Knowledge + Practice

CompTIA Server+ SK0-005 (SK0-005) — Questions 76–150

185 questions total · 3pages · All types, answers revealed

Take a mock exam Exam hub

Data quality score: 10/100 — Not ready for indexing

18 warnings found across 75 questions. This page is set to noindex until issues are resolved.

Page 2 of 3

76

MCQhard

A technician is replacing a failed hard drive in a hot-swap RAID 5 array. After inserting the new drive, the RAID controller does not automatically rebuild. What should the technician do first?

A.Check the SAS cable connection

B.Reboot the server

C.Replace the drive with a different model

D.Manually initiate a rebuild from the RAID controller utility

AnswerD

Correct. Most controllers require the administrator to manually start the rebuild after replacing a failed drive.

Why this answer

Many RAID controllers require manual initiation of the rebuild process. Rebooting may not trigger it. Replacing with a different model is unnecessary.

Checking cabling is less likely since the drive is detected. The technician should use the controller utility to start the rebuild.

Full explanation →

77

PBQmedium

A medium-size enterprise runs a vSphere 7.0 cluster with two hosts (HostA and HostB) for production VMs. Each host has two 10GbE uplinks (vmnic0 and vmnic1) connected to separate physical switches (SW1 and SW2) for redundancy. A single vSphere standard switch (vSwitch0) uses both uplinks with teaming policy set to 'Route based on originating virtual port ID,' 'Network failure detection: Link status only,' and 'Notify switches: Yes.' Lately, several VMs running on HostA experience intermittent network disconnections lasting 20–30 seconds, while VMs on HostB are unaffected. The administrator checks vCenter events and sees repeated messages: 'Lost uplink redundancy on vSwitch0. vmnic0 is down.' followed seconds later by 'Uplink redundancy restored. vmnic0 is up.' The physical switch SW1's log shows the port for vmnic0 transitions through spanning-tree listening and learning states each time this occurs, taking about 15 seconds. The link is a trunk allowing all necessary VLANs, with no errors or security violations. The network team has already swapped the fiber cable and SFP+ transceiver for vmnic0 without improvement. The VMs affected are those whose virtual ports are pinned to vmnic0 by the load-balancing policy; VMs pinned to vmnic1 never experience disconnections. The administrator has also rebooted HostA and updated the NIC firmware, but the flapping continues. What should the administrator do to permanently resolve the intermittent connectivity?

A.Disable the 'Notify switches' option on the vSwitch teaming configuration to avoid unnecessary RARP broadcasts.

B.Reconfigure the physical switch port for vmnic0 to an access port instead of a trunk to simplify spanning-tree operations.

C.Enable spanning-tree PortFast on the SW1 and SW2 ports connected to the hosts so the ports bypass the listening/learning states.

D.Change the NIC teaming load balancing policy to 'Route based on IP hash' to distribute traffic across both uplinks more evenly.

AnswerC

Why this answer

Option C is correct because the symptoms as confirmed by the switch log show that each link flap triggers spanning-tree recalculation, causing the port to cycle through listening and learning states before forwarding resumes. Enabling PortFast on switch ports that are connected to end devices (like ESXi hosts) allows immediate forwarding. Option A is wrong because changing to access mode would break multiple VLANs and still face STP delays.

Option B is wrong because disabling notify switches might worsen MAC table inconsistencies. Option D is wrong because changing load balancing does not stop the flapping or STP convergence; the issue is at layer 2.

Full explanation →

78

MCQeasy

A technician is installing a new 2U server into a datacenter rack. The server is equipped with redundant power supplies. According to best practices for power redundancy, how should the technician connect the power supplies?

A.Connect one PSU to a UPS and the other directly to mains

B.Run one PSU at 110V and the other at 220V for load balancing

C.Connect each PSU to a separate circuit

D.Connect both PSUs to the same power distribution unit (PDU)

AnswerC

Best practice is to connect redundant PSUs to independent power sources (separate PDUs on different circuit breakers) to eliminate single points of failure.

Why this answer

Option B is correct because connecting each power supply to a separate circuit (or separate PDUs fed by different circuits) ensures that if one circuit fails, the other keeps the server powered. Option A is wrong because connecting both to the same PDU creates a single point of failure. Option C is wrong because while a UPS is important, connecting only one PSU to a UPS defeats redundancy if the non-UPS circuit fails.

Option D is wrong because operating voltages are standardized and must match the server specifications.

Full explanation →

79

MCQmedium

Refer to the exhibit. A server administrator configured iptables rules on a Linux server. Immediately afterward, they are unable to connect to the server via SSH. The output of 'iptables -L INPUT -n' is shown. What is the most likely cause of the connectivity issue?

A.The last DROP rule blocks all traffic, including established SSH sessions.

B.The DROP rule for port 22 appears before the ACCEPT rule, causing all SSH packets to be dropped.

C.The default INPUT policy is set to ACCEPT, allowing all traffic.

D.The ACCEPT rule for port 22 is missing the ESTABLISHED state, preventing return traffic.

AnswerB

Correct. With the DROP preceding the ACCEPT, every SSH packet matches the DROP target first.

Why this answer

iptables processes rules in order. The DROP rule for destination port 22 appears before the ACCEPT rule, so all incoming SSH packets are dropped before the ACCEPT rule can permit new connections.

Full explanation →

80

PBQhard

A company is migrating a legacy line-of-business application from Windows Server 2012 R2 to a new Windows Server 2022 server that is a member of an Active Directory domain. The application runs as a Windows service under a domain service account named CORP\svc_app. The service account has been granted the 'Log on as a service' user right on the old server, and the application is configured to listen on a static TCP port 8443. After installing the application on the new server and configuring it with the same service account and port, the application fails to start. The administrator checks the Windows Event Viewer and sees two errors in the System log: 'The CORP\svc_app service failed to start due to the following error: The service did not start due to a logon failure' and 'The service cannot bind to the designated port 8443'. The administrator has already verified that the service account's password is correct and has not expired, that the account is enabled, that the port 8443 is not being used by another service, and that the Windows Firewall has an inbound rule allowing traffic on port 8443. The application's configuration file correctly points to port 8443. What should the administrator do to resolve the issue?

A.Restart the Windows Server 2022 server to apply any pending policy changes.

B.Grant the 'Log on as a service' user right to the CORP\svc_app account via Local Security Policy or Group Policy.

C.Configure the application to use a dynamic port instead of the static port 8443.

D.Reset the service account password and update the service configuration.

AnswerB

Why this answer

The correct answer is B. The 'Log on as a service' user right is a security policy setting that must be explicitly assigned to a service account on each individual server. Even though the account had this right on the old server, it does not automatically carry over to the new server.

Without this right, the service cannot start, and the 'logon failure' error is a classic symptom. Option A is incorrect because the password was already verified as correct. Option C is incorrect because the application requires a static port (port 8443) and changing to a dynamic port would break client connectivity.

Option D is incorrect because restarting the server does not assign the missing user right and will not resolve the logon failure.

Full explanation →

81

MCQhard

Refer to the exhibit. A technician reviewing the server's storage array status sees the above output. The server is using a hot spare with a RAID 5 array. What should the technician do NEXT?

A.Run a full backup and then replace the drive

B.Rebuild the array to include the hot spare

C.Continue monitoring; the drive is still functional

D.Immediately replace the drive in slot 1I:1:3 to prevent data loss

AnswerD

Proactive replacement avoids the risk of drive failure and the array operating in a degraded state.

Why this answer

A predictive failure warning means the drive is likely to fail soon. Immediate replacement prevents array degradation and possible data loss. The hot spare is activated only on actual failure; rebuilding the array to include the hot spare is not possible manually for predictive failures.

Backing up is prudent but not the most urgent next step.

Full explanation →

82

PBQeasy

A small business has a single file server running Windows Server 2019. The server uses two internal SATA drives in a RAID 1 mirror for the operating system and data. The company's backup solution performs a full backup every night to an external USB hard drive, which is stored in the server room. The IT administrator recently noticed that the server's system volume is running low on space and decides to migrate the data to a larger drive. During the migration, the server crashes and will not boot. The administrator attempts to restore from the latest backup but finds that the backup drive is corrupted and cannot be read. The company has no offsite backups. What should the administrator have done to prevent this situation?

A.Regularly test backup restorations to verify data integrity.

B.Implement a RAID 5 array instead of RAID 1 for better redundancy.

C.Document the backup procedure and create a disaster recovery plan.

D.Use a cloud-based backup service with offsite storage.

AnswerA

Why this answer

The correct answer is D: Regularly test backup restorations to verify data integrity. The administrator assumed backups were valid without verification. Option A is wrong because RAID 1 provides redundancy but does not protect against corruption or accidental deletion; the issue here is backup corruption.

Option B is wrong because cloud backup is a good practice but not strictly required; the root cause is lack of backup testing. Option C is wrong because while documentation is helpful, it would not prevent data loss from a corrupted backup drive.

Full explanation →

83

PBQhard

A large enterprise uses a centralized backup solution with a backup server running Commvault. Backups are stored on a deduplicated disk array and replicated to a secondary site for disaster recovery. The company's security team detects ransomware activity that has encrypted several file servers. The backup administrator checks the backup repository and finds that the backup data is also encrypted because the backup service account had permissions to modify backup files, and the ransomware propagated to the repository. The last known good backup is from two weeks ago, which is too old for the organization's RPO of 24 hours. The backup administrator is under pressure to restore operations quickly. Which of the following should the administrator implement to prevent this from recurring?

A.Immutable backup storage and a dedicated service account with least-privilege access.

B.Encrypt all backup data at rest and in transit.

C.Require multi-factor authentication for the backup service account.

D.Air-gap the backup repository by disconnecting it from the network except during backup windows.

AnswerA

Why this answer

The correct answer is A: Implement immutable backup storage and use a separate service account with write permissions only during backup windows. Immutable backups cannot be modified or deleted by any user or process, including ransomware. Option B is wrong because air-gapping alone does not prevent access if the backup server is compromised; immutable storage is more robust.

Option C is wrong because while MFA is a good security practice, it does not protect backups that are already accessible with valid credentials. Option D is wrong because encryption of backup data protects it during transit or while stored, but does not prevent the ransomware from encrypting the files if the backup system is accessible.

Full explanation →

84

MCQhard

A server has been randomly rebooting several times a day with no pattern. The administrator reviews the IPMI System Event Log and finds multiple 'Correctable ECC error' entries for DIMM slot B2. The server memory is configured with 16 DIMMs of the same type and manufacturer, all recently installed. What should the administrator do FIRST to resolve this issue?

A.Disable ECC in the firmware to prevent the module from reporting errors.

B.Reseat the DIMM in slot B2 and run a memory diagnostic test.

C.Increase the DRAM voltage slightly in the BIOS/UEFI to improve stability.

D.Replace the DIMM in slot B2 with an identical spare.

AnswerD

Correctable ECC errors point to a physical memory fault; proactive replacement prevents uncorrectable errors and downtime.

Why this answer

Correctable ECC errors indicate a failing or marginal memory module. The first step is to replace the DIMM showing errors. Option A is wrong because reseating does not guarantee the errors will stop, and the DIMM is likely faulty.

Option C is wrong because while increasing voltage might help with stability, it is not recommended as a first fix and could void warranty. Option D is wrong because disabling ECC removes error correction but does not fix the underlying hardware fault.

Full explanation →

85

MCQmedium

A server administrator is troubleshooting a physical server that randomly crashes once or twice a week. The administrator has already verified that the power supply is functioning correctly and has checked the event logs for critical errors. According to standard troubleshooting methodology, what should the administrator do next?

A.Check network cables and switch connections.

B.Run memory diagnostics (e.g., MemTest86) to test RAM.

C.Reinstall the operating system.

D.Replace the CPU with a known good one.

AnswerB

Random crashes are often caused by faulty memory; running diagnostics is a low-impact step to isolate the issue.

Why this answer

Option B is correct because random crashes often indicate a memory issue, and running memory diagnostics is a logical next step after verifying power and logs. Option A is premature because replacing the CPU is more invasive and less likely to resolve random crashes. Option C is a last resort after hardware issues are ruled out.

Option D is irrelevant to random crashes.

Full explanation →

86

MCQhard

Refer to the exhibit. A technician receives an alert from the monitoring system showing the error in the exhibit. The server is still online, but performance has degraded. Which of the following is the MOST likely cause and appropriate action?

A.The SATA controller driver is corrupted; reinstall the driver

B.The disk has a bad sector; run CHKDSK and monitor

C.The hard disk drive is failing; back up data and replace the drive

D.The disk is experiencing high I/O; upgrade to SSD

AnswerC

Controller errors on \Device\Harddisk0 typically mean the drive is failing. Backing up and replacing is the best course.

Why this answer

Event ID 11 from Disk source indicates a controller error, often due to a failing disk or cable. The most likely cause is a failing hard drive. Backing up and replacing the drive is the appropriate action.

Bad sectors might be the symptom but replacing is safer. Driver corruption is less likely; high I/O wouldn't cause a controller error.

Full explanation →

87

MCQhard

A RAID 5 array is degraded due to a failed disk. What is the best practice for recovery?

A.Replace the failed disk and restore from backup

B.Replace the failed disk and allow the array to rebuild automatically

C.Replace the failed disk and perform a manual rebuild from backup

D.Delete the logical drive and recreate the array

AnswerB

RAID 5 can rebuild using parity; replacing the disk triggers automatic rebuild, preserving data and uptime.

Why this answer

Option C is correct because replacing the failed disk and allowing automatic rebuild utilizes the array's redundancy and minimizes downtime. Option A destroys the existing configuration. Option B and D are unnecessary if the array can rebuild.

Full explanation →

88

MCQmedium

An administrator notices that a Linux server's /var/log/messages file is filled with repeated "eth0: link up" and "eth0: link down" entries every few seconds. The server is connected to a managed switch. Which of the following is the most likely cause?

A.The switch port is configured for auto-negotiation while the NIC is set to 1000/full

B.The NIC driver is outdated

C.Spanning Tree Protocol is blocking the port

D.The switch port is experiencing a flapping MAC address

AnswerD

MAC flapping causes the switch to detect constant changes, resulting in the physical link going up and down rapidly.

Why this answer

Option D is correct because MAC address flapping on a switch port causes the link state to repeatedly change. Option A would cause performance issues but not constant link state changes. Option B might cause instability but is not the typical cause of flapping.

Option C would block traffic but not cause the physical link to go up and down.

Full explanation →

89

MCQmedium

A server hosts a database that requires nightly backups. The backup strategy uses a full backup every Sunday and differential backups on other days. On Wednesday, the server fails. Which backup sets are required to restore to the most recent state?

A.Last full backup and all differential backups since Sunday

B.Last full backup only

C.Last full backup and the latest differential backup

D.Last full backup and all incremental backups since Sunday

AnswerC

This restores the database to the state at the time of the last differential, which includes all changes since Sunday.

Why this answer

A differential backup contains all changes since the last full backup. Therefore, only the last full backup and the latest differential are needed for a restore. Incremental backups would require all incrementals since the last full, but the scenario uses differential backups.

Full explanation →

90

MCQmedium

A server configured with RAID 5 has two failed drives. The array is offline and critical data is inaccessible. The administrator has replacement drives available. What should the administrator do to restore the data and array with minimal data loss?

A.Reconfigure the RAID to RAID 0 using the remaining good drives.

B.Replace both failed drives and initiate a full array rebuild.

C.Replace both failed drives and restore from backup.

D.Replace one failed drive, allow rebuild, then replace the second.

AnswerC

Dual drive failure in RAID 5 results in data loss; restoration from backup is required to recover data, and then the array can be recreated.

Why this answer

Option A is correct. RAID 5 can survive a single drive failure, but with two failed drives, the array is completely broken and cannot be rebuilt. Restoring from backup is the only reliable method to recover the data.

Options B and C incorrectly assume the array can still rebuild, and option D would worsen data integrity.

Full explanation →

91

PBQmedium

A medium-sized company runs an e-commerce platform on a cluster of three physical servers hosting virtual machines. The disaster recovery plan includes daily backups to a remote data center using Veeam Backup & Replication. The company's annual disaster recovery drill is scheduled for next week. During the drill, the IT team plans to simulate a complete site failure by powering off the primary data center. The recovery time objective (RTO) is 4 hours, and the recovery point objective (RPO) is 1 hour. The team successfully restores the VMs at the remote site, but the application experiences significant performance degradation and many transactions fail due to database inconsistency. Investigation reveals that the backup was taken at 2:00 AM, but the failure occurred at 10:00 AM, and the application's database had transactions between 2:00 AM and 10:00 AM that were not captured. What should the IT team do to improve the recovery process?

A.Configure RAID 10 on all database servers to improve disk performance.

B.Upgrade the WAN connection between sites to reduce backup transfer times.

C.Enable log shipping with point-in-time recovery for the database.

D.Adjust the RTO to 8 hours to allow for more comprehensive backups.

AnswerC

Why this answer

The correct answer is B: Implement log shipping with point-in-time recovery for the database. The RPO of 1 hour is not being met because the backup schedule is daily. Option A is wrong because while a faster WAN can reduce backup time, the core issue is the backup frequency, not bandwidth.

Option C is wrong because the issue is not data redundancy but recovery granularity; RAID protects against drive failure but not data loss from missing transactions. Option D is wrong because increasing RTO does not solve the RPO violation; the goal is to reduce data loss, not relax the time target.

Full explanation →

92

MCQeasy

A server administrator is troubleshooting a network connectivity issue on a server that has recently been moved to a different rack. The server can ping its own IP address but cannot ping the default gateway. Which of the following is the MOST likely cause?

A.Faulty Ethernet cable or incorrect patch panel port

B.Incorrect DNS server configuration

C.Incorrect subnet mask

D.Duplicate IP address on the network

AnswerA

A physical connectivity issue at layer 1 can prevent the server from reaching the gateway while still allowing the NIC to respond to its own IP.

Why this answer

Option A is correct because being able to ping self but not gateway suggests a layer 1 or 2 issue like a faulty patch cable. Option B is wrong because DNS would affect name resolution, not ping. Option C is wrong because incorrect subnet mask would affect self-ping or gateway detection.

Option D is wrong because duplicate IP would cause intermittent issues or conflict messages.

Full explanation →

93

MCQmedium

A technician installs additional RAM in a server. After powering on, the server emits a continuous beep code and does not POST. The server documentation indicates this beep code signifies a memory error. Which of the following is the MOST likely cause?

A.The total RAM exceeds the server's maximum supported capacity.

B.The new RAM is not fully seated in the memory slot.

C.The new RAM is ECC and the existing RAM is non-ECC.

D.The server BIOS needs to be updated to support the new RAM type.

AnswerB

A loose connection is the most frequent cause of memory errors after installation. Reseating the module usually resolves the issue immediately.

Why this answer

Memory errors after installation commonly result from improper seating. A beep code indicating memory detection failure points to a physical connection issue.

Full explanation →

94

MCQmedium

Refer to the exhibit. A backup job to a network share failed. The administrator reviews the backup log. What is the most likely cause of the failure?

A.The backup user account lacks appropriate permissions.

B.The backup server is powered off.

C.The network link is down.

D.The backup file path exceeds the maximum length.

AnswerA

The 'Access is denied' error is a classic indication of insufficient NTFS or share permissions on the target folder.

Why this answer

Option B is correct. The 'Access is denied' error clearly indicates a permissions problem—the backup user account does not have the necessary rights to write to the share. Option A would present a 'network path not found' or 'host unreachable' error.

Option C would also indicate network unreachable, not access denied. Option D would typically produce a 'path too long' error, not access denied.

Full explanation →

95

Multi-Selectmedium

A server administrator is troubleshooting a network connectivity issue where a newly installed server cannot communicate with other devices on the same subnet. The server has a static IP address configured. Other devices on the same switch can communicate. Which TWO of the following could be the cause of the issue? (Select TWO)

Select 2 answers

A.The DNS server address is incorrect.

B.The server's default gateway is incorrectly set.

C.The switch port is configured with port security and has learned a different MAC address.

D.Incorrect subnet mask configured on the server.

E.The DHCP server has exhausted its scope.

AnswersC, D

Port security limits allowed MAC addresses; if the port sees the new server's MAC, it may block the frames if the maximum is exceeded or the address is not authorized.

Why this answer

Options A and B are correct. An incorrect subnet mask (A) would cause the server to misinterpret which IPs are local, preventing communication with devices on the same subnet. Port security on the switch (B) could block traffic if the learned MAC address does not match.

Option C (default gateway) is irrelevant for same-subnet communication. Option D (DNS) affects name resolution, not basic IP connectivity. Option E (DHCP) is not used since the server has a static IP.

Full explanation →

96

MCQhard

A technician is troubleshooting a server that fails to boot after a scheduled power outage. The server is connected to a UPS. Upon pressing the power button, the server powers on briefly (fans spin, lights flash) and then shuts down after 2 seconds. The POST does not complete. The server has a dual power supply with each connected to a separate PDU. Which of the following is the MOST likely cause?

A.The UPS battery is depleted

B.One of the power supplies has failed

C.A short circuit in the motherboard

D.The CMOS battery is dead

AnswerC

A short circuit causes the power supply to detect overcurrent and shut down immediately, resulting in a brief power-on and then shutdown.

Why this answer

Option C is correct because immediate power-off after a brief spin-up is a classic symptom of a short circuit, often on the motherboard. Option A is wrong because a failed power supply would typically prevent any power-on or cause beep codes, not a brief power-on. Option B is wrong because the UPS battery condition would not cause this behavior if the server is receiving utility power; also the server is receiving power momentarily.

Option D is wrong because a dead CMOS battery would cause date/time loss but not prevent boot completely.

Full explanation →

97

MCQhard

Refer to the exhibit. The Print Spooler service on a critical Windows Server 2019 fails to start at every boot. The server was recently updated with the latest cumulative patch. Which of the following is the MOST likely cause?

A.The system drive has insufficient free space

B.A service on which the Print Spooler depends is not starting

C.A recent printer driver update is corrupted

D.The password for the service account has expired

AnswerB

Timeouts during service startup are often caused by a stalled or disabled dependency service, especially after OS updates.

Why this answer

Event ID 7000 with a timeout error strongly suggests a dependency service is not starting correctly. The Print Spooler depends on the Remote Procedure Call (RPC) service among others; a recent patch may have altered the startup configuration of a dependency. The Print Spooler runs under the LocalSystem account, so password expiration is not a factor.

A corrupt driver usually causes the service to crash after starting, not a timeout. Insufficient disk space would generate a different error.

Full explanation →

98

MCQeasy

Refer to the exhibit. A server technician sees the following output. What is the current status of the RAID array?

A.Rebuilding

B.Degraded

C.Healthy

D.Failed

AnswerB

'State : clean, degraded' and a 'removed' device confirm the array is running in a degraded mode without full redundancy.

Why this answer

The 'State' line clearly indicates 'clean, degraded', and one device is marked as 'removed'. The array is operational but missing a drive.

Full explanation →

99

PBQhard

A medium-sized organization runs several critical virtual machines on a Windows Server 2019 Hyper-V host with 64 GB of RAM and two 12-core processors. One of the VMs, a database server, has been experiencing intermittent performance degradation, specifically during peak hours. The VM is configured with 4 vCPUs and 16 GB of static memory. The host's overall CPU utilization rarely exceeds 40%, and memory usage is around 50%. The administrator logs into the host and checks the VM's CPU usage in Hyper-V Manager, which shows it averaging 65% with occasional spikes to 95%. However, inside the VM, Task Manager shows constant 95-100% CPU usage on all logical processors. No other VMs are reporting performance issues. The administrator needs to determine the root cause and apply a fix that does not involve adding more physical resources or rebooting the production VM during business hours. Which of the following actions should the administrator take?

A.Increase the VM's memory from 16 GB to 32 GB to reduce paging and improve performance

B.Increase the VM's vCPU count to 8 to handle the workload and reduce contention

C.Use Performance Monitor on the host to examine 'Hyper-V Hypervisor Virtual Processor' metrics for the VM and compare with in-guest CPU usage to identify scheduling issues

D.Check the host's overall CPU usage in Task Manager and increase the VM's vCPU count if the host has spare capacity

AnswerC

Why this answer

Option C is correct because comparing the host-level guest CPU metrics (which show 65% average) with the in-guest metrics (100%) reveals that the VM is being limited by its vCPU allocation, likely due to co-scheduling or contention with other VMs' vCPUs on the same physical cores. Investigating and adjusting CPU scheduling or reservation settings can alleviate this. Option A is wrong because the host's overall CPU is fine; the issue is within the VM or hypervisor scheduling.

Option B is wrong because increasing vCPUs without diagnosing the bottleneck might worsen contention. Option D is wrong because increasing memory won't resolve a CPU bottleneck.

Full explanation →

100

MCQeasy

A server fails to boot after installing new memory. The POST beep code indicates a memory error. What is the most likely cause?

A.The new memory is incompatible with the server

B.The memory module is not seated properly

C.The BIOS is not updated to support the new memory

D.The memory is installed in the wrong slot

AnswerA

Incompatibility (wrong type, speed, or rank) is a frequent cause of POST memory errors. The server's memory controller may fail to initialize the module.

Why this answer

The POST memory error most commonly indicates an incompatible or improperly seated memory module. Incompatible memory (e.g., wrong type, speed, or rank) is a frequent issue when adding memory to servers. Option B is less common because most servers auto-detect slots.

Option C is not required for basic memory compatibility. Option D would cause system instability, not a specific memory error.

Full explanation →

101

MCQmedium

Refer to the exhibit. A server administrator receives reports that an internal web server is inaccessible. After connecting locally, the administrator runs a command and receives the following output. Which of the following commands would best resolve the issue?

A.Disable SELinux and restart the httpd service

B.Run `yum update httpd` to update the application

C.Edit the configuration file to correct the typo on line 15

D.Install the mod_ssl module and restart httpd

AnswerD

The 'Invalid command' error for SSLCertificateFile means mod_ssl is not installed; installing it will provide the directive.

Why this answer

Option C is correct because the error indicates the mod_ssl module is missing; installing it provides the SSLCertificateFile directive. Option A updates the package but does not add missing modules. Option B would not help because the directive is spelled correctly.

Option D is unrelated to the module error.

Full explanation →

102

Multi-Selecthard

A server administrator needs to set up out-of-band management for a new server. Which THREE of the following are essential for successful configuration and remote access? (Choose three.)

Select 3 answers

A.A DHCP server configured to provide an IP to the management interface.

B.A dedicated management network interface (e.g., iDRAC, iLO dedicated port).

C.A Baseboard Management Controller (BMC) with proper firmware.

D.An installed operating system on the server.

E.A web browser or SSH client to access the management console.

AnswersB, C, E

A dedicated port physically separates management traffic from production data, which is fundamental to true out-of-band operation.

Why this answer

Out-of-band management relies on a dedicated hardware controller (BMC), a separate network interface for remote access, and a client-side tool to interact with it.

Full explanation →

103

MCQeasy

A financial services firm requires a disaster recovery solution that provides a Recovery Point Objective (RPO) of near zero and a Recovery Time Objective (RTO) of less than 2 hours. Which of the following site types is MOST appropriate?

A.Cloud-based backup with daily replication

B.Cold site

C.Warm site

D.Hot site

AnswerD

A hot site maintains near real-time synchronization and redundant hardware, allowing rapid failover with minimal data loss and downtime.

Why this answer

Option D is correct because a hot site is fully equipped, with near real-time data replication, enabling the fastest recovery and minimal data loss. A cold site (Option A) has the longest recovery time. A warm site (Option B) has some equipment but data must be restored from backup, increasing RTO and RPO.

Cloud-based backup with daily replication (Option C) does not meet near-zero RPO.

Full explanation →

104

MCQeasy

Refer to the exhibit. A Windows file server at a branch office lost network connectivity after a scheduled reboot. The administrator logs in via the console and runs `ipconfig /all`, which shows the output in the exhibit. The server should have a static IP of 10.0.0.50. What should the administrator do to restore connectivity?

A.Disable IPv6 on the network adapter.

B.The DHCP server is unreachable; check DHCP server availability.

C.Release and renew the DHCP lease.

D.Set a static IP configuration as intended.

AnswerD

Because the server is intended to use a static IP, the administrator must manually configure the IP, subnet mask, and gateway to restore connectivity.

Why this answer

Option A is correct. The exhibit shows an APIPA address (169.254.x.x), which indicates the server obtained an automatic private address because it could not reach a DHCP server. However, since the server is supposed to use a static IP, the administrator should directly configure the static IP settings.

Option B would fail because no DHCP server is reachable. Option C is true but not the correct solution for a server that needs a static IP. Option D is unrelated to the IPv4 configuration issue.

Full explanation →

105

MCQmedium

A server cannot connect to a specific network share. The administrator can successfully ping the server's IP address from the client. Which of the following is MOST likely causing the issue?

A.Incorrect subnet mask

B.Duplicate IP address on the network

C.DNS server is misconfigured

D.Host-based firewall blocking file sharing ports

AnswerD

Correct — Firewalls often allow ICMP but block TCP/UDP ports used by SMB/CIFS, so ping succeeds but share access fails.

Why this answer

Option C is correct because Windows Firewall or an equivalent host-based firewall may block SMB (port 445) or NetBIOS ports, preventing share access even though ICMP is allowed. Option A is wrong because DNS would affect name resolution, not reachability by IP. Option B is wrong because an incorrect subnet mask would generally prevent any communication, including pings.

Option D is wrong because a duplicate IP would cause intermittent connectivity or an IP conflict error, not a consistent inability to access shares while ping works.

Full explanation →

106

MCQeasy

A server technician replaces a failed RAM module with an identical spare. After installation, the server powers on but emits continuous short beeps and does not complete POST. Which of the following is the MOST likely cause?

A.The new RAM module is incompatible with the motherboard.

B.The RAM module is not fully seated in the slot.

C.The CPU has been damaged during the installation.

D.The power supply is providing insufficient voltage.

AnswerB

Continuous short beeps are a classic symptom of a memory issue, and reseating the module is the first troubleshooting step. Even identical modules can be improperly installed.

Why this answer

Continuous short beeps typically indicate a memory error, and the most common cause after a RAM replacement is that the module is not fully seated. Even though the module is known good and compatible, improper installation can prevent POST. Option C is correct because reseating the module will often resolve the issue.

Option A is incorrect because an incompatible module would likely produce a different beep code or no POST at all, but the module is identical and known good. Option B is incorrect because insufficient power would likely prevent the server from powering on at all, not cause RAM beep codes. Option D is incorrect because CPU damage is unlikely from a simple RAM swap and would produce different symptoms.

Full explanation →

107

MCQmedium

A technician is troubleshooting a server that fails to boot after a power outage. The server displays a "Non-system disk or disk error" message. Which action should the technician take first?

A.Run a filesystem check utility from a recovery disk.

B.Replace the hard drive with a known good one.

C.Reseat the hard drive data and power cables.

D.Check the boot order in the BIOS configuration.

AnswerD

Power outages can reset BIOS settings, changing the boot order. Verifying and correcting the boot order is the best first step.

Why this answer

The error indicates that the server cannot find a bootable device. The most common cause after a power outage is a change in the BIOS boot order. Checking the boot order is a quick, non-invasive first step.

Replacing the drive or reseating cables may be necessary if boot order is correct, but starting with boot order is best.

Full explanation →

108

MCQeasy

A server technician is mounting a 4U server in a standard 19-inch rack. Which of the following safety precautions is MOST important before lifting the server into place?

A.Ensure the server's power supply voltage matches the rack's PDU.

B.Install cable management arms before mounting.

C.Confirm that the rack's weight capacity can support the server.

D.Verify that the rack is properly grounded.

AnswerC

Exceeding weight limits can cause the rack to become unstable or collapse, posing a direct physical danger to the technician and nearby equipment.

Why this answer

Ensuring the rack can support the server's weight is critical to prevent the rack from tipping or collapsing, which could cause serious injury or equipment damage.

Full explanation →

109

PBQmedium

A regional hospital operates two data centers located 10 miles apart, with synchronous replication of critical patient record systems between them. The replication ensures that any write to the primary storage is immediately mirrored to the secondary site. The hospital also maintains weekly full backups to LTO-8 tapes, which are stored in a fireproof safe at an offsite warehouse 30 miles away. The IT team has not implemented storage snapshots or continuous data protection due to budget constraints. Last week, a ransomware attack encrypted all files on the primary site. The replication process promptly mirrored the encrypted data to the secondary site, rendering both copies inaccessible. The attackers demanded $500,000 in Bitcoin. The hospital's disaster recovery plan specifies an RPO of 1 hour and an RTO of 4 hours. The IT director must now choose a restoration strategy that minimizes data loss and downtime while ensuring a clean, malware-free environment. The backup tapes are confirmed to be unencrypted and free of ransomware. Which of the following actions should the IT director take first?

A.Pay the ransom demand to obtain the decryption key and decrypt both sites.

B.Restore the most recent tape backup to the primary site and re-enable replication.

C.Fail over to the secondary data center and attempt to decrypt the ransomware using available tools.

D.Wipe the secondary data center storage, restore from the latest clean tape backup at the secondary site, and then reverse replication to the primary.

AnswerD

Why this answer

Option C is correct because both the primary and secondary copies are encrypted, so the only clean data source is the offsite tape. Wiping the secondary site, restoring from tape there, and then reversing replication to the primary ensures a malware-free environment and uses the existing replication infrastructure to bring the primary back online quickly, potentially within the 4-hour RTO. Option A is unrealistic since no decryption tool is available for modern ransomware without the key.

Option B runs the risk of the primary becoming reinfected if any remnants remain, and it leaves the encrypted secondary uncorrected. Option D is inadvisable as paying the ransom does not guarantee data recovery and funds criminal activity.

Full explanation →

110

MCQhard

A server running a critical application fails to boot with the error: 'Boot device not found.' The server uses UEFI and a RAID 5 array for the OS. The administrator verifies that all disks are present and powered. Which of the following should the administrator check FIRST?

A.The array configuration in the RAID BIOS

B.The integrity of the OS boot files

C.The boot order in UEFI

D.The RAID controller battery

AnswerA

Correct — The RAID setup utility will show if the array is degraded, offline, or missing, which is the most likely cause of the boot device error.

Why this answer

Option C is correct. With all disks powered and present, the RAID array may be degraded or its configuration lost, leading to the boot device error. Checking the array configuration in the RAID controller's BIOS (or UEFI setup) allows verifying that the array is intact and the boot volume is accessible.

Option A (RAID battery) is important for write cache but not directly causing 'boot device not found.' Option B (boot order) might be an issue, but after checking that the RAID array is operational; if the array is offline, boot order changes won't help. Option D (OS boot files) should be checked after ensuring the RAID subsystem is functional.

Full explanation →

111

MCQmedium

A server administrator is upgrading the RAM on a server that supports quad-channel memory architecture. They install four identical 16GB DDR4 ECC modules, but the server only recognizes the memory as operating in single-channel mode. Which of the following is the most likely cause?

A.The DIMMs are not installed in the correct slots

B.One of the DIMMs is faulty

C.The DIMMs do not support ECC

D.The DIMMs are not registered (RDIMM)

AnswerA

Quad-channel mode requires DIMMs to be installed in specific slots according to the motherboard manual. Incorrect slot population results in lower channel modes.

Why this answer

Option C is correct because quad-channel memory requires DIMMs to be populated in specific, color-coded slots according to the motherboard's population rules. If the modules are not in the correct slots, the memory controller will operate in a lower channel mode. Option A is wrong because faulty modules would likely cause POST failures or memory errors, not simply a channel mode reduction.

Option B is wrong because ECC support is not required for channel mode operation; it is an error-correction feature. Option D is wrong because while registered DIMMs are often used in servers, unregistered DIMMs can still operate in quad-channel mode if supported.

Full explanation →

112

MCQmedium

A technician is troubleshooting a server that fails to boot. The server powers on, fans spin, but no video output and no beep codes. The technician reseats the RAM and GPU, but the issue persists. Which of the following should the technician check NEXT?

A.Replace the CMOS battery

B.Test or replace the CPU

C.Flash the BIOS firmware

D.Replace the power supply

AnswerB

A faulty CPU can cause the system to power on with fans but no POST or beep codes. This is a logical next step after verifying RAM and GPU.

Why this answer

Option C is correct because if the system powers on but no POST, a faulty CPU is a common cause when other components are reseated. Option A is wrong because power supply issues would typically cause no power or cycling. Option B is wrong because the CMOS battery is for clock/BIOS settings, not boot failure.

Option D is wrong because BIOS corruption is less likely after reseating.

Full explanation →

113

Multi-Selecthard

Following a firmware update on a server's RAID controller, the server fails to boot and reports "No boot device found." The RAID array status shows healthy in the controller BIOS. Which THREE of the following actions should the administrator take to resolve the issue? (Choose three.)

Select 3 answers

A.Roll back the RAID controller firmware

B.Rebuild the RAID array from backup

C.Reset the RAID controller configuration to defaults

D.Verify the boot order in the system BIOS

E.Install the latest drivers for the RAID controller in the OS

AnswersA, C, D

If the new firmware caused the boot issue, rolling back to the previous version can restore functionality.

Why this answer

Options A, B, and E are correct. Rolling back firmware can undo a bad update. Verifying boot order ensures the correct device is first.

Resetting the controller configuration may clear incompatible settings from the update. Rebuilding the array is unnecessary as it is healthy. Installing OS drivers is impossible without a booted OS.

Full explanation →

114

MCQeasy

A technician is installing a new server for a department. The server will run a single application that requires high reliability. The operating system should be protected against a single disk failure without sacrificing read performance. Which RAID configuration is MOST appropriate?

A.RAID 5

B.RAID 6

C.RAID 1

D.RAID 0

AnswerC

RAID 1 mirrors data across two disks, providing fault tolerance and excellent read performance for the OS.

Why this answer

Option D is correct because RAID 1 mirrors the OS drive, providing fault tolerance and good read performance. Option A (RAID 0) has no redundancy. Option B (RAID 5) requires at least three disks and has write penalty.

Option C (RAID 6) requires at least four disks and is overkill for a simple OS mirror.

Full explanation →

115

MCQeasy

A server fails to boot with an 'Operating System Not Found' error. The BIOS detects the hard drive. What is the MOST likely cause?

A.Failed CPU

B.Incorrect memory timings

C.Overheating

D.Corrupted Master Boot Record

AnswerD

If the MBR is damaged or missing, the BIOS can detect the drive but cannot hand off to the OS bootloader.

Why this answer

Option B is correct because a corrupted Master Boot Record (MBR) can prevent the system from locating the OS loader even when the drive is detected by BIOS. Option A (incorrect memory timings) would typically cause POST failures, not a missing OS message. Option C (failed CPU) would prevent POST entirely.

Option D (overheating) would likely cause shutdowns before OS load.

Full explanation →

116

MCQmedium

A server is running out of disk space on the system drive (C:). The server is running Windows Server 2019. The IT manager wants to add more space without downtime. The server has one free SATA port and one available drive bay. Which of the following is the BEST solution?

A.Shrink the existing partition and extend it onto an additional drive

B.Add a new drive, initialize it, and configure a RAID 1 mirror with the existing drive

C.Add a new drive, create a new partition, and mount it as a folder in the system drive

D.Replace the current system drive with a larger one and restore from backup

AnswerC

This allows adding space without downtime; the mounted folder appears as part of C: drive.

Why this answer

Option C is correct because mounting a new drive as a folder into the C: drive allows immediate space expansion without downtime or rebooting. Option A is wrong because it requires downtime for replacement and restore. Option B is wrong because configuring a mirror would require converting to dynamic disk and may require a reboot; also it duplicates data but does not add usable capacity.

Option D is wrong because shrinking the system partition and extending to another disk is complex and often requires reboot or specialized software.

Full explanation →

117

PBQhard

A company uses a two-node failover cluster for a critical database application. The cluster consists of Node A and Node B, with shared storage connected via SAS. During a routine check, the administrator discovers that Node A has failed and the cluster resources did not fail over to Node B. The cluster service is running on Node B, but the database resource remains offline. Node B can successfully ping Node A's management IP address but not the dedicated cluster heartbeat IP. The shared storage appears in the operating system on Node B, but attempts to bring the disks online fail. The administrator must restore database service as quickly as possible. Which of the following actions should the administrator take FIRST?

A.Check and repair connectivity to the shared storage from Node B

B.Run the cluster validation wizard

C.Force a quorum on Node B using the /forcequorum switch

D.Reboot Node A

AnswerA

Why this answer

The immediate problem is that the database resource cannot start because the shared storage cannot be brought online. This indicates a storage connectivity issue (e.g., SAS cable, HBA, or multipath problem) that must be resolved before any cluster actions can succeed. Rebooting Node A (A) might restore the node but takes time and may not fix the storage access for Node B.

Running the cluster validation wizard (B) is a diagnostic step, not a repair action, and would delay service restoration. Forcing quorum on Node B (C) allows cluster operations but does not address the underlying storage problem; the disk would still fail to come online.

Full explanation →

118

PBQeasy

A small business has purchased a new server to function as a file server for 25 employees. The server is equipped with four 1TB SATA hard disk drives and no hardware RAID controller; the operating system supports software RAID. The business owner's primary requirements are data redundancy to protect against a single drive failure and maximum usable storage capacity, while keeping costs low. The IT technician is tasked with configuring the storage. The technician evaluates the following options: RAID 0 striping across all four drives; RAID 1 mirroring using two pairs (drives 1+2 mirrored, drives 3+4 mirrored), providing two separate volumes; RAID 5 with parity across all four drives; and RAID 10 combining mirroring and striping. The technician needs to recommend the configuration that best meets the requirements. Which of the following should the technician implement?

A.Configure RAID 10 by mirroring two pairs and striping across them, providing 2TB of storage with high performance and redundancy.

B.Configure RAID 5 to stripe data and parity across all four drives, providing 3TB of usable storage with single-drive fault tolerance.

C.Configure RAID 0 to stripe across all four drives for maximum 4TB storage and performance.

D.Configure RAID 1 with two mirrored pairs, providing 2TB of total storage across two volumes, ensuring redundancy.

AnswerB

Why this answer

Option C is correct because RAID 5 provides single-drive fault tolerance and maximizes usable capacity (3TB out of 4TB), offering the best balance between redundancy and storage space. Option A provides no redundancy. Option B uses mirroring, which wastes half the total capacity (only 2TB usable).

Option D also provides only 2TB and adds performance benefits that are not the primary requirement, while costing more in usable space.

Full explanation →

119

MCQeasy

A technician is monitoring a server with a RAID 5 array that has a hot spare. One of the drives fails. Which of the following actions will occur automatically in this configuration?

A.The server will shut down to protect data

B.The array will continue to operate in degraded mode until manual intervention

C.The data will be mirrored to another server

D.The hot spare will be activated and the array will start rebuilding

AnswerD

This is the standard behavior of a hot spare—automatic replacement and rebuild to restore redundancy.

Why this answer

When a hot spare is present, the RAID controller automatically activates the spare and begins rebuilding the array without operator intervention. Degraded operation without a hot spare requires manual replacement. Shutdown and mirroring are not typical behaviors.

Full explanation →

120

MCQmedium

A server fails to power on after a technician replaced the power supply unit (PSU). The technician notices the server's LEDs are off and no fans are spinning. Which of the following should the technician do FIRST?

A.Replace the PSU with another new unit

B.Replace the motherboard

C.Verify the incoming power is within acceptable voltage range

D.Check that the new PSU is properly seated and all power cables are connected

AnswerD

After a PSU replacement, improper seating or disconnected cables are common. This low-effort check addresses the most probable cause.

Why this answer

The FIRST step is to check that the new PSU is properly seated and all power cables are connected, as this is the most likely cause after a replacement. Replacing the motherboard or PSU again is premature without verifying connections. Checking incoming power is a possibility but less likely if the server was working before.

Full explanation →

121

MCQmedium

A server administrator notices that a database server is experiencing high CPU usage at specific times of the day. After checking logs, the administrator finds that a report generation task scheduled at those times is causing the issue. The task cannot be rescheduled or optimized further. Which of the following actions should the administrator take to ensure the server remains responsive for other applications during peak usage?

A.Add more virtual CPUs to the server's VM.

B.Configure the task to run at a lower priority.

C.Move the database to a server with faster CPU cores.

D.Configure processor affinity to dedicate a core to the database process.

AnswerB

Setting a lower scheduling priority (e.g., increasing nice value) allows other processes to preempt the CPU when needed, improving overall system responsiveness.

Why this answer

Option D is correct because lowering the priority (nice value) of the task allows other processes to utilize the CPU without being blocked. Option A is wrong because adding vCPUs does not guarantee other processes will get CPU time if the task consumes all available cycles. Option B is wrong because processor affinity only pins a process to a specific CPU core but does not change its scheduling priority.

Option C is wrong because replacing hardware is not immediate and may not solve scheduling contention.

Full explanation →

122

PBQmedium

A small business plans to deploy a new on-premises server for a virtualization environment. The server will run a hypervisor hosting four virtual machines: a domain controller, a file server, a web application server, and an SQL database server. The business expects moderate workloads and needs to ensure reliable performance and data protection. The procurement department has proposed the following server configuration: single Intel Xeon E-2300 series CPU (4 cores, 8 threads), 16 GB DDR4 ECC RAM, two 1 TB SATA hard drives configured in RAID 1, a single 1 GbE network interface, and a 500W power supply. The IT manager reviews the proposal and identifies several deficiencies that will not meet the expected workload requirements. Which of the following changes to the server configuration is the MOST important to address first to ensure the VMs can run effectively?

A.Increase the RAM to at least 32 GB to support the four VMs.

B.Replace the SATA hard drives with SSDs and configure RAID 10 for better I/O performance.

C.Add a second 1 GbE network interface and configure NIC teaming for redundancy.

D.Upgrade the CPU to a model with at least 8 cores and 16 threads.

AnswerA

Why this answer

In virtualization, RAM is typically the first resource to become a bottleneck because each VM requires its own memory allocation. 16 GB is insufficient for four VMs, especially with an SQL database server, which often demands a large memory footprint. Option C is correct because increasing RAM to at least 32 GB allows the hypervisor to allocate adequate memory to each VM, preventing excessive swapping and performance degradation. Option A is incorrect because the proposed CPU (4c/8t) can handle moderate workloads if RAM is sufficient; more cores are secondary.

Option B is incorrect because while SSDs and RAID 10 would improve disk I/O, the immediate showstopper is insufficient RAM, which would cause VMs to fail or thrash regardless of storage speed. Option D is incorrect because a single 1 GbE link might be adequate initially, and NIC teaming addresses redundancy, not the fundamental resource deficit.

Full explanation →

123

PBQhard

A company has a virtualized server environment with two physical hosts running VMware vSphere. Each host has 2 CPUs, 128GB RAM, and 6x 600GB SAS drives in RAID 10. Recently, host A experienced a power surge that caused it to shut down abruptly. After restarting, the host boots but the RAID controller reports that one of the drives in the RAID 10 array is missing. The administrator has a replacement drive of the same model. What should the administrator do first?

A.Use the RAID controller utility to set the new drive as a hot spare and then reboot

B.Replace the missing drive with the new one and allow the RAID controller to automatically rebuild

C.Check the RAID controller logs to determine if the drive is faulty or if it's a connection issue, and then reseat the drive or replace cables before replacing

D.Rebuild the entire RAID array after backing up data from the surviving drives

AnswerC

Why this answer

The most appropriate first step is to troubleshoot the connection. The drive might be loose or the cable damaged due to the surge. Option C is correct because reseating or checking cables is non-invasive and could resolve the issue without replacing a working drive.

Option A is incorrect because replacing immediately might be unnecessary if the drive is fine. Option B is incorrect because setting as hot spare won't help if the drive is not detected. Option D is incorrect because rebuilding the entire array is drastic and risks data loss.

Full explanation →

124

MCQeasy

A small business has a limited budget and can tolerate up to 72 hours of downtime in the event of a disaster. Which type of disaster recovery site would be most cost-effective?

A.Cloud-based DR with pay-as-you-go.

B.Cold site with no pre-configured hardware.

C.Hot site with real-time replication.

D.Warm site with pre-installed hardware but no data.

AnswerA

Cloud DR allows the business to pay only when resources are consumed, eliminating upfront investment and ongoing idle hardware costs, ideal for a limited budget and relaxed RTO.

Why this answer

Option D is correct because a cloud-based DR site with pay-as-you-go model requires no upfront investment in hardware and can be spun up as needed, making it cost-effective for a business with a high downtime tolerance. Option A is wrong because a hot site is the most expensive, with real-time replication. Option B is wrong because a warm site requires pre-installed hardware that incurs ongoing costs, even if data is not up-to-date.

Option C is wrong because a cold site still requires occasional maintenance and may have hidden costs; modern cloud DR can be cheaper and more flexible.

Full explanation →

125

PBQeasy

A junior administrator is managing a Linux server used by a development team. The root filesystem (/) has reached 98% capacity, causing the system to slow down and some applications to fail. The server has an LVM volume group with 20 GB of free space, but the root logical volume is 50 GB with an ext4 filesystem. The administrator needs to free space quickly and safely without rebooting or adding new disks. They log in via SSH and want to identify where the large files are and then take action. There are concerns about accidentally deleting critical system files or logs that might be needed for auditing. The server has the following typical directories: /var (with logs), /home (user files), /opt (application files), /tmp. Which of the following sequences of actions is the most appropriate to resolve the issue?

A.Run 'du -sh /*' to locate large directories, then examine and compress or truncate old log files in /var/log

B.Execute 'rm -rf /tmp/*' to clear temporary files and regain space

C.Use 'find / -type f -size +100M -exec rm {} \;' to delete all files larger than 100MB

D.Extend the root logical volume by 10 GB using 'lvextend' and then resize the filesystem with 'resize2fs'

AnswerA

Why this answer

Option A is correct because it uses 'du -sh /*' to safely identify the largest directories, then targets specific log files in /var/log that can be compressed or moved, freeing space without deleting required files. Option B is wrong because blindly removing all files in /tmp may delete needed temporary files for running applications. Option C is wrong because using 'find' with 'exec rm' is very dangerous and could delete critical files if misused.

Option D is wrong because resizing the filesystem, while possible with LVM, should be considered after attempting to free space safely; also the free space in VG might be needed elsewhere.

Full explanation →

126

MCQmedium

A financial services firm requires a disaster recovery site that provides immediate failover with zero data loss. Which type of site should they implement?

A.A warm site with asynchronous replication.

B.A cloud-based site with daily snapshots.

C.A cold site with tape restoration.

D.A hot site with synchronous replication.

AnswerD

Synchronous replication ensures data is mirrored in real-time, enabling immediate failover with no data loss.

Why this answer

Option A is correct because a hot site with synchronous replication ensures that data is written to both primary and secondary sites simultaneously, providing zero RPO and immediate failover. Option B (warm site) requires some time to bring systems online, leading to downtime and potential data loss. Option C (cold site) involves significant setup time and last-known-good backup restoration.

Option D (cloud with daily snapshots) introduces an RPO of up to 24 hours, not zero data loss.

Full explanation →

127

PBQmedium

A mid-sized manufacturing company operates a primary data center with all critical servers. They have a warm standby site located 100 miles away. For databases, the primary SAN uses synchronous replication to the standby SAN; no tape backups are taken for databases. File and application servers are backed up to an on-premises tape library using nightly incrementals with a weekly full backup every Sunday. Tapes are shipped off-site every Monday morning. On Tuesday morning, a ransomware attack encrypts the entire primary SAN. Because of the real-time replication, the standby SAN is encrypted almost instantly. The on-site tape library is also connected to the network and its tapes, including Sunday's full and Monday's incremental, are encrypted by the attack. The most recent off-site shipment was the previous Monday (eleven days ago), meaning the off-site tapes contain a full backup from eleven days ago and daily incrementals up to that point. The company's RPO is 1 hour for databases and 24 hours for file servers; RTO is 8 hours. The IT director must decide the best immediate course of action to restore operations while adhering to the DR plan as closely as possible.

A.Rebuild all database servers from scratch and restore file servers from the most recent off-site tapes, accepting 11 days of data loss for file servers too.

B.Attempt to restore the databases from the replicated SAN by breaking replication and scanning for uncorrupted blocks.

C.Pay the ransom demand to the attackers in hopes of receiving the decryption key.

D.Restore all systems from the 11-day-old off-site tapes, accepting the loss of data generated during the last 11 days.

AnswerD

Why this answer

Option D is correct because the off-site tapes are the only clean, unaffected backups available. Restoring from them is the only way to avoid paying the ransom and to ensure data integrity, even though it means losing 11 days of data. Option A is wrong because paying the ransom does not guarantee data recovery, encourages further crime, and may not meet compliance requirements.

Option B is wrong because the replicated SAN data is already encrypted and likely unrecoverable without the decryption key. Option C is wrong because rebuilding databases from scratch is unnecessary when the off-site tapes include database backups (from the full/incremental set) and would result in far greater data loss.

Full explanation →

128

PBQmedium

You are a server administrator at a mid-sized company that hosts its own on-premises Exchange server and file server. The infrastructure consists of three racks: Rack A contains the core switches and firewalls, Rack B contains the Exchange server (Dell PowerEdge R740) and the file server (HP ProLiant DL380 Gen10), and Rack C contains backup devices and a tape library. The data center cooling is provided by a raised-floor system with perforated tiles. Recently, the file server has been experiencing random shutdowns during peak usage hours (10 AM to 2 PM). The shutdowns are preceded by system event log warnings indicating that the CPU temperature has exceeded the threshold. The ambient temperature around the rack is 20°C (68°F) as measured by a handheld thermometer. Other servers in Rack B do not exhibit this behavior. The file server is a 2U server with two Xeon processors, 128 GB RAM, and six hot-swap SATA drives. It runs Windows Server 2019. The server has been in service for three years with no prior issues. The data center manager has noted that the perforated tiles are clear of obstructions. You have verified that the fans in the file server are spinning and the internal air filters are clean. Which of the following is the MOST likely cause of the overheating issue?

A.The ambient temperature sensor in the data center is reporting incorrectly and the actual temperature is higher.

B.The internal fans are not operating at full speed due to a failed fan controller.

C.The file server's power supply is failing and causing voltage drops that affect fan performance.

D.The perforated tile under the file server has insufficient airflow due to cable blockage below the raised floor.

AnswerD

Why this answer

Option B is correct because the file server's shutdowns occur during peak hours when cooling load is highest. If the server is located in a spot with inadequate underfloor airflow (e.g., a tile blocked by cables or a misaligned tile), it will not receive enough cool air, leading to CPU overheating despite the ambient reading. Option A is incorrect because the fans are verified to be spinning and filters clean.

Option C is unlikely because the ambient is normal and other servers are fine. Option D is possible but not as specific to peak hours; a failing PSU usually causes power loss, not CPU thermal events.

Full explanation →

129

PBQhard

The Coho Vineyard company operates a two-node Windows Server failover cluster to provide high availability for a critical SQL database. Node A has been running the database workload without issues, while Node B was taken offline two weeks ago due to a memory module failure. The faulty memory was replaced, and Node B was powered on. The administrator verified that Node B boots correctly, the network links are up, and the cluster service is running. However, the database role fails to start on Node B. Checking the cluster logs reveals that Node B cannot join the cluster, and the event 'Cluster service has lost quorum' is recorded. The administrator confirms both nodes can ping each other and access the shared SAN storage, but the cluster disk resource appears as 'Offline' on Node B. What should the administrator do to resolve the issue and bring the database online?

A.Evict Node B from the cluster and re-add it.

B.Manually force start the cluster service on Node B with the /forcequorum switch.

C.Restore the system state backup on Node B.

D.Run the cluster validation wizard to check configuration.

AnswerA

Why this answer

Evicting and re-adding the node clears stale configuration and allows it to rejoin the cluster properly after an extended period offline and hardware replacement.

Full explanation →

130

MCQhard

A Linux database server has recently exhibited sluggish response times. An analysis of system performance shows high CPU wait I/O, frequent page swapping, and a low cache hit ratio. The server has 16GB of RAM, and the database itself stores 100GB of active data. Which of the following is the MOST effective long-term solution to improve performance?

A.Increase the physical RAM in the server to at least 64GB.

B.Tune the database engine's query cache size.

C.Configure the server to use a larger swap partition.

D.Replace the existing hard drives with faster SSDs.

AnswerA

More RAM reduces swapping and allows caching of a larger working set, directly addressing the high I/O wait and low cache hit ratio.

Why this answer

Option C (Increase physical RAM to 64GB) is correct because the server is experiencing memory pressure leading to excessive swapping and low cache utilization. More RAM allows the database to cache a larger portion of active data in memory, reducing I/O wait and improving response times. Option A (Add faster SSDs) may reduce I/O wait but does not address the root cause—memory starvation.

Option B (Tune the database query cache) might provide minor relief but is not a substitute for adequate memory. Option D (Increase swap space) would worsen performance by enabling more swapping.

Full explanation →

131

PBQmedium

A medium-sized business runs a critical internal application on a single physical server running Windows Server 2019. The application is memory-intensive, often using up to 24 GB out of 32 GB RAM during peak hours. Over the past week, the server has experienced three unexpected reboots, each occurring during peak load. The server is not part of a cluster, and all data is stored on local disks. You have checked the Windows System event log and found Event ID 41 (Kernel-Power) indicating an unexpected shutdown. There are no related critical errors in the Application log. You have also reviewed the server's firmware logs and found multiple corrected memory errors (ECC) over the last month, with an increase in frequency just before each crash. The server is under warranty, and the hardware vendor's diagnostic tools report a failing memory module in DIMM slot A1. The vendor has recommended replacing the faulty DIMM immediately. However, the server is currently processing critical end-of-quarter financial reports that cannot be interrupted for at least 6 hours. Which of the following is the BEST course of action to minimize risk of data loss and downtime until a planned maintenance window?

A.Use Windows Memory Diagnostic tool to try to isolate the memory region and prevent the application from using it.

B.Continue running the server as is, as ECC memory can correct errors and the server will only crash if errors are uncorrectable; the risk is low.

C.Immediately shut down the server, replace the faulty DIMM, and restart.

D.Inform management of the criticality, request emergency approval for immediate maintenance, and if denied, ensure current backups are verified and monitor the server closely for any signs of degradation until the maintenance window.

AnswerD

Why this answer

Option D is correct because it follows proper change management: informing stakeholders, seeking emergency approval if needed, and mitigating risk by verifying backups and monitoring. Option A is wrong because immediately shutting down would interrupt critical processing and potential data loss, without management approval. Option B is wrong because Windows Memory Diagnostic is a boot-time tool and cannot effectively isolate memory regions to avoid crashes on a running production system.

Option C is wrong because the server has already crashed, indicating uncorrectable errors; continuing without action risks data corruption and further unplanned outages.

Full explanation →

132

MCQmedium

A server displays a 'CMOS battery low' error during POST. After the technician replaces the CR2032 battery with a new one, the server still loses date and time settings when disconnected from power. Which of the following should the technician try NEXT?

A.Check the power supply for voltage fluctuations

B.Update the BIOS firmware

C.Replace the motherboard

D.Verify the new battery is functional and properly seated

AnswerD

A 'dead on arrival' battery or poor contact is a common cause. Checking with a multimeter or trying another new battery is the logical next step.

Why this answer

Option A is correct because it is possible the new battery is defective, installed incorrectly, or not making proper contact. The first step is to verify the battery itself and its installation. Option B is wrong because a faulty motherboard is possible, but troubleshooting should start with the simplest and most likely cause.

Option C is wrong because power supply fluctuations are unlikely to cause CMOS settings loss specifically when unplugged. Option D is wrong because the BIOS chip retaining settings is part of the CMOS circuit, but the immediate issue is likely the power source (battery) for the CMOS.

Full explanation →

133

MCQhard

After applying a Windows security patch, a server fails to boot and displays 'Bootmgr is missing'. The server is UEFI-based. Which of the following is the MOST efficient way to resolve the issue?

A.Use the recovery environment to repair the boot loader.

B.Reset the BIOS to factory settings.

C.Replace the hard drive and restore from backup.

D.Boot from the installation media and run chkdsk.

AnswerA

Tools like bootrec /fixboot in the recovery environment are specifically designed to fix boot manager issues on UEFI systems.

Why this answer

Option D is correct because the error indicates boot loader corruption, and the recovery environment can repair it without reinstalling the OS or replacing hardware. Option A: chkdsk checks disk errors, not boot loader integrity. Option B is overly destructive and time-consuming.

Option C: BIOS reset does not affect UEFI boot entries or file system boot loader files.

Full explanation →

134

PBQhard

Your organization is migrating a Windows Server 2019 file server with 2 TB of shared data to a new server running Windows Server 2022. The migration must minimize user downtime and ensure file permissions are preserved. Users access files during business hours (8 AM to 6 PM) and the migration must be completed within a four-hour window starting at 10 PM on Saturday. You plan to use DFS Replication (DFSR) for initial data copy and then perform a final synchronization during the cutover. After setting up DFSR between the old and new servers, you realize that the initial replication will take approximately 12 hours due to the large number of files. What should you do to complete the migration within the allowed window?

A.Use robocopy to pre-stage the data from old to new server during off-hours before the cutover, then enable DFSR to replicate only changes made after pre-staging; during the cutover window, do a final DFSR sync

B.Disable DFSR and use robocopy with /MIR /COPYALL during the cutover window to copy all data

C.Perform a full backup of the old server and restore to the new server during the cutover window using Windows Backup

D.Increase the DFSR staging quota and bandwidth throttling to accelerate initial replication

AnswerA

Why this answer

Option C is correct because pre-staging data using robocopy with appropriate flags (copying security and attributes) and then enabling DFSR for the delta changes is a best practice for large migrations. Option A is wrong because simply increasing DFSR bandwidth does not reduce the time needed for initial replication of 2 TB. Option B is wrong because using robocopy alone during the cutover window may not complete within four hours if you need to copy all data; pre-staging is required.

Option D is wrong because performing a full backup and restore during the window is too time-consuming for 2 TB.

Full explanation →

135

MCQeasy

A server technician has just replaced a failed hard drive in a RAID 5 array. After inserting the new drive, the array begins rebuilding, but after 10 minutes, the rebuild fails and the array status shows 'degraded' again. Which of the following is the MOST likely cause?

A.The new drive has a higher rotational speed.

B.The new drive has a different firmware version than the other drives.

C.The new drive is not hot-swappable and was inserted while the server was on.

D.The new drive is larger than the other drives in the array.

AnswerD

A larger drive may cause rebuild failure because the RAID controller cannot properly integrate a disk with greater capacity than existing members.

Why this answer

Option A is correct. In RAID 5, if the replacement drive is larger than the other drives, some RAID controllers will fail the rebuild because they cannot utilize the extra capacity or may encounter metadata inconsistencies. Option B is unlikely because enterprise drives are typically hot-swappable.

Option C (firmware differences) can sometimes cause issues but is less common than size mismatch. Option D (rotational speed) rarely prevents a rebuild.

Full explanation →

136

MCQhard

A network administrator needs to configure centralized authentication for network devices. The solution must provide encryption of the entire authentication process, support for multiple protocols, and accounting of user actions. Which protocol should be used?

A.TACACS+

B.Kerberos

C.RADIUS

D.LDAP

AnswerA

TACACS+ encrypts the entire body of the packet, supports multiple protocols, and provides detailed accounting, fitting the requirements.

Why this answer

TACACS+ encrypts the entire authentication process, offers granular control over authorization, and supports accounting. RADIUS (B) only encrypts the password, not the entire session. LDAP (A) is a directory service, not an encryption-focused authentication protocol.

Kerberos (C) uses tickets and encryption but is primarily for single sign-on within a domain, not commonly used for network device administration.

Full explanation →

137

MCQmedium

A system administrator needs to configure secure remote access to servers in the data center. The current setup uses password-based SSH, but the security policy mandates multifactor authentication and prevention of brute-force attacks. Which solution best meets these requirements?

A.Implement SSH key authentication only.

B.Use SSH with public key authentication and install fail2ban.

C.Deploy a VPN with certificate-based authentication and enable MFA.

D.Enable RDP with network-level authentication.

AnswerC

A VPN secures the entire communication channel, certificates provide strong machine-level trust, and MFA adds the required second factor for user authentication.

Why this answer

Option C is correct because a VPN with certificate-based authentication provides strong encryption and identity verification, and enabling MFA adds an extra layer of security that satisfies the multifactor mandate. Option A is wrong because SSH key authentication alone does not provide MFA; an attacker with the key can still connect. Option B is wrong because while fail2ban helps against brute-force, it does not implement MFA.

Option D is wrong because RDP is less secure for remote server administration and NLA does not constitute full MFA.

Full explanation →

138

PBQhard

An organization has a server with a hardware RAID 5 array consisting of four 2 TB SAS drives. The server hosts a critical database and is configured with a hot spare. During routine monitoring, the storage administrator discovers that one drive has failed and the hot spare has automatically taken over, with the array currently rebuilding. However, the rebuild process repeatedly fails at approximately 30% completion, and the RAID controller logs show I/O errors on the hot spare drive. The failed drive was replaced with an identical model from inventory, and the rebuild was restarted, but it again fails at the same point. All other drives show healthy SMART status, and the server's firmware and RAID controller firmware are up to date. The database is still online and functioning, but the array is running in a degraded state, putting data at risk. The server is located in a remote data center without onsite staff, and a maintenance window is scheduled in three days.

A.Initiate a full array consistency check to find and repair any parity mismatches before rebuilding.

B.Run a low-level diagnostic on the replacement drive and verify its firmware revision against the RAID controller's compatibility list.

C.Back up all data immediately, then break and recreate the RAID 5 array from scratch, restoring the backup.

D.Replace the RAID controller card and its cache module, then attempt the rebuild again.

AnswerB

Why this answer

Option D is correct because the repeated rebuild failure at the same point, with I/O errors on the new drive, suggests either a physical media error on the new drive or an incompatibility issue. Running a manufacturer diagnostic and checking the firmware version of the spare can reveal if the drive is faulty or needs a firmware update to match the controller’s expectations. Option A (replacing the RAID controller) is unlikely needed when the issue seems confined to a single drive slot.

Option B (performing a consistency check) is useful but won't resolve the rebuild failure; it could even cause more wear. Option C (breaking and recreating the array) is the most drastic and will destroy all data, requiring restore from backup.

Full explanation →

139

MCQhard

A system administrator notices unusual file encryption activity on a file server. The activity appears to be rapidly spreading to other servers, and ransom notes are appearing. Which of the following should the administrator do FIRST?

A.Notify law enforcement

B.Run antivirus scan on the affected servers

C.Disconnect the affected servers from the network

D.Restore the encrypted files from backup

AnswerC

Immediate isolation is the first step in incident response to contain the damage and prevent the ransomware from spreading to other systems.

Why this answer

Option B is correct because the immediate priority in a ransomware outbreak is to contain the threat by disconnecting affected systems from the network, preventing further lateral movement and encryption of additional assets. Restoring from backup (Option A) is a recovery step that should occur after containment. Notifying law enforcement (Option C) is important but secondary to stopping the spread.

Running an antivirus scan (Option D) may be ineffective on already encrypted systems and wastes time that should be spent on containment.

Full explanation →

140

MCQmedium

After a brief power outage, a server does not power on when the power button is pressed. The power supply LED indicator is green, but the internal fans do not spin and there is no video output. Which of the following is the MOST appropriate troubleshooting step?

A.Test the system with a known-good CPU.

B.Reset the server's configuration via the CMOS jumper.

C.Check that the 24-pin ATX power connector is securely connected to the motherboard.

D.Replace the power supply.

AnswerC

Power surges can loosen connectors. Reseating the main power connector is a quick, non-invasive step that often resolves such failures.

Why this answer

A green LED indicates standby power is present. If the system does not fully power on, the primary power delivery from the PSU to the motherboard may be disrupted, often by a loose connector.

Full explanation →

141

MCQmedium

Refer to the exhibit. A server is running slowly. Based on the memory statistics, what is the MOST likely issue?

A.Memory leak in an application

B.Virtual memory is misconfigured

C.Insufficient physical memory

D.Page file is too small

AnswerC

Correct. Only 1 GB available indicates physical memory is nearly exhausted, causing excessive paging and slowness.

Why this answer

With only 1 GB of available physical memory out of 16 GB, the server is heavily dependent on paging, leading to slow performance.

Full explanation →

142

MCQhard

Refer to the exhibit. A Linux server's local firewall is configured as shown. The administrator is unable to perform backups to a network-attached storage (NAS) device using TCP port 10000. Which firewall rule is causing the issue?

A.The INPUT policy is set to ACCEPT.

B.The DROP all rule at the end blocks all traffic except SSH.

C.The NAS device uses a different subnet.

D.The SSH ACCEPT rule is allowing traffic.

AnswerB

The DROP rule matches all packets that were not explicitly accepted (only port 22), including the backup traffic on port 10000.

Why this answer

Option D is correct. The INPUT chain contains an explicit DROP all rule at the end, which blocks any traffic not explicitly allowed. The only allowed traffic is SSH on port 22.

The backup traffic on port 10000 matches the DROP rule and is therefore dropped. Option A is incorrect because the policy ACCEPT is overridden by the explicit DROP. Option B allows SSH traffic but does not affect port 10000.

Option C about subnets is irrelevant to the local firewall shown.

Full explanation →

143

MCQeasy

A server with dual redundant power supplies shuts down unexpectedly. One power supply has a solid amber LED. What is the most likely cause?

A.The server is drawing too much power

B.The power cord is unplugged

C.The power supply has failed

D.The server is overheating

AnswerC

An amber LED on a redundant power supply is a standard indicator of failure. The server likely shut down because the other supply could not handle the load alone or also failed.

Why this answer

A solid amber LED on a redundant power supply typically indicates a power supply failure. Overheating would cause both to fail or trigger thermal shutdown. A power cord unplugged would show no LED.

Server overload would not cause a single amber LED.

Full explanation →

144

MCQeasy

A small business needs a disaster recovery site that can be brought online within 2 hours of a primary site failure. The business can tolerate minimal data loss. Which type of recovery site should they implement?

A.Cold site

B.Hot site

C.Warm site

D.Mobile site

AnswerB

A hot site offers real-time data replication and ready-to-run systems, allowing failover within minutes to a couple of hours, achieving minimal data loss.

Why this answer

Option C is correct because a hot site maintains near-real-time data replication and preconfigured hardware, enabling failover within 2 hours and minimal data loss. A cold site (Option A) requires hardware setup and data restoration, taking days. A warm site (Option B) has pre-installed hardware but lacks current data, typically taking hours to a day to activate.

A mobile site (Option D) is a portable solution with variable provisioning time and may not meet the 2-hour requirement consistently.

Full explanation →

145

MCQhard

Refer to the exhibit. A server administrator is troubleshooting a DNS resolution issue on a Windows Server 2019. The exhibit shows the output of the command `nslookup` queried against the server's own IP. Based on the output, what is the most likely cause of the resolution failure?

A.The DNS server does not have an A record for server1.contoso.com.

B.The DNS server's root hints are misconfigured.

C.The DNS server is not configured to forward queries to an external DNS server.

D.The DNS server has an incorrect reverse lookup zone configuration.

AnswerA

The 'Non-existent domain' error directly indicates that the queried A record is missing from the contoso.com zone.

Why this answer

Option D is correct because the NXDOMAIN response indicates the queried name does not exist in the DNS zone. Option A is wrong because forwarding is irrelevant for an authoritative zone. Option B is wrong because reverse lookup zones are for IP-to-name resolution, not name-to-IP.

Option C is wrong because root hints are used for recursion, not for authoritative responses.

Full explanation →

146

MCQhard

Refer to the exhibit. A server administrator runs a dmidecode command to check memory configuration and obtains the output shown. The system supports DDR4-2666, but all DIMMs are running at 1866 MT/s. Which action will allow the memory to run at the maximum supported speed?

A.Enable XMP profile in the BIOS to force all DIMMs to 2666 MT/s.

B.Replace the DIMM in slot A1 with a DDR4-2666 registered module.

C.Clear the CMOS to reset the memory training data.

D.Move the DIMM from A1 to A2 and the DIMM from A2 to A1.

AnswerB

All memory runs at the speed of the slowest module. Replacing the 2133 MT/s DIMM removes the bottleneck.

Why this answer

Correct: The slower 2133 MT/s DIMM in slot A1 limits all modules to its speed. Replacing it with a 2666 MT/s module allows the system to run at the highest common denominator. Option A is wrong because reordering slots won't change the speed limitation.

Option C is wrong because XMP is for overclocking desktop memory, not typical on registered server DIMMs. Option D is wrong because clearing CMOS only resets BIOS settings, not memory speed mismatch.

Full explanation →

147

MCQmedium

A server administrator configures a scheduled task to back up a database using a command-line tool. The task runs successfully when executed manually, but fails when run via the task scheduler. The log shows 'Error: Access denied.' What is the MOST likely cause?

A.The scheduled task is running under the wrong user account.

B.The database service is stopped.

C.The command-line tool is not installed.

D.The backup destination is full.

AnswerA

When the task runs manually, it uses the current user's security context; the scheduler often uses a system or different user account that may not have the required permissions, causing access denied.

Why this answer

Option C is correct because 'Access denied' usually points to permission issues; the task scheduler may run under a different user account that lacks necessary privileges. Option A is wrong because a full destination would yield a 'disk full' error, not access denied. Option B is wrong because if the tool were not installed, the error would be 'command not found.' Option D is wrong because a stopped database service would produce a connection error, not access denied.

Full explanation →

148

MCQeasy

A server logged the warning shown in the exhibit. Which of the following should the technician check first?

A.The power supply voltage to the processor

B.The processor cooling fan

C.The ambient temperature of the data center

D.The thermal paste between the heatsink and processor

AnswerB

A failed or obstructed cooling fan is the most common cause of high CPU temperature warnings.

Why this answer

Option C is correct because the warning indicates high processor temperature, which is often caused by a failed or inadequate cooling fan for the CPU. Option A is wrong because the thermal paste would not cause a sudden temperature change; it's a more gradual issue. Option B is wrong while power supply issues can cause overheating, the more direct cause is the CPU fan.

Option D is wrong because ambient temperature might be a factor but checking the CPU fan is a more immediate and likely cause.

Full explanation →

149

MCQhard

Refer to the exhibit. A server administrator encounters an authentication issue when accessing a web server. The exhibit shows an error from the Domain Controller's event log. What is the most likely cause of the problem?

A.The web server's service account is not configured to support AES encryption types.

B.The DNS service is not resolving the web server's FQDN.

C.The domain controller clock is out of sync with the web server.

D.The service account for the web server has an expired password.

AnswerA

The missing key and the mismatch between requested (AES etype 18) and available etypes directly point to missing AES support on the account.

Why this answer

Option B is correct because the error shows that the requested encryption types (etype 18 is AES) are missing from the account's available etypes, indicating the service account is not configured to support AES. Option A would produce a clock skew error. Option C would result in a password expiration event.

Option D would cause name resolution or host not found errors, not a Kerberos encryption mismatch.

Full explanation →

150

MCQeasy

An administrator needs to remotely manage several Linux servers securely without using passwords. Which of the following is the BEST method?

A.Use Telnet with SSH tunneling.

B.Use VNC with a strong password.

C.Use RDP with certificate-based authentication.

D.Use SSH with key-based authentication.

AnswerD

SSH with key-based authentication is the industry standard for secure, password-less remote administration on Linux servers.

Why this answer

Option C is correct because SSH with key-based authentication provides strong, password-less remote access. Option A is wrong because RDP is primarily used on Windows, not typical for Linux. Option B is wrong because Telnet is insecure, and SSH tunneling does not make Telnet secure.

Option D is wrong because VNC is less secure and not designed for efficient server administration.

Full explanation →

Page 2 of 3

All pages

Practice SK0-005 by domain

Target a specific domain to shore up weak areas.

server-hardware-installation-management server-administration security-disaster-recovery troubleshooting

See all domains with question counts →