management controller (BMC) or IPMI system event log for thermal or power events.
AnswersB, E

Degraded power supplies and stopped fans can cause abrupt power loss or thermal shutdowns that leave no OS bugcheck. Verifying PSU health along with fan and chassis status directly targets the hardware conditions that produce clean, unexpected reboots. This complements the management-controller log review by confirming the physical fault behind the logged event.

Why this answer

Unexpected shutdowns with no bugcheck usually originate below the operating system, so the investigation belongs at the hardware layer. Out-of-band management logs capture thermal and power events the OS cannot record, while physical inspection of power supplies and cooling confirms the fault. Software-level tools and network firmware updates do not explain a reset that bypasses the OS.

Exam trap

The trap here is choosing in-OS diagnostic tools for a symptom that occurs below the operating system, where only out-of-band and physical checks will show the cause.

Full explanation →
56
PBQeasy

A small law firm has a single Windows Server 2016 Essentials server that functions as a domain controller and file server. After a sudden power outage over the weekend, the server does not boot normally. Instead, it displays a black screen with the message: 'BOOTMGR is missing. Press Ctrl+Alt+Del to restart.' The IT support specialist arrives on Monday morning to find the server in this state. The firm's operations are at a standstill because all case files and email archives are inaccessible. The specialist has access to the Windows Server 2016 installation media and a recent system state backup stored on an external drive. The server hardware passed POST, and all disks are detected in the BIOS. The specialist needs to restore the server's ability to boot into Windows as quickly as possible, with minimal risk to existing data. Which of the following procedures should the specialist perform FIRST?

A.Connect the external backup drive, boot from the installation media, and perform a full system restore from the backup.
B.Open the server case, reseat the RAM modules and SATA cables, and then attempt to boot again.
C.Boot from the installation media, select 'Repair your computer', and from the Command Prompt run 'bootrec /fixmbr' and 'bootrec /fixboot'.
D.Press F8 during startup to access Advanced Boot Options and select 'Last Known Good Configuration'.
AnswerC

Why this answer

Option C is correct because the 'BOOTMGR is missing' error typically indicates a corrupt master boot record or boot sector. Using bootrec /fixmbr and /fixboot from the installation media repairs the boot files without affecting data. Option A is a full system restore, which risks data loss and is overkill.

Option B is hardware reseating, unnecessary since POST passed. Option D, Last Known Good Configuration, does not fix missing boot manager files.

Full explanation →
57
MCQeasy

A small business runs a Windows Server 2022 domain controller and a member file server. The administrator must ensure that if a server's system disk fails, the server can be rebuilt quickly with its operating system, roles, and settings intact. Backups are currently taken with Windows Server Backup to a dedicated backup volume on the same server. Which change should the administrator make?

A.Enable Storage Replica between the system disk and the backup volume so the backup volume holds a live mirror of the operating system.
B.Convert the system disk to a RAID 1 mirror pair and continue storing backups on the existing backup volume.
C.Configure Windows Server Backup to store backups on a separate external disk or network share and schedule a bare-metal recovery backup including system state.
D.Create a scheduled task that copies the Windows folder to the backup volume each night and enable shadow copies on the system volume.
AnswerC

Backups stored on a volume inside the same server are lost when that server's disk fails, so the target must move off the box. A bare-metal recovery backup captures the operating system, roles, and configuration needed to rebuild the server, and system state inclusion preserves Active Directory and registry settings on the domain controller.

Why this answer

The core flaw is that the only backup copy shares a chassis with the data it protects. Moving backup storage to an external disk or network share and taking a bare-metal recovery backup with system state gives the administrator a copy that survives the server's failure and contains everything needed to rebuild it.

Exam trap

The trap here is treating local redundancy such as RAID or shadow copies as a backup, when both remain inside the same server that is expected to fail.

Full explanation →
58
Multi-Selecthard

A system administrator manages a Windows Server 2019 environment with multiple physical servers. The administrator needs to implement a remote management solution that provides out-of-band access to the servers' console even when the operating system is unresponsive or powered off. The solution must also allow mounting virtual media for OS installation and support remote power cycling. Which TWO of the following should the administrator implement? (Choose two.)

Select 2 answers
A.Set up a VPN connection for administrators to access the server management network.
B.Configure the servers' baseboard management controllers (BMCs) with dedicated network access.
C.Enable Remote Desktop Protocol (RDP) on all servers and restrict access via firewall rules.
D.Deploy a terminal server and use it as a jump host for administrative connections.
E.Install a remote management card or use an integrated lights-out (iLO) or iDRAC interface in each server.
AnswersB, E

A baseboard management controller (BMC) provides out-of-band management independent of the operating system. It allows remote console access, virtual media mounting, and power control even when the server is off. Configuring dedicated network access ensures the BMC is reachable without relying on the host OS, satisfying all the stated requirements.

Why this answer

Out-of-band management requires a baseboard management controller (BMC) or an integrated lights-out interface like iLO or iDRAC. These components operate independently of the operating system, providing console access, virtual media mounting, and remote power cycling even when the server is off or unresponsive. Configuring dedicated network access for the BMC ensures reliable connectivity.

Other options like RDP or VPNs do not provide the required out-of-band capabilities.

Exam trap

The trap here is confusing remote access tools that depend on the operating system, such as RDP or VPNs, with true out-of-band management that operates independently of the OS.

Full explanation →
59
MCQmedium

A server administrator is responsible for protecting sensitive data. The backup process copies files to a network share daily. Which of the following should the administrator do to BEST ensure the confidentiality of the backup data both during transfer and at rest?

A.Configure the network share with SMB encryption only.
B.Use a dedicated NIC for backup traffic on an isolated VLAN.
C.Place the backup server in a physically locked cage with restricted access.
D.Encrypt the backup files before transfer using a tool like GPG, and store them encrypted.
AnswerD

Pre-transfer encryption protects data confidentiality both in transit and at rest on the backup media.

Why this answer

Encrypting the backup files before transfer (Option B) ensures data confidentiality during transit and while stored on the backup server. Option A provides network segmentation but no encryption. Option C encrypts only the transfer, not the data at rest.

Option D is a physical security measure and does not encrypt the data.

Full explanation →
60
Multi-Selecthard

A server administrator is troubleshooting a server that fails to boot after a firmware update. The server powers on, completes POST, but then displays a message that no bootable device is found. The administrator suspects that the firmware update reset the storage controller configuration. Which of the following should the administrator check? (Choose two.)

Select 2 answers
A.Run a memory diagnostic to rule out RAM failure.
B.Replace the CMOS battery to ensure BIOS settings are retained.
C.Verify that the boot order in the UEFI/BIOS includes the correct storage controller and drive.
D.Check that the RAID controller is set to the correct mode (e.g., RAID vs. AHCI) and that the virtual drive is imported.
E.Reinstall the operating system to restore boot files.
AnswersC, D

A firmware update can reset UEFI/BIOS settings to defaults, which may change the boot order. If the storage controller or drive is not in the boot order, the system will report no bootable device. Checking and correcting the boot order is a critical first step in resolving this issue.

Why this answer

The correct answers are to verify the boot order in UEFI/BIOS and to check the RAID controller mode and import any foreign configuration. Firmware updates often reset BIOS/UEFI settings, which can alter boot order or storage controller settings. Restoring these settings can make the boot device visible again, resolving the 'no bootable device' error without data loss.

Exam trap

The trap here is assuming hardware failure or OS corruption when a firmware update has simply reset critical storage and boot settings.

Full explanation →
61
Multi-Selecthard

A server administrator is tasked with installing a new PCIe expansion card into a rack-mounted server. The server will be used in a data center with limited airflow. Which of the following should the administrator consider to ensure proper installation and cooling? (Choose two.)

Select 2 answers
A.Set the expansion card's fan speed to maximum using the server's management software.
B.Ensure the expansion card is compatible with the server's PCIe slot type and generation.
C.Install the card in the slot closest to the power supply to reduce cable length.
D.Remove the server's top cover to improve airflow around the expansion card.
E.Verify that the server's air baffle is installed correctly to direct airflow over the expansion card.
AnswersB, E

Compatibility is essential: a PCIe card must match the slot's physical size (x1, x4, x8, x16) and generation (e.g., PCIe 3.0 vs 4.0) to function. Installing an incompatible card can damage components or result in non-operation. This is a fundamental requirement for any expansion card installation.

Why this answer

Proper installation of a PCIe card requires verifying compatibility with the slot and ensuring the server's air baffle is correctly installed to direct airflow. These two steps address both functional and thermal requirements. Other options like adjusting card fan speed, choosing a slot based on power supply proximity, or removing the top cover are not valid or safe practices for ensuring proper cooling.

Exam trap

The trap here is focusing on minor cable length or fan speed adjustments while overlooking the critical need for slot compatibility and proper air baffle placement.

Full explanation →
62
MCQmedium

A financial services firm requires zero data loss in the event of a primary data center failure. They operate two data centers 50 miles apart connected by a high-bandwidth, low-latency link. Which replication method should they use to meet this requirement?

A.Asynchronous replication every 15 minutes
B.Snapshot replication every hour
C.Backup replication nightly
D.Synchronous replication
AnswerD

Synchronous replication ensures that any write is committed to both replicas before being acknowledged, thus achieving RPO=0.

Why this answer

Option B is correct because synchronous replication writes data to both sites before acknowledging the write to the application, ensuring zero data loss (RPO=0). Asynchronous replication (Option A) introduces a delay and can lose the latest transactions. Snapshot replication (Option C) is point-in-time and not continuous, leading to potential data loss between snapshots.

Backup replication nightly (Option D) can lose up to a day's data.

Full explanation →
63
MCQeasy

A database server hosts a critical application that requires a recovery point objective (RPO) of 4 hours. The company wants to minimize the impact on production performance during backups. Which backup strategy should be implemented?

A.Continuous data protection (CDP) with synchronous replication.
B.A weekly full backup with daily differential backups.
C.A weekly full backup with hourly incremental backups.
D.A nightly full backup.
AnswerC

Hourly incrementals ensure that no more than 1 hour of data is lost (well within the 4-hour RPO) and have minimal impact on production because they only back up changed data.

Why this answer

Option C is correct because hourly incremental backups meet the 4-hour RPO while minimizing resource usage compared to more frequent full backups or continuous replication. Option A is wrong because differential backups grow in size and can still exceed the RPO window. Option B is wrong because nightly full backups would fail to meet the 4-hour RPO if a disaster occurs hours after the last backup.

Option D is wrong because CDP with synchronous replication imposes high performance overhead and is unnecessary beyond the 4-hour RPO requirement.

Full explanation →
64
Multi-Selecthard

A security team is hardening a fleet of Linux web servers that will be exposed to the internet. They want to reduce the attack surface and limit the impact of a compromised service account. Which two actions BEST support these goals? (Choose two.)

Select 2 answers
A.Configure the firewall to allow only ports 80 and 443 from any source and deny all other inbound traffic by default.
B.Store database credentials in a world-readable configuration file so all administrators can access them during outages.
C.Grant the web service account sudo rights with no password so administrators can troubleshoot quickly during incidents.
D.Disable SELinux or AppArmor on the servers so that application updates do not fail during deployment.
E.Run the web service under a dedicated non-privileged account and restrict its file permissions to only the directories it must read.
AnswersA, E

A default-deny inbound policy that permits only the required web ports dramatically reduces the exposed attack surface. Services such as SSH, database listeners, and management interfaces are no longer reachable from the internet, so an attacker cannot directly exploit them. This is a foundational host-hardening step for internet-facing servers and directly supports the goal of limiting what can be attacked.

Why this answer

Reducing attack surface means exposing only necessary ports and removing unnecessary services, while limiting impact means confining what a compromised process can do. A default-deny firewall with only web ports open and running the service as a restricted non-privileged account with minimal file access both serve those goals. Disabling mandatory access control, granting passwordless sudo, and exposing credentials all increase risk.

Exam trap

The trap here is treating administrative convenience, such as passwordless sudo or world-readable credentials, as acceptable hardening when it actually expands the impact of a compromise.

Full explanation →
65
MCQmedium

After a thunderstorm, a server in a remote office is reachable via remote console but has no network connectivity. The network switch port shows a steady link light, but the server's NIC shows no link light. Which of the following is the MOST likely cause?

A.TCP/IP stack corruption.
B.Switch port is administratively disabled.
C.Incorrect VLAN assignment on the switch port.
D.The NIC hardware has failed.
AnswerD

A failed NIC would not establish a link, explaining why the switch sees a link but the server does not—the fault lies between the server's NIC port and the cable.

Why this answer

Option C is correct. A lack of link light on the server's NIC while the switch has a link indicates a physical failure between the NIC and the cable, such as a damaged NIC. Option A would result in no link on the switch as well.

Option B would still allow the NIC to establish link. Option D would not affect link lights.

Full explanation →
66
Multi-Selectmedium

A datacenter administrator is hardening a new Windows Server 2022 host that will run a public-facing web application. The administrator needs to reduce the attack surface at the operating system level. Which two actions should the administrator take? (Choose two.)

Select 2 answers
A.Enable the Windows Defender Firewall and create inbound rules that allow only the required web and management ports.
B.Grant all domain users local Administrator rights so that support staff can troubleshoot quickly.
C.Disable Windows Update on the server so that unexpected patches do not interrupt the web application.
D.Remove or disable unused server roles, features, and services that are not required by the web application.
E.Install a full desktop experience with all optional Windows features enabled to simplify future administration.
AnswersA, D

Enabling the host firewall and restricting inbound traffic to necessary ports reduces the number of services reachable from the network. This directly lowers the attack surface by blocking unused or unexpected listeners, which is a core operating system hardening step for a public-facing server.

Why this answer

Reducing the operating system attack surface means removing what is not needed and restricting what remains. Disabling unused roles and services removes exploitable code, while enabling the host firewall and limiting inbound rules controls network exposure. Together they shrink the set of reachable services and reduce the likelihood of a successful compromise.

Exam trap

The trap here is treating convenience features and broad administrative rights as harmless, when they actually expand the attack surface.

Full explanation →
67
PBQhard

A company operates a Windows Server 2019 machine that functions as a domain controller and file server. Over the past week, the server has randomly rebooted several times, often during periods of heavy file access. The administrator reviews the System event log and finds multiple Event ID 41 (Kernel-Power) entries with no preceding critical errors. The server is connected to an uninterruptible power supply (UPS) that reports stable input voltage. The server room temperature sensors indicate normal ambient temperature (22°C / 72°F). The server hardware is three years old and has not had any recent changes. The administrator has already run a full antivirus scan with no threats found. Which of the following should the administrator do NEXT to diagnose the issue?

A.Inspect and clean the CPU and chassis fans, and check for dust buildup
B.Update the server's BIOS to the latest version
C.Replace the power supply unit
D.Disable the automatic restart feature in System Properties
AnswerA

Why this answer

Option C is correct because random reboots with Kernel-Power 41 often indicate overheating due to failing fans or dust buildup, even if ambient temperature is normal. Option A is wrong because the power supply is likely not the issue given the UPS stability. Option B is wrong because a BIOS update is unlikely to solve hardware overheating.

Option D is wrong because disabling automatic restart only hides the symptom and does not prevent the reboots.

Full explanation →
68
Multi-Selecthard

A technician is diagnosing a server that intermittently reboots under heavy load. The server has dual CPUs, 256GB of RAM, and four 1TB NVMe drives. The technician suspects a hardware issue. Which of the following should the technician check to confirm a power-related problem? (Choose two.)

Select 2 answers
A.Use a multimeter to measure the voltage at the wall outlet
B.Run a CPU stress test and monitor core temperatures
C.Review the IPMI event log for power supply failures or voltage warnings
D.Check the power supply rating and total system power draw to ensure adequate capacity
E.Reseat the memory modules and run a memory diagnostic
AnswersC, D

The IPMI event log records power supply status, voltage fluctuations, and thermal events. Intermittent reboots under load often correlate with power supply degradation or insufficient power delivery. Checking the log can reveal warnings such as a failed power supply or voltage out of range. This is a non-intrusive first step to confirm power issues before replacing hardware.

Why this answer

Power-related intermittent reboots under load are best diagnosed by reviewing the IPMI event log for power supply warnings and verifying that the power supply capacity meets the total system draw. These two checks directly address power delivery and capacity. Other options target thermal or memory issues, which are less likely given the load-correlated symptom.

Exam trap

The trap here is focusing on thermal or memory diagnostics when the symptom is specifically tied to heavy load, which points to power delivery.

Full explanation →
69
PBQmedium

A healthcare provider is reviewing its disaster recovery strategy. They have two data centers: one primary in City A and a secondary in City B, 200 miles apart. Currently, they perform daily backups that are replicated to City B each night. In the event of a primary site failure, they can fail over to City B, but there is a 4-hour RTO due to manual processes. Their new RTO target is 2 hours, with an RPO of 15 minutes. The IT team is considering various replication technologies. The provider runs a mix of Windows and Linux servers hosting electronic health records (EHR), PACS imaging, and billing applications. Their current backup scheme is a full backup each night, with transaction logs backed up every 6 hours, but these are not immediately shipped offsite. They have experienced power outages in City A, prompting the review. The IT director is concerned about data consistency and quick recovery. The secondary site currently has sufficient hardware to run all critical applications, but data is only updated nightly. The link between data centers has 100 Mbps bandwidth and 10 ms latency, and upgrading it would cost $50,000. The existing staff can script failover procedures. Which solution best meets the new RPO and RTO while staying within budget?

A.Use application-level log shipping from the primary databases to secondary with a 5-minute delay, and manually failover.
B.Increase backup frequency to every 4 hours and use a warm site with pre-staged hardware, keeping the manual failover process.
C.Upgrade the inter-site link to 1 Gbps and implement synchronous replication for all critical VMs.
D.Implement asynchronous block-level replication with a 15-minute lag, and automate failover scripts to reduce RTO.
AnswerD

Why this answer

Option A is correct because asynchronous block-level replication with a 15-minute lag directly meets the RPO, and combining it with automated failover scripts can achieve the 2-hour RTO without requiring a costly bandwidth upgrade. Option B would meet the requirements but the link upgrade and synchronous replication infrastructure exceed the budget. Option C fails the RPO (4-hour backups are too infrequent) and RTO (manual failover is 4 hours).

Option D uses application log shipping that is not comprehensive (misses other servers) and manual failover would not meet the RTO.

Full explanation →
70
MCQmedium

A system administrator configures full backups on Sunday evenings and differential backups on weekdays. On Thursday morning, a disk failure occurs. Which of the following sets of backups is necessary to completely restore the server's data with the fewest number of backup files?

A.Sunday full only
B.Sunday full, Monday differential, Tuesday differential, Wednesday differential
C.Sunday full and Thursday differential
D.Sunday full and Wednesday differential
AnswerD

Correct. Wednesday's differential contains all changes since Sunday, so only these two files are required for a full restore.

Why this answer

A differential backup includes all changes since the last full backup. Therefore, only the most recent differential and the last full backup are needed for a complete restore. Using Sunday's full and Wednesday's differential requires just two files, whereas incremental backups would require the full plus every incremental since.

Option A (full plus all four differentials) is unnecessary. Option C references a Thursday backup that hasn't occurred yet. Option D ignores all changes since Sunday.

Full explanation →
71
MCQmedium

A company performs full backups every Sunday and differential backups daily. After a ransomware attack, they discover that both the production data and all attached backup media were encrypted. They need to ensure data can be recovered in the future. Which of the following is the BEST change to their backup strategy?

A.Store backups on an air-gapped or offline system.
B.Encrypt the backup data using AES-256.
C.Perform full backups daily instead of weekly.
D.Switch from differential to incremental daily backups.
AnswerA

Air-gapped backups are physically disconnected from the network, making them immune to remote ransomware attacks and ensuring data recoverability.

Why this answer

Option D is correct because air-gapped backups are physically isolated and cannot be reached by ransomware, ensuring recoverability. Option A increases backup frequency but doesn't protect against ransomware that encrypts attached media. Option B changes backup type but still leaves backups online and vulnerable.

Option C protects data at rest but if the encryption keys are on the same system, they can be compromised, and encryption itself doesn't prevent deletion/encryption by ransomware.

Full explanation →
72
PBQhard

A company runs a popular public-facing e-commerce website hosted on a farm of five Windows Server 2019 web servers behind a hardware load balancer. Recently, users have been reporting intermittent '503 Service Unavailable' errors during peak shopping hours. The administrator checks the load balancer and finds that all servers are marked as healthy with low CPU and memory usage. However, when inspecting a sample server, the administrator notices a large number of TCP connections in the TIME_WAIT state, consuming all available ephemeral ports. The application is ASP.NET based and uses IIS. The server configuration is as follows: Windows Server 2019 Standard, 4 vCPUs, 16 GB RAM, default TCP/IP settings. The administrator needs to resolve the connectivity issues without making changes to the application code or altering the network architecture. Which of the following actions should the administrator take to fix the problem PERMANENTLY?

A.Add two additional web servers to the farm to distribute the load.
B.Increase the ephemeral port range using netsh, and consider reducing the TIME_WAIT delay via registry settings.
C.Schedule a nightly restart of the IIS application pools.
D.Reduce the maximum number of concurrent connections in the IIS application pool settings.
AnswerB

Why this answer

Option A is correct because ephemeral port exhaustion is the root cause. Increasing the ephemeral port range provides more ports, and reducing TIME_WAIT delay frees them faster. Option B adds servers, which is a temporary workaround and does not prevent port exhaustion on each server.

Option C requires nightly restarts, causing brief outages and not solving the underlying issue. Option D limits concurrent connections but may degrade performance and does not address port exhaustion.

Full explanation →
73
MCQmedium

A server administrator is investigating a performance problem on a Windows Server 2019 file server. Users report that large file copies to a data volume take far longer than expected, but small file operations are fine. The administrator opens Performance Monitor and observes that the PhysicalDisk\Avg. Disk sec/Write counter for the array hosting the data volume is consistently between 40 and 60 ms, while the same counter on the OS volume stays under 5 ms. Disk queue length on the data volume remains low. Which of the following is the MOST likely cause?

A.The data volume's partition is misaligned to the underlying RAID stripe.
B.The data volume is formatted with the ReFS file system instead of NTFS.
C.The write-back cache on the RAID controller has been disabled or the battery-backed cache unit has failed.
D.The server's NIC teaming configuration is using a standby adapter for the data path.
AnswerC

Large sequential writes depend heavily on the controller's write-back cache to absorb and reorder I/O. When the cache is disabled or the battery/capacitor unit fails, the controller switches to write-through mode, so each write must commit to spinning media before the next is acknowledged. That raises latency on the data volume to tens of milliseconds while keeping queue length low, exactly matching the observed counters.

Why this answer

Elevated Avg. Disk sec/Write with a low queue length on a single array points to per-I/O latency rather than an overloaded queue. A failed battery-backed cache unit or disabled write-back cache forces the controller into write-through behavior, so each large write waits for physical media commit.

This selectively penalizes large sequential writes while leaving small operations and the OS volume unaffected.

Exam trap

The trap here is assuming high disk latency always means the array is overloaded with queued requests, when a low queue length with high per-write latency actually indicates the controller has lost its write cache.

Full explanation →
74
MCQmedium

A server administrator is troubleshooting a Windows Server 2019 server that is experiencing slow performance. The administrator suspects that a specific process is consuming excessive CPU resources. Which of the following tools should the administrator use to identify the process?

A.Performance Monitor
B.Event Viewer
C.Resource Monitor
D.Task Manager
AnswerD

Task Manager provides a real-time view of running processes and their CPU, memory, disk, and network usage. It allows the administrator to quickly sort processes by CPU usage and identify the one consuming excessive resources. This makes it the most direct tool for this scenario.

Why this answer

Task Manager is the best tool for quickly identifying a process consuming excessive CPU. It provides a real-time list of processes with CPU usage percentages, allowing the administrator to sort and pinpoint the culprit. While other tools offer more detailed analysis, Task Manager is the most direct and efficient for this immediate troubleshooting need.

Exam trap

The trap here is assuming that more advanced tools like Performance Monitor or Resource Monitor are always better for troubleshooting, when in fact Task Manager is often the quickest for real-time process identification.

Full explanation →
75
MCQmedium

A server administrator is installing a new PCIe network adapter into a rack server. The card is a full-height, full-length adapter, but the server chassis only accepts low-profile cards in its riser. Which of the following is the BEST course of action?

A.Install the card in the server's x16 slot without the riser to gain the needed height clearance.
B.Bend the card's mounting bracket so the adapter fits under the chassis lid.
C.Use a different riser that supports full-height cards, if the chassis offers one, or return the card for a low-profile equivalent.
D.Attach the card externally with a PCIe extension cable and leave the chassis lid open.
AnswerC

Match the card to the chassis: check whether the server offers an alternative riser that supports full-height or full-length cards, often an orderable option, or obtain a low-profile version of the same adapter, which many vendors offer. Also confirm the slot's PCIe generation and lane width, power requirements, and the server vendor's compatibility list, so the card is supported and cooled correctly.

Why this answer

Form factor compatibility is a prerequisite for card installation. A full-height, full-length adapter cannot be made to fit a low-profile riser through improvisation; the administrator must either use a chassis riser option that supports the larger form factor or obtain a low-profile equivalent adapter. This keeps mechanical retention, airflow, and support intact.

Exam trap

The trap here is trying to make a physically incompatible card fit, when the correct resolution is matching form factor through the proper riser or a different adapter.

Full explanation →

Page 1 of 6

Page 2

All pages

123456

Practice SK0-005 by domain

Target a specific domain to shore up weak areas.

server-administrationserver-hardware-installation-managementsecurity-disaster-recoverytroubleshooting
See all domains with question counts →