Courseiva

CompTIA Server+ SK0-005 (SK0-005) — Questions 151–225

414 questions total · 6 pages · All types, answers revealed

Take a mock examExam hub
Page 2

Page 3 of 6

Page 4
151
Multi-Selectmedium

A server administrator is troubleshooting a physical server that reports a predictive failure on a drive in a hardware RAID 5 array. The array is still online and functioning. The administrator wants to replace the failing drive while minimizing risk to the data. Which of the following steps should the administrator perform? (Choose two.)

Select 2 answers
A.Delete the array and recreate it from scratch to ensure a clean rebuild.
B.Force the failing drive offline immediately so the controller begins rebuilding onto a spare.
C.Identify the physical bay of the failing drive using the RAID controller management utility or locator LED before removal.
D.Power down the server and remove the drive while the system is offline to avoid hot-swap risk.
E.Verify a current, tested backup of the array data exists before beginning the replacement.
AnswersC, E

Pulling the wrong drive from a RAID 5 array causes an immediate data-loss event because two members would be missing. Using the controller utility or the bay's locator LED to positively identify the degraded member ensures the correct physical drive is removed and preserves array integrity.

Why this answer

Replacing a member of a degraded RAID 5 array safely requires two things: a validated backup in case the rebuild fails or another drive dies, and positive identification of the correct physical bay so the wrong drive is never removed. Both steps directly reduce the risk of catastrophic data loss during the swap.

Exam trap

The trap here is treating a predictive failure as harmless because the array is still online, and skipping backup verification or bay identification before pulling a drive.

Full explanation →
152
MCQmedium

A financial services company runs a single physical server hosting a customer-facing web application. The security team must ensure that if an attacker modifies system binaries, the server can detect the change during a forensic investigation. Which technology should be implemented to meet this requirement?

A.Security information and event management (SIEM) with log correlation
B.Host-based intrusion prevention system (HIPS) with signature-based detection
C.Full disk encryption (FDE) using TPM-backed BitLocker
D.File integrity monitoring (FIM) using a tool such as Tripwire
AnswerD

FIM tools compute cryptographic hashes of critical files and compare them against a known-good baseline. Any unauthorized modification to system binaries changes the hash, alerting the security team. This directly satisfies the requirement to detect tampering during a forensic investigation, as the baseline and alerts provide evidence of what changed and when.

Why this answer

The requirement is to detect unauthorized changes to system binaries for forensic purposes. File integrity monitoring establishes a cryptographic baseline and alerts on any deviation, providing clear evidence of tampering. Other options focus on prevention, log aggregation, or data-at-rest protection, none of which directly detect binary modification with forensic detail.

Exam trap

The trap here is confusing real-time prevention with after-the-fact detection, assuming a HIPS or SIEM will automatically provide file integrity evidence.

Full explanation →
153
MCQmedium

Refer to the exhibit. During boot, the server displays this error and shuts down. Which of the following is the most likely cause?

A.The CPU heatsink is not properly installed.
B.The CPU fan is not connected to the CPU_FAN header.
C.The BIOS fan profile is set to 'Silent' mode.
D.The CPU has failed.
AnswerB

The error message 'No fan detected' strongly indicates a physical disconnection. The system halts to prevent thermal damage.

Why this answer

The error shown in the exhibit is a 'CPU Fan Error' or 'CPU Fan Speed Error' that occurs during POST. This specific error is triggered when the motherboard does not detect a tachometer (RPM) signal on the CPU_FAN header. The most common cause is that the CPU fan is not connected to the CPU_FAN header, either because it is plugged into a different header (e.g., SYS_FAN) or not plugged in at all.

Since the fan is not connected to the correct header, the motherboard cannot read its speed and halts the boot to prevent overheating.

Exam trap

SK0-005 often tests the specific POST error messages and their causes; candidates may confuse a CPU fan error with a heatsink installation issue or a failed CPU, but the key is that the error explicitly indicates a fan detection problem, not a thermal or CPU failure.

How to eliminate wrong answers

Option A is wrong because a poorly installed heatsink would typically cause high CPU temperatures and thermal shutdowns, not an immediate fan error at boot; the fan might still spin and report RPM. Option C is wrong because a 'Silent' fan profile would only lower fan speeds, not eliminate the tachometer signal entirely; the motherboard would still detect some RPM, though it might warn if below a threshold, but the error would not be as definitive as 'CPU Fan Error'. Option D is wrong because a failed CPU would usually result in no POST at all, not a specific fan error; the motherboard would not be able to report a fan issue if the CPU were dead.

Full explanation →
154
MCQmedium

A datacenter administrator must implement a backup strategy for a file server that holds 8 TB of active patient imaging data. The organization requires that a complete copy of the data be stored offsite weekly, and that the offsite copy be protected from accidental deletion or alteration for at least 30 days. The administrator has a 10 GbE connection to the remote site. Which of the following should the administrator configure to meet these requirements?

A.Configure a weekly full backup to a remote object storage bucket with a 30-day object lock in compliance mode.
B.Configure a weekly full backup to a remote iSCSI LUN and enable CHAP authentication on the target.
C.Configure a weekly full backup to a remote tape library and store the tapes in a secure offsite vault.
D.Configure a weekly full backup to a remote SMB share and enable versioning on the share.
AnswerA

Object storage with a compliance-mode object lock enforces WORM (write once, read many) retention for the specified period, meaning even the root account cannot delete or alter the objects before the lock expires. This directly satisfies the 30-day immutability and offsite retention requirement, and the 10 GbE link supports the weekly 8 TB transfer.

Why this answer

The requirement is for an offsite weekly full copy that cannot be deleted or altered for 30 days. Object storage with a compliance-mode object lock provides WORM immutability that even privileged users cannot bypass until the retention period ends. The 10 GbE link is sufficient for the weekly 8 TB transfer, and the remote bucket satisfies the offsite condition.

Exam trap

The trap here is assuming that any remote share or LUN with access controls provides immutability, when only a WORM-enforcing mechanism such as object lock in compliance mode guarantees retention against privileged deletion.

Full explanation →
155
MCQmedium

Refer to the exhibit. What is the most likely cause of this error?

A.The boot order is set incorrectly
B.The hard drive data cable is loose
C.The boot sector is corrupted
D.The hard drive has failed
AnswerA

An incorrect boot order causes the firmware to attempt a non-bootable device first, producing the 'no boot device' error shown. This satisfies the exhibit's symptom, since the operating system is present but the firmware never reaches the correct disk.

Why this answer

The error 'Boot device not found' with 'Hard Disk: (3F0)' indicates the BIOS cannot find a bootable device. The most common cause is an incorrect boot order, where the system is trying to boot from a non-bootable device before the hard drive. A corrupt boot sector would give a different error (e.g., 'Missing operating system').

A loose cable could cause the drive not to be detected at all, but often the system would show no hard drive in BIOS. A failed drive would typically be detected but unbootable.

Full explanation →
156
MCQeasy

A server administrator is replacing a failed hard drive in a RAID 5 array on a production server. The server supports hot-swap drives. Which of the following should the administrator do FIRST to replace the drive?

A.Reconfigure the RAID array to RAID 6 before replacing the drive.
B.Power down the server before replacing the drive.
C.Remove the failed drive and insert the replacement drive.
D.Back up all data on the server before replacing the drive.
AnswerC

In a hot-swap capable server, the failed drive can be removed and replaced without powering down the system. The RAID controller will automatically rebuild the array onto the new drive. This is the correct first step because hot-swap support allows safe removal and insertion while the server is running.

Why this answer

With hot-swap support, the failed drive can be removed and replaced while the server remains online. The RAID controller will detect the new drive and begin rebuilding the array. Powering down, reconfiguring RAID, or performing a full backup first are unnecessary and would introduce downtime or delay.

The correct first action is to physically replace the drive.

Exam trap

The trap here is overcomplicating the process by thinking a backup or power-down is required, but hot-swap drives are designed for immediate replacement.

Full explanation →
157
MCQhard

A server administrator is troubleshooting a Linux server that is experiencing intermittent network connectivity issues. Users report that connections to the server sometimes time out, and the administrator notices that `ifconfig` shows a high number of dropped packets on the `eth0` interface. The switch port is configured for 1 Gbps full duplex. Which of the following is the MOST likely cause?

A.The switch port is configured for jumbo frames, but the server NIC is not.
B.The network interface card (NIC) is configured for half duplex due to autonegotiation failure.
C.The Ethernet cable is faulty and needs to be replaced.
D.The NIC driver is outdated and needs to be updated.
AnswerB

A duplex mismatch between the NIC and switch (e.g., NIC at half duplex, switch at full duplex) causes collisions and dropped packets. The switch port is set to full duplex, so if the NIC autonegotiates to half duplex, performance degrades and packet loss occurs. This is a classic cause of intermittent connectivity and high drop counts.

Why this answer

A duplex mismatch between the NIC and switch causes collisions and dropped packets, leading to intermittent connectivity issues. The switch port is set to full duplex, so if the NIC is at half duplex, performance suffers. The correct answer identifies this mismatch.

Exam trap

The trap here is overlooking the switch configuration and assuming a hardware failure; duplex mismatch is a frequent cause of such symptoms.

Full explanation →
158
MCQmedium

A technician is troubleshooting a server that fails to boot. The server displays a 'Boot Device Not Found' error. The technician verifies that the hard drives are spinning and appear in the RAID controller's BIOS. What should the technician check next?

A.Boot order in BIOS
B.Operating system files
C.SATA cable connections
D.RAID array status
AnswerA

With drives detected by the RAID controller, the failure lies in the boot sequence rather than hardware. Checking the BIOS boot order confirms whether the correct logical volume or device is listed first, resolving the 'Boot Device Not Found' error.

Why this answer

When a server reports 'Boot Device Not Found' but the drives are detected by the RAID controller, the most likely cause is that the BIOS/UEFI boot order does not list the RAID logical volume (or the correct device) as a boot option. The firmware is looking at the wrong device or has lost the boot entry. Checking and correcting the boot order is the logical next step before assuming OS or hardware failure.

Exam trap

SK0-005 often tests the tendency to jump to hardware or OS causes when the error message explicitly indicates the firmware cannot find a boot device—candidates overlook the simple BIOS boot order check.

How to eliminate wrong answers

Option B is wrong because if the OS files were corrupted, the server would typically find the boot device and then fail with a bootloader or OS error, not 'Boot Device Not Found.' Option C is wrong because the drives are already visible in the RAID controller BIOS, which confirms the physical SATA/SAS connections are working. Option D is wrong because a degraded RAID array would still usually present a bootable volume (unless it is failed), and the error would more likely be a RAID failure message—plus the question states drives are spinning and visible.

Full explanation →
159
MCQeasy

A small office has a single physical server running Windows Server 2022 that hosts a file share and a print server. The administrator wants to protect against a hard drive failure that would cause downtime. The server has four drive bays, all currently empty. The administrator needs a solution that provides redundancy and maximizes usable capacity while tolerating one drive failure. Which of the following should the administrator implement?

A.RAID 1 with two drives
B.RAID 5 with three drives
C.RAID 5 with four drives
D.RAID 0 with four drives
AnswerC

RAID 5 with four drives stripes data and parity across all four drives, tolerating one drive failure while using the full capacity of the array minus one drive's worth of parity. This maximizes usable capacity among the redundant options given the four available bays and meets the requirement to survive a single drive failure without downtime.

Why this answer

RAID 5 with four drives provides single-drive fault tolerance and uses all four bays, yielding usable capacity equal to three drives. RAID 0 offers no redundancy, RAID 1 with two drives wastes two bays, and RAID 5 with three drives leaves a bay unused. Therefore, four-drive RAID 5 best satisfies both redundancy and capacity maximization.

Exam trap

The trap here is choosing RAID 1 because it is simple and redundant, without considering that the scenario explicitly asks to maximize usable capacity and that four drive bays are available.

Full explanation →
160
MCQmedium

A data center administrator is hardening a newly racked Linux server that will host a customer-facing API. The security policy states that only HTTPS (TCP 443) should be reachable from the internet, and no other services should be exposed. The administrator wants the change to survive a reboot and be enforced by the kernel's packet filter. Which of the following should the administrator configure to meet these requirements?

A.Add a rule to /etc/hosts.deny that blocks all services except HTTPS.
B.Install fail2ban and configure a jail that bans any IP address that connects to a port other than 443.
C.Set SELinux to enforcing mode and create a custom policy that only permits the httpd_t domain to bind to port 443.
D.Configure nftables with a persistent ruleset that allows established connections and TCP 443, then drops all other inbound traffic.
AnswerD

nftables is the current Linux kernel packet-filtering framework that replaces iptables, and a ruleset saved with the nft command or the distribution's persistent service will be reloaded at boot. Allowing established connections plus TCP 443 and dropping the rest enforces the policy at the kernel level, which is exactly what the security policy requires for this API server.

Why this answer

A kernel-level, persistent packet filter is needed so that only TCP 443 is reachable and the policy survives reboots. nftables is the modern Linux netfilter interface, and a saved ruleset with a default drop and an allow for established connections and TCP 443 meets the requirement. Host-based access files, SELinux alone, and fail2ban do not provide the same default-deny enforcement.

Exam trap

The trap here is assuming that TCP wrappers or SELinux alone can replace a stateful packet filter for controlling which ports are reachable from the network.

Full explanation →
161
MCQmedium

A server administrator is troubleshooting a server that intermittently fails to boot and occasionally displays a 'CMOS checksum error' during POST. The server's clock also resets to an old date after each power cycle. The administrator has already verified that the power supply is functioning and that all internal cables are securely connected. Which of the following is the MOST likely cause of these symptoms?

A.The power supply unit is failing to provide stable voltage.
B.The server's RAM modules are faulty and causing POST errors.
C.The motherboard's BIOS firmware is corrupted and requires reflashing.
D.The CMOS battery on the motherboard is depleted.
AnswerD

A depleted CMOS battery cannot maintain the real-time clock and BIOS settings when the server is powered off. This leads to clock resets and checksum errors because the stored configuration is lost. Replacing the battery is the standard fix. The other options do not explain the loss of time and settings.

Why this answer

The symptoms of a clock resetting and CMOS checksum errors point directly to a depleted CMOS battery. This battery maintains the real-time clock and BIOS settings when the server is unplugged. Without it, settings are lost on power-off, causing the observed errors.

The other options do not account for the loss of time and configuration data.

Exam trap

The trap here is assuming that intermittent boot failures always indicate a power supply or RAM issue, while overlooking the specific clock and CMOS error symptoms that uniquely point to the CMOS battery.

Full explanation →
162
MCQmedium

Refer to the exhibit. An administrator is reviewing logs after a server experienced performance issues and unexpected shutdowns. Based on the log entries, which component is MOST likely failing?

A.RAID controller
B.RAM module
C.Hard disk drive
D.Power supply
AnswerC

Medium errors and failed sector reallocation are direct indicators of physical hard disk drive failure.

Why this answer

The log entries show multiple SCSI medium errors, unrecovered read errors, and auto-reallocation failures on device sda, which are classic signs of a failing hard disk drive (Option B). A RAID controller (A) would typically show different errors, RAM (C) would cause memory-related errors, and a power supply (D) would trigger power event logs.

Full explanation →
163
Multi-Selectmedium

A company is implementing a backup strategy for a critical database server. The backup window is limited, and the database must remain available during backups. The administrator needs to ensure that transaction log backups are performed and that the database can be restored to a point in time. Which two actions should the administrator take? (Choose two.)

Select 2 answers
A.Configure the database to use the full recovery model.
B.Set the database to the simple recovery model to minimize log growth.
C.Detach the database during backups to ensure consistency.
D.Perform only full backups during the backup window and skip log backups.
E.Schedule transaction log backups at regular intervals.
AnswersA, E

The full recovery model is required for transaction log backups and point-in-time restore. Without it, the database may use simple recovery, which does not support log backups or restoring to a specific point in time, so this action is necessary for the stated requirements.

Why this answer

To support point-in-time restore and keep the database online, the administrator must use the full recovery model and schedule transaction log backups. The full recovery model preserves the log until it is backed up, and regular log backups capture changes and truncate the log, enabling restoration to a specific moment.

Exam trap

The trap here is thinking that simple recovery or full backups alone enable point-in-time restore; only the full recovery model with log backups provides that capability.

Full explanation →
164
MCQeasy

A system administrator is configuring a backup strategy for a small business. The business requires that backups be stored offsite to protect against physical disasters, and that backup data be encrypted both in transit and at rest. Which of the following backup solutions BEST meets these requirements?

A.Use a cloud backup service that encrypts data with AES-256 before transmission and stores it encrypted in the cloud.
B.Perform backups to a tape drive and store tapes in a remote vault, using hardware encryption on the tape drive.
C.Back up to a local external hard drive that is rotated weekly to a bank safe deposit box, using BitLocker encryption.
D.Configure a backup to a network-attached storage (NAS) device located in a different building on the same campus, using SMB signing.
AnswerA

A cloud backup service with client-side AES-256 encryption ensures data is encrypted before leaving the server (in transit) and remains encrypted at rest in the cloud. This meets both encryption requirements and provides offsite storage without manual intervention. It is a robust solution for small businesses needing secure, offsite backups.

Why this answer

The cloud backup service with AES-256 encryption ensures data is encrypted both before transmission and while stored, satisfying the encryption requirements. It also provides offsite storage inherently, protecting against physical disasters. Other options either lack encryption in transit, do not provide true offsite protection, or rely on manual processes that may not be reliable.

Exam trap

The trap here is assuming that any offsite backup method automatically includes encryption in transit, or that encryption at rest alone is sufficient.

Full explanation →
165
MCQmedium

A server administrator runs a Linux server hosting a MariaDB database. Users report that the database is extremely slow. The administrator runs top and sees a load average of 45 on a system with 4 CPU cores, and %iowait is consistently above 80%. Which command should the administrator run next to identify the specific storage device causing the bottleneck?

A.iostat -x 2
B.vmstat 2
C.sar -n DEV 2
D.netstat -i 2
AnswerA

iostat -x provides extended statistics per block device, including %util, await, and svctm, which reveal which disk is saturated. With high %iowait and load average, this identifies the specific device causing the bottleneck, enabling targeted remediation such as moving the database to faster storage or rebalancing I/O.

Why this answer

The high load average and %iowait indicate a storage bottleneck. To resolve the issue, the administrator must identify the specific disk causing the saturation. iostat -x provides per-device extended statistics, including %util and await, which pinpoint the bottleneck. Other tools like vmstat give system-wide I/O wait but lack per-device detail, while network-focused commands are irrelevant here.

Exam trap

The trap here is assuming that vmstat or top provides enough detail to identify the specific disk, when only per-device tools like iostat can reveal the exact bottleneck.

Full explanation →
166
MCQhard

Refer to the exhibit. An administrator receives reports that a web application is returning HTTP 502 errors. The administrator examines the Nginx error log on the reverse proxy server and sees the following. Which of the following is MOST likely causing the errors?

A.The Nginx service is not running.
B.The upstream server at 10.0.1.25:8080 refuses connections.
C.The firewall on the reverse proxy is blocking port 80.
D.The client's DNS cannot resolve example.com.
AnswerB

'Connection refused' directly signals that the upstream server is not listening on that port or is actively rejecting connections.

Why this answer

Option A is correct because the error 'Connection refused' indicates the upstream server (10.0.1.25:8080) is not accepting connections, typically because the backend service is down or the port is closed. Option B is incorrect because if Nginx were not running, no such log entry would be generated. Option C is incorrect because the client's DNS resolution is not involved after Nginx has already attempted to contact the upstream IP.

Option D is incorrect because a firewall blocking outbound connections would cause a timeout, not a 'Connection refused' message.

Full explanation →
167
MCQhard

A server running a critical database application crashes and fails to boot with the error message 'Operating System not found.' The server is equipped with a hardware RAID 5 array consisting of three identical disks. A technician suspects a disk failure. What is the MOST likely cause of this error?

A.A single disk has experienced a complete failure.
B.The boot sector on the disk is corrupted.
C.The RAID controller firmware is corrupted.
D.Two or more disks have failed.
AnswerD

RAID 5 tolerates exactly one disk failure; with two or more disks failed, the array loses parity and cannot reconstruct data, so the boot volume becomes unreadable and the firmware reports no operating system. This directly explains the 'Operating System not found' error given three disks in the array.

Why this answer

Option D is correct because RAID 5 can tolerate a single disk failure and continue operating in a degraded state. The 'Operating System not found' message indicates the RAID array is offline or the boot volume is inaccessible, which most commonly happens when two or more disks fail simultaneously, exceeding the redundancy of RAID 5. Option A would not cause this error; a single failure would allow the OS to boot.

Option C is less common and might produce different errors. Option B could happen but is normally a second-order effect.

Full explanation →
168
Multi-Selectmedium

A technician is preparing to install a new 2U rack server into a cabinet that already hosts several running servers. The technician must ensure proper airflow and physical security. Which of the following actions should the technician take? (Choose two.)

Select 2 answers
A.Secure the server to the rails and cabinet using the front thumbscrews or captive fasteners
B.Align the server's front intake with the cold aisle and rear exhaust with the hot aisle
C.Install the server so its rear exhaust faces the cold aisle to shorten the cable runs
D.Fill every empty rack unit with a blanking panel to increase overall airflow volume
E.Leave the front bezel off to maximize unrestricted intake airflow
AnswersA, B

This is correct because fastening the chassis to the rails and cabinet prevents it from sliding forward during cable pulls or service, which could dislodge power and network connections on adjacent units. Captive thumbscrews or front fasteners also deter casual removal and satisfy physical security expectations in shared or colocation cabinets.

Why this answer

Rack servers must face the cold aisle so intake air stays cool, and they must be fastened to the rails to prevent movement that could disturb adjacent cabling. These two actions address airflow integrity and physical security respectively. Reversing orientation breaks thermal containment, while removing the bezel or mischaracterizing blanking panels does not satisfy the stated requirements.

Exam trap

The trap here is confusing blanking panels' role in preventing hot-air recirculation with an imagined benefit of increasing airflow volume.

Full explanation →
169
MCQhard

A company uses a two-node failover cluster for a critical application. The cluster nodes are located in the same data center, and the quorum configuration uses a file share witness on a separate server in the same data center. During a major power outage, both cluster nodes and the file share witness server lose power. What is the impact on cluster availability?

A.The cluster will automatically fail over to a third site because the witness server is unavailable.
B.The cluster continues operating because the nodes can use a dynamic quorum and adjust the vote count.
C.The cluster will be offline until one of the nodes or the witness comes back online.
D.The cluster remains online because the nodes can communicate directly and form quorum without the witness.
AnswerC

With all three voting members down, there are zero votes, below the quorum majority. The cluster will not start until at least two members are available (e.g., both nodes, or one node and the witness).

Why this answer

With a two-node cluster plus a file share witness, quorum requires a majority of votes — 2 out of 3. When both nodes and the witness lose power simultaneously, no votes remain, so the cluster cannot achieve quorum and all clustered roles go offline. Availability is restored only when at least two of the three voting members (e.g., one node plus the witness, or both nodes) return.

Exam trap

SK0-005 often tests the misconception that dynamic quorum or node-to-node communication can preserve cluster availability when every voting member, including the witness, is offline — candidates forget that quorum fundamentally requires a majority of surviving votes.

How to eliminate wrong answers

Option A is wrong because a failover cluster cannot 'fail over to a third site' that does not exist — there is no third site in this scenario, and witness loss does not trigger site failover. Option B is wrong because dynamic quorum adjusts vote assignment only while nodes are still running and communicating; it cannot manufacture quorum when every voting member is powered off. Option D is wrong because two nodes alone do not constitute a majority of a three-vote cluster — with the witness down, the nodes have only 2 of 3 votes and cannot form quorum by themselves.

Full explanation →
170
MCQmedium

A hospital's server room has a raised floor and a dedicated UPS circuit. During a scheduled power maintenance window, the facilities team must cut utility power to replace a breaker panel. The UPS must keep the two domain controllers and the electronic medical records (EMR) database server running for at least 20 minutes so they can be gracefully shut down. Which configuration should the administrator verify FIRST to meet this requirement?

A.The UPS battery runtime at the current load and the load percentage relative to UPS capacity
B.The UPS network management card's SNMP community string and trap destination
C.The redundant power supply configuration of the servers connected to the UPS
D.The automatic voltage regulation (AVR) settings on the UPS
AnswerA

Runtime is a function of load versus battery capacity. If the connected load is near the UPS's maximum, the batteries may only provide a few minutes, not the required 20. Verifying actual runtime at the current load confirms whether the UPS can bridge the maintenance window and allow graceful shutdown of the domain controllers and EMR database server.

Why this answer

The deciding factor for surviving a planned utility cut is whether the UPS can supply the connected load for the required duration. Runtime depends on battery capacity and the actual load drawn by the domain controllers and EMR database server. Confirming runtime at current load is the only option that directly validates the 20-minute requirement before the maintenance window begins.

Exam trap

The trap here is assuming that any UPS with a network management card and healthy batteries will automatically provide the needed runtime regardless of how much load is connected.

Full explanation →
171
MCQmedium

A network administrator is configuring a RAID array for a new file server that will store large media files. The server has six 4 TB SAS drives. The administrator needs to maximize storage capacity while providing fault tolerance against a single drive failure. Which RAID level should be implemented?

A.RAID 5
B.RAID 10
C.RAID 0
D.RAID 6
AnswerA

RAID 5 uses block-level striping with distributed parity, requiring a minimum of three drives. With six 4 TB drives, usable capacity is 20 TB (5 drives worth), and it can survive one drive failure. This balances capacity and fault tolerance, making it ideal for the file server requirement.

Why this answer

RAID 5 offers the best balance of capacity and fault tolerance for the given requirements. With six 4 TB drives, it provides 20 TB of usable space and can withstand one drive failure. RAID 6 offers more fault tolerance but less capacity, while RAID 0 lacks fault tolerance and RAID 10 sacrifices too much capacity.

Therefore, RAID 5 is the correct choice.

Exam trap

The trap here is assuming that RAID 6 or RAID 10 is always better due to higher fault tolerance, but the requirement specifically asks to maximize capacity while tolerating a single drive failure.

Full explanation →
172
MCQeasy

A technician is troubleshooting a server that powers on but produces no video output and emits a repeating beep code. The server's documentation indicates the pattern corresponds to a memory error. The technician has already reseated the existing DIMMs and verified the slots are clean. Which of the following should the technician do NEXT?

A.Update the system firmware to the latest revision from the vendor.
B.Clear the CMOS and reconfigure the BIOS memory timings to default values.
C.Install a known-good DIMM in the first populated slot and retest the system.
D.Replace the motherboard because the memory controller is integrated into the chipset.
AnswerC

Substituting a known-good module isolates whether the fault follows the DIMM or stays with the slot or board. This is the logical next diagnostic step after reseating, because it distinguishes a failed memory module from a defective slot or memory controller without replacing major components.

Why this answer

After reseating and cleaning, the fastest way to determine whether the fault is the module itself or the slot and board is to install a known-good DIMM in the primary slot. If the system POSTs, the original module is faulty; if it still beeps, the slot or board is implicated.

Exam trap

The trap here is jumping to a motherboard replacement when the beep code has not yet been proven to follow the DIMM rather than the slot.

Full explanation →
173
MCQeasy

A server administrator notices that a database server is responding slowly to queries. The CPU utilization is at 30%, memory at 40%, and disk latency is normal. Which of the following should the administrator check NEXT?

A.Network bandwidth utilization
B.Power supply status
C.Database index fragmentation
D.Operating system patch level
AnswerA

With CPU, memory and disk latency all healthy, the bottleneck lies elsewhere. Checking network bandwidth utilisation reveals whether saturated links or packet loss are delaying query responses between the database server and its clients, which is the remaining resource constraint the stem leaves unexamined.

Why this answer

Network bandwidth utilization should be checked next because high network usage can cause slow responses even when CPU, memory, and disk are fine.

Full explanation →
174
MCQhard

A company runs a busy web application on a single Windows Server 2022 server with 32 GB RAM, two 8-core CPUs, and a hardware RAID 10 array. Users report intermittent slowdowns, and Performance Monitor shows that the PhysicalDisk\% Idle Time counter for the data volume frequently drops below 10% while the Processor\% Processor Time remains around 40%. The server hosts the web application, its SQL Server 2019 database, and the operating system on the same RAID 10 array. Which of the following is the MOST appropriate next step to improve performance?

A.Upgrade the CPUs to higher-frequency models to reduce disk queue length.
B.Move the SQL Server database files and logs to separate dedicated physical disk arrays.
C.Add more RAM to the server to reduce disk paging.
D.Enable write caching on the RAID controller without a battery backup unit.
AnswerB

PhysicalDisk\% Idle Time below 10% means the disk is nearly always busy, indicating an I/O bottleneck. Separating database files and transaction logs onto dedicated spindles reduces contention with the OS and web application, improving throughput. This is a standard storage optimization for database servers and directly addresses the observed counter.

Why this answer

The PhysicalDisk\% Idle Time counter below 10% indicates the disk subsystem is saturated, while processor utilization is moderate. Separating SQL Server data and log files onto dedicated arrays reduces I/O contention and improves overall throughput. Adding RAM or upgrading CPUs does not target the actual bottleneck, and enabling write caching without protection adds risk without guaranteeing a fix.

Exam trap

The trap here is assuming that any performance issue requires more RAM or CPU, when the specific counter clearly points to disk saturation.

Full explanation →
175
Multi-Selectmedium

A company operates a single data center with 40 physical servers and no secondary site. Management has approved a project to improve disaster recovery posture and wants the ability to restore critical workloads after a total site loss. The budget is limited, and the company already owns a large tape library and an offsite vault contract. Which two components should the administrator include in the solution? (Choose two.)

Select 2 answers
A.RAID 6 arrays on every production server to protect against multiple simultaneous drive failures.
B.A second UPS with extended battery modules installed in the same server room as the primary UPS.
C.A cloud-based warm standby environment running replicated virtual machines for all 40 servers with automatic failover.
D.Offsite rotation of backup media with documented chain-of-custody and retention schedules aligned to the recovery requirements.
E.A documented, tested recovery procedure that includes bare-metal restore steps and periodic restore validation from offsite media.
AnswersD, E

Media stored only in the data center is lost with the site. A formal rotation to the existing offsite vault, with chain-of-custody records and a retention schedule matched to recovery needs, guarantees a usable copy exists elsewhere. This is a low-cost change that leverages the vault contract the company already pays for and directly supports site-loss recovery.

Why this answer

With no secondary site and a constrained budget, the practical path is to ensure an offsite copy exists and that it can actually be used. Rotating media to the existing vault with proper custody records guarantees survivability, and documented, validated bare-metal restore procedures prove the organization can rebuild critical workloads from those media after losing the data center.

Exam trap

The trap here is equating local redundancy technologies such as RAID or extra UPS capacity with disaster recovery, when a total site loss defeats every control that lives inside the building.

Full explanation →
176
MCQhard

A datacenter administrator is planning a disaster recovery site for a critical application. The business requires that the application be able to resume within 15 minutes of a primary site failure, but the application can tolerate up to 30 minutes of data loss. Which combination of metrics and site strategy best fits these requirements?

A.An RTO of 30 minutes and an RPO of 15 minutes, supported by a cold site with offsite tape backups.
B.An RTO of 15 minutes and an RPO of 30 minutes, supported by a cold site with offsite tape backups.
C.An RTO of 30 minutes and an RPO of 15 minutes, supported by a warm site with replicated data.
D.An RTO of 15 minutes and an RPO of 30 minutes, supported by a warm site with replicated data.
AnswerD

The recovery time objective of 15 minutes matches the requirement to resume quickly, and the recovery point objective of 30 minutes matches the tolerable data loss. A warm site with replicated data can be brought online within that window, making this combination appropriate for the stated business requirements.

Why this answer

Recovery time objective defines how quickly service must be restored, while recovery point objective defines how much data loss is acceptable. The scenario requires an RTO of 15 minutes and an RPO of 30 minutes. A warm site with replicated data provides the pre-staged infrastructure and recent data needed to meet both targets.

Exam trap

The trap here is swapping RTO and RPO or assuming any offsite site can meet a short recovery time without considering how long hardware and data restoration take.

Full explanation →
177
MCQmedium

A technician is installing a new 2U rack server in a data center. The server documentation specifies that the rail kit must be mounted in a rack with square-hole mounting holes, but the existing rack cabinet uses round threaded holes. The technician needs the server to slide in and out of the rack for maintenance while remaining securely supported. Which of the following should the technician do?

A.Drill new square holes in the rack posts so the supplied rails fit
B.Obtain a rail kit or adapter designed for round threaded-hole racks and install the server with it
C.Install the rails using the included cage nuts and screws in the round holes
D.Place the server on fixed shelf rails and skip the sliding rail installation
AnswerB

Round threaded-hole racks require rail kits with adapter brackets or a dedicated round-hole rail kit, because the mounting geometry and hole pitch differ from square-hole racks. Using the correct adapter preserves the sliding rail function and load rating. This is the only option that keeps the server both securely mounted and serviceable by sliding, which the scenario explicitly requires.

Why this answer

Round threaded-hole racks and square-hole racks use different mounting hardware and hole geometry, so a rail kit built for square holes will not seat correctly in a threaded-hole rack. The proper resolution is to use a rail kit or adapter bracket specifically designed for round threaded-hole racks, which maintains the sliding function and rated load capacity the technician needs for routine maintenance access.

Exam trap

The trap here is assuming any rail kit will bolt into any rack, when the mounting-hole style dictates which rail kit or adapter is required.

Full explanation →
178
MCQhard

A security team wants to reduce the impact of a compromised service account that is used by a scheduled backup application on a Windows server. The account currently has domain administrator rights. Which action BEST limits the blast radius while keeping backups functional?

A.Configure a longer, more complex password on the existing domain administrator account.
B.Enable BitLocker on the backup server's system volume.
C.Move the scheduled backup jobs to run under the local SYSTEM account on each server.
D.Replace the domain administrator account with a dedicated service account granted only the required backup privileges.
AnswerD

A dedicated service account scoped to only the backup-related privileges follows the principle of least privilege. If the credential is compromised, the attacker inherits only those limited rights instead of full domain administrator access, which directly shrinks the blast radius while the scheduled backups continue to run.

Why this answer

Least privilege is the controlling principle: a service account used by a backup application should hold only the rights the application needs and nothing more. Swapping the domain administrator credential for a scoped service account keeps backups operational while ensuring a compromise yields limited, contained privileges instead of domain-wide control.

Exam trap

The trap here is treating password hardening as equivalent to privilege reduction, when the real exposure is the excessive rights attached to the account.

Full explanation →
179
MCQhard

A company is planning to deploy a new web application on multiple servers behind a load balancer. The application requires consistent session data across all servers for seamless user experience. Which of the following solutions would BEST meet this requirement?

A.Configure each web server to store sessions locally and use sticky sessions on the load balancer.
B.Use round-robin DNS to distribute traffic.
C.Store session data in a shared, high-performance in-memory data store like Redis.
D.Implement database session storage with synchronous replication between servers.
AnswerC

A centralized in-memory data store allows all web servers to access and modify session data quickly, providing seamless user experience and consistent state across the cluster.

Why this answer

Option B is correct because a shared in-memory data store like Redis provides low-latency access to session data for all servers, ensuring consistency and high availability. Option A is wrong because round-robin DNS does not handle session persistence. Option C is wrong because sticky sessions tie a user to one server; if that server fails, the session is lost and consistency is not maintained across servers.

Option D is wrong because synchronous database replication adds latency and complexity, making it less suitable for high-performance web applications.

Full explanation →
180
MCQmedium

A server administrator is installing a new 2U rack server into a datacenter rack. The server has two hot-swap 1100W power supplies. The rack currently has a 30A/208V single-phase PDU that is only 40% loaded. The administrator connects both power supplies to the same PDU. After a few months, one power supply fails, but the server remains operational. Which of the following should the administrator do to improve power redundancy?

A.Install a redundant PDU in the same rack and connect both power supplies to it.
B.Enable power capping on the server to reduce the load on the PDU.
C.Connect one power supply to a different PDU on a separate power feed.
D.Replace the 1100W power supplies with higher-wattage units.
AnswerC

Connecting each power supply to a separate PDU fed by a different power source provides true redundancy. If one PDU or its upstream feed fails, the other supply continues to power the server. This is a best practice for mission-critical servers and addresses the single point of failure that caused the initial concern.

Why this answer

The server currently has both power supplies connected to the same PDU, creating a single point of failure. To achieve true power redundancy, each power supply must be connected to a separate power source, ideally on different circuits or feeds. This ensures that if one PDU or feed fails, the server continues to operate on the remaining supply.

Exam trap

The trap here is assuming that simply having two power supplies ensures redundancy, when connecting them to the same PDU leaves a single point of failure.

Full explanation →
181
MCQhard

A technician is installing a new server with a hardware RAID controller. The server will host a database that requires high write performance and redundancy. The technician configures four SSDs in a RAID 10 array. After installation, the operating system reports the array as 1.2TB, but the technician expected 2.4TB. Which of the following explains the discrepancy?

A.The operating system is using a 512-byte sector size instead of 4K, reducing usable capacity.
B.RAID 10 uses mirroring and striping, so only half of the raw capacity is available for data.
C.The RAID controller is configured for RAID 5, which uses one drive for parity.
D.The SSDs are not compatible with the RAID controller, causing a size mismatch.
AnswerB

RAID 10 combines mirroring and striping. With four drives, data is mirrored across pairs, so the usable capacity is half of the total raw capacity. If each drive is 600GB, the raw capacity is 2.4TB, and the usable capacity is 1.2TB. This matches the reported size and is expected behavior for RAID 10.

Why this answer

RAID 10 requires a minimum of four drives and provides both striping and mirroring. The usable capacity is always 50% of the total raw capacity because each block is written to two drives. In this scenario, four 600GB drives yield 2.4TB raw and 1.2TB usable.

The technician's expectation of 2.4TB would only be correct for RAID 0 or a non-redundant configuration.

Exam trap

The trap here is confusing RAID 10 with RAID 5 or RAID 6, where usable capacity is a higher percentage of raw capacity.

Full explanation →
182
PBQhard

A medium-sized e-commerce company operates three critical servers: a web front-end, a database server, and a file server. Currently, a full backup of all servers is performed every Sunday starting at 11:00 PM and completes in about 6 hours. Differential backups run each weekday at 11:00 PM, taking roughly 2 hours. On a Wednesday at 10:00 AM, a ransomware attack encrypts all data on all servers. The IT team’s incident response plan requires restoration with an RPO of 4 hours and an RTO of 8 hours. The latest clean backup is Tuesday’s differential, resulting in approximately 10 hours of data loss. Future attacks could occur at any time. Management is willing to spend up to $200 per month to improve the backup strategy but cannot afford new hardware or a dedicated hot site. The team needs a solution that reduces both RPO and RTO within budget while maintaining simplicity for a small IT staff of two. Which of the following backup strategies should be implemented to best meet these requirements?

A.Switch to daily full backups to a local NAS, which takes 8 hours.
B.Adopt real-time replication to a hot site located offsite.
C.Continue the current strategy but increase the frequency of differential backups to every 4 hours.
D.Implement hourly incremental backups with daily full backups to a cloud backup service, costing $50/month.
AnswerD

Why this answer

B is correct. Hourly incremental backups with daily fulls to a cloud service gives a maximum data loss of about one hour (if failure right before an incremental), meeting the 4-hour RPO. Daily full backups ensure faster restoration since only the last full and up to a few incrementals need to be applied, likely achieving an 8-hour RTO.

The $50/month cost is within budget. Option A (daily full to NAS) extends the backup window to 8 hours and may not meet RPO if an attack occurs between backups. Option C (more frequent differentials) will cause backup times to grow, potentially exceeding the window, and still may have a 4-hour RPO gap if scheduled every 4 hours but an attack occurs after the last.

Option D is cost-prohibitive. Thus, B is feasible and effective.

Full explanation →
183
PBQmedium

An administrator is monitoring a server that has a hardware RAID 5 array consisting of four 2 TB disks. The RAID controller's management software reports that one disk has a status of 'Pred Fail' (predictive failure). The array also has a dedicated hot spare disk already installed and set up. The array is still fully functional with no data loss, but the 'Pred Fail' warning indicates the disk is likely to fail soon. The server is a production database server that cannot be taken offline except for scheduled maintenance windows, which are not until the following weekend. The administrator needs to ensure data integrity and avoid any risk of downtime or data loss while waiting for the replacement. Which immediate action should the administrator take?

A.Wait for the disk to completely fail so that the hot spare will automatically rebuild the array
B.Use the RAID management software to initiate a proactive replacement of the pred fail disk with the hot spare
C.Take a full backup immediately and then replace the disk during the next maintenance window
D.Remove the pred fail disk from the array to force the hot spare to rebuild, then re-add the disk later
AnswerB

Why this answer

When a RAID controller reports 'Pred Fail' and a hot spare is already configured, the correct immediate action is to use the RAID management software to proactively fail over the predictive-failure disk to the hot spare. This forces a rebuild while the disk is still readable, avoiding the risk of a rebuild failure if the disk dies completely and ensuring the array returns to full redundancy before the weekend maintenance window.

Exam trap

SK0-005 often tests the misconception that a hot spare only activates on complete disk failure — candidates pick 'wait for failure' thinking the hot spare handles everything, missing that proactive failover on predictive failure is the recommended practice to preserve redundancy.

How to eliminate wrong answers

Option A is wrong because waiting for complete failure means the array runs degraded with no redundancy, and if another disk fails during that window, data is lost — plus a rebuild from a dead disk may encounter unreadable sectors. Option C is wrong because taking only a backup and waiting until the weekend leaves the array in a vulnerable state for days; a backup does not restore RAID redundancy. Option D is wrong because physically removing a disk from a live array is risky and unnecessary when the management software can perform a controlled failover; pulling a disk can also cause the controller to mark the slot as failed in a way that complicates re-adding it.

Full explanation →
184
MCQmedium

A datacenter administrator is hardening a newly racked server that will host a public-facing application. The security policy requires that all administrative access to the server use encrypted protocols and that remote interactive logons be limited to the secure shell. Which action best meets these requirements?

A.Disable Telnet and enable SSH, then restrict the firewall to TCP port 22 for management traffic.
B.Disable Telnet and enable RDP, then restrict the firewall to TCP port 3389 for management traffic.
C.Keep Telnet enabled but require administrators to connect through a VPN, and restrict the firewall to TCP port 23 from the VPN subnet.
D.Disable both Telnet and SSH, enable a serial console server, and require administrators to use out-of-band access for all management.
AnswerA

SSH encrypts the entire administrative session, including credentials and commands, and restricting the firewall to TCP 22 enforces that remote interactive logons occur only over the secure shell. Disabling Telnet removes the cleartext alternative, so the policy requirement for encrypted administrative access is satisfied without exposing additional management ports.

Why this answer

The policy names two conditions: encrypted administrative protocols and remote interactive logons limited to the secure shell. SSH meets both because it encrypts the session and is the secure shell itself, while disabling Telnet eliminates the cleartext option. Tightening the firewall to TCP 22 ensures no other remote interactive protocol can be used for management.

Exam trap

The trap here is assuming that any encrypted remote protocol, such as RDP over TLS, satisfies a policy that specifically requires SSH for administrative logons.

Full explanation →
185
Multi-Selectmedium

A technician is preparing to replace a failed hot-swap SAS drive in a production server. The server has a RAID 1 array for the operating system and a RAID 5 array for data. The failed drive belongs to the RAID 5 array. Which of the following steps should the technician take before physically removing the drive? (Choose two.)

Select 2 answers
A.Back up all data on the RAID 5 array to external media.
B.Verify the drive's slot location using the storage management utility or drive bay LED.
C.Confirm the array is in a degraded but functional state and not rebuilding.
D.Update the RAID controller firmware before removing the drive.
E.Power down the server to prevent electrical damage to the backplane.
AnswersB, C

Confirming the exact slot of the failed drive prevents removing a healthy member of the RAID 5 array. Storage management utilities and bay fault LEDs identify the degraded member. Removing the wrong drive from a RAID 5 set could cause a second failure and data loss if the array is already degraded, so verifying the slot is a required step before physical removal.

Why this answer

Before pulling a failed drive from a RAID 5 array, the technician must confirm the correct slot and verify the array's current state. These steps prevent removing a healthy drive and ensure the array can tolerate the replacement. Backups, power-down, and firmware updates are not required immediate pre-removal actions for a hot-swap replacement.

Exam trap

The trap here is treating a hot-swap replacement as a major maintenance event that requires a shutdown or firmware update, when the real risks are pulling the wrong drive and misreading the array state.

Full explanation →
186
MCQhard

A financial services company must retain backup data for seven years to satisfy regulatory requirements. The data is written once and never modified, and the company wants to minimize cost while ensuring the data cannot be altered or deleted before its retention period expires. Which storage solution best meets these requirements?

A.A high-performance SAN with daily snapshots
B.WORM tape or object storage with object lock
C.A RAID 6 array with monthly full backups
D.A cloud file share with versioning enabled
AnswerB

Write once read many (WORM) media and object storage with object lock enforce immutability for a defined retention period. They are cost-effective for long-term archival, and the data cannot be altered or deleted until the retention period expires, directly satisfying the regulatory and immutability requirements.

Why this answer

Regulatory retention with immutability requires media or services that physically or logically prevent modification and deletion. WORM tape and object storage with object lock provide this capability at low cost for infrequently accessed data. SAN snapshots, RAID arrays, and ordinary versioned file shares all allow deletion or alteration, so they cannot satisfy the requirement.

Exam trap

The trap here is confusing versioning or RAID redundancy with true immutability, when only WORM media or object lock enforces a non-deletable retention period.

Full explanation →
187
MCQeasy

A server administrator is installing a new 1U server into a rack that already contains several servers. The rack has a limited number of power outlets, and the administrator needs to connect the server's two redundant power supplies. Which of the following should the administrator do to ensure power redundancy?

A.Connect both power supplies to the same PDU using two outlets
B.Connect one power supply to a PDU and leave the other unplugged as a spare
C.Connect each power supply to a different PDU on separate circuits
D.Connect both power supplies to the same circuit but different PDUs
AnswerC

Connecting each power supply to a separate PDU fed by different circuits ensures that a single PDU or circuit failure does not take down the server. This is a standard practice for redundancy. It protects against power strip failure, breaker trips, or circuit overload. The server continues running on the remaining power supply until power is restored.

Why this answer

For true power redundancy, each power supply should connect to a separate PDU on a different circuit. This isolates the server from a single PDU or circuit failure. Connecting both to the same PDU or circuit leaves a single point of failure, while leaving one unplugged provides no active redundancy.

Separate circuits are the accepted best practice.

Exam trap

The trap here is thinking that two outlets on the same PDU provide redundancy, when they share the same power source.

Full explanation →
188
MCQhard

A data center team is deploying a new 4U storage server that will hold 24 nearline SAS drives. The server will sit in a rack alongside network switches, and the team wants to minimize vibration-related drive errors. Which of the following installation practices BEST addresses this concern?

A.Use a rack with a higher static load rating so the added drive weight does not flex the frame.
B.Install the server on sliding rails with rubber isolation washers and ensure the rack is anchored and stabilized.
C.Mount the server at the top of the rack to keep it away from floor-level vibration.
D.Fill all empty rack U space with blanking panels to improve front-to-back airflow.
AnswerB

Rotational vibration from adjacent drives and fans degrades nearline drive performance and can shorten life. Isolation washers and properly anchored, stabilized racks damp that energy before it reaches the chassis. This combination directly targets vibration transfer and rack movement, which is exactly the concern for a densely populated storage server in a mixed rack.

Why this answer

High-density nearline drives are sensitive to rotational and translational vibration, which adjacent drives, fans, and rack movement generate. Isolating the chassis with rubber-mounted rails and anchoring the rack reduces the energy reaching the drives and prevents the frame from swaying. Airflow and load rating are valid considerations but do not address vibration coupling.

Exam trap

The trap here is confusing airflow management or rack weight capacity with vibration isolation, which are separate mechanical concerns.

Full explanation →
189
MCQhard

A server administrator is troubleshooting a Windows Server that is experiencing slow performance. The administrator runs Performance Monitor and notices that the 'Avg. Disk sec/Transfer' counter is consistently above 25 ms. Which of the following is the MOST likely cause?

A.The server has insufficient RAM, causing excessive paging.
B.The CPU is overloaded, causing delays in processing disk I/O requests.
C.The network adapter is causing retransmissions, slowing down disk access.
D.The disk subsystem is experiencing a bottleneck due to high latency.
AnswerD

The 'Avg. Disk sec/Transfer' counter measures the average time it takes to complete a disk transfer. Values above 25 ms indicate significant latency, often pointing to a storage bottleneck. This could be due to slow disks, a failing drive, or excessive load. Addressing the disk subsystem, such as upgrading to SSDs or redistributing load, is necessary to improve performance.

Why this answer

The 'Avg. Disk sec/Transfer' counter in Performance Monitor measures disk latency. Values above 25 ms indicate a storage bottleneck, where the disk subsystem cannot keep up with I/O requests.

This can be caused by slow physical disks, RAID degradation, or excessive load. Troubleshooting should focus on the storage layer, such as checking disk health, optimizing RAID configuration, or moving to faster storage. Memory, CPU, and network issues would not directly cause this specific counter to spike.

Exam trap

The trap here is attributing high disk latency to memory or CPU problems instead of recognizing it as a storage subsystem bottleneck.

Full explanation →
190
MCQmedium

A server administrator is diagnosing a Windows Server 2019 server that reboots unexpectedly about once a day. Windows Event Viewer shows Event ID 6008 (unexpected shutdown) and a BugCheck entry with stop code 0x00000050 (PAGE_FAULT_IN_NONPAGED_AREA). The server has 512 GB of RAM and the page file is system-managed. Which tool should the administrator use to analyze the memory dump and identify the faulty driver?

A.Performance Monitor with the Memory\Pool Nonpaged Bytes counter
B.Resource Monitor's Memory tab to inspect hard faults per second
C.System Configuration (msconfig) to perform a diagnostic startup
D.WinDbg with the !analyze -v command against the MEMORY.DMP file
AnswerD

WinDbg is the Microsoft debugging tool that reads the kernel memory dump and the !analyze -v extension pinpoints the faulting module, stack, and driver behind stop code 0x00000050. This directly identifies the faulty driver, which the administrator needs to update or remove. It is the correct tool for post-crash kernel dump analysis on Windows Server.

Why this answer

The stop code 0x00000050 indicates a page fault in nonpaged pool, and Windows has captured a kernel dump. WinDbg with the !analyze -v command parses that dump, resolves the call stack, and names the faulting driver. Performance Monitor and Resource Monitor are live-monitoring tools, while msconfig is an isolation method; none analyze dump files.

The administrator needs the exact driver to remediate the recurring bugcheck.

Exam trap

The trap here is assuming that live performance tools can analyze a crash dump, when dump parsing requires a debugger such as WinDbg.

Full explanation →
191
MCQhard

A technician is installing a new server that will host a virtualized environment. The server has 512GB of RAM installed as 16 x 32GB DIMMs. The technician notices that the server reports only 256GB of RAM during POST. Which of the following is the MOST likely cause?

A.One of the memory channels has failed, disabling half the DIMMs
B.The DIMMs are not all the same speed, so the server downclocked and disabled half
C.The server's memory controller only supports up to 256GB
D.The DIMMs are installed in the wrong slots, causing half of them to be disabled
AnswerD

Many servers require DIMMs to be populated in specific slot order to enable all memory channels. If DIMMs are installed in slots that are not recognized without a corresponding slot being filled, the server may disable half the memory. This is a common issue when populating all slots without following the population rules. The result is exactly half the installed memory being reported.

Why this answer

The most likely cause is incorrect DIMM slot population. Servers require DIMMs to be installed in a specific order to enable all channels. If half the DIMMs are in slots that are not activated without a corresponding slot being filled, the server will report only half the installed memory.

Other options would typically produce errors or not match the exact half-memory symptom.

Exam trap

The trap here is assuming a hardware failure or limit, when the symptom of exactly half the memory often points to a population rule violation.

Full explanation →
192
MCQmedium

A server administrator is troubleshooting a newly racked server that powers on but does not POST. The server's front-panel status LED shows a steady amber condition, and no video signal is produced. The administrator has already confirmed that both power supplies are connected to working PDUs and that the power button is not faulty. Which of the following should the administrator check NEXT?

A.Replace the system board battery (CMOS battery).
B.Reseat the CPU and apply fresh thermal paste.
C.Connect a serial console to check for BIOS output.
D.Verify that the memory modules are fully seated and in the correct slots per the server documentation.
AnswerD

A steady amber status LED with no POST often points to a memory fault or misconfiguration. Memory not fully seated or installed in an unsupported slot population order is a common cause. Reseating and verifying slot population according to the vendor's guidelines is a logical next step before replacing components.

Why this answer

The steady amber status LED and lack of POST indicate a critical hardware fault, often memory-related. Verifying that memory modules are properly seated and populated according to the server documentation is a non-invasive, high-probability fix. Other options involve more invasive or less likely steps that should be deferred until basic hardware checks are completed.

Exam trap

The trap here is assuming that a no-POST condition always points to a failed CPU or motherboard, when memory seating or configuration is a more common and easily correctable cause.

Full explanation →
193
MCQmedium

A company's primary file server runs Windows Server 2019 with four 1 TB SATA drives in a RAID 5 array controlled by a hardware RAID controller. The server hosts shared project data that is accessed continuously during business hours. The administrator notices that write performance has degraded significantly over the past month, and the RAID controller log shows an increasing number of medium errors on one drive. The administrator needs to replace the failing drive with minimal downtime and without losing data. Which of the following should the administrator do FIRST?

A.Update the RAID controller firmware to the latest version.
B.Verify that a recent, restorable backup of the array exists.
C.Run a full surface scan on all drives in the array to identify additional errors.
D.Replace the failing drive with a new drive of equal or larger capacity, allowing the controller to rebuild the array.
AnswerB

Before any physical intervention on a degraded RAID array, confirming a recent, tested backup is essential. During a RAID 5 rebuild, the array is vulnerable to a second drive failure, which would cause total data loss. A verified backup ensures the data can be restored if the rebuild fails or another drive fails during the process.

Why this answer

Before replacing a drive in a degraded RAID 5 array, the administrator must ensure that a recent, restorable backup exists. RAID 5 can tolerate only one drive failure; during a rebuild, the array is extremely vulnerable, and a second failure would result in total data loss. Verifying a backup first protects the data and allows recovery if the rebuild fails.

Exam trap

The trap here is assuming that a RAID 5 array always protects data during a rebuild, when in fact the array is at its most vulnerable point and a verified backup is the true safety net.

Full explanation →
194
MCQhard

A database server with 64 GB of RAM and RAID 5 storage is experiencing intermittent performance degradation. System monitoring shows constant 95% memory utilization, high disk queue length, and frequent page faults. The server is running a critical application that cannot be restarted during business hours. Which action will provide the BEST permanent resolution?

A.Replace the RAID 5 array with RAID 10
B.Move the page file to a dedicated SSD
C.Increase the size of the page file
D.Add more physical RAM
AnswerD

Constant 95% memory utilisation with frequent page faults indicates the working set exceeds 64 GB, forcing disk paging that inflates queue length. Adding physical RAM removes the paging bottleneck permanently without restarting the critical application during business hours.

Why this answer

High memory utilization combined with frequent page faults indicates a memory bottleneck. Adding physical RAM eliminates the need for paging, permanently resolving the root cause. Increasing or moving the page file only mitigates the symptoms, while replacing RAID 5 with RAID 10 improves disk performance but does not address the underlying memory shortage.

Full explanation →
195
Multi-Selectmedium

A server administrator is implementing a backup strategy for a Windows Server 2022 file server. The administrator needs to ensure that backups can be restored quickly and that the backup data is protected against ransomware. Which two actions should the administrator take? (Choose two.)

Select 2 answers
A.Enable deduplication on the backup target to reduce storage consumption.
B.Store backups on a network share that is accessible using domain administrator credentials.
C.Schedule backups to run only during off‑peak hours to minimize performance impact.
D.Use a cloud backup service that supports immutable backups and versioning.
E.Configure Windows Server Backup to store backups on an external USB drive that is kept offline when not in use.
AnswersD, E

Immutable backups cannot be altered or deleted for a specified retention period, providing strong protection against ransomware. Versioning allows restoration to a previous point in time. This approach ensures that backup data is protected even if credentials are compromised, and it enables quick recovery.

Why this answer

To protect backups from ransomware and ensure quick restoration, the administrator should keep backups offline or use immutable cloud storage. An offline USB drive is inaccessible to ransomware when disconnected, and immutable cloud backups cannot be altered. Both approaches provide strong protection and enable reliable recovery.

Exam trap

The trap here is assuming that any backup is sufficient, but backups stored on always‑connected network shares or without immutability can be encrypted by ransomware, rendering them useless for recovery.

Full explanation →
196
MCQhard

A technician is replacing a failed hard drive in a hot-swap RAID 5 array. After inserting the new drive, the RAID controller does not automatically rebuild. What should the technician do first?

A.Check the SAS cable connection
B.Reboot the server
C.Replace the drive with a different model
D.Manually initiate a rebuild from the RAID controller utility
AnswerD

Hot-swap insertion alone does not guarantee the controller detects and rebuilds the array; many controllers require an explicit rebuild command. Initiating the rebuild manually from the RAID controller utility restores redundancy using parity data, satisfying the requirement to recover the degraded RAID 5 array.

Why this answer

In a hot-swap RAID 5 array, the controller detects the new drive but may not begin rebuilding automatically depending on its configuration — some controllers require an explicit rebuild command. The technician's first action should be to open the RAID controller utility (e.g., MegaRAID Storage Manager, Dell OpenManage, or HPE Smart Storage Administrator) and manually initiate the rebuild. This is the least invasive step and directly addresses the missing rebuild.

Exam trap

SK0-005 often tests the assumption that hot-swap drives always trigger automatic rebuilds — candidates overlook that controller configuration or foreign-configuration states may require a manual rebuild command before any hardware troubleshooting is warranted.

How to eliminate wrong answers

Option A is wrong because if the SAS cable were disconnected, the controller would not detect the new drive at all — the scenario states the drive was inserted and detected, just not rebuilt. Option B is wrong because rebooting the server is disruptive and unnecessary; it may or may not trigger an automatic rebuild and risks downtime for a production array. Option C is wrong because replacing the drive with a different model is premature — the current drive is functional and detected; the issue is a configuration/command gap, not hardware incompatibility.

Full explanation →
197
PBQmedium

A medium-size enterprise runs a vSphere 7.0 cluster with two hosts (HostA and HostB) for production VMs. Each host has two 10GbE uplinks (vmnic0 and vmnic1) connected to separate physical switches (SW1 and SW2) for redundancy. A single vSphere standard switch (vSwitch0) uses both uplinks with teaming policy set to 'Route based on originating virtual port ID,' 'Network failure detection: Link status only,' and 'Notify switches: Yes.' Lately, several VMs running on HostA experience intermittent network disconnections lasting 20–30 seconds, while VMs on HostB are unaffected. The administrator checks vCenter events and sees repeated messages: 'Lost uplink redundancy on vSwitch0. vmnic0 is down.' followed seconds later by 'Uplink redundancy restored. vmnic0 is up.' The physical switch SW1's log shows the port for vmnic0 transitions through spanning-tree listening and learning states each time this occurs, taking about 15 seconds. The link is a trunk allowing all necessary VLANs, with no errors or security violations. The network team has already swapped the fiber cable and SFP+ transceiver for vmnic0 without improvement. The VMs affected are those whose virtual ports are pinned to vmnic0 by the load-balancing policy; VMs pinned to vmnic1 never experience disconnections. The administrator has also rebooted HostA and updated the NIC firmware, but the flapping continues. What should the administrator do to permanently resolve the intermittent connectivity?

A.Disable the 'Notify switches' option on the vSwitch teaming configuration to avoid unnecessary RARP broadcasts.
B.Reconfigure the physical switch port for vmnic0 to an access port instead of a trunk to simplify spanning-tree operations.
C.Enable spanning-tree PortFast on the SW1 and SW2 ports connected to the hosts so the ports bypass the listening/learning states.
D.Change the NIC teaming load balancing policy to 'Route based on IP hash' to distribute traffic across both uplinks more evenly.
AnswerC

Why this answer

Option C is correct because the symptoms as confirmed by the switch log show that each link flap triggers spanning-tree recalculation, causing the port to cycle through listening and learning states before forwarding resumes. Enabling PortFast on switch ports that are connected to end devices (like ESXi hosts) allows immediate forwarding. Option A is wrong because changing to access mode would break multiple VLANs and still face STP delays.

Option B is wrong because disabling notify switches might worsen MAC table inconsistencies. Option D is wrong because changing load balancing does not stop the flapping or STP convergence; the issue is at layer 2.

Full explanation →
198
MCQeasy

A small office has a single physical server running Windows Server 2022 that hosts a file share and a print server. The administrator wants to ensure that if the server's operating system becomes corrupted, the server can be restored quickly to a working state. Which backup type should the administrator use?

A.Volume shadow copy
B.System state backup
C.Bare metal recovery backup
D.File-level backup of the file share only
AnswerC

A bare metal recovery backup captures the entire operating system, applications, and data, allowing a full restore to new or existing hardware without a preinstalled OS. This is the appropriate choice when the goal is to recover quickly from a corrupted operating system.

Why this answer

A bare metal recovery backup includes the operating system, applications, and data, enabling a complete restore even if the OS is corrupted. This meets the need to quickly return the server to a working state without a lengthy manual rebuild.

Exam trap

The trap here is confusing system state backups with full server recovery; system state covers critical OS components but not the entire OS volume.

Full explanation →
199
MCQhard

A server administrator is installing a new 1U server into a rack. The server's rail kit includes both inner and outer rails. The administrator notices that the inner rails need to be attached to the server chassis before mounting. Which of the following is the correct procedure to install the server into the rack?

A.Attach the inner rails to the server chassis, then slide the server into the outer rails already mounted in the rack.
B.Attach both inner and outer rails to the server chassis, then lift the entire assembly into the rack.
C.Attach the outer rails to the server chassis, then slide the server into the inner rails mounted in the rack.
D.Mount the server directly onto the rack posts without using the rail kit.
AnswerA

This is the standard procedure for rail kits with inner and outer rails. The inner rails attach to the server, and the outer rails mount to the rack. Then the server with inner rails slides into the outer rails and locks into place. This ensures proper alignment and secure mounting.

Why this answer

The correct procedure is to attach the inner rails to the server chassis and the outer rails to the rack, then slide the server into the rack. This is the standard method for rail kits with separate inner and outer components. Other options reverse the components or omit rails entirely, which would result in improper or unsafe installation.

Exam trap

The trap here is confusing which rail component attaches to the server versus the rack, leading to an inverted installation that will not work.

Full explanation →
200
MCQeasy

A technician is installing a new 2U server into a datacenter rack. The server is equipped with redundant power supplies. According to best practices for power redundancy, how should the technician connect the power supplies?

A.Connect one PSU to a UPS and the other directly to mains
B.Run one PSU at 110V and the other at 220V for load balancing
C.Connect each PSU to a separate circuit
D.Connect both PSUs to the same power distribution unit (PDU)
AnswerC

Best practice is to connect redundant PSUs to independent power sources (separate PDUs on different circuit breakers) to eliminate single points of failure.

Why this answer

Option B is correct because connecting each power supply to a separate circuit (or separate PDUs fed by different circuits) ensures that if one circuit fails, the other keeps the server powered. Option A is wrong because connecting both to the same PDU creates a single point of failure. Option C is wrong because while a UPS is important, connecting only one PSU to a UPS defeats redundancy if the non-UPS circuit fails.

Option D is wrong because operating voltages are standardized and must match the server specifications.

Full explanation →
201
MCQmedium

A datacenter administrator manages a rack of servers that handle nightly batch processing. The company's security policy requires that all server hard drives be sanitized before disposal, and the drives previously contained customer PII. The administrator needs a method that renders the data unrecoverable and also allows the drives to be reused internally for non-sensitive test systems. Which of the following should the administrator use?

A.Use a software tool to overwrite every sector of each drive with a fixed pattern, then verify the overwrite.
B.Degauss each drive with a strong magnetic field and then relabel it for reuse.
C.Remove the platters from each drive and shred them, then install new drives in the test systems.
D.Perform a quick format on each drive using the operating system's disk management utility.
AnswerA

Overwriting every sector with a fixed pattern (such as zeros or random data) and verifying the write is a standard sanitization method that renders the previous PII unrecoverable while leaving the drive usable for non-sensitive internal systems. This satisfies the policy and supports reuse, unlike physical destruction or weaker logical methods.

Why this answer

The requirement is to sanitize drives that held PII while keeping them usable for non-sensitive purposes. Overwriting every sector with a fixed pattern and verifying the overwrite achieves both goals. Quick formatting leaves data intact, degaussing ruins the drives, and shredding platters destroys them, so only the overwrite method satisfies both sanitization and reuse.

Exam trap

The trap here is assuming that any method that makes data hard to read also satisfies sanitization policy, when the reuse requirement eliminates destructive techniques.

Full explanation →
202
MCQeasy

A server administrator is troubleshooting a rack server that fails to complete POST. The server emits a series of beep codes, and no video output appears. The administrator has already reseated the memory modules and confirmed they are in the correct slots. Which of the following should the administrator check NEXT?

A.The CMOS battery voltage
B.The power supply output voltages
C.The operating system boot loader configuration
D.The hard drive S.M.A.R.T. status
AnswerB

Beep codes with no video during POST often indicate a power delivery problem or a failed component. Checking the power supply output voltages with a multimeter or PSU tester confirms whether the PSU delivers stable rails. If voltages are out of tolerance, the system may fail POST before initializing video, matching the scenario.

Why this answer

Beep codes with no video output during POST indicate a hardware failure detected before video initialization. After confirming memory seating, the next logical check is power delivery, since unstable or out-of-tolerance PSU voltages can halt POST. CMOS battery, disk health, and boot loader configuration affect later stages and would not produce these symptoms.

Exam trap

The trap here is assuming any boot-related failure points to the operating system or storage, when the absence of video output means the failure occurs before the OS is even involved.

Full explanation →
203
Multi-Selecthard

A server administrator is hardening a newly deployed Linux web server that will be exposed to the internet. The security policy requires minimizing the attack surface and protecting authentication. Which two actions BEST align with that policy? (Choose two.)

Select 2 answers
A.Install a full desktop environment and remote GUI tools so administrators can avoid using the command line.
B.Disable all unused network services and close their associated ports using the host firewall.
C.Enforce key-based SSH authentication and disable password authentication for remote administration.
D.Configure SSH to permit direct root login with a strong password to simplify administration.
E.Set the firewall default policy to allow all inbound traffic, then block only known malicious source IP addresses.
AnswersB, C

Every listening service is potential attack surface, so disabling unused daemons and blocking their ports reduces the number of exploitable entry points. This directly supports minimizing attack surface. The host firewall enforces the closure even if a service is accidentally re-enabled, giving defense in depth for an internet-facing server, which matches the stated hardening policy.

Why this answer

Hardening an internet-facing server means shrinking what is reachable and strengthening how administrators authenticate. Disabling unused services and closing their ports removes unnecessary entry points, while enforcing key-based SSH and disabling password authentication removes the easiest credential attack path. The other choices either expand the attack surface, weaken privileged access, or rely on an ineffective blocklist model.

Exam trap

The trap here is treating convenience measures such as root login or a desktop GUI as acceptable hardening when they actually enlarge the attack surface.

Full explanation →
204
PBQhard

A company is migrating a legacy line-of-business application from Windows Server 2012 R2 to a new Windows Server 2022 server that is a member of an Active Directory domain. The application runs as a Windows service under a domain service account named CORP\svc_app. The service account has been granted the 'Log on as a service' user right on the old server, and the application is configured to listen on a static TCP port 8443. After installing the application on the new server and configuring it with the same service account and port, the application fails to start. The administrator checks the Windows Event Viewer and sees two errors in the System log: 'The CORP\svc_app service failed to start due to the following error: The service did not start due to a logon failure' and 'The service cannot bind to the designated port 8443'. The administrator has already verified that the service account's password is correct and has not expired, that the account is enabled, that the port 8443 is not being used by another service, and that the Windows Firewall has an inbound rule allowing traffic on port 8443. The application's configuration file correctly points to port 8443. What should the administrator do to resolve the issue?

A.Restart the Windows Server 2022 server to apply any pending policy changes.
B.Grant the 'Log on as a service' user right to the CORP\svc_app account via Local Security Policy or Group Policy.
C.Configure the application to use a dynamic port instead of the static port 8443.
D.Reset the service account password and update the service configuration.
AnswerB

Why this answer

The error 'The service did not start due to a logon failure' combined with the port bind failure points to the service account lacking the 'Log on as a service' right on the new server. User rights such as 'Log on as a service' are assigned per-machine via Local Security Policy or centrally via Group Policy, and they do not automatically follow a domain account when it is used on a new server. Even though the account is enabled and the password is valid, without the SeServiceLogonRight the Service Control Manager cannot create the logon token, so the service fails before it can bind to port 8443.

Granting the right on the new server resolves both errors.

Exam trap

SK0-005 often tests the misconception that a valid, enabled domain service account automatically has the right to log on as a service on any server, when in fact SeServiceLogonRight must be granted per machine.

How to eliminate wrong answers

Option A is wrong because a reboot does not grant a missing user right — pending policy changes would already be reflected in the error, and the logon failure is a rights assignment issue, not a refresh timing issue. Option C is wrong because changing to a dynamic port does not address the logon failure; the port bind error is a downstream symptom of the service never starting, and the port is already verified as free. Option D is wrong because the administrator already verified the password is correct and unexpired; resetting it would not add the missing 'Log on as a service' right and would not fix the logon failure.

Full explanation →
205
MCQeasy

A technician needs to add four new 2.5-inch SSDs to a rack server that currently has all eight 2.5-inch front drive bays populated with SAS hard drives. The server's backplane supports hot-swap and the RAID controller supports online capacity expansion. Which of the following is the BEST way to add the SSDs?

A.Replace four existing SAS hard drives with the SSDs and rebuild the array, accepting the loss of the hard drive capacity.
B.Install an additional hot-swap drive cage or expander backplane connected to the existing RAID controller, then add the SSDs and expand the array.
C.Connect the four SSDs to the motherboard's onboard SATA ports and create a separate operating system RAID volume.
D.Attach the SSDs as external USB 3.0 drives and present them to the RAID controller as pass-through disks.
AnswerB

When all front bays are occupied, the supported method is to add more bays through an approved drive cage or expander backplane attached to the RAID controller. This maintains hot-swap capability and lets the controller incorporate the new disks into a logical drive using online capacity expansion. It follows vendor-supported cabling and thermal design.

Why this answer

All front bays are full, so the technician must extend the drive subsystem using a supported additional cage or expander backplane tied to the RAID controller. That preserves hot-swap serviceability and allows online capacity expansion to include the new SSDs. Replacing drives, using onboard SATA, or attaching USB disks does not meet the requirement of adding four SSDs to the existing protected storage.

Exam trap

The trap here is choosing a workaround like USB or onboard SATA instead of using the vendor-supported drive cage or expander path for additional hot-swap bays.

Full explanation →
206
MCQmedium

A server administrator is troubleshooting a tower server that reports no video output on the local monitor, but the power LED is solid green and the fans spin at normal speed. The administrator connects to the baseboard management controller (BMC) over the network and sees a POST code of 'B4' with a message indicating USB device initialization. A USB flash drive is left in a rear port. Which of the following is the MOST likely cause of the missing video?

A.The USB flash drive is causing the POST process to stall before video initialization completes.
B.The BMC is redirecting the video output to its remote console, so the local monitor stays blank.
C.The video card has failed and must be replaced before the server will POST.
D.The monitor cable is connected to the wrong port on the server.
AnswerA

The POST code 'B4' with a USB initialization message indicates the firmware is hung while enumerating USB devices. When POST stalls at this stage, video initialization may not complete, leaving the local monitor blank. Removing the flash drive and rebooting typically clears the hang. This matches the evidence of a solid power LED, normal fans, and a specific POST code.

Why this answer

The POST code 'B4' with a USB initialization message is the key evidence: the server is hanging during USB device enumeration, which can prevent video initialization from completing. Removing the offending USB flash drive and rebooting is the correct remediation. The other causes either contradict the POST code or would not produce that specific code.

Exam trap

The trap here is assuming no video always means a video subsystem failure, when a POST hang at USB enumeration is the actual cause.

Full explanation →
207
Multi-Selecthard

A company is hardening a publicly reachable Linux web server that runs an SSH service for administration. The security team wants to reduce the attack surface and enforce stronger authentication. Which two actions BEST accomplish this? (Choose two.)

Select 2 answers
A.Install a host-based intrusion detection system that alerts on suspicious SSH login patterns.
B.Require public key authentication and disable password-based SSH logins.
C.Disable direct root login over SSH and require administrators to authenticate with individual accounts.
D.Enable verbose logging of all SSH connection attempts to a remote syslog server.
E.Change the SSH service to listen on a non-standard port to hide it from scanners.
AnswersB, C

Public key authentication is far more resistant to brute-force and credential-stuffing attacks than passwords, and disabling password logins removes that entire class of attack. This enforces stronger authentication while preserving administrative access for users who hold authorized keys, which is exactly the hardening goal described.

Why this answer

The strongest reductions in SSH attack surface come from removing weak authentication paths and eliminating shared, highly privileged logins. Requiring public keys with password authentication disabled blocks brute-force approaches, while forbidding direct root login enforces named accounts and per-user accountability. Together they harden authentication and limit the impact of a single compromised credential.

Exam trap

The trap here is treating detection or obscurity measures, such as logging or port changes, as if they reduced exposure rather than merely observing it.

Full explanation →
208
MCQhard

A company operates a primary datacenter and a cold standby site. The disaster recovery plan states that the standby site must be able to take over within 8 hours, but the current plan requires rebuilding servers from bare metal and restoring data from tape, which takes 3 days. Which change best aligns the standby site with the stated recovery time objective?

A.Convert the standby site to a warm site with pre-staged hardware and replicated data.
B.Document the rebuild procedure in more detail and rehearse it quarterly.
C.Increase the frequency of tape backups from weekly to daily.
D.Add a second tape library at the cold site for parallel restores.
AnswerA

A warm site has hardware and data already in place, so recovery involves powering on systems and applying recent changes rather than rebuilding from bare metal. This reduces recovery time from days to hours, matching the 8-hour RTO while costing less than a fully active-active site.

Why this answer

The gap is recovery time, not recovery point. A warm site with pre-staged hardware and replicated data removes the bare-metal rebuild step, bringing recovery within hours. Backup frequency, extra tape libraries, and documentation improvements address data freshness or process quality but leave the multi-day hardware rebuild in place.

Exam trap

The trap here is treating a recovery point objective problem as a recovery time objective problem, so the fix addresses backup frequency instead of the time to rebuild infrastructure.

Full explanation →
209
MCQmedium

A server administrator is configuring a new Linux server that will host a web application. The application requires a persistent storage volume that can be easily expanded without downtime. The server has a single physical disk with 500 GB of free space. The administrator decides to use LVM (Logical Volume Management). Which of the following is the correct sequence of steps to create a new logical volume and mount it?

A.lvcreate, vgcreate, pvcreate, mkfs, mount
B.vgcreate, pvcreate, lvcreate, mkfs, mount
C.pvcreate, vgcreate, lvcreate, mkfs, mount
D.pvcreate, lvcreate, vgcreate, mkfs, mount
AnswerC

This sequence is correct: first create a physical volume (pvcreate) on the disk or partition, then create a volume group (vgcreate) from that physical volume, then create a logical volume (lvcreate) within the volume group, then create a filesystem (mkfs) on the logical volume, and finally mount it. This is the standard LVM workflow.

Why this answer

The correct order for setting up LVM is to create physical volumes, then a volume group, then logical volumes, then a filesystem, and finally mount it. This logical progression ensures that each layer is built upon the previous one. The other sequences violate the dependency order and would result in errors.

Exam trap

The trap here is mixing up the order of LVM commands, especially placing lvcreate before vgcreate or vgcreate before pvcreate.

Full explanation →
210
MCQmedium

A company's file server is running low on disk space. The administrator notices that the disk holding the operating system and application logs is nearly full. Which of the following is the BEST immediate step to free up space while maintaining system stability?

A.Delete the largest log files in the Windows directory.
B.Compress the entire operating system drive.
C.Move the pagefile to a different volume.
D.Run Disk Cleanup to remove temporary files and old updates.
AnswerD

Disk Cleanup safely removes temporary files, system cache, and old Windows updates, freeing space without affecting critical system files or application functionality. It is a built-in tool that identifies safe-to-delete items, making it the best immediate action to regain space while preserving stability.

Why this answer

Disk Cleanup is the safest and most efficient immediate solution because it targets unnecessary files without risking system integrity. Other options either jeopardize stability, offer limited benefit, or introduce performance penalties. The goal is to quickly reclaim space while ensuring the server remains operational and compliant.

Exam trap

The trap here is assuming that manually deleting large files is always safe, when in fact it can break logging and auditing.

Full explanation →
211
MCQeasy

A technician is tasked with installing a new PCIe expansion card into a rack-mounted server. The server will be powered off but remains in the rack. Which of the following should the technician do FIRST to prevent electrostatic discharge (ESD) damage?

A.Wear an antistatic wrist strap connected to the server chassis.
B.Touch the metal frame of the rack to discharge static electricity.
C.Place the expansion card on a non-conductive surface.
D.Power on the server to warm up the components and reduce static.
AnswerA

Wearing an antistatic wrist strap connected to the server chassis equalizes the electrical potential between the technician and the server, preventing ESD. This is the first and most important step before handling internal components. The server should be powered off and unplugged, but the wrist strap should be connected to the chassis to ensure a common ground. This is a standard ESD prevention practice.

Why this answer

The first step to prevent ESD is to wear an antistatic wrist strap connected to the server chassis. This ensures the technician and the server are at the same electrical potential, preventing static discharge that could damage sensitive components. Other methods like touching the rack are temporary and less effective.

Always follow proper ESD procedures before handling internal hardware.

Exam trap

The trap here is thinking that simply touching a metal object discharges static sufficiently, but continuous grounding through a wrist strap is required for safe handling.

Full explanation →
212
PBQeasy

A small business has a single file server running Windows Server 2019. The server uses two internal SATA drives in a RAID 1 mirror for the operating system and data. The company's backup solution performs a full backup every night to an external USB hard drive, which is stored in the server room. The IT administrator recently noticed that the server's system volume is running low on space and decides to migrate the data to a larger drive. During the migration, the server crashes and will not boot. The administrator attempts to restore from the latest backup but finds that the backup drive is corrupted and cannot be read. The company has no offsite backups. What should the administrator have done to prevent this situation?

A.Regularly test backup restorations to verify data integrity.
B.Implement a RAID 5 array instead of RAID 1 for better redundancy.
C.Document the backup procedure and create a disaster recovery plan.
D.Use a cloud-based backup service with offsite storage.
AnswerA

Why this answer

The correct answer is D: Regularly test backup restorations to verify data integrity. The administrator assumed backups were valid without verification. Option A is wrong because RAID 1 provides redundancy but does not protect against corruption or accidental deletion; the issue here is backup corruption.

Option B is wrong because cloud backup is a good practice but not strictly required; the root cause is lack of backup testing. Option C is wrong because while documentation is helpful, it would not prevent data loss from a corrupted backup drive.

Full explanation →
213
PBQhard

A large enterprise uses a centralized backup solution with a backup server running Commvault. Backups are stored on a deduplicated disk array and replicated to a secondary site for disaster recovery. The company's security team detects ransomware activity that has encrypted several file servers. The backup administrator checks the backup repository and finds that the backup data is also encrypted because the backup service account had permissions to modify backup files, and the ransomware propagated to the repository. The last known good backup is from two weeks ago, which is too old for the organization's RPO of 24 hours. The backup administrator is under pressure to restore operations quickly. Which of the following should the administrator implement to prevent this from recurring?

A.Immutable backup storage and a dedicated service account with least-privilege access.
B.Encrypt all backup data at rest and in transit.
C.Require multi-factor authentication for the backup service account.
D.Air-gap the backup repository by disconnecting it from the network except during backup windows.
AnswerA

Why this answer

The correct answer is A: Implement immutable backup storage and use a separate service account with write permissions only during backup windows. Immutable backups cannot be modified or deleted by any user or process, including ransomware. Option B is wrong because air-gapping alone does not prevent access if the backup server is compromised; immutable storage is more robust.

Option C is wrong because while MFA is a good security practice, it does not protect backups that are already accessible with valid credentials. Option D is wrong because encryption of backup data protects it during transit or while stored, but does not prevent the ransomware from encrypting the files if the backup system is accessible.

Full explanation →
214
MCQmedium

A server administrator is troubleshooting a physical server that randomly crashes once or twice a week. The administrator has already verified that the power supply is functioning correctly and has checked the event logs for critical errors. According to standard troubleshooting methodology, what should the administrator do next?

A.Check network cables and switch connections.
B.Run memory diagnostics (e.g., MemTest86) to test RAM.
C.Reinstall the operating system.
D.Replace the CPU with a known good one.
AnswerB

With power and logs already cleared, memory is the prime suspect for intermittent crashes. MemTest86 exercises RAM outside the OS, exposing faulty modules that cause random reboots. This follows the methodology's next step: test the most probable remaining hardware cause before escalating.

Why this answer

After verifying power and checking event logs, the next logical step in standard troubleshooting methodology (CompTIA's six-step process) is to test the most likely remaining hardware cause of random crashes. Random crashes once or twice a week with no logged critical errors strongly suggest intermittent memory faults, which often do not produce OS-level event log entries. MemTest86 is the standard tool for testing RAM and is non-destructive, making it the correct next diagnostic step before escalating to more invasive actions.

Exam trap

SK0-005 often tests whether candidates jump to drastic fixes (OS reinstall, CPU replacement) instead of following the ordered troubleshooting methodology of testing the most likely and least invasive cause first, so the trap is selecting an aggressive action over a diagnostic one.

How to eliminate wrong answers

Option A is wrong because network cables and switch connections would cause connectivity issues, not random server crashes, and are unrelated to the symptom. Option C is wrong because reinstalling the operating system is a drastic, data-destructive action that should only be considered after hardware has been ruled out, and it violates the methodology of testing the most probable cause first. Option D is wrong because replacing the CPU is a much more invasive and expensive step than testing RAM, and CPUs fail far less often than memory; it should only be done after memory and other components are eliminated.

Full explanation →
215
MCQhard

A server administrator is installing a new SAS SSD into a server that supports hot-swap drives. The server has a hardware RAID controller and the drive bay is accessible from the front. The administrator wants to add the drive to an existing RAID 5 array without bringing the server down. Which of the following should the administrator do?

A.Insert the drive and use the operating system's disk management to extend the volume onto the new disk.
B.Insert the drive and use the RAID controller's online capacity expansion feature to add it to the array.
C.Insert the drive and configure it as a global hot spare for the existing array.
D.Insert the drive and create a new RAID 0 array with it, then span the volumes.
AnswerB

Online capacity expansion allows adding a drive to an existing RAID array while the system remains operational. The administrator should insert the hot-swap drive, then use the RAID controller management utility to expand the array. This process may take time and can impact performance, but it avoids downtime. This is the correct method for adding capacity without shutting down the server.

Why this answer

To add a drive to an existing RAID 5 array without downtime, the administrator should use the RAID controller's online capacity expansion feature. This allows the array to be reconfigured to include the new drive while the system remains online. The process typically involves inserting the hot-swap drive, then using the controller's management software to expand the array.

Performance may degrade during the rebuild, but it avoids service interruption.

Exam trap

The trap here is confusing a hot spare with capacity expansion; a hot spare only provides redundancy and does not increase usable storage.

Full explanation →
216
MCQeasy

A small business runs a single physical server that hosts a customer relationship management (CRM) application and its database. The owner wants a backup strategy that allows the server to be restored on different hardware if the original server fails completely. Which backup type should the administrator implement?

A.Incremental backup
B.Bare-metal backup
C.Differential backup
D.Full backup
AnswerB

A bare-metal backup captures the entire server, including the operating system, system state, applications, and data, in a format that can be restored to completely different hardware. This directly satisfies the requirement to rebuild the server on new hardware after a total failure. It typically uses a bootable recovery environment and injects the appropriate mass storage drivers during restore, making it the correct choice for hardware-independent recovery.

Why this answer

The owner needs the server to be recoverable on different hardware after a complete failure. A bare-metal backup captures the operating system, system state, applications, and data, and its restore process can inject drivers for the new hardware, allowing the server to boot on dissimilar equipment. Full, differential, and incremental backups protect data but do not by themselves provide hardware-independent operating system recovery.

Exam trap

The trap here is assuming that any full backup automatically provides bare-metal recovery, when in fact hardware-independent restore requires a backup type that includes the operating system and boot configuration.

Full explanation →
217
MCQmedium

A datacenter operator is reviewing physical security for a server room that houses backup tapes and network core switches. The room has a single wooden door with a mechanical lock, and the key is shared among the facilities staff. Which change should the administrator recommend FIRST to improve access control?

A.Add a second mechanical lock to the door to create two-key access
B.Install a security camera in the hallway outside the server room
C.Move the backup tapes to a locked cabinet inside the server room
D.Install an electronic access control system with individual credentials and an audit log
AnswerD

An electronic access control system replaces a shared mechanical key with unique credentials per person and records every entry. This provides accountability and revokes access immediately when someone leaves. For a room containing backup tapes and core switches, individual accountability and auditability are the most direct improvements to access control.

Why this answer

The fundamental weakness is that a single mechanical lock with a shared key provides no individual accountability and cannot be selectively revoked. An electronic access control system issues unique credentials and logs each entry, directly improving both prevention and audit. This is the first and most impactful change for protecting the tapes and core switches.

Exam trap

The trap here is choosing a detective control such as a camera or an additional physical barrier, rather than replacing the shared-key mechanism that causes the accountability gap.

Full explanation →
218
MCQhard

Refer to the exhibit. A technician receives an alert from the monitoring system showing the error in the exhibit. The server is still online, but performance has degraded. Which of the following is the MOST likely cause and appropriate action?

A.The SATA controller driver is corrupted; reinstall the driver
B.The disk has a bad sector; run CHKDSK and monitor
C.The hard disk drive is failing; back up data and replace the drive
D.The disk is experiencing high I/O; upgrade to SSD
AnswerC

Controller errors on \Device\Harddisk0 typically mean the drive is failing. Backing up and replacing is the best course.

Why this answer

Event ID 11 from Disk source indicates a controller error, often due to a failing disk or cable. The most likely cause is a failing hard drive. Backing up and replacing the drive is the appropriate action.

Bad sectors might be the symptom but replacing is safer. Driver corruption is less likely; high I/O wouldn't cause a controller error.

Full explanation →
219
MCQhard

A security administrator is configuring a server to meet a requirement that all administrative access must use multifactor authentication and be encrypted in transit. The server runs Windows Server 2022. Which solution should the administrator implement?

A.Secure Shell (SSH) with public key authentication
B.Remote Desktop Gateway (RD Gateway) with multifactor authentication
C.Virtual Private Network (VPN) with preshared key authentication
D.Remote Desktop Protocol (RDP) with Network Level Authentication (NLA)
AnswerB

RD Gateway encapsulates RDP traffic in HTTPS, encrypting it in transit, and can be integrated with multifactor authentication providers such as Microsoft Entra MFA or third-party RADIUS solutions. This directly satisfies both requirements: encrypted administrative access and MFA enforcement. It also provides a single point of entry that can be monitored and controlled, making it the correct solution for secure remote administration of Windows Server 2022.

Why this answer

The requirement is for administrative access that is both encrypted in transit and protected by multifactor authentication. Remote Desktop Gateway with MFA encrypts RDP sessions over HTTPS and enforces a second authentication factor, meeting both conditions. RDP with NLA lacks MFA, SSH with public key is single-factor, and VPN with preshared key is also single-factor, so none of those fully satisfy the requirements.

Exam trap

The trap here is equating encryption with multifactor authentication, or assuming that any encrypted remote access method automatically includes a second factor when it does not.

Full explanation →
220
MCQhard

A RAID 5 array is degraded due to a failed disk. What is the best practice for recovery?

A.Replace the failed disk and restore from backup
B.Replace the failed disk and allow the array to rebuild automatically
C.Replace the failed disk and perform a manual rebuild from backup
D.Delete the logical drive and recreate the array
AnswerB

RAID 5 stores parity across remaining disks, so replacing the failed disk lets the controller reconstruct its contents automatically. This satisfies best practise by restoring redundancy without rebuilding the array from scratch or risking unnecessary data loss.

Why this answer

In a RAID 5 array, a single disk failure leaves the array degraded but still operational because parity data on the remaining disks can reconstruct the missing data. Best practice is to replace the failed disk and allow the controller to rebuild the array automatically from parity, restoring redundancy without downtime or data loss. This is the standard hot-swap recovery procedure and requires no backup restore because the data is still intact.

Exam trap

SK0-005 often tests whether candidates understand that RAID 5 tolerates one disk failure and rebuilds from parity, so the trap is choosing backup restore or array recreation when the correct action is simply replacing the disk and letting the controller rebuild.

How to eliminate wrong answers

Option A is wrong because restoring from backup is unnecessary when the array is only degraded — RAID 5 is designed to survive a single disk failure, and the data remains accessible via parity. Option C is wrong because a manual rebuild from backup is not how RAID recovery works; the controller rebuilds from parity, not from backup, and using backup would be slower and riskier. Option D is wrong because deleting and recreating the logical drive destroys all data on the array and is only appropriate when the array has failed beyond recovery (e.g., two disks failed in RAID 5).

Full explanation →
221
MCQhard

A server administrator is troubleshooting a Windows Server host that has been randomly losing connectivity to its iSCSI storage for the past week. The host has two dedicated NICs for iSCSI, each connected to a separate switch, and multipath I/O is configured. Event logs show intermittent path failures that recover within seconds. Switch port statistics show no errors, and both storage controllers report healthy. Which of the following should the administrator check FIRST to diagnose the intermittent path loss?

A.Replace the transceivers in both iSCSI NICs because intermittent link drops indicate failing optics
B.Confirm that the two iSCSI NICs are not participating in a team or spanning tree topology that introduces loops
C.Review the host's TCP retransmission and timeout settings, and check for network congestion on the storage VLAN
D.Verify that the iSCSI initiator and target are configured with matching CHAP authentication secrets
AnswerC

Intermittent iSCSI path failures that recover within seconds commonly result from dropped or delayed frames on the storage VLAN, causing TCP retransmissions and initiator timeouts. Checking retransmission counters, congestion, and timeout values on the dedicated storage network is the most direct way to confirm whether the storage VLAN is losing packets, which matches the self-healing behavior described.

Why this answer

Intermittent iSCSI path failures that recover within seconds, with clean switch port statistics and healthy storage controllers, point to packet loss or congestion on the storage network rather than a hardware fault. Reviewing TCP retransmission counters and timeout settings on the dedicated storage VLAN reveals whether frames are being dropped or delayed, which would cause the initiator to declare a path failed and then recover.

Exam trap

The trap here is treating intermittent storage path failures as a hardware problem and replacing components before examining network-level evidence such as retransmissions and congestion.

Full explanation →
222
Multi-Selecthard

A server administrator is troubleshooting a Linux server that is experiencing intermittent network connectivity issues. Users report that connections to the server occasionally time out, but the server responds to pings most of the time. The administrator suspects a duplex mismatch on the network interface. Which two commands should the administrator use to verify the current speed and duplex settings of the interface? (Choose two.)

Select 2 answers
A.ethtool eth0
B.ifconfig eth0
C.mii-tool eth0
D.ip -s link show eth0
E.netstat -i
AnswersA, C

ethtool eth0 displays the current link speed, duplex mode, and whether auto-negotiation is enabled for the interface. This directly provides the information needed to confirm a duplex mismatch. It is the standard Linux utility for querying and setting Ethernet card parameters, making it the correct choice for this scenario.

Why this answer

To confirm a duplex mismatch, the administrator needs to see the actual speed and duplex settings of the interface. ethtool and mii-tool both query the network interface card and report these parameters. The other commands provide statistics or IP configuration but not the negotiated duplex mode. Using either ethtool or mii-tool will reveal whether the interface is set to full or half duplex and at what speed.

Exam trap

The trap here is confusing interface statistics commands with link parameter commands; error counters suggest a problem but do not reveal duplex settings.

Full explanation →
223
MCQmedium

A server hosts a database that requires nightly backups. The backup strategy uses a full backup every Sunday and differential backups on other days. On Wednesday, the server fails. Which backup sets are required to restore to the most recent state?

A.Last full backup and all differential backups since Sunday
B.Last full backup only
C.Last full backup and the latest differential backup
D.Last full backup and all incremental backups since Sunday
AnswerC

Differential backups capture every change since the last full backup, so only the most recent differential is needed. Restoring requires the last full backup plus that latest differential, which returns the database to its Wednesday state.

Why this answer

A differential backup contains all changes since the last full backup. Therefore, only the last full backup and the latest differential are needed for a restore. Incremental backups would require all incrementals since the last full, but the scenario uses differential backups.

Full explanation →
224
MCQeasy

A server administrator is setting up a new Windows Server 2022 file server. The server has two 1 TB NVMe drives. The administrator wants to ensure that if one drive fails, the server can continue to operate without data loss, and also wants to maximize read performance. Which of the following should the administrator implement?

A.RAID 10
B.RAID 1
C.RAID 0
D.RAID 5
AnswerB

RAID 1 mirrors data across both drives, providing redundancy so that if one drive fails, the other continues to serve data. It also allows reads to be serviced from either drive, which can improve read performance. This meets both requirements: continued operation after a single drive failure and improved read performance.

Why this answer

RAID 1 mirrors data across two drives, providing fault tolerance if one drive fails and allowing read operations to be distributed across both drives for better performance. RAID 0 lacks redundancy, RAID 5 needs at least three drives, and RAID 10 needs at least four drives, so none of those meet the requirements with only two drives.

Exam trap

The trap here is assuming RAID 5 or RAID 10 can be used with two drives, but they have minimum drive requirements.

Full explanation →
225
MCQmedium

A company stores nightly database backups on a dedicated backup server in the same data center as the production database. The security team wants to ensure that a ransomware infection on the production network cannot encrypt or delete the backup copies. Which control should the administrator implement?

A.Enable deduplication on the backup server to reduce storage consumption.
B.Increase the backup retention period from 30 days to 90 days on the existing backup server.
C.Add a second backup server in the same rack and replicate backups between the two servers.
D.Configure immutable snapshots or WORM storage on the backup repository and restrict network access to the backup server.
AnswerD

Immutable snapshots or write-once-read-many storage prevent backup data from being altered or deleted for a defined retention period, even by compromised administrative credentials. Restricting network access reduces the chance that ransomware can reach the repository in the first place, providing a strong defense against destructive attacks.

Why this answer

To survive ransomware, backups must be both isolated from the production network and protected from modification. Immutable or WORM storage prevents deletion or encryption even if administrative credentials are compromised, and network restrictions reduce the chance of the repository being reached. Retention or replication alone does not stop a destructive attack.

Exam trap

The trap here is assuming that more retention or a second copy automatically protects backups, without considering whether the copies are writable and reachable.

Full explanation →
Page 2

Page 3 of 6

Page 4

All pages

123456

Practice SK0-005 by domain

Target a specific domain to shore up weak areas.

server-administrationserver-hardware-installation-managementsecurity-disaster-recoverytroubleshooting
See all domains with question counts →