Knowledge + Practice

CompTIA Server+ SK0-005 (SK0-005) — Questions 76–150

414 questions total · 6 pages · All types, answers revealed

Take a mock exam Exam hub

Page 2 of 6

76

MCQhard

A technician is installing a new PCIe 4.0 x16 network adapter into a server that has a PCIe 3.0 x16 slot available. The server's BIOS is configured to auto-negotiate PCIe link speed. After installation, the adapter is detected but operates at reduced throughput. Which of the following is the MOST likely reason?

A.The BIOS needs to be updated to support PCIe 4.0.

B.The adapter is not compatible with the server's chipset.

C.The PCIe slot is electrically wired for x8 only.

D.The adapter is operating at PCIe 3.0 speeds due to slot limitations.

AnswerD

PCIe 4.0 adapters can run in PCIe 3.0 slots but will negotiate down to PCIe 3.0 speeds. This reduces maximum throughput. The adapter is detected and functional, but performance is limited by the older slot, which is the expected behavior.

Why this answer

The adapter operates at reduced throughput because it is installed in a PCIe 3.0 slot. PCIe is backward compatible, so a PCIe 4.0 adapter will negotiate down to the slot's maximum speed, which is PCIe 3.0. This limits bandwidth but does not prevent operation.

Exam trap

The trap here is assuming that a PCIe 4.0 adapter will always run at full speed regardless of the slot generation, ignoring backward compatibility limitations.

Full explanation →

77

MCQhard

A company performs annual disaster recovery tests. The last test revealed that the recovery time objective (RTO) was not met because the backup tapes were corrupted. The backup administrator proposes changes to the backup verification process. Which practice is MOST effective to ensure recoverability?

A.Perform a full backup more frequently.

B.Implement automated integrity checks and periodic test restores.

C.Switch to disk-based backups exclusively.

D.Store backup tapes offsite only after verification.

AnswerB

Integrity checks (e.g., checksums) verify that backup data matches the expected state, and test restores confirm that the data can actually be recovered, addressing both media and logical corruption.

Why this answer

Option B is correct because automated integrity checks and periodic test restores directly validate that backups are usable and meet recovery objectives, catching corruption early. Option A is wrong because increasing backup frequency does not verify that backups are error-free. Option C is wrong because verifying tapes before offsite storage reduces risk but does not guarantee ongoing media integrity; tapes can degrade over time.

Option D is wrong because switching to disk-based backups avoids some tape-specific issues but still requires verification processes to ensure data is not corrupted.

Full explanation →

78

Multi-Selectmedium

A systems administrator is designing the backup strategy for a Windows Server 2022 file server that holds the company's only copy of active project data. The business requires that a single accidental deletion of a folder be recoverable quickly without a full restore, and that a ransomware event that encrypts the volume still leave a usable copy of the data. Which two actions should the administrator take to meet both requirements? (Choose two.)

Select 2 answers

A.Increase the NTFS permissions on the project folder so only senior staff can delete files.

B.Configure a backup job that writes to a target that is offline or immutable, such as rotated removable media or a hardened repository with immutability enabled.

C.Enable Volume Shadow Copy Service on the data volume and schedule shadow copies several times per day.

D.Configure RAID 6 on the data volume to protect the project data against loss.

E.Enable BitLocker with a TPM protector on the data volume to prevent unauthorized access to the backups.

AnswersB, C

Ransomware commonly seeks out and encrypts reachable backup targets, so a copy that is offline or immutable at the time of attack remains intact. Rotated removable media is physically offline between jobs, and an immutable repository prevents deletion or modification for a retention period. This provides the clean recovery source the scenario demands after a volume-wide encryption event.

Why this answer

The scenario pairs two distinct risks: a fast, granular recovery from an accidental deletion, and a clean copy surviving a ransomware event that compromises the live volume. Shadow copies handle the first by presenting browsable point-in-time versions on the same volume. An offline or immutable backup target handles the second, because the encrypted host cannot reach or alter that copy.

RAID and encryption improve availability and confidentiality but provide no restoration path.

Exam trap

The trap here is treating RAID or disk encryption as a backup, when neither preserves a historical copy that survives deletion or encryption of the live volume.

Full explanation →

79

PBQeasy

A small business relies on a single Dell PowerEdge T340 tower server running Windows Server 2019 as its primary domain controller and file server. The server is situated in a locked, air-conditioned IT closet and is protected by an online surge protector. During a severe thunderstorm last evening, the building experienced a momentary power loss. This morning, the administrator found the server completely powered off. When the power button is pressed, the front panel diagnostic LEDs briefly illuminate, and all internal cooling fans start spinning for about two to three seconds, but then the server abruptly powers down. There are no audible beep codes, and the monitor never receives a video signal. The administrator has already verified the power cable is firmly seated in both the server and the surge protector, swapped the power cable with a known-good one, and tested the surge protector with another device, which powered on normally. No spare parts are immediately available, and server downtime must be kept to a minimum. What should the administrator do FIRST to diagnose and resolve the problem?

A.Replace the power supply with a compatible, known-good unit.

B.Swap the motherboard with an identical one from a spare parts inventory.

C.Connect the server directly to a different power outlet, bypassing the surge protector.

D.Remove the server's RAM modules and reinstall them one at a time, testing after each.

AnswerA

Why this answer

Option B is correct: the brief fan spin with immediate shutdown and absence of POST is a classic sign of a failing power supply that cannot maintain output under load. After a power surge, the power supply is the most probable damaged component. Option A is wrong because motherboard failure would typically produce beep codes or consistent power without POST, and swapping it is high-effort without first testing the power supply.

Option C is wrong because RAM issues usually generate beep codes or a continuous power-on state with no boot, not the described brief spin-down. Option D is wrong because the administrator already confirmed other devices work on the same circuit, ruling out a supply-side issue.

Full explanation →

80

PBQeasy

A small law firm relies on a single server that hosts a document management system and email. The server is backed up nightly using differential backups to an external USB hard drive that remains connected to the server. One Monday morning, the office manager finds all files encrypted and a ransom note on the screen. The server’s event logs indicate that the encryption began at 2:00 AM on Saturday. The firm’s offsite backup policy rotates two sets of tapes, and the most recent set was taken offsite on Friday evening and is stored in a bank safe deposit box. The USB backup drive, still attached to the server, shows its files also encrypted. The firm does not have a cloud backup service for the server. The office manager wants to restore operations as quickly as possible with minimal data loss and zero risk of reinfection. What is the BEST course of action?

A.Restore the server from the firm's cloud backup service for email.

B.Scan the USB drive with antivirus, then restore the latest differential backup from it.

C.Pay the ransom to obtain the decryption key, then perform a full backup.

D.Reimage the server, then restore data from the Friday offsite tape backup.

AnswerD

Why this answer

A is correct. The offsite tape backup from Friday evening is air-gapped and predates the infection (Saturday 2:00 AM), ensuring it is clean. Reimaging the server provides a known-good operating system.

Option B is risky because the USB drive’s backup likely contains infected files; even an antivirus scan might not detect all ransomware artifacts. Option C is not possible since there is no server cloud backup. Option D is not recommended and may not result in file recovery.

Thus, A is the safest and most reliable method.

Full explanation →

81

MCQmedium

A company is reviewing its disaster recovery plan. The plan currently states that a full backup is performed every Sunday and incremental backups are performed Monday through Saturday. A disaster destroys the primary server on Wednesday at 2:00 PM, after the Wednesday incremental backup has completed. The administrator needs to restore the server to the most recent state possible. Which of the following backup sets should the administrator restore?

A.The most recent full backup and all incremental backups since that full backup

B.The most recent full backup only

C.The most recent full backup and the most recent differential backup

D.The most recent full backup and the most recent incremental backup

AnswerA

With an incremental backup scheme, each incremental contains only the changes since the last backup of any type. To restore to the most recent state, the administrator must apply the last full backup followed by every incremental backup in sequence from Monday through Wednesday. This reconstructs all changes made since the full backup and yields the most recent recoverable state.

Why this answer

Incremental backups record only changes since the last backup, so a restore requires the last full backup plus every incremental in order. Restoring the full plus all incrementals since that full recreates the data as of the last incremental. Using only the latest incremental or only the full would lose data, and differential backups are not part of this schedule.

Exam trap

The trap here is confusing incremental with differential backups; assuming that the latest incremental contains all changes since the full backup leads to restoring an incomplete set and losing data.

Full explanation →

82

MCQmedium

A server administrator is deploying a Linux server that must automatically start a custom application after every reboot. The application is a binary located at /opt/myapp/bin/myapp and requires the environment variable APP_HOME=/opt/myapp. The server uses systemd. Which of the following is the most appropriate way to ensure the application starts on boot and can be managed with systemctl?

A.Create a cron job with @reboot /opt/myapp/bin/myapp in the root crontab.

B.Place a shell script in /etc/profile.d/ that exports APP_HOME and starts the application.

C.Add a line to /etc/rc.local that exports APP_HOME=/opt/myapp and runs /opt/myapp/bin/myapp &.

D.Create a systemd unit file in /etc/systemd/system/myapp.service that includes ExecStart=/opt/myapp/bin/myapp and Environment=APP_HOME=/opt/myapp, then enable it with systemctl enable myapp.service.

AnswerD

This is correct because systemd is the native service manager on modern Linux distributions. Placing a unit file in /etc/systemd/system allows systemctl to manage the service, and the Environment directive sets the required variable. Enabling the unit creates the necessary symlinks so the service starts at boot, satisfying both requirements.

Why this answer

The correct approach uses systemd, the standard init system on most modern Linux distributions. A unit file in /etc/systemd/system allows full lifecycle management via systemctl, and the Environment directive ensures the required variable is set. Enabling the unit ensures the application starts automatically at boot, meeting both the startup and management requirements.

Exam trap

The trap here is assuming that legacy methods like /etc/rc.local or cron @reboot are equivalent to a proper systemd service, but they lack management and dependency features.

Full explanation →

83

MCQeasy

A datacenter manager must protect a file server's data against a single hard disk failure while maximizing usable capacity. The server has four 4 TB drives and a hardware RAID controller. Which RAID level should be implemented?

A.RAID 5

B.RAID 0

C.RAID 1

D.RAID 6

AnswerA

RAID 5 stripes data and parity across all four drives, providing fault tolerance for one disk failure while losing the capacity of only one drive for parity. This yields approximately 12 TB of usable space, which is the highest usable capacity among the redundant options. It satisfies the requirement to survive a single disk failure and maximizes capacity, making it the appropriate choice for this file server.

Why this answer

The requirement is to survive one disk failure while maximizing usable capacity on four 4 TB drives. RAID 5 stripes both data and single parity across all members, so one drive's worth of capacity is lost to parity, yielding roughly 12 TB usable. It tolerates exactly one disk failure, matching the requirement, and provides more usable space than mirroring or double parity.

RAID 0 offers no redundancy, so it fails the fault-tolerance condition.

Exam trap

The trap here is assuming that any RAID level with redundancy is acceptable without evaluating the capacity trade-off, when the scenario specifically requires maximizing usable space while tolerating only a single failure.

Full explanation →

84

MCQeasy

A system administrator is configuring a RAID array for a database server that requires high fault tolerance and improved read performance. The array will consist of six 1 TB drives. The administrator wants to maximize usable capacity while being able to survive a single drive failure. Which RAID level should the administrator choose?

A.RAID 5

B.RAID 1

C.RAID 0

D.RAID 6

AnswerA

RAID 5 uses distributed parity across all drives, allowing the array to survive a single drive failure. With six 1 TB drives, usable capacity is 5 TB, maximizing capacity while providing fault tolerance. It also offers improved read performance through striping, making it suitable for the database server's requirements.

Why this answer

RAID 5 provides fault tolerance by surviving one drive failure and maximizes usable capacity by using only one drive's worth of space for parity. With six drives, it yields 5 TB usable, which is higher than RAID 6 or RAID 1. It also offers better read performance than a single drive or mirror, meeting the database server's needs.

Exam trap

The trap here is assuming that higher RAID numbers always mean better, or that RAID 6 is necessary for single-drive fault tolerance when RAID 5 already meets the requirement with more usable capacity.

Full explanation →

85

MCQhard

A security administrator is configuring disk encryption on a new file server that will store regulated data. The server has a TPM 2.0 chip and runs Windows Server 2022. The administrator wants to ensure that the encryption keys are protected and that the server can boot without requiring a USB key at every restart. Which configuration should the administrator use?

A.Enable BitLocker on the system volume and store the recovery key in Active Directory, using TPM-only protection.

B.Enable BitLocker with a startup PIN and store the PIN in a secure password vault.

C.Use EFS to encrypt the data folders instead of BitLocker, and back up the EFS certificate to a smart card.

D.Enable BitLocker with a USB startup key and keep the USB key plugged into the server at all times.

AnswerA

TPM-only protection allows the server to boot unattended because the TPM releases the volume master key after verifying boot integrity. Storing the recovery key in Active Directory provides a secure backup for recovery, meeting both unattended boot and key protection requirements.

Why this answer

BitLocker with TPM-only protection allows the server to start without user interaction because the TPM validates boot components and releases the key. Storing the recovery key in Active Directory ensures that administrators can recover access if the TPM changes or the volume becomes locked, satisfying both unattended boot and key protection.

Exam trap

The trap here is confusing startup authentication methods: a startup PIN or USB key adds manual steps, while TPM-only enables unattended boot but still requires a recovery key backup.

Full explanation →

86

MCQmedium

A company runs a critical file server on Windows Server 2022 with a RAID 5 array of four 4-TB SAS drives. During a routine check, the administrator notices that the array is in a degraded state because one drive has failed. While waiting for a replacement drive to arrive, a second drive fails. The administrator needs to restore access to the data as quickly as possible. Which of the following should the administrator do FIRST?

A.Force the second failed drive online using the RAID controller management utility.

B.Restore the most recent backup to a new array or server.

C.Replace both failed drives and let the RAID controller rebuild the array automatically.

D.Swap the failed drives with new ones and initialize the array, then restore from backup.

AnswerB

With two drives failed in a RAID 5 array, the array is no longer fault-tolerant and data cannot be accessed through normal means. The fastest way to restore access is to recover from the most recent backup onto a new array or server. This minimizes downtime and ensures data integrity, as the original array is unrecoverable without both drives.

Why this answer

In a RAID 5 array, a single drive failure is tolerated, but a second failure renders the array inoperable. The administrator must recover from backup to restore data and service. Replacing drives or forcing them online will not recover the data and may cause further damage.

Restoring from backup is the only reliable method to regain access.

Exam trap

The trap here is assuming that RAID 5 can survive two simultaneous drive failures, when in fact it can only tolerate one.

Full explanation →

87

Multi-Selectmedium

A technician is diagnosing a server that intermittently reboots under heavy load. The server is in a rack with proper airflow, and the operating system logs show no software errors. Which of the following should the technician check as part of the hardware diagnosis? (Choose two.)

Select 2 answers

A.Review the baseboard management controller event log for correctable and uncorrectable memory errors.

B.Rebuild the RAID array to clear any latent media errors on the data disks.

C.Verify that the server's power supplies provide adequate wattage for the installed CPUs, GPUs, and drives under peak load.

D.Confirm that the operating system's page file is sized to at least twice the installed physical RAM.

E.Update the antimalware definitions and run a full system scan to rule out a rootkit.

AnswersA, C

The BMC logs platform hardware events such as correctable and uncorrectable ECC errors that may not surface in the OS. Repeated correctable errors under load can indicate a failing DIMM and can precede an uncorrectable error that triggers a reboot. Checking this log is a core hardware diagnostic step.

Why this answer

Intermittent reboots under heavy load point to hardware causes such as memory errors or power delivery problems. The BMC event log can reveal ECC errors that the OS never sees, and a power budget check can expose an undersized or failing supply. Both are direct hardware diagnostics for load-dependent resets.

Page file sizing, malware scans, and RAID rebuilds do not explain this symptom.

Exam trap

The trap here is treating a load-dependent reboot as a software or storage problem instead of checking the BMC hardware log and power delivery capacity.

Full explanation →

88

MCQmedium

A company's backup policy requires that all server backups be written to removable media that can be stored offsite. The backup administrator is configuring a new Windows Server 2022 server and needs to ensure that the backup target appears as a locally attached disk to the backup software. The media must support being rotated daily and must not require the server to be powered off. Which type of storage should the administrator use?

A.External USB 3.0 hard disk drive

B.Tape library connected via Fibre Channel

C.Internal SATA solid-state drive (SSD) in a hot-swap bay

D.iSCSI target on a network-attached storage (NAS) device

AnswerA

An external USB 3.0 hard disk drive connects to the server and appears as a locally attached disk, which is exactly what the backup software expects. It is removable, supports daily rotation, and can be connected or disconnected without powering off the server. This satisfies the offsite storage requirement while providing adequate capacity and performance for server backups.

Why this answer

The requirement is for removable media that appears as a locally attached disk and can be rotated offsite without powering down the server. An external USB hard drive meets all these conditions: it presents as a local disk, is easily removable, and supports daily rotation. Other options either do not appear as local disks or are not designed for frequent physical transport.

Exam trap

The trap here is assuming that any removable storage, such as an internal hot-swap drive, is suitable for offsite rotation, when the scenario specifically requires a locally attached disk that is practical for daily transport.

Full explanation →

89

MCQeasy

A server administrator is troubleshooting a Linux server that has become unresponsive to SSH and console logins. The server is still powered on, and the fans are running. The administrator wants to check the system logs from a previous boot to determine if a kernel panic occurred. Which command should the administrator use?

A.tail -f /var/log/messages

B.journalctl -b -1

C.cat /proc/kmsg

D.dmesg

AnswerB

journalctl -b -1 displays the journal entries from the previous boot, which is exactly what the administrator needs to review kernel messages, including any panic or OOM events that preceded the hang. On systemd-based Linux distributions, this command reads persistent journal files if storage is enabled, making it the correct tool for post-mortem analysis of an unresponsive server.

Why this answer

When a Linux server becomes unresponsive, the administrator needs to inspect logs from the previous boot to identify a kernel panic or other fatal event. The systemd journal retains logs across reboots if persistent storage is configured. The journalctl -b -1 command specifically selects the boot before the current one, allowing review of kernel messages, service failures, and panic traces.

Other commands either show only the current boot or require a live, responsive system.

Exam trap

The trap here is reaching for dmesg or live log tailing when the server is unresponsive and the relevant evidence is from a prior boot, which requires a command that can access historical journal entries.

Full explanation →

90

MCQhard

A server administrator is installing a PCIe expansion card into a 2U server and notices the card requires supplemental power but the server's power supply lacks a spare PCIe power connector. The server's documentation lists a maximum slot power budget of 75W for the x16 slot. Which of the following is the MOST appropriate action?

A.Use a dual SATA-to-PCIe power adapter to feed the supplemental connector

B.Move the card to a x8 slot to reduce its power consumption

C.Verify the card's power requirement and confirm the PSU or riser can supply it before proceeding

D.Install the card and rely on the slot to supply all required power

AnswerC

This is correct because the card's stated power draw and the platform's available PCIe power cabling or riser capability determine whether the installation is viable. Confirming the real requirement against the PSU and riser specification prevents an underpowered card and identifies whether a higher-wattage PSU or a powered riser is needed before any hardware is committed.

Why this answer

Expansion cards with supplemental power connectors need more than the slot can deliver, so the technician must reconcile the card's actual power requirement with what the PSU and riser can provide. Confirming this before installation avoids underpowered operation, link instability, or damage. Relying on slot power, using unsafe adapters, or narrowing the lane width do not resolve the electrical shortfall.

Exam trap

The trap here is treating a supplemental power connector as optional and assuming the slot alone can drive any card that physically fits.

Full explanation →

91

MCQeasy

A server administrator receives alerts that a server's RAID 5 array has a failed drive. The administrator replaces the failed drive with a new one of the same model and capacity. After the rebuild completes, the administrator notices that the array is still showing as degraded. Which of the following is the MOST likely reason for the array remaining degraded?

A.Another drive in the array has failed or is reporting errors.

B.The new drive was not properly initialized or added to the array.

C.The replacement drive is not compatible with the RAID controller.

D.The RAID controller needs to be reset to recognize the new drive.

AnswerA

In a RAID 5 array, if a second drive fails during or after the rebuild, the array will remain degraded or fail entirely. The administrator should check the status of all drives. Often, a second drive may have pre-failure warnings that were overlooked. This is the most likely cause for the array not returning to optimal state.

Why this answer

After replacing a failed drive and completing a rebuild, a RAID 5 array should return to optimal. If it remains degraded, the most probable cause is an additional drive failure or errors on another drive. RAID 5 can tolerate only one drive failure; a second failure leaves the array degraded.

Checking all drive statuses is essential.

Exam trap

The trap here is assuming that a successful rebuild automatically restores the array to optimal, while overlooking the possibility of a second drive issue.

Full explanation →

92

MCQmedium

A company's file server is running low on disk space. The administrator notices that the volume hosting user home directories is nearly full, with only 10 GB free out of 2 TB. Users report that they cannot save new files. The administrator needs to free up space immediately without deleting any user data. Which of the following should the administrator do FIRST?

A.Enable NTFS compression on the volume.

B.Use File Server Resource Manager to generate a storage report and identify large files.

C.Move the pagefile to another volume.

D.Run Disk Cleanup to remove temporary files and system caches.

AnswerB

File Server Resource Manager (FSRM) can generate storage reports that identify large files, duplicate files, and files by owner. This allows the administrator to pinpoint what is consuming space and take targeted action, such as archiving or moving data, without deleting user files. It is a non-destructive first step to understand the problem before freeing space.

Why this answer

The administrator should first identify what is consuming disk space before taking any action. File Server Resource Manager provides detailed storage reports that show large files, duplicates, and usage by owner, enabling targeted cleanup without risking user data. Other options either do not address the specific volume or are not immediate or effective enough.

Exam trap

The trap here is assuming that generic cleanup tools like Disk Cleanup will free enough space on a data volume, when the real issue is user data consumption that requires analysis first.

Full explanation →

93

Multi-Selecthard

A company is implementing a disaster recovery plan for its on-premises data center. The plan must include measures to ensure data integrity and availability during a site-wide power failure. Which two actions should be included in the plan? (Choose two.)

Select 2 answers

A.Schedule full backups to run only during business hours.

B.Deploy an uninterruptible power supply (UPS) for all critical servers and storage.

C.Enable write caching on all storage controllers without battery backup.

D.Configure RAID 0 on all database servers to improve performance.

E.Implement a generator with automatic transfer switch (ATS) to provide long-term power.

AnswersB, E

A UPS provides temporary battery power during an outage, allowing servers to shut down gracefully or ride through short outages. This prevents data corruption from sudden power loss and maintains availability until generators start or systems shut down cleanly. It is a fundamental component of power failure preparedness.

Why this answer

To ensure data integrity and availability during a site-wide power failure, a UPS provides immediate battery power for graceful shutdown or ride-through, while a generator with ATS supplies long-term power to keep systems operational. Together, they form a layered power protection strategy. Other options compromise data integrity or do not address power failure directly.

Exam trap

The trap here is selecting RAID 0 for performance or enabling write caching without battery backup, which actually increase the risk of data loss during a power failure.

Full explanation →

94

MCQeasy

A server administrator is troubleshooting a server whose time drifts several minutes per day, causing Kerberos authentication failures between the server and its domain controller. The server is a domain member with no special role. Which of the following is the MOST appropriate first step to correct the time synchronization problem?

A.Restart the Windows Time (W32Time) service and verify the domain time source.

B.Increase the Kerberos ticket lifetime policy on the domain controller.

C.Replace the server's CMOS battery and set the BIOS clock manually.

D.Configure the server to synchronize with an external NTP pool instead of the domain hierarchy.

AnswerA

Restarting W32Time and confirming the configured source re-establishes synchronization with the domain hierarchy, which is the authoritative time source for a member server. This is a low-risk first step that directly targets the drifting clock and the resulting Kerberos failures, and it verifies whether the service or its source configuration is the problem before more invasive changes.

Why this answer

A domain member should obtain time from the domain hierarchy, so the first corrective action is to ensure the Windows Time service is running and configured to use that source. Kerberos rejects authentication when clock skew exceeds its tolerance, which explains the reported failures. External NTP pools, policy changes, and CMOS replacement do not address the loss of domain synchronization.

Exam trap

The trap here is reaching for an external NTP pool, when domain members are expected to inherit time from the domain hierarchy rather than an outside source.

Full explanation →

95

Multi-Selectmedium

A server administrator is troubleshooting a Linux server that is experiencing performance degradation. The administrator suspects high disk I/O. Which two commands should the administrator use to identify the processes and disks causing the I/O load? (Choose two.)

Select 2 answers

A.iotop -o

B.top

C.iostat -x 1

D.vmstat 1

E.netstat -tuln

AnswersA, C

iotop -o displays only processes that are actively performing I/O, showing disk read/write bandwidth per process. This directly identifies which processes are causing high disk I/O. It requires root privileges and is ideal for real-time monitoring of I/O-heavy processes.

Why this answer

iostat -x 1 provides per-disk extended statistics, helping identify which disk is saturated. iotop -o shows per-process I/O usage, identifying which processes are causing the load. Together, they allow the administrator to correlate process activity with disk utilization. The other commands either focus on network, CPU/memory, or lack per-process or per-disk granularity.

Exam trap

The trap here is selecting general-purpose tools like top or vmstat, which show overall system load but not the specific per-process or per-disk I/O details needed for this diagnosis.

Full explanation →

96

PBQmedium

A database administrator notices that the primary SQL Server instance has been experiencing severe performance degradation over the past hour. The server is a virtual machine with 8 vCPUs and 64 GB of RAM, and it normally operates with around 40% CPU utilization. Currently, Task Manager shows 100% CPU usage, with the sqlservr.exe process consuming nearly all cycles. The database response times have increased tenfold, and some queries are timing out. There are no scheduled maintenance jobs running, and the transaction log backup completed successfully earlier. The DBA checks active sessions and finds one long-running ad-hoc query from a new reporting tool that was deployed this morning. The query is performing a cross join on two large tables with missing WHERE clauses, causing a Cartesian product. Ending the session will roll back the query and free resources.

A.Increase the virtual machine's memory allocation from 64 GB to 128 GB to reduce paging.

B.Immediately add more vCPUs to the virtual machine to handle the increased load.

C.Identify and kill the offending long-running query using the SQL Server management tools.

D.Restart the SQL Server service to clear all active connections and start fresh.

AnswerC

Why this answer

Option A is the correct immediate action. Identifying and terminating the specific offending query is the fastest way to restore normal operation without disrupting other database activities. Option B (adding vCPUs) is not a quick fix and doesn't address the root cause.

Option C (restarting the SQL service) will disconnect all users and cause unnecessary downtime. Option D (increasing the VM's memory) won't help a CPU-bound problem caused by an inefficient query.

Full explanation →

97

MCQhard

An administrator installs a new PCIe NVMe solid-state drive into a server's x8 slot, but the operating system does not detect it. The slot is enabled in BIOS, the drive is on the compatibility list, and it is fully seated. The motherboard manual notes that the slot shares lanes with an onboard SAS controller that is currently enabled. Which of the following should the administrator do to resolve the issue?

A.Update the NVMe drive firmware so it enumerates in the shared slot.

B.Move the drive to a different x8 slot and leave the onboard SAS controller enabled.

C.Set the slot's bifurcation to x4x4 in BIOS to split the available lanes.

D.Disable the onboard SAS controller in BIOS or relocate the drive to a slot with dedicated lanes.

AnswerD

When a PCIe slot shares lanes with an onboard controller, enabling that controller can leave no lanes for the add-in card, so the slot appears empty. Disabling the onboard SAS controller in BIOS frees the shared lanes for the NVMe drive, and moving the card to a slot with dedicated lanes achieves the same result. Either action restores lane availability.

Why this answer

PCIe lane sharing means an add-in slot and an onboard controller cannot both use the same lanes simultaneously. With the onboard SAS controller enabled, the shared slot has no lanes to train the NVMe drive, so the OS never sees it. Disabling the onboard controller or moving the card to a slot with dedicated lanes restores the electrical link and allows detection.

Exam trap

The trap here is assuming any physically compatible PCIe slot always has usable lanes, when lane sharing with an enabled onboard controller can silently leave the slot electrically dead.

Full explanation →

98

MCQhard

A server that uses iSCSI storage has suddenly lost connectivity to all LUNs. The network team confirms no changes have been made. Which of the following is the FIRST step in troubleshooting this issue?

A.Check the VLAN configuration on the switch.

B.Replace the network cables to the storage array.

C.Verify the status of the iSCSI initiator service on the server.

D.Reconfigure the IP address of the server.

AnswerC

Verifying the iSCSI initiator service directly addresses the server-side software that maintains session state to every LUN. If the Microsoft iSCSI Initiator service has stopped or crashed, all targets drop simultaneously despite an unchanged network, matching the stem's sudden total loss of connectivity. Restarting it restores sessions without network investigation.

Why this answer

The first step in troubleshooting iSCSI connectivity loss is to verify the status of the iSCSI initiator service on the server, because if the service is stopped or failed, the server cannot connect to any LUNs. This is a local, non-disruptive check that should precede network or hardware changes. It aligns with the troubleshooting principle of checking the most likely and least invasive cause first.

Exam trap

SK0-005 often tests the order of troubleshooting steps — candidates may jump to network or hardware fixes, but the FIRST step should be the least invasive local check, such as the iSCSI initiator service.

How to eliminate wrong answers

Option A is wrong because checking VLAN configuration is a network-side change that should come after verifying the local initiator service, and the network team already confirmed no changes. Option B is wrong because replacing cables is a physical intervention that is premature without first checking the initiator service status. Option D is wrong because reconfiguring the server's IP address is disruptive and unnecessary before verifying the initiator service and basic connectivity.

Full explanation →

99

MCQmedium

A server administrator is troubleshooting a Linux server that cannot reach any external websites, but internal resources are accessible. The administrator runs 'ip addr' and sees the correct IP address and subnet mask on eth0. Running 'ip route' shows no default route. What is the most likely cause?

A.The network interface is down.

B.The DNS server is unreachable.

C.The default gateway is not configured.

D.A firewall is blocking outbound traffic.

AnswerC

The 'ip route' output shows no default route, meaning the server lacks a gateway to reach external networks. Without a default route, the server can only communicate with hosts on its local subnet. Internal resources are accessible because they are on the same subnet, but external traffic fails. Configuring the default gateway resolves the issue.

Why this answer

The correct answer is that the default gateway is not configured. The 'ip route' output shows no default route, which is necessary to reach external networks. Internal resources are accessible because they are on the same subnet, but external traffic cannot be routed.

Configuring the default gateway restores external connectivity.

Exam trap

The trap here is assuming that DNS is the issue because users typically report 'cannot reach websites' as a name resolution problem, but the missing default route is the root cause.

Full explanation →

100

MCQeasy

After a power outage, a server fails to boot and displays a "Missing operating system" error. The server uses RAID 1 for the OS disk. The administrator verifies both drives are present in the RAID configuration utility but one drive is marked as failed. What should the administrator do FIRST?

A.Boot from a Windows recovery media and run chkdsk

B.Check the boot order in BIOS/UEFI

C.Reseat the failed drive and attempt to boot

D.Replace the failed drive and rebuild the array

AnswerB

Power loss can reset BIOS settings; verifying the boot order ensures the system looks for the OS on the correct drive.

Why this answer

Option C is correct because the system may be trying to boot from an incorrect device, especially after a power event may have reset BIOS settings. Option A is a later step if the array is truly broken. Option B is not the first step because the array itself may be bootable.

Option D is unlikely to restore a failed drive.

Full explanation →

101

MCQmedium

A system administrator needs to apply critical security patches to a production web server that cannot be taken offline. The server runs a Linux operating system and hosts a high-availability website. The administrator wants to ensure that if the patches cause a failure, the server can be quickly rolled back to its previous state. Which of the following actions should the administrator take FIRST?

A.Back up all user data to a network share.

B.Schedule a maintenance window and notify users of potential downtime.

C.Take a snapshot of the server's virtual machine before applying patches.

D.Apply the patches during off-peak hours without any additional steps.

AnswerC

A snapshot captures the entire VM state, including OS and applications, enabling a fast and complete rollback.

Why this answer

Option B is correct because taking a snapshot provides a point-in-time state of the virtual machine, allowing quick rollback if the patches cause issues. Option A backs up user data but does not capture the system state needed for a full rollback. Option C is a procedural step but not the first technical action to enable recovery.

Option D is reckless and provides no rollback capability.

Full explanation →

102

Multi-Selecthard

Which THREE of the following are typically essential elements of a disaster recovery plan (DRP)? (Choose three.)

Select 3 answers

A.Emergency contact and communication plan

B.Server hardware specifications

C.Test and exercise schedule

D.Network topology diagram

E.Business impact analysis (BIA)

AnswersA, C, E

An emergency contact and communication plan is essential because a DRP must specify who to notify, how, and in what order during an outage. It satisfies the stem's requirement for essential DRP elements by ensuring coordinated escalation and stakeholder updates, without which recovery actions stall and downtime extends unnecessarily.

Why this answer

Option A (Emergency contact and communication plan) is essential because a DRP must define who to notify, how to reach them, and the escalation paths during an incident, ensuring coordinated response across staff, management, and vendors. Option C (Test and exercise schedule) is essential because a DRP is only reliable if it is validated through regular drills, tabletop exercises, and simulations that reveal gaps and keep recovery time objectives (RTOs) and recovery point objectives (RPOs) achievable. Option E (Business impact analysis (BIA)) is essential because it identifies critical business functions, dependencies, and acceptable downtime, providing the foundation for recovery priorities and strategy selection within the DRP.

Option B (Server hardware specifications) is not a core DRP element; hardware details belong to asset inventories or build documentation and are too granular for the plan itself. Option D (Network topology diagram) is also not essential to the DRP; while useful as a supporting reference, the plan focuses on roles, procedures, priorities, and validation rather than detailed technical diagrams.

Exam trap

The trap is confusing supporting documentation (like hardware specs or network diagrams) with essential DRP elements; candidates might select them because they seem important, but the exam expects the core components: communication, testing, and BIA.

Full explanation →

103

MCQeasy

A server in the datacenter fails to power on after a scheduled power maintenance. The facility team confirms that power is being supplied to the rack. The server's front panel LED is not illuminated. Which of the following should the administrator check FIRST?

A.Reseat the CPU and memory modules.

B.Verify that the power cable is securely connected to the server and the PDU.

C.Replace the power supply unit.

D.Update the server's BIOS firmware.

AnswerB

With rack power confirmed and no front panel LED, the most likely fault is a disrupted connection between server and PDU. Reseating the power cable is the fastest, least invasive check before investigating PSUs, internal components or firmware.

Why this answer

The first step is to verify that the power cable is securely connected to both the server and the PDU. Since the facility team confirms power is supplied to the rack, the issue likely lies in the connection to the server. A loose cable would prevent power from reaching the server, resulting in no front panel LED.

This is a simple, non-invasive check that should be performed before replacing hardware or reseating components.

Exam trap

SK0-005 often tests the tendency to jump to hardware replacement (PSU) without first checking simple physical connections, leading candidates to overlook the most basic cause.

How to eliminate wrong answers

Option A is wrong because reseating CPU and memory is unnecessary and risky when the server shows no signs of power; it should be considered only after basic power checks. Option C is wrong because replacing the power supply unit is premature; the PSU might be fine if the cable is disconnected. Option D is wrong because updating BIOS firmware requires the server to be powered on and is irrelevant to a no-power condition.

Full explanation →

104

MCQeasy

A junior administrator is tasked with creating a new virtual machine on a Windows Server 2019 Hyper-V host. The VM will run a lightly used internal application and requires 4 GB of RAM, 2 virtual processors, and a 60 GB virtual hard disk. The administrator creates the VM using the default dynamic memory settings and a dynamically expanding VHDX. After a week, users report that the application occasionally becomes very slow. Performance monitoring shows that the VM's memory utilization frequently hits the configured maximum, and disk latency spikes during these times. Which of the following is the MOST likely cause of the performance issue?

A.The VM is experiencing memory pressure due to dynamic memory configuration, causing excessive paging.

B.The host's CPU is oversubscribed, causing the VM's virtual processors to wait.

C.The virtual switch is misconfigured, causing network latency.

D.The dynamically expanding VHDX is causing disk fragmentation and slow I/O.

AnswerA

Dynamic memory allows the VM's memory to fluctuate based on demand, but if the maximum is set too low, the VM can run out of memory. The frequent hitting of the configured maximum indicates memory pressure, leading to paging to disk (using the VHDX or page file), which causes disk latency spikes and application slowdowns.

Why this answer

Dynamic memory in Hyper-V adjusts the VM's memory within a configured minimum and maximum. If the maximum is set too low, the VM can run out of memory, causing the guest OS to page heavily to disk. This results in high disk latency and application slowdowns.

The memory utilization hitting the maximum confirms memory pressure as the root cause. Adjusting the dynamic memory maximum or using static memory would resolve the issue.

Exam trap

The trap here is assuming that dynamic memory automatically allocates as much memory as needed, when in reality it is bounded by the configured maximum and can cause paging if set too low.

Full explanation →

105

MCQmedium

A company performs a full backup every Sunday and incremental backups Monday through Saturday. On Wednesday, a database file becomes corrupted. The administrator needs to restore the most recent version of the file prior to corruption. Which backup sets must be restored?

A.The most recent full backup and the most recent incremental backup only.

B.The most recent full backup and all incremental backups since that full backup.

C.The most recent differential backup.

D.The most recent full backup only.

AnswerB

Incremental backups capture only changes since the last backup of any type. To restore to the most recent state before corruption, the administrator must restore the last full backup and then apply each subsequent incremental backup in sequence. This ensures all changes are applied in the correct order. Restoring only the full backup would lose all changes made after Sunday, and restoring a single incremental would not include earlier changes.

Why this answer

With an incremental backup scheme, each incremental contains only the changes since the previous backup. To restore the most recent version of a file, the administrator must restore the last full backup and then apply every incremental backup in sequence. This reconstructs the file to its state just before corruption.

Restoring only a subset would result in missing data and potential inconsistency.

Exam trap

The trap here is thinking that restoring the full backup and only the latest incremental is sufficient; incremental backups are not cumulative, so all incrementals since the full backup are needed.

Full explanation →

106

MCQhard

A server has been experiencing random crashes and generating memory-related errors in the system event log. The technician has already run memory diagnostics which show frequent errors on a single DIMM. The server has four DIMMs installed. Which of the following is the BEST next step?

A.Update the BIOS firmware

B.Replace all four DIMMs to prevent future issues

C.Replace the failing DIMM with a known good, matching module

D.Reseat all DIMMs and re-run diagnostics

AnswerC

Diagnostics already identified a single faulty DIMM, so the fault is confirmed and isolated. Swapping that module for a known good, matching specification part restores stability without disturbing the other three DIMMs or risking mismatched memory timings.

Why this answer

The memory diagnostics already identified a single faulty DIMM, so the most direct and effective next step is to replace that specific module with a known good, matching one. This resolves the immediate hardware failure without unnecessary cost or downtime. Matching ensures compatibility and avoids introducing new issues.

Exam trap

SK0-005 often tests the misconception that any memory error requires replacing all DIMMs or updating firmware, rather than isolating and replacing the specific faulty module identified by diagnostics.

How to eliminate wrong answers

Option A is wrong because updating BIOS firmware is unlikely to fix a physically failing DIMM and is not the best next step after diagnostics confirm a hardware fault. Option B is wrong because replacing all four DIMMs is unnecessary and costly when only one is faulty; it does not address the root cause more effectively. Option D is wrong because reseating may temporarily fix contact issues but will not repair a defective DIMM that already shows frequent errors.

Full explanation →

107

MCQhard

A server administrator is troubleshooting a RAID 5 array that has suddenly become degraded. The array consists of four SAS drives. The administrator runs the RAID controller management utility and sees that one drive has failed. After replacing the failed drive, the rebuild process starts but stalls at 20%. The administrator checks the event log and sees numerous medium errors on another drive. What should the administrator do next?

A.Back up critical data immediately before taking further action.

B.Restart the server to reset the RAID controller and resume the rebuild.

C.Force the rebuild to complete by setting the drive with medium errors offline.

D.Replace the drive with medium errors and allow the rebuild to continue.

AnswerA

In a degraded RAID 5 array with a second drive showing medium errors, the array is at high risk of total failure. Backing up critical data is the first priority to prevent data loss. The rebuild is stalled, and another drive is unreliable; if that drive fails during rebuild, data will be lost. A backup ensures data can be restored if the array fails.

Why this answer

A degraded RAID 5 array with a second drive showing medium errors is in a precarious state. The rebuild is stalled, and another drive failure could cause data loss. The immediate priority is to back up critical data.

Only after a backup should the administrator attempt to replace the problematic drive or take other corrective actions, ensuring data can be restored if the array fails completely.

Exam trap

The trap here is focusing on fixing the RAID array immediately without first ensuring data is backed up, risking total data loss if another drive fails during the rebuild.

Full explanation →

108

MCQhard

A technician installs a new 2U server whose chassis is 24 inches deep into a rack with 30-inch posts. After mounting, the technician notices the server's rear fans are recirculating hot exhaust because the rack's rear door is perforated but the server's rear panel sits flush against it. Cable bundles also press against the door. Which of the following is the BEST action to correct the airflow problem?

A.Increase the speed of the server's rear fans through the management controller to overcome the back pressure.

B.Reinstall the server with a rail kit that positions the chassis so a gap remains between the rear panel and the door, and reroute cables to preserve that gap.

C.Replace the perforated rear door with a solid door to contain the exhaust.

D.Reverse the server's airflow direction so the fans draw air from the rear and exhaust to the front.

AnswerB

Rear clearance is required so exhaust can escape and intake air is not drawn from the hot aisle. If the chassis sits flush against a perforated door, exhaust recirculates and static pressure rises, reducing cooling efficiency. Selecting rails that leave a proper gap and managing cables so they do not block the rear plenum restores the intended front-to-back airflow path and keeps the door closable.

Why this answer

A server needs unobstructed space behind the rear panel so exhaust can leave the chassis and enter the hot aisle. When the chassis sits flush against a perforated door and cables fill the remaining space, exhaust recirculates into the intakes. Using rails that leave a proper gap and rerouting cables restores the front-to-back airflow path while keeping the cabinet closed.

Exam trap

The trap here is treating a perforated door as sufficient for cooling and compensating with fan speed, when the real issue is the missing rear clearance that lets exhaust recirculate.

Full explanation →

109

MCQeasy

A server administrator is troubleshooting an issue where a database server's performance degrades every night at 2 AM. Resource monitor shows high disk I/O and CPU usage during that time. There are no scheduled tasks on the server. Which of the following should the administrator investigate FIRST?

A.Network congestion from backups

B.Disk defragmentation tasks

C.A cron job misconfiguration

D.Scheduled antivirus scans on the server

AnswerD

Many antivirus solutions have a default scan schedule; even without local tasks, managed scans can run at 2 AM and heavily use disk and CPU.

Why this answer

Option A is correct because centrally managed antivirus software may perform scans at a default time, causing high resource usage. Option B would result in network utilization, not local disk I/O. Option C is possible but typically scheduled and would appear in the task scheduler.

Option D contradicts the statement that no scheduled tasks exist.

Full explanation →

110

MCQhard

A company has a server running Windows Server 2022 with two 10-Gbps network adapters. The server hosts a high-traffic web application that requires maximum throughput and fault tolerance. The network switches support 802.3ad link aggregation. The administrator configures NIC teaming using LACP with Address Hash. After deployment, users report intermittent connectivity issues. Which of the following is the MOST likely cause?

A.The load balancing mode should be Dynamic instead of Address Hash.

B.The switch ports are not configured for LACP.

C.The server's network adapters are not identical models.

D.The NIC teaming mode should be Switch Independent instead of LACP.

AnswerB

LACP requires that the switch ports be configured for link aggregation (e.g., an EtherChannel or port-channel). If the switch ports are not configured for LACP, the team will not form correctly, leading to intermittent connectivity or failure. The administrator must ensure the switch configuration matches the NIC teaming settings.

Why this answer

The most likely cause is that the switch ports are not configured for LACP. LACP requires configuration on both the server and the switch to form a link aggregation group. Without proper switch configuration, the team will not function correctly, causing intermittent connectivity.

Exam trap

The trap here is assuming that configuring NIC teaming on the server alone is sufficient for LACP; the switch must also be configured.

Full explanation →

111

MCQmedium

A datacenter administrator is preparing to decommission a rack of servers that stored customer financial records. Company policy requires that data be rendered unrecoverable before the servers leave the facility, and the servers will be resold to a third party. Which action best satisfies the policy?

A.Delete all partitions and format each drive with a quick format.

B.Remove the drives and store them in a locked cabinet on site.

C.Run the manufacturer's secure erase utility and verify completion on each drive.

D.Degauss the drives before returning them to the reseller.

AnswerC

A manufacturer secure erase overwrites or cryptographically erases the drive media and provides verification, rendering the financial records unrecoverable while leaving the drives usable for resale. This matches both the data destruction policy and the plan to resell the hardware.

Why this answer

The policy demands unrecoverable destruction of financial data while the hardware is resold. A manufacturer secure erase physically or cryptographically erases the media and can be verified, satisfying both goals. Quick formatting leaves recoverable data, locked storage does not destroy anything, and degaussing destroys the drives needed for resale.

Exam trap

The trap here is equating deleting partitions or quick formatting with data destruction, when those operations leave the original data blocks recoverable.

Full explanation →

112

MCQeasy

A technician is disposing of several decommissioned servers that previously stored customer financial records. The drives will leave the building. Which action BEST ensures the data cannot be recovered by anyone who obtains the drives?

A.Physically destroy the drives by shredding or degaussing them before disposal.

B.Format each drive with the operating system's quick format option.

C.Move the drives to a locked storage room until a future disposal decision is made.

D.Delete all files and empty the recycle bin on each drive.

AnswerA

Shredding physically reduces the media to fragments, and degaussing destroys the magnetic alignment on traditional magnetic drives, making recovery infeasible. This ensures that even a determined party who obtains the drives cannot reconstruct the financial records, which is the strongest guarantee available for media leaving the facility.

Why this answer

Because the drives contain regulated financial data and are leaving the facility, the disposal method must make recovery infeasible. Physical destruction through shredding or degaussing removes any possibility of reading the media, which is stronger than any software-based erasure and aligns with the requirement that the data cannot be recovered by a later holder.

Exam trap

The trap here is treating logical deletion or quick formatting as secure erasure, when both leave the original data blocks recoverable.

Full explanation →

113

MCQmedium

A server administrator needs to deploy a new physical server that will run a database requiring high availability and maximum performance. The server has four 1 TB NVMe SSDs. The administrator wants to configure RAID 10 for both redundancy and performance. Which of the following should the administrator do to achieve this?

A.Configure a RAID 6 array using the NVMe drives.

B.Configure a hardware RAID 10 array using the RAID controller.

C.Configure software RAID 5 using the operating system's disk management tools.

D.Configure a RAID 0 array using the NVMe drives.

AnswerB

Hardware RAID 10 combines mirroring and striping, providing both redundancy and improved performance. Using a dedicated RAID controller offloads parity calculations and management from the CPU, which is ideal for a database server. This configuration meets the requirement for high availability and maximum performance with the available four NVMe SSDs.

Why this answer

RAID 10 is the best choice for a database requiring high availability and maximum performance because it combines mirroring for redundancy and striping for performance. Hardware RAID offloads processing to a dedicated controller, further enhancing performance. The other RAID levels either lack redundancy (RAID 0) or have lower performance (RAID 5, RAID 6) for write-intensive workloads.

Exam trap

The trap here is assuming that any RAID level with redundancy (like RAID 5 or RAID 6) will meet performance requirements, but RAID 10 is superior for write-intensive database workloads.

Full explanation →

114

Multi-Selectmedium

A server administrator is troubleshooting a physical server that emits a continuous amber health LED and whose operating system logs show correctable memory errors increasing on one DIMM slot. The server is still running production workloads. Which of the following actions should the administrator take? (Choose two.)

Select 2 answers

A.Run a full memory diagnostic such as memtest86+ or the vendor's offline diagnostics before replacement

B.Move the DIMM to a different slot and continue running without diagnostics

C.Schedule a maintenance window and replace the DIMM in the flagged slot

D.Increase the memory clock speed to improve error correction throughput

E.Disable ECC in the BIOS so the correctable errors stop being logged

AnswersA, C

An offline diagnostic confirms which module is failing and rules out a slot or controller issue before parts are ordered or the server is opened. It also verifies that other DIMMs are healthy so the maintenance window addresses all affected modules at once. This validation step reduces the chance of a repeat failure after replacement.

Why this answer

Correctable memory errors climbing on one DIMM signal a degrading module that should be validated and replaced. Running offline diagnostics confirms the faulty part and checks the remaining modules, while replacing the DIMM during a maintenance window removes the root cause before errors become uncorrectable and threaten production. Suppressing, relocating, or overclocking the memory leaves the failing hardware in service.

Exam trap

The trap here is silencing the amber LED or the log entries by disabling ECC or moving the DIMM, rather than treating escalating correctable errors as a hardware failure that must be replaced.

Full explanation →

115

MCQhard

A server uses NIC teaming with LACP (802.3ad) for load balancing and failover. After replacing a failed switch with a new switch of the same model, the server loses network connectivity. The switch ports show no activity. Which of the following is the MOST likely cause?

A.The switch ports are not configured as access ports.

B.The new switch has a different firmware version.

C.The server's NIC teaming mode is set to active/passive.

D.LACP is not enabled on the switch ports.

AnswerD

LACP requires configuration on the switch; default is no LACP, so the switch does not negotiate the port-channel, leading to no connectivity.

Why this answer

LACP must be explicitly enabled and configured on switch ports to form a port-channel (Option D). New switches ship with default configurations that do not include LACP. The server's NIC teaming mode (Option A) was previously working, so it is likely correct.

Access port configuration (Option B) would affect VLAN membership but not completely drop traffic. Firmware differences (Option C) rarely cause total loss of connectivity without other configuration mismatches.

Full explanation →

116

MCQmedium

A server administrator is troubleshooting a Windows Server 2019 host that fails to apply a monthly cumulative update. Windows Update returns error 0x800f0922, and the C: volume has 30 GB free while the System Reserved partition has only 12 MB free. Which of the following is the MOST likely cause?

A.The cumulative update is incompatible with the installed .NET Framework version.

B.The server's antivirus software is blocking the update package.

C.The System Reserved partition lacks sufficient free space for the update to stage its files.

D.The Windows Update service is disabled on the server.

AnswerC

Error 0x800f0922 commonly occurs when the small System Reserved or EFI System Partition cannot accommodate the update's staging requirements, and 12 MB is far below the typical headroom needed. The large amount of free space on C: rules out general disk exhaustion. Extending or cleaning the reserved partition resolves the failure.

Why this answer

Error 0x800f0922 during cumulative update installation is strongly associated with insufficient free space on the System Reserved or EFI System Partition, which the update uses to stage files. With only 12 MB free on that partition and ample space on C:, the reserved partition is the bottleneck. Freeing or extending it allows the update to complete.

Exam trap

The trap here is focusing on the large C: volume's free space and overlooking that cumulative updates also stage files on the small System Reserved or EFI partition, which is the actual constraint.

Full explanation →

117

MCQhard

A server administrator is troubleshooting a Windows Server 2019 that periodically loses network connectivity. The server has two teamed network adapters in switch-independent mode. Users report intermittent access to file shares. The administrator runs `Get-NetLbfoTeam` and sees the team status is 'Degraded'. Which of the following is the MOST likely cause?

A.One of the physical adapters in the team has failed or is disconnected.

B.The switch ports for both adapters are configured with different VLANs.

C.The NIC teaming mode is set to switch-dependent, causing a configuration conflict.

D.The server's TCP/IP stack is corrupted, requiring a reset.

AnswerA

A degraded NIC team status in Windows Server typically indicates that one or more member adapters are not functioning. This could be due to a failed adapter, a disconnected cable, or a switch port issue. The remaining adapter may still pass traffic, but redundancy is lost, and intermittent connectivity can occur if the active adapter is overwhelmed or if failover events happen.

Why this answer

The 'Degraded' status of a Windows NIC team indicates that at least one member adapter is not operational. This commonly results from a failed adapter, unplugged cable, or switch port issue. The team continues to function with remaining adapters but loses redundancy and may experience intermittent connectivity.

Checking physical connections, adapter status in Device Manager, and switch port statistics will confirm the cause. Other options do not directly explain the degraded state.

Exam trap

The trap here is focusing on logical configuration like VLANs or TCP/IP when the team status points to a physical adapter problem.

Full explanation →

118

MCQhard

Several users report sluggish performance from a database server. The server administrator notices that the CPU fans are running at maximum speed and the baseboard management controller (BMC) reports CPU temperatures of 85°C even at idle. The administrator already cleaned dust from the chassis and verified all fans are operational. Which of the following should the administrator do NEXT?

A.Add additional case fans to improve airflow.

B.Replace the CPU fans with higher RPM models.

C.Reapply thermal paste on the CPU heat sinks.

D.Increase the fan speed thresholds in the BIOS.

AnswerC

High idle temperatures with working fans and a clean chassis indicate poor heat transfer between the CPU and its heat sink. Reapplying thermal paste restores that conductive interface, which is the next logical step before considering heat sink replacement or BIOS thermal configuration changes.

Why this answer

High CPU temperatures at idle despite clean fans and operational cooling indicate a degraded thermal interface between the CPU and heatsink. Reapplying thermal paste restores heat transfer efficiency, which should bring temperatures down. This is the next logical step after ruling out dust and fan failures.

Exam trap

SK0-005 often tests the troubleshooting sequence for overheating, causing candidates to jump to fan or airflow solutions before addressing the CPU thermal interface.

How to eliminate wrong answers

Option A is wrong because adding case fans improves overall airflow but does not address the CPU-to-heatsink thermal interface, which is the likely bottleneck. Option B is wrong because replacing CPU fans with higher RPM models does not fix a dried-out or poorly applied thermal paste. Option D is wrong because increasing fan speed thresholds in the BIOS only changes when fans ramp up; it does not reduce CPU temperature at idle and may mask the real issue.

Full explanation →

119

MCQhard

A VMware ESXi host runs six virtual machines, each configured with 8GB of RAM, totaling 48GB allocated. The host physically has 32GB of RAM, and memory overcommitment is enabled. Recently, a critical VM experienced severe performance degradation during peak hours, with the guest OS showing high memory pressure and balloon driver activity, while other VMs showed moderate usage. Which of the following actions will BEST resolve the issue without compromising other VMs?

A.Purchase and install an additional 32GB of physical RAM in the host.

B.Disable the VMware balloon driver on all virtual machines.

C.Configure a memory reservation of 8GB for the critical VM.

D.Reduce the CPU limit on the non-critical VMs during peak hours.

AnswerC

A reservation grants the VM guaranteed access to physical RAM, protecting it from ballooning and hypervisor swapping, thus stabilizing performance.

Why this answer

Option B (Set a memory reservation equal to its configured 8GB on the critical VM) is correct because it guarantees physical RAM for that VM, preventing the balloon driver from reclaiming its memory and reducing hypervisor swapping. Option A (Increase host RAM) would solve it broadly but is not the most immediate, targeted action and may not be feasible. Option C (Disable balloon driver on all VMs) could cause host swapping, degrading all VMs.

Option D (Reduce CPU limits) does not address memory contention.

Full explanation →

120

MCQmedium

A server administrator is installing a new 2U rack server that will use four 960GB SATA SSDs in a hardware RAID 10 array for the operating system. The server's RAID controller supports both SATA and SAS drives. After physically installing the drives in the front bays, the administrator powers on the server but the RAID controller does not detect any drives. Which of the following is the MOST likely cause?

A.The power supply units are insufficient to power the SSDs.

B.The RAID controller firmware needs to be updated to support SATA SSDs.

C.The drives are not initialized in the RAID controller BIOS.

D.The drives are not properly seated in the backplane connectors.

AnswerD

In a 2U server, drives slide into front bays and connect to a backplane. If not fully seated, the controller cannot detect them. Reseating the drives ensures proper contact with the backplane connectors, which is a common oversight during initial installation.

Why this answer

The most likely cause is that the drives are not fully seated in the backplane connectors. In hot-swap bays, drives must be pushed firmly until they click. If not seated, the RAID controller sees no drives.

Reseating is a simple first step before investigating firmware or configuration.

Exam trap

The trap here is assuming a firmware or configuration issue when the physical connection is the most common point of failure during initial installation.

Full explanation →

121

MCQmedium

A company’s file server runs Windows Server 2022 and hosts a 4 TB volume. Users report that saving large files to a shared folder occasionally fails with an error about insufficient disk space, even though the volume shows 800 GB of free space. Performance Monitor shows high Avg. Disk sec/Transfer and frequent paging. Which action should the administrator take first to resolve the file‑save failures?

A.Enable Data Deduplication on the volume to reclaim space.

B.Convert the volume to ReFS to improve file handling.

C.Increase the amount of RAM in the server.

D.Move the shared folder to a different volume with more free space.

AnswerC

The high Avg. Disk sec/Transfer and paging indicate that the server is memory‑constrained, causing excessive disk I/O. When RAM is insufficient, the system pages to disk, slowing file operations and causing timeouts that can appear as insufficient disk space errors. Adding RAM reduces paging, improves disk performance, and allows file saves to complete successfully.

Why this answer

The server’s symptoms—high disk transfer times, frequent paging, and file‑save failures despite free space—point to insufficient RAM. When memory is low, Windows pages heavily to disk, causing I/O bottlenecks and timeouts. Adding RAM reduces paging, improves disk responsiveness, and resolves the file‑save errors.

Other options do not address the memory constraint and could introduce unnecessary changes.

Exam trap

The trap here is assuming that free disk space alone guarantees successful file saves, overlooking how memory exhaustion can cause I/O timeouts that masquerade as disk space errors.

Full explanation →

122

Multi-Selectmedium

A datacenter manager is reviewing physical security controls for a server room. Which two controls are considered preventive measures against unauthorized physical access? (Choose two.)

Select 2 answers

A.Biometric lock

B.Security camera

C.Log monitoring

D.Visitor sign-in sheet

E.Access control vestibule

AnswersA, E

A biometric lock uses a unique physical characteristic, such as a fingerprint or iris scan, to authenticate individuals before granting access. It is a preventive control because it stops unauthorized persons from entering the server room unless they present valid biometric data. This directly prevents physical intrusion and is a common requirement for high-security areas, making it one of the correct preventive measures.

Why this answer

Preventive controls actively stop unauthorized access before it occurs. A biometric lock and an access control vestibule both require authentication and physically block entry, making them preventive. Security cameras and log monitoring are detective controls that record or detect events, and a visitor sign-in sheet is an administrative control that documents but does not prevent access.

Exam trap

The trap here is classifying detective controls such as cameras and log monitoring as preventive, when they only observe or record rather than stop unauthorized access.

Full explanation →

123

MCQeasy

A server administrator needs to deploy a new physical server that will host a database. The database requires high random read/write performance and redundancy. The server has a RAID controller that supports RAID 0, 1, 5, 6, and 10. The administrator installs four identical SAS SSDs. Which RAID level should the administrator configure to meet the performance and redundancy requirements?

A.RAID 0

B.RAID 5

C.RAID 10

D.RAID 1

AnswerC

RAID 10 combines mirroring and striping, providing both redundancy and high performance for random reads and writes. With four drives, it creates two mirrored pairs and stripes data across them. This offers excellent performance and fault tolerance, making it ideal for database workloads. It is the best choice among the options for meeting both performance and redundancy requirements.

Why this answer

RAID 10 offers the best combination of high random read/write performance and redundancy for a database server. It stripes data across mirrored pairs, allowing multiple simultaneous reads and writes while tolerating drive failures. Other RAID levels either lack redundancy (RAID 0) or have performance limitations for write-intensive workloads (RAID 1, RAID 5).

Exam trap

The trap here is assuming RAID 5 is sufficient for databases because it offers redundancy and decent read performance, but it falls short on random write performance.

Full explanation →

124

Multi-Selecthard

A company is designing a disaster recovery plan for a critical web application. The plan must ensure that the application can be recovered within a 4-hour recovery time objective (RTO) and that no more than 1 hour of data is lost. The application runs on virtual machines backed by a storage area network (SAN). Which two actions best support these objectives? (Choose two.)

Select 2 answers

A.Perform nightly full backups to tape and store the tapes offsite.

B.Configure the virtual machines to replicate to a secondary host every 15 minutes using hypervisor-based replication.

C.Enable daily snapshots on the primary SAN and retain them for 30 days.

D.Store a copy of the application installation media in a locked cabinet at the primary site.

E.Implement SAN-based replication to a secondary site with a 1-hour recovery point objective.

AnswersB, E

Hypervisor-based replication every 15 minutes keeps the secondary copy within the 1-hour RPO and allows rapid failover, supporting the 4-hour RTO. It complements SAN replication by providing an application-consistent or crash-consistent copy that can be powered on quickly.

Why this answer

Meeting a 1-hour RPO and 4-hour RTO requires a recent, ready-to-use copy of the data at a secondary location. SAN-based replication with a 1-hour RPO and hypervisor-based replication every 15 minutes both provide that. Nightly tape backups, primary-site snapshots, and local installation media either exceed the RPO or do not survive a site failure.

Exam trap

The trap here is selecting any backup or replication method without verifying that its interval and location actually satisfy both the 1-hour RPO and the 4-hour RTO.

Full explanation →

125

MCQeasy

A server administrator is configuring a new Windows Server 2022 server that will host a database. The server has four 10 TB SAS drives and a hardware RAID controller. The administrator needs to maximize performance for random reads and writes while providing redundancy. Which RAID level should the administrator implement?

A.RAID 10

B.RAID 0

C.RAID 5

D.RAID 1

AnswerA

RAID 10 combines mirroring and striping, using four drives in two mirrored pairs. It provides excellent random read and write performance because data is striped across mirrors, and it offers redundancy by tolerating one drive failure per mirror. This makes it ideal for database workloads requiring high performance and fault tolerance.

Why this answer

RAID 10 stripes data across multiple mirrored pairs, delivering high random read and write performance while providing redundancy. For a database server with four drives, RAID 10 utilizes all drives for both performance and fault tolerance, unlike RAID 1 which uses only two drives for a single mirror, or RAID 5 which incurs write penalties due to parity. RAID 0 lacks redundancy, so it is not suitable.

Exam trap

The trap here is choosing RAID 5 for its balance of capacity and redundancy, but its write penalty makes it a poor fit for random write-intensive database workloads.

Full explanation →

126

MCQeasy

A server administrator is troubleshooting a server that is emitting a continuous beeping sound. The server is powered on but does not display any video. The administrator checks the server's documentation and finds that the beep code indicates a memory error. Which of the following should the administrator do FIRST?

A.Reseat the memory modules and test one at a time.

B.Update the BIOS to the latest version.

C.Replace all memory modules with new ones.

D.Check the power supply voltages with a multimeter.

AnswerA

Reseating memory modules can resolve issues caused by poor contact, and testing one module at a time helps isolate a faulty DIMM. This is a non-destructive first step that directly addresses the indicated memory error. It is also cost-effective and quick to perform before considering replacements or more complex diagnostics.

Why this answer

The correct answer is to reseat the memory modules and test one at a time. This approach is methodical and addresses the most likely causes of a memory error: poor contact or a single faulty DIMM. It is a quick, non-destructive step that can often resolve the issue without replacing hardware.

Only if this fails should more advanced steps be taken.

Exam trap

The trap here is jumping to replace all memory or update BIOS when a simple reseat and isolation test is the appropriate first action.

Full explanation →

127

MCQeasy

A server administrator is tasked with ensuring that a critical database server remains available in the event of a hardware failure. The solution must provide automatic failover with minimal administrative overhead. Which of the following should be implemented?

A.Load balancing

B.Scheduled backups

C.RAID 1 mirroring

D.Server clustering

AnswerD

Server clustering links nodes so a surviving member automatically takes over the failed node's workload, delivering failover with minimal manual intervention. This satisfies the stem's automatic failover and low administrative overhead constraints, unlike standalone backups or manual restore procedures.

Why this answer

Server clustering groups two or more servers so that if one node fails, another automatically takes over the workload with minimal manual intervention. This provides the automatic failover and low administrative overhead the scenario requires for a critical database server. Clustering is the standard high-availability solution for database workloads needing continuous uptime.

Exam trap

SK0-005 often tests the distinction between storage-level redundancy (RAID) and server-level high availability (clustering)—candidates pick RAID 1 thinking disk mirroring equals server failover, missing that RAID cannot survive a whole-server outage.

How to eliminate wrong answers

Option A is wrong because load balancing distributes traffic across multiple servers for performance and scalability but does not by itself provide automatic failover of a stateful database workload or guarantee session/data continuity. Option B is wrong because scheduled backups protect data but do not keep the server available—restoring from backup involves significant downtime and manual effort, violating the minimal-overhead requirement. Option C is wrong because RAID 1 mirroring only protects against a single disk failure at the storage layer; it does nothing if the server's motherboard, power supply, or OS fails, so it cannot deliver server-level automatic failover.

Full explanation →

128

PBQhard

A medium-sized company uses a backup strategy that includes a full backup every Sunday at 2:00 AM and differential backups Monday through Saturday at 2:00 AM. The backups are written to a network-attached storage (NAS) device. On Thursday morning, the company experiences a ransomware attack that encrypts all data on the file server, including the NAS. The administrator needs to restore the file server with minimal data loss. The last successful full backup was from the previous Sunday, and differential backups were successful on Monday, Tuesday, and Wednesday. However, Thursday's differential was not completed because the attack occurred before the scheduled time. The administrator attempts to restore using the Sunday full backup and Thursday's differential, but the restore fails because the differential backup on the NAS is also encrypted. Which of the following is the best course of action?

A.Pay the ransom to decrypt the differential backup

B.Restore from the Sunday full backup and Wednesday's differential backup

C.Reinstall the operating system and restore files from cloud storage

D.Restore using only Wednesday's differential backup

AnswerB

Why this answer

Differential backups capture all changes since the last full backup, so Wednesday's differential contains everything modified since Sunday. Restoring the Sunday full backup followed by Wednesday's differential recovers all data up to Wednesday night, which is the most recent uncorrupted recovery point available. Thursday's differential is encrypted and unusable, so Wednesday is the correct fallback.

Exam trap

SK0-005 often tests whether candidates understand that a differential backup cannot be restored without its parent full backup — the trap is picking 'restore Wednesday's differential only' or assuming Thursday's encrypted differential can somehow be used.

How to eliminate wrong answers

Option A is wrong because paying the ransom is never a recommended recovery strategy — it funds attackers, does not guarantee decryption, and violates most security policies. Option C is wrong because reinstalling the OS and restoring from cloud storage is unnecessary and assumes cloud copies exist; the scenario describes NAS-only backups, and this would cause far more data loss than Wednesday's differential. Option D is wrong because a differential backup cannot be restored alone — it requires the preceding full backup as its base, so restoring only Wednesday's differential would fail or produce an incomplete filesystem.

Full explanation →

129

MCQeasy

A technician is installing a new server into a rack and needs to ensure the chassis does not tip forward when a heavy component is pulled out on its rails. Which of the following should the technician install FIRST?

A.A vertical PDU mounted in the rear of the rack to add weight to the back of the cabinet.

B.Cage nuts and screws at the front of the server to secure the chassis to the front uprights.

C.A cable management arm attached to the rear of the rails to limit forward travel.

D.A stabilizer or anti-tip foot on the bottom front of the rack before extending any equipment.

AnswerD

Rack stabilizers or anti-tip feet extend the effective footprint of the cabinet and prevent it from tipping when heavy servers are pulled forward on their rails. Installing them before extending equipment is a standard safety practice in server hardware installation and protects both personnel and hardware from a rack overturning.

Why this answer

Anti-tip feet or stabilizers widen the rack's base and prevent it from pitching forward when a server on sliding rails is fully extended. They should be deployed before equipment is pulled out, making them the correct first step to protect the technician and the installed hardware from an overturn.

Exam trap

The trap here is assuming front flange screws alone keep a rack from tipping when rails are extended.

Full explanation →

130

MCQmedium

A server technician is replacing a failed hot-swappable 2.5-inch SAS drive in a production 2U server while it remains powered on. The drive bay is populated and the array is in a degraded state. Which of the following should the technician do FIRST before physically removing the failed drive?

A.Verify the replacement drive has a higher spindle speed and larger cache than the failed unit

B.Shut down the server and place it in maintenance mode before opening the chassis

C.Delete the failed member from the RAID configuration to prevent rebuild conflicts

D.Identify the failed drive's bay location using the drive LED status indicators or the RAID controller management utility

AnswerD

This is correct because pulling the wrong drive from a live array can cause a second failure and take the volume offline entirely. The controller management utility or the bay fault LED unambiguously identifies which physical slot corresponds to the failed member, so the technician removes only the intended drive while the array remains degraded but accessible.

Why this answer

Before touching a live array, the technician must positively identify the failed member's physical bay. Fault LEDs on the drive carrier or the controller's management interface map logical members to physical slots, preventing removal of a healthy drive that would push a degraded array into a failed state. Shutting down, deleting configuration, or checking performance specs do not address the immediate risk of removing the wrong component.

Exam trap

The trap here is assuming any drive can be pulled because the hardware is hot-swappable, when the real hazard is removing a healthy member and destroying the array.

Full explanation →

131

MCQmedium

A server administrator receives alerts that a file server's system volume is nearly full. The administrator runs a disk usage report and finds that a single log directory contains millions of small files consuming most of the free space. Users need the server to remain online while the issue is resolved. Which of the following should the administrator do to reclaim space with the LEAST disruption?

A.Extend the system volume by adding a disk to the existing array and expanding the partition online

B.Perform an online defragmentation of the system volume to consolidate the small files

C.Archive or rotate the log files to another volume and delete or compress the older logs

D.Run a full antivirus scan on the volume to remove infected files and quarantine them

AnswerC

Moving older logs to another volume and removing or compressing them directly reclaims space on the system volume without taking the server offline or disrupting users. This addresses the identified cause, the accumulation of millions of small files, and can be performed while the server remains in service. It is the least disruptive effective remedy for the capacity shortfall.

Why this answer

The disk usage report identifies millions of accumulated log files as the cause of the near-full volume, so the direct, low-impact remedy is to archive or rotate those logs to another volume and remove or compress the old ones. This reclaims space immediately without taking the server offline or disrupting users, unlike scanning, defragmenting, or expanding the volume, which do not address the root cause.

Exam trap

The trap here is reaching for storage expansion or maintenance operations when the immediate problem is an accumulation of files that can simply be relocated or deleted online.

Full explanation →

132

MCQhard

A server administrator is configuring a Windows Server 2022 failover cluster with two nodes. The cluster will host a highly available file server role. The administrator needs to ensure that the file server role can fail over automatically if one node goes down. The cluster has shared storage presented as a single disk. Which of the following should the administrator configure to meet this requirement?

A.Configure the file server role to use a distributed network name and a scale-out file server.

B.Enable Cluster Shared Volumes (CSV) and place the file server role on the CSV.

C.Add the file server role as a clustered role and ensure the shared disk is added as a resource in the role.

D.Configure the file server role with a preferred owner and set the failover threshold to 1.

AnswerC

To enable automatic failover, the file server role must be a clustered role with the shared disk as a dependency. This ensures that the role and its storage move together to the surviving node. The cluster service manages the failover automatically when a node fails, provided quorum is maintained. This is the standard configuration for a highly available file server.

Why this answer

The correct configuration is to add the file server role as a clustered role and include the shared disk as a resource in that role. This ensures that the role and its storage are managed together and can fail over automatically to the other node if one fails. The cluster service handles the failover based on node health and quorum.

Exam trap

The trap here is confusing Cluster Shared Volumes with traditional shared storage for failover clustering; CSV is not used for standard file server roles.

Full explanation →

133

MCQeasy

A server administrator is replacing a failed hard drive in a server that uses a hardware RAID controller. The server supports hot-swappable drives. Which of the following should the administrator do FIRST to safely replace the drive?

A.Remove the drive immediately and replace it with a new one.

B.Back up all data on the server before replacing the drive.

C.Power down the server and disconnect power cables.

D.Identify the failed drive using the RAID controller management utility or drive LEDs.

AnswerD

Before removing a drive, the administrator must positively identify the failed drive to avoid pulling a good drive and causing a second failure. RAID controllers provide management utilities (e.g., MegaRAID Storage Manager, iDRAC, or HPE Smart Storage Administrator) that show which physical drive is failed. Drive LEDs also indicate fault status. This step ensures the correct drive is replaced.

Why this answer

The correct first step is to identify the failed drive using the RAID controller management utility or drive LEDs. This prevents accidentally removing a healthy drive, which could cause a second failure and potentially data loss. Once the failed drive is confirmed, the administrator can safely hot-swap it.

Backups and power-down are not required first steps in a hot-swap scenario.

Exam trap

The trap here is thinking that hot-swap means you can just pull any drive without verification, or that you must power down first.

Full explanation →

134

MCQmedium

A server administrator is configuring a new Linux server that will run a critical web application. The administrator needs to ensure that the web service automatically starts if the server reboots and restarts if it crashes. The server uses systemd. Which of the following should the administrator do?

A.Add the service to /etc/rc.local and use a cron job to check and restart it.

B.Use the nohup command to run the service in the background and add it to the root crontab with @reboot.

C.Create a systemd service unit with Restart=always and enable it with systemctl enable.

D.Configure the service as a SysV init script and use chkconfig to enable it.

AnswerC

Creating a systemd service unit with Restart=always ensures the service restarts if it crashes. Enabling the unit with systemctl enable configures it to start automatically at boot. This meets both requirements: automatic start on reboot and restart on crash. systemd is the standard init system on modern Linux distributions, so this is the correct approach.

Why this answer

Using a systemd service unit with Restart=always and enabling it is the correct method. systemd provides built-in service management, including automatic restart on failure and start on boot. This is the standard and most reliable way to ensure a critical service remains available on modern Linux servers.

Exam trap

The trap here is assuming that legacy methods like cron or rc.local can provide the same level of service management as systemd.

Full explanation →

135

MCQhard

A server administrator is troubleshooting a server that fails to boot after a firmware update. The server powers on, completes POST, but then displays a message indicating no bootable device found. The administrator confirms the RAID controller is detected and the drives are online. What is the most likely cause?

A.The operating system boot files are corrupted.

B.The boot order in the UEFI/BIOS was reset during the firmware update.

C.The RAID array is degraded and needs to be rebuilt.

D.The firmware update failed and corrupted the RAID controller.

AnswerB

Firmware updates can reset UEFI/BIOS settings to defaults, including boot order. If the boot order no longer includes the RAID volume or the correct device, the server will report no bootable device. Since the RAID controller and drives are online, the data is intact. Reconfiguring the boot order to prioritize the RAID volume resolves the issue.

Why this answer

The correct answer is that the boot order in the UEFI/BIOS was reset during the firmware update. Firmware updates often reset BIOS settings to defaults, which can remove the RAID volume from the boot order. Since the RAID controller and drives are online, the data is safe.

Reconfiguring the boot order restores bootability.

Exam trap

The trap here is assuming data loss or corruption, but the drives are online and the controller is detected, so the issue is configuration, not hardware failure.

Full explanation →

136

MCQhard

A system administrator is configuring a new server that will run a high-performance database. The server has four 1 TB NVMe drives and a hardware RAID controller that supports RAID 0, 1, 5, 6, 10, and 50. The database workload is write-intensive with random I/O. The administrator needs to maximize performance while providing redundancy against a single drive failure. Which RAID level should the administrator choose?

A.RAID 6

B.RAID 5

C.RAID 10

D.RAID 0

AnswerC

RAID 10 combines mirroring and striping, providing both redundancy and high performance. It can tolerate a single drive failure (or more, depending on which drives fail) and excels at write-intensive random I/O because it does not require parity calculations. With four drives, RAID 10 uses two mirrored pairs, offering excellent performance and fault tolerance.

Why this answer

For a write-intensive random I/O database workload, RAID 10 is the best choice because it provides redundancy and superior write performance by avoiding parity overhead. RAID 0 lacks redundancy, while RAID 5 and RAID 6 incur write penalties that would hinder performance. RAID 10 meets both the performance and redundancy requirements.

Exam trap

The trap here is assuming that RAID 5 or RAID 6, which offer redundancy, are suitable for write-intensive workloads, when their parity calculations significantly degrade write performance.

Full explanation →

137

MCQhard

A server administrator is troubleshooting a Windows Server 2019 host whose local volumes suddenly show as RAW in Disk Management after a storage controller firmware update. The volumes were NTFS and contained production data. Which of the following actions should the administrator take FIRST?

A.Immediately reformat the volumes as NTFS to restore service

B.Capture a sector-level image of each affected disk before attempting any repair

C.Run chkdsk /f on each affected volume to repair the file system

D.Roll back the controller firmware and reboot to see if the volumes return

AnswerB

Imaging the disks first preserves the exact on-disk state, so any subsequent repair or recovery attempt can be repeated or reversed without further risk. Because the volumes turned RAW right after a firmware update, the data is probably intact and the issue may be metadata interpretation or controller configuration. Working from an image protects the original evidence.

Why this answer

When volumes unexpectedly appear as RAW after a controller firmware change, the priority is preserving the current disk state. A sector-level image captures everything before any write occurs, so repair, rollback, or third-party recovery can proceed safely. Repair tools, formatting, and even a firmware rollback all risk modifying the disks, so imaging must come first.

Exam trap

The trap here is treating RAW as ordinary corruption and running chkdsk or reformatting, when the correct first move is to preserve the disks because the data may still be fully recoverable.

Full explanation →

138

MCQmedium

A server administrator is troubleshooting a newly installed 2U server that powers on but does not complete POST. The server emits a repeating beep code and no video output appears. The administrator has already reseated the memory modules and verified that the power supplies are fully seated and the power LEDs are green. Which of the following should the administrator check NEXT?

A.Replace the CMOS battery and clear the NVRAM using the motherboard jumper.

B.Verify that the CPU is properly seated in its socket and that the heatsink is making full contact.

C.Check the front panel USB and video cables for proper connection to the motherboard.

D.Update the BIOS firmware to the latest version using the vendor's update utility.

AnswerB

A repeating beep code with no video on a new build commonly indicates a CPU or socket issue. If the processor is not fully seated or the heatsink is not making proper contact, the system may halt before POST completes. Checking CPU seating and heatsink contact is a logical next step after memory and power have been ruled out.

Why this answer

After ruling out memory and power, a repeating beep code with no POST on a new server strongly suggests the CPU is not properly seated or the heatsink is not making full contact. Many motherboards emit a specific beep pattern for CPU errors. Verifying CPU installation and heatsink contact is the next logical hardware check.

Exam trap

The trap here is assuming that a no-POST condition with beep codes always points to memory, even after memory has been reseated and verified.

Full explanation →

139

Multi-Selecthard

A server administrator is troubleshooting a Linux server that is experiencing performance issues. The administrator suspects that a specific process is consuming excessive CPU resources. Which two commands can be used to identify the process? (Choose two.)

Select 2 answers

A.ps aux --sort=-%cpu

B.top

C.free -m

D.netstat -tuln

E.df -h

AnswersA, B

This command lists all running processes and sorts them by CPU usage in descending order. The --sort=-%cpu option ensures the highest CPU consumers appear at the top. It provides a snapshot that is useful for identifying processes with high CPU usage, making it an effective tool for this scenario.

Why this answer

The top and ps aux --sort=-%cpu commands both provide information about CPU usage per process. The top command offers a live, interactive view, while ps aux --sort=-%cpu gives a sorted snapshot. The other commands focus on disk space, network ports, and memory, which are not directly useful for identifying a CPU-intensive process.

Exam trap

The trap here is assuming that any system monitoring command will help, when only those that display per-process CPU usage are relevant.

Full explanation →

140

MCQeasy

A rack-mounted server must be installed in a datacenter cabinet that is only 30 inches deep, while the server's rails require a minimum depth of 35 inches for the rear brackets to attach. The server is currently supported only by the front flanges. Which of the following should the technician do?

A.Mount the server in the shallow cabinet using a universal rail kit that does not require rear attachment.

B.Trim the rear rails to fit the 30-inch cabinet and torque the front flanges to compensate for the missing rear support.

C.Install the server using only the front mounting flanges and support the rear with a shelf.

D.Relocate the server to a cabinet that meets the rail's minimum depth requirement and mount it with both front and rear brackets secured.

AnswerD

Rails are engineered to bear the chassis weight at both the front and rear attachment points. A cabinet shallower than the rail's minimum depth cannot support the rear brackets, so moving the server to a compliant cabinet and securing both ends is the correct way to ensure stability, airflow alignment, and safe serviceability.

Why this answer

Server rails are designed to attach at both the front and rear of the cabinet, distributing the chassis weight and keeping the unit square. A cabinet that does not meet the rail's minimum depth cannot accept the rear brackets, so the correct action is to install the server in a cabinet that satisfies the rail specification rather than improvising support.

Exam trap

The trap here is treating the front flanges as sufficient structural support for a permanently racked server.

Full explanation →

141

Multi-Selectmedium

A server administrator is troubleshooting intermittent network connectivity issues on a server. Users report that connections to the server sometimes time out, and the administrator notices that the server's link LED on the switch occasionally goes dark. The administrator has already replaced the patch cable from the server to the wall jack. Which of the following should the administrator check NEXT? (Choose two.)

Select 2 answers

A.Verify the integrity of the structured cabling between the wall jack and the patch panel.

B.Update the NIC driver to the latest version from the vendor's website.

C.Reconfigure the switch port to use a fixed speed and duplex instead of auto-negotiation.

D.Check the switch port for errors, duplex mismatches, or flapping using the switch's management interface.

E.Replace the server's network interface card with a known-good spare.

AnswersA, D

Intermittent link loss after replacing the patch cable often indicates a problem in the permanent link, such as a damaged or poorly terminated cable between the wall jack and patch panel. Testing or certifying this segment can reveal opens, shorts, or high attenuation that cause intermittent connectivity. This is a logical next step in isolating the fault.

Why this answer

Intermittent link loss after replacing the patch cable points to the structured cabling or the switch port. Checking the permanent link between the wall jack and patch panel, and reviewing switch port statistics for errors or flapping, are the next logical diagnostic steps to isolate the fault.

Exam trap

The trap here is assuming the NIC or driver is at fault when the link LED on the switch is going dark, which indicates a physical layer issue rather than a software or NIC problem.

Full explanation →

142

MCQmedium

A server administrator is troubleshooting a Windows Server 2019 file server that intermittently becomes unreachable on the network for 30-60 seconds at a time. Event Viewer shows repeated Netlogon 5719 errors stating that no domain controller is available, and the network team confirms no switch or router outages. The server has two teamed NICs. Which of the following should the administrator check FIRST to resolve this issue?

A.Replace both network interface cards in the team because intermittent link failures indicate failing hardware.

B.Rebuild the Netlogon secure channel by resetting the computer account password with netdom or Test-ComputerSecureChannel.

C.Disable the NIC team and configure a single adapter to eliminate teaming as a possible cause.

D.Verify the DNS server addresses configured on the server and confirm the domain controller records resolve correctly.

AnswerD

Netlogon 5719 with no network outages typically indicates the server cannot locate a domain controller through DNS, so validating the configured DNS servers and confirming the SRV and A records for the domain controllers resolve correctly is the most direct first step to isolate the failure.

Why this answer

Intermittent Netlogon 5719 errors with confirmed network stability almost always trace back to name resolution or domain-locator configuration. Checking the DNS servers and confirming domain controller SRV records resolve correctly identifies whether the server can find a domain controller at all, which is the fastest path to a definitive diagnosis.

Exam trap

The trap here is assuming that a network reachability symptom must be a physical or switching problem, when the underlying cause is actually DNS-based domain controller location.

Full explanation →

143

Multi-Selectmedium

A company runs a critical application on a physical Windows Server 2022 with four 146 GB SAS drives in a RAID 5 array and a single hot-spare. The server has been in production for five years. The IT manager asks you to recommend two proactive measures to reduce the risk of unplanned downtime due to drive failures. (Choose two.)

Select 2 answers

A.Configure a weekly scheduled consistency check (patrol read) on the RAID controller.

B.Enable and configure SMART monitoring with alerting on the server.

C.Schedule a nightly full backup of the server to an external USB drive.

D.Convert the RAID 5 array to RAID 0 to improve performance.

E.Replace all drives with higher-capacity drives to increase the array size.

AnswersA, B

A consistency check scans the array for media errors and corrects them using parity, detecting latent sector faults before a rebuild. On a five-year-old RAID 5 array, this reduces the chance that a second drive fails during rebuild. It is a proactive, non-disruptive maintenance task that directly addresses the scenario's goal of reducing unplanned downtime from drive failures.

Why this answer

A consistency check (patrol read) proactively scans the RAID array for media errors and corrects them using parity, while SMART monitoring predicts drive failures before they occur. Together, they provide early warning and maintenance that can prevent a drive failure from causing downtime. The other options either increase risk, do not address drive failure, or only help after an outage.

Exam trap

The trap here is confusing data protection (backups) with uptime protection (proactive drive health monitoring and maintenance).

Full explanation →

144

PBQmedium

A server administrator receives reports that a production server is shutting down unexpectedly after running for several hours. The server is a 2U rackmount unit located in a data center with proper ambient cooling (20°C/68°F). The server has redundant power supplies connected to separate PDUs and no power anomalies are reported. The administrator checks the operating system event logs and finds a critical log entry: 'The system was shut down due to a thermal event.' However, the CPU temperature logs show that the CPU was at 47°C at the time of shutdown, and the chassis inlet temperature was 23°C. The server's internal fans are running at high speed and are clearly audible. The administrator suspects a thermal issue but is unsure why the CPU is not showing high temperature. The server has a baseboard management controller (BMC) that monitors various sensors. Which of the following components should the administrator investigate FIRST to identify the likely cause of the shutdown?

A.Swap the redundant power supplies to rule out a failing PSU.

B.Inspect the voltage regulator module (VRM) temperatures and airflow around the motherboard.

C.Replace the CPU heatsink and reapply thermal paste.

D.Update the server firmware and BIOS to the latest version.

AnswerB

Why this answer

Option B is correct because voltage regulator modules (VRMs) can overheat and trigger a thermal shutdown via the BMC even when the CPU temperature is within normal limits. VRMs are often located in areas with restricted airflow and are critical to CPU power delivery. Option A is incorrect because CPU temperature is normal, so the heatsink is likely functioning.

Option C is incorrect because power supply faults would not generate a thermal event. Option D is a possible long-term fix for a firmware bug, but physical inspection of temperature-sensitive components should come first.

Full explanation →

145

MCQeasy

A technician is installing a new server into a rack and needs to connect the server's out-of-band management port so the server can be powered on and monitored remotely. Which of the following should the technician connect?

A.The iDRAC or iLO dedicated management port to the management network.

B.The serial port to a terminal server.

C.The USB port to a KVM switch in the rack.

D.The onboard 1 GbE NIC to the production network switch.

AnswerA

The dedicated management port, branded iDRAC on Dell and iLO on HPE, provides out-of-band access independent of the operating system. It allows remote power control, console redirection, and hardware monitoring, which is exactly what the technician needs for remote power-on and monitoring.

Why this answer

Out-of-band management is provided by a dedicated service processor with its own network port, such as iDRAC or iLO. Connecting that port to the management network lets an administrator power cycle the server, view the console, and monitor hardware health even when the operating system is down.

Exam trap

The trap here is confusing in-band network connectivity with out-of-band management that works independently of the operating system.

Full explanation →

146

MCQhard

A server administrator is troubleshooting a performance issue on a Linux server. The server hosts a database that performs many small random reads and writes. The administrator suspects that disk I/O is the bottleneck. Which command should the administrator use to view real-time disk I/O statistics per device, including utilization and await times?

A.vmstat 2

B.top

C.netstat -i

D.iostat -x 2

AnswerD

iostat is part of the sysstat package and provides detailed per-device I/O statistics. The -x option displays extended statistics such as %util (utilization) and await (average wait time), which are critical for diagnosing I/O bottlenecks. Running it with an interval of 2 seconds gives real-time monitoring, making it ideal for this scenario.

Why this answer

iostat -x provides extended disk I/O statistics per device, including %util and await, which directly indicate disk performance and bottlenecks. vmstat gives a high-level view but lacks per-device detail, top focuses on CPU and memory, and netstat is for network interfaces. Therefore, iostat is the correct tool for diagnosing disk I/O issues.

Exam trap

The trap here is confusing general system monitoring tools like vmstat or top with specialized disk I/O tools; only iostat provides per-device extended statistics.

Full explanation →

147

MCQeasy

A rack-mount server must be installed in a cabinet that is only 30 inches deep, while the server's rails are designed for a 36-inch cabinet and allow the chassis to extend beyond the front and rear posts. The server must remain serviceable and the cabinet doors must close. Which of the following should the technician do FIRST?

A.Verify the rail kit's minimum cabinet depth and obtain a shorter rail kit or a deeper cabinet if the specified depth is not met.

B.Install the server with the front posts only and let the rear of the chassis rest on the cabinet base.

C.Mount the server vertically using a wall-mount bracket instead of the rails.

D.Remove the cabinet's rear door to provide the extra clearance the server needs.

AnswerA

Rail kits specify a minimum and maximum cabinet depth, commonly expressed as the distance between front and rear mounting posts. If the cabinet's post-to-post distance is below the rail kit minimum, the rails cannot be secured at both ends and the chassis will protrude. Confirming the specification and sourcing a compatible rail kit or cabinet is the correct first step before any physical work.

Why this answer

Rack rails are rated for a specific range of cabinet depths, and installing them in a shallower cabinet leaves the chassis unsupported at the rear and protruding past the posts. Checking the rail kit's published depth range and procuring compatible hardware or a deeper cabinet resolves the incompatibility before any damage or unsafe mounting occurs.

Exam trap

The trap here is treating cabinet depth as a cosmetic clearance issue and improvising support, when rail kits have hard minimum and maximum depth specifications that must be matched.

Full explanation →

148

MCQmedium

After installing additional RAM modules in a server, the BIOS displays only a portion of the installed memory. The modules are identical in speed and size but from different manufacturers. Which of the following is the BEST initial troubleshooting step?

A.Replace the motherboard.

B.Run memtest86 immediately.

C.Reseat all memory modules and ensure proper slot population.

D.Update the server BIOS firmware.

AnswerC

This addresses the most common cause of unrecognized memory: poor connections or incorrect order of slots.

Why this answer

Reseating memory and checking population order (Option C) are the first steps because improper seating or incorrect slot placement can cause the BIOS to not recognize all modules. Updating BIOS (Option A) might help if a compatibility issue exists, but physical inspection should come first. Replacing the motherboard (Option B) is too extreme.

Running memtest86 (Option D) is useful but should follow physical checks.

Full explanation →

149

MCQhard

A server administrator is planning a storage configuration for a new database server that will handle a high volume of random writes. The server has eight 1.2 TB 10K RPM SAS drives and a hardware RAID controller with a 4 GB cache and battery backup. The administrator needs to maximize write performance while ensuring data redundancy. Which RAID level and configuration should the administrator implement?

A.RAID 5 with a stripe size of 64 KB

B.RAID 10 with a stripe size of 256 KB

C.RAID 0 with a stripe size of 64 KB

D.RAID 6 with a stripe size of 128 KB

AnswerB

RAID 10 mirrors and stripes data, providing excellent random write performance because no parity calculations are needed. Each write is simply written to two drives. The 256 KB stripe size can improve throughput for large I/Os, but for random writes, the stripe size has less impact. RAID 10 also ensures redundancy, allowing one drive per mirrored pair to fail.

Why this answer

RAID 10 provides the best random write performance among the options because it uses mirroring and striping without parity overhead. Each write is written to two drives, avoiding the read-modify-write cycle of parity RAID. It also provides redundancy.

RAID 5 and RAID 6 incur parity penalties, and RAID 0 lacks redundancy, so RAID 10 is the correct choice for a high-random-write database server.

Exam trap

The trap here is focusing only on stripe size tuning while overlooking the fundamental write penalty of parity RAID levels.

Full explanation →

150

Multi-Selectmedium

A technician is preparing to install a new server into a rack in a small server room. Which of the following steps should be performed to help ensure proper airflow and thermal management? (Choose two.)

Select 2 answers

A.Leave one rack unit of empty space between the new server and adjacent servers to improve cooling.

B.Verify that the server's airflow direction matches the rack's existing front-to-back or back-to-front configuration.

C.Remove the server's top cover to increase passive airflow around internal components.

D.Position the server at the top of the rack so its heat rises away from other equipment.

E.Install blanking panels in any unused rack units to prevent hot air from recirculating to the front.

AnswersB, E

Mixing airflow directions in a shared rack causes hot exhaust from one server to be drawn into the intake of another, raising inlet temperatures and triggering thermal throttling or shutdown. Confirming that the new server's fan modules and bezel match the rack's established direction prevents recirculation and keeps all equipment within its thermal envelope.

Why this answer

Thermal management in a rack depends on maintaining a consistent airflow direction and preserving the separation between cold intake air and hot exhaust air. Matching the server's airflow to the rack's established direction prevents recirculation, and blanking panels close unused rack units so hot air cannot escape to the front and be drawn back into equipment intakes.

Exam trap

The trap here is assuming open space or an open chassis improves cooling, when both actually break the pressure boundary and allow hot-air recirculation.

Full explanation →

Page 2 of 6

All pages

Practice SK0-005 by domain

Target a specific domain to shore up weak areas.

server-administration server-hardware-installation-management security-disaster-recovery troubleshooting

See all domains with question counts →