Courseiva

CompTIA Server+ SK0-005 (SK0-005) — Questions 151–185

185 questions total · 3pages · All types, answers revealed

Take a mock examExam hub

Data quality score: 55/100 — Review before indexing

9 warnings found across 35 questions. This page is set to noindex until issues are resolved.

Page 2

Page 3 of 3

151
MCQeasy

A user attempts to access a shared folder named \\Server\Finance. The share permissions are set to 'Everyone – Full Control'. The NTFS permissions on the folder grant the user 'Read & Execute' but deny 'Write'. What is the user's effective permission when accessing the share over the network?

A.Full Control
B.Write
C.No Access
D.Read & Execute
AnswerD

Correct. The intersection of share (Full Control) and NTFS (Read & Execute) yields Read & Execute.

Why this answer

When share and NTFS permissions combine, the most restrictive of the two applies. Share gives Full Control, NTFS gives Read & Execute, so effective access is Read & Execute.

Full explanation →
152
MCQhard

A web application server is experiencing intermittent 502 Bad Gateway errors during peak usage hours. The server's reverse proxy logs show connections to the backend application server being refused. The application server's resource monitor shows CPU utilization at 95% and memory utilization at 40%. Which of the following actions is MOST likely to resolve the issue?

A.Replace the reverse proxy with a hardware load balancer.
B.Add more CPU cores to the server.
C.Increase the server's physical memory.
D.Adjust thread pool and connection timeout settings on the application server.
AnswerD

Modifying thread pool size and timeouts can allow the server to handle more concurrent requests and reduce connection refusals under load.

Why this answer

Option B is correct. High CPU and connection refusals commonly indicate that the application’s worker thread pool or connection queue is saturated, preventing new connections. Tuning thread pool and timeout settings can alleviate this.

Adding CPU (option C) may help long-term but is not the most direct fix. Memory (option A) is not the bottleneck. Replacing the proxy (option D) does not address the backend overload.

Full explanation →
153
Multi-Selectmedium

Which TWO of the following are considered best practices for securing a server's remote management access?

Select 2 answers
A.Use SSH key-based authentication
B.Enable default administrative shares
C.Allow all inbound ICMP
D.Disable unused services
E.Use telnet for remote CLI
AnswersA, D

SSH keys provide a more secure alternative to passwords, using cryptographic keys that are resistant to brute-force attacks.

Why this answer

Using SSH key-based authentication provides strong encryption and eliminates password theft risks. Disabling unused services reduces the attack surface. Enabling default administrative shares increases exposure.

Allowing all inbound ICMP can facilitate reconnaissance. Telnet sends data in plaintext and is insecure.

Full explanation →
154
MCQhard

A server has a RAID 5 array with four drives. One drive fails and is replaced. During the rebuild, a second drive reports a media error and the rebuild fails. What should the administrator do FIRST to minimize the risk of permanent data loss?

A.Run a consistency check on the array
B.Replace the drive that reported the media error immediately
C.Back up all critical data before any further rebuilding
D.Restart the RAID controller to reinitialize the rebuild
AnswerC

Data should be safeguarded first; once the backup is complete, troubleshooting can continue with reduced risk.

Why this answer

A media error on another drive during a RAID 5 rebuild indicates that drive may also be failing. If another drive fails completely, the entire array and its data will be lost. Therefore, the immediate priority is to back up critical data before any further rebuild action.

Replacing the drive or restarting the controller could trigger another rebuild, risking complete array loss. A consistency check does not address the urgency.

Full explanation →
155
MCQeasy

A company performs a full backup on Sunday and incremental backups Monday through Saturday. A server fails on Thursday at 10:00 AM. Which sequence correctly restores the data?

A.Restore Sunday full, then Tuesday and Wednesday incrementals.
B.Restore Sunday full and Wednesday incremental only.
C.Restore Wednesday's incremental, then Sunday full.
D.Restore Sunday full, then Monday, Tuesday, and Wednesday incrementals.
AnswerD

Correct sequence: full backup provides the base, and all subsequent incremental backups up to the last good point (Wednesday) must be applied in order.

Why this answer

Option C is correct because an incremental backup captures only changes since the last backup, requiring the last full backup and all subsequent incrementals up to the point of failure. Options A and D are wrong because they skip Monday’s incremental (A) or both Monday and Tuesday (D). Option B is wrong because it restores out of order, which would not apply the data correctly.

Full explanation →
156
PBQhard

A file server running Windows Server 2016 is critical for a department's daily operations. For the past two weeks, it has been crashing with a blue screen every 1–2 days. The IT team collects minidump files and opens the latest one in WinDbg. After running '!analyze -v', they obtain the following output: ``` DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. Arguments: Arg1: fffff80012345678, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000000, value 0 = read operation, 1 = write operation Arg4: fffff80abcde1234, address which referenced memory Debugging Details: ... PROCESS_NAME: fileserver.exe SYMBOL_NAME: NetAdapterCx.sys!NetAdapterCxSetLinkState+0x1234 IMAGE_NAME: NetAdapterCx.sys ... ``` The server has 64GB ECC RAM, two Intel Xeon processors, and a Broadcom NetXtreme quad-port 10GbE NIC. The NIC driver was updated from version 7.12.6 to 7.14.8 two weeks ago as part of patch management. The BSODs started occurring immediately after that driver update; prior to the update, the server had been stable for over six months. The driver was obtained from the server manufacturer's support site and installed without error. The administrator wants to restore stability with minimal downtime and risk. Which action should the administrator take FIRST?

A.Replace the Broadcom NIC with a different brand network adapter and disable the onboard NIC in the BIOS.
B.Boot into Safe Mode and roll back the network adapter driver to the previous version (7.12.6).
C.Reinstall Windows Server 2016 and restore data from backups to eliminate any corrupted system files.
D.Run Windows Memory Diagnostic overnight to check for hardware memory errors that might corrupt driver loading.
AnswerB

Why this answer

Option A is correct because the crash dump explicitly denotes NetAdapterCx.sys (the network driver framework) as the cause, and the problem started right after the driver was updated. Rolling back is the quickest and safest step to restore operational stability. Option B is wrong because an OS reinstall is extreme and unlikely to fix a driver-specific issue.

Option C is wrong because the dump identifies a driver, not a memory fault, and ECC memory typically reports errors before causing crashes. Option D is wrong because a hardware replacement is costly and unnecessary when a driver rollback is available.

Full explanation →
157
MCQmedium

A server configured with a RAID 5 array and a hot spare experiences intermittent crashes under heavy disk I/O. A technician suspects a failing drive. Which of the following should the technician do FIRST?

A.Initiate a manual failover to the hot spare.
B.Remove the suspected drive and rebuild the array.
C.Replace the hot spare with a new drive.
D.Run the array manufacturer's diagnostic utility.
AnswerD

This is the first step to confirm a drive failure and identify which drive is problematic.

Why this answer

Running the manufacturer's diagnostic utility (Option B) is correct because it provides a non-invasive method to verify the health of the drives without disrupting the array. Replacing the hot spare (Option A) is premature without confirmation. Removing a suspected drive (Option C) risks data loss if the array is already degraded.

Initiating a manual failover (Option D) is unnecessary if the drive has not actually failed.

Full explanation →
158
MCQmedium

Users report slow file server performance. The administrator suspects a single process is consuming excessive CPU and wants to analyse its threads and handles. Which tool should be used?

A.System Information
B.Task Manager
C.Resource Monitor
D.Performance Monitor
AnswerC

Resource Monitor offers detailed real-time metrics per process, including thread and handle counts, allowing precise identification of resource consumption.

Why this answer

Resource Monitor provides real-time, in-depth per-process data including CPU, memory, disk, network, and the ability to drill down into associated threads and handles. Task Manager shows basic per-process CPU but not thread-level details. Performance Monitor is for long-term logging.

System Information only gives static hardware/software inventory.

Full explanation →
159
PBQhard

A mid-sized e-commerce company experienced a ransomware attack that encrypted all on-premises servers and their locally attached backup storage. The attack occurred on a Friday evening; the company was closed over the weekend. By Monday morning, the IT team discovered the encryption and found a ransom note demanding $500,000 in Bitcoin. The company has a disaster recovery plan that calls for restoring from daily tape backups stored offsite. However, the most recent offsite tape was taken home by a backup operator for the weekend and has not been returned. The tape contains full backups from Wednesday. The IT team has clean installation media and application software available. The company's RPO is 24 hours, and RTO is 48 hours. Management wants to minimize data loss and avoid paying the ransom. Based on this scenario, which of the following should the IT team do to recover the business operations?

A.Pay the ransom to obtain the decryption key, then restore the environment, and implement better security controls.
B.Rebuild the servers from scratch using clean media, and manually re-enter transactions since the last good backup based on paper records and customer emails.
C.Wait for the backup operator to return the tape, then restore from that tape, accepting data loss since Wednesday.
D.Rebuild the servers from scratch using clean media, restore the latest offsite tape if available, and apply available transaction logs from the on-premises backup server that was encrypted (attempting to recover unencrypted logs).
AnswerD

Why this answer

Option A is correct because it follows the existing DR plan by restoring from the available offsite tape (even though a few days old) and builds clean servers to avoid reinfection. It also attempts to salvage any unencrypted transaction logs from the compromised environment to minimize data loss beyond Wednesday. Paying the ransom (Option B) is against best practices and may not guarantee full recovery.

Waiting for the operator to return the tape (Option C) delays action and may still result in significant data loss; the operator's return is uncertain. Manually re-entering transactions (Option D) is highly labor-intensive, error-prone, and could exceed the 48-hour RTO.

Full explanation →
160
PBQhard

A large financial services company must comply with federal regulations mandating quarterly disaster recovery tests. Their primary data center in New York hosts all trading applications, and a hot site in Chicago is maintained with real-time data replication via synchronous mirroring. During the last DR test, the IT team successfully failed over network and storage within 8 minutes, meeting the 15-minute RTO for connectivity. However, they encountered a major issue: the hot site's firewalls, intrusion detection systems, and application-level access controls were not configured to match the primary environment. The security team had to manually create firewall rules, update IDS signatures, and reconfigure access policies based on documentation, which took over 4 hours. As a result, the total system readiness exceeded 4.5 hours, causing a significant gap in trading operations. The regulatory auditor noted this deficiency and required a corrective action plan. The company must ensure that the next DR test achieves full operational readiness, including security controls, within the 15-minute RTO. The IT budget is already allocated for the current fiscal year, so large capital expenditures are not possible, but the team can leverage existing tools and automation. Which of the following is the BEST approach to address this issue?

A.Develop detailed runbooks for the security team to manually configure devices during failover; then conduct quarterly drills to reduce configuration time.
B.Re-evaluate the RTO to extend it to 4 hours and inform regulators of a realistic capability.
C.Replace the existing firewalls and IDS at the hot site with identical hardware from the same vendors as the primary site.
D.Implement a configuration management tool that automatically synchronizes firewall rules, IDS signatures, and access controls to the hot site in near real-time.
AnswerD

Why this answer

Option A is correct because implementing a configuration management or synchronization tool directly addresses the root cause—manual configuration—by automating the replication of security policies to the hot site in near real-time. This eliminates human error and delay, meeting the 15-minute RTO without requiring new hardware. Option B (detailed runbooks and drills) still relies on manual interaction, which is unlikely to achieve 15-minute readiness.

Option C merely lowers the standard instead of fixing the process and would likely be rejected by regulators. Option D (identical hardware) does not automatically transfer configurations; they would still need to be applied, so it does not solve the time problem.

Full explanation →
161
Multi-Selectmedium

A server experienced an unexpected power loss. After power is restored, the server boots successfully, but several critical services fail to start automatically. The administrator checks the system logs and finds errors indicating missing LUNs from a SAN. The SAN administrator confirms the SAN is online and the LUNs are assigned to the server's WWNs. The server uses FC HBAs. Which TWO steps should the administrator perform to diagnose the issue?

Select 2 answers
A.Rescan the SCSI bus on the server.
B.Check the FC switch zoning configuration.
C.Replace the FC HBAs.
D.Reboot the SAN controller.
E.Reinstall the multipathing driver.
AnswersA, B

A rescan will refresh the server's list of visible LUNs and may re-establish connections that were lost during the power cycle.

Why this answer

Options A and C are correct. After an unexpected power loss, the SAN topology or host's view of LUNs may be stale. Rescanning the SCSI bus forces the host to re-discover all accessible LUNs.

Checking FC switch zoning ensures that the path between the host and storage is still correctly allowed after the power event. Option B is unnecessary and disruptive, as the SAN is confirmed online. Option D is premature.

Option E is unrelated to sudden LUN disappearance after power restoration.

Full explanation →
162
MCQmedium

Refer to the exhibit. A web server is running on port 80, but users are unable to connect. The administrator has confirmed the web server service is running. The output of iptables -L is shown. What is the most likely reason for the connectivity issue?

A.The server's default gateway is incorrect
B.The firewall is blocking incoming traffic on port 80
C.SELinux is enforcing and blocking port 80
D.The web server is not bound to the correct IP address
AnswerB

The REJECT all rule at the end of the INPUT chain drops any packet not explicitly allowed, including HTTP requests to port 80.

Why this answer

The iptables rules accept only related/established traffic and drop SSH. The catch-all REJECT rule blocks all other incoming connections, including HTTP on port 80, because no explicit ACCEPT rule exists for it.

Full explanation →
163
PBQhard

A data center technician is troubleshooting a server that is overheating and shutting down intermittently. The server is a 2U rackmount with six fans at the front and a power supply with an integrated fan at the rear. The technician checks the ambient temperature (72°F) and verifies that the server intake temperature is normal. The server's system logs show 'CPU temperature threshold exceeded' before each shutdown. The technician has replaced the thermal paste on the CPU and reseated the heat sink, but the issue persists. Which of the following should the technician do NEXT?

A.Move the server to a cooler location in the data center
B.Reinstall the CPU heat sink with more thermal paste
C.Replace the chassis fans with high-static-pressure models
D.Replace the power supply unit
AnswerC

Why this answer

Option B is correct: the fans may be running but not at full speed due to a faulty fan controller or sensors. Option A is wrong because ambient temp is fine. Option C is wrong because CPU is already reseated.

Option D is wrong because power supply is not indicated.

Full explanation →
164
MCQeasy

A company wants to protect its Microsoft SQL Server database with a backup strategy that provides point-in-time recovery up to every 15 minutes. The database is critical and runs on a dedicated server. Which backup schedule should be implemented?

A.Use storage-level snapshots every 15 minutes on a SAN.
B.Full backup daily, differential backup hourly.
C.Full backup weekly, differential daily, transaction log backups every 15 minutes.
D.Set up database mirroring with automatic failover and full weekly backups.
AnswerC

Combining full, differential, and frequent transaction log backups allows restoration to any point in time down to the last log backup.

Why this answer

Option B (Full backup weekly, differential daily, transaction log backups every 15 minutes) is correct because full and differential backups provide a base, while frequent transaction log backups enable granular point-in-time restore. Option A lacks transaction log backups, so recovery granularity is limited to daily. Option C uses mirroring, which is high availability (not a backup) and does not protect against logical corruption.

Option D uses snapshot technology but snapshots alone are not a backup and may impact performance if taken every 15 minutes.

Full explanation →
165
PBQeasy

A small law firm has a single on-premises server running their case management software, email, and document storage. They perform a full backup each night at 11 PM to an external USB 4 TB drive, which is then stored on a shelf in the server room. The server room is located in the basement of their office building. Last week, an electrical fire started in the server room, completely destroying the server and the backup drive. The firm lost all data since the last backup, and it took two weeks to procure new hardware and restore from an older, off-site backup that was taken during a manual process three months ago. Their insurance company now requires a formal disaster recovery plan. The firm has a limited budget and minimal IT staff. They want to prevent data loss and minimize downtime in future disasters. What is the BEST course of action to improve their disaster recovery capabilities?

A.Subscribe to a cloud backup service that performs automatic daily backups to a remote data center.
B.Increase backup frequency to every hour and store the drive in a desk drawer in a different room on the same floor.
C.Purchase a fireproof safe for the server room and store the USB backup drive in it after each backup.
D.Install a second server on-site and configure real-time mirroring between the two servers.
AnswerA

Why this answer

Option B is correct because cloud backup automatically sends data to a remote location, satisfying the off-site requirement of the 3-2-1 backup rule, is cost-effective for a small firm, and requires little IT overhead. Option A is wrong because mirroring on-site still leaves them vulnerable to site-wide disasters like fire. Option C is wrong because a fireproof safe does not protect against all disaster types and keeps the backup on-site.

Option D is wrong because it still stores the backup on-site, increasing cost and management without solving the off-site need.

Full explanation →
166
PBQhard

A company is expanding its data center to support a new four-node database cluster for a critical application requiring 99.999% uptime, meaning only minutes of downtime per year. Each server node has dual 1000W power supplies. The facility provides two independent power feeds from separate utility substations, each backed by its own online double-conversion UPS. There are four 20A/208V PDUs available, two per power feed. The design must ensure that the loss of any single power feed, any single UPS, or any single PDU does not cause any server to lose power or impact the cluster's availability. The servers are located in a single rack, and cabling must follow best practices for manageability and airflow. The IT architect is evaluating different power distribution strategies to meet these fault-tolerance requirements. Which of the following configurations achieves full redundancy with no single point of failure in the power path?

A.Connect each server's power supplies to two PDUs that are both on the same power feed, and use the second feed only as a cold standby in case of a primary feed failure.
B.Connect the first power supply of each server to a PDU on power feed A and the second power supply to a PDU on power feed B.
C.Connect each server's power supplies to the same PDU, but distribute servers across the four PDUs for load balancing.
D.Use a single large PDU with dual inputs from both feeds and an automatic transfer switch, connecting all servers to that PDU.
AnswerB

Why this answer

Option D is correct because connecting each server's power supplies to two different PDUs that are on separate power feeds guarantees that if one feed, UPS, or PDU fails, the server continues to receive power from the remaining source. Option A does not protect against PDU failure. Option B exposes servers to a power feed failure.

Option C introduces a single PDU as a single point of failure.

Full explanation →
167
MCQhard

Refer to the exhibit. A technician is troubleshooting a server that is experiencing data corruption. What is the MOST likely cause?

A.Corrupted file system
B.Loose data cable
C.Failed hard disk drive
D.Faulty RAID controller
AnswerD

Correct. Event ID 11 with 'controller error' indicates a problem with the storage controller, which can cause data corruption.

Why this answer

Event ID 11 with a controller error typically indicates a faulty RAID controller or HBA, not a disk failure or cable issue.

Full explanation →
168
MCQeasy

To comply with company security policies, a server administrator must disable all unnecessary services on a newly deployed Windows Server 2019. The server will only act as a file server with no web hosting role. Which service should be disabled?

A.World Wide Web Publishing Service
B.DHCP Server service
C.Server service
D.DNS Server service
AnswerA

This is an IIS component; if web hosting is not needed, it should be disabled to reduce the attack surface.

Why this answer

Option C is correct because the World Wide Web Publishing Service (W3SVC) is part of IIS and is not required for a file server role. Leaving it running increases the attack surface. Option A (DNS Server) might be used if the server provides name resolution, but it is not mentioned.

Option B (DHCP Server) is also not specified as needed. Option D (Server service) is essential for file sharing and should not be disabled.

Full explanation →
169
MCQmedium

An organization's disaster recovery plan specifies an RPO of 4 hours. Their current backup schedule performs a full backup at midnight and incremental backups every 2 hours from 8:00 AM to 8:00 PM. A server failure occurs at 3:00 AM, and data created after 8:00 PM the previous day is permanently lost. Which of the following is the MOST likely reason?

A.The incremental backups were not synthetically rolled into the full backup.
B.The RPO was set too low for the business requirements.
C.There is a gap in the backup schedule overnight that exceeds the RPO.
D.The backup media became corrupted.
AnswerC

The schedule only covers 8:00 AM–8:00 PM with incrementals, leaving a long interval overnight where no backups capture data changes, violating the 4-hour RPO.

Why this answer

Option C is correct because the backup schedule has no coverage from 8:00 PM to 8:00 AM the next morning (except full at midnight), creating a 12-hour gap overnight that exceeds the 4-hour RPO. Data created after 8:00 PM and before the failure at 3:00 AM is lost because no backup captured it. Option A is incorrect because RPO is a requirement, not the cause.

Option B is speculative. Option D refers to synthetic fulls, which are not relevant to this gap.

Full explanation →
170
MCQhard

Refer to the exhibit. A server administrator is reviewing security logs after a suspected brute-force attack on the SSH service. The following excerpt from /var/log/secure is displayed. Which security control would have been MOST effective in preventing the successful login?

A.Disabling root login via SSH.
B.Implementing fail2ban or similar intrusion prevention.
C.Enforcing a strong password policy.
D.Using a different SSH port.
AnswerB

fail2ban tracks authentication failures and temporarily or permanently bans IPs that exceed the threshold, which would have blocked 192.168.1.100 after the initial failures, preventing the successful login.

Why this answer

Option B is correct because fail2ban or a similar intrusion prevention system monitors logs for repeated failures and blocks the attacker's IP address after a configurable number of attempts, stopping the attack before the correct password is guessed. Option A is wrong because a strong password policy might resist guessing for a long time, but the admin password was eventually guessed; it does not actively prevent repeated attempts. Option C is wrong because disabling root login would not have prevented the attack on the admin account, which was the one compromised.

Option D is wrong because changing the SSH port is security through obscurity and does not prevent brute-force attempts once the port is discovered.

Full explanation →
171
PBQhard

You are a server engineer for a financial services firm. The company recently deployed a new HP ProLiant DL380 Gen10 server running Windows Server 2022 with SQL Server 2019. The server has 2 Intel Xeon Gold processors, 128GB RAM, and a Smart Array P408i-p controller managing two RAID 1 arrays: one for OS (two 300GB 10K SAS) and one for data (four 600GB 10K SAS). After one month, the OS array reports a predictive failure on one drive. You replace the drive via hot-swap, and the RAID controller rebuilds. However, the server now experiences random system crashes with Event ID 1001 (BugCheck) and the SQL database occasionally becomes corrupt requiring restore from backup. The server's RAM has been tested with HP's diagnostic tool and passed, and the CPU temperature is normal. The RAID controller log shows no errors during the rebuild but occasional 'Parity errors' logged before the drive replacement. Which of the following is the MOST likely cause of the current instability?

A.The new replacement drive is faulty.
B.The motherboard has a faulty PCIe slot for the RAID controller.
C.The remaining original OS drive has bad sectors that were not detected.
D.The RAID controller cache module has failed.
AnswerC

Why this answer

Option C is correct because predictive failure on one drive may indicate that the entire mirrored pair has latent defects; the remaining original drive may have bad sectors that were not detected. The parity errors before replacement suggest data inconsistency, and after rebuild, the system relies on the remaining drive which can cause crashes and database corruption. Option A is wrong because the rebuild completed without errors, so the new drive is likely fine.

Option B is wrong because a failed cache module would cause general errors, not specific parity issues. Option D is wrong because a faulty PCIe slot would cause intermittent disconnects of the controller, not these symptoms.

Full explanation →
172
MCQeasy

A server fails to complete POST and emits a series of beeps: two long, three short. According to the manufacturer's documentation, this beep code indicates a memory error. The server has eight DIMMs installed. Which of the following steps should the technician perform FIRST?

A.Replace all memory modules.
B.Reseat all memory modules and attempt to boot.
C.Clear the CMOS battery.
D.Update the server's UEFI firmware.
AnswerB

Reseating corrects poor electrical contacts, which is the most common cause of transient memory errors signaled by POST beeps.

Why this answer

Option A is correct. Reseating memory modules is the least invasive and often the most effective first step for beep codes indicating memory errors, as poor connections from thermal expansion or vibration can cause such issues. Option B is excessive before attempting reseating.

Option C may reset BIOS settings but does not physically reseat RAM. Option D does not directly address the immediate memory detection failure.

Full explanation →
173
MCQmedium

A server's performance degrades significantly during peak usage hours. Monitoring shows high memory utilization and consistently high disk I/O. Which of the following should the technician check FIRST?

A.RAID controller battery status
B.Network bandwidth utilization
C.CPU utilization statistics
D.Page file location and configuration
AnswerD

When physical memory is overcommitted, the server pages to disk; poor page file placement can cause high I/O and slow performance.

Why this answer

Option B is correct because high memory usage and heavy disk I/O suggest excessive paging. Checking the page file location and its performance (e.g., on a slow disk) is the first step to diagnose paging bottlenecks. Option A is less likely if CPU is not a known issue.

Option C would typically cause different symptoms. Option D is unrelated to immediate memory/disk correlation.

Full explanation →
174
MCQeasy

An organization wants to test its disaster recovery plan with minimal disruption to business operations and minimal cost. The test should verify the plan's effectiveness by discussing scenarios. Which type of test should they perform?

A.Tabletop exercise
B.Parallel test
C.Full interruption test
D.Simulation test
AnswerA

A tabletop exercise is a walk-through discussion that incurs almost no direct cost and zero disruption, making it ideal for initial plan verification.

Why this answer

Option C is correct because a tabletop exercise is a discussion-based review of the plan steps with key stakeholders, requiring no system downtime and very low cost. A full interruption test (Option A) actually shuts down primary systems and fails over, causing disruption. A parallel test (Option B) runs systems at the DR site without cutting over but still involves significant resource allocation.

A simulation test (Option D) may involve live drills or emulate components, often costing more than a tabletop.

Full explanation →
175
Multi-Selecteasy

During a security incident, a server is suspected to be compromised by malware. The incident response team needs to preserve evidence and minimize impact. Which TWO actions should be taken FIRST? (Select TWO.)

Select 2 answers
A.Disconnect the server from the network.
B.Run an antivirus scan.
C.Reboot the server in safe mode.
D.Power off the server immediately.
E.Make a forensic image of the system memory.
AnswersA, E

Isolating the server from the network stops the attacker's remote access and prevents malware propagation while preserving the system state for investigation.

Why this answer

Options B and C are correct. Disconnecting the server from the network (B) is an immediate containment step to prevent data exfiltration or spread. Capturing a forensic image of system memory (C) preserves volatile data such as running processes, network connections, and encryption keys before they are lost.

Option A is wrong because powering off loses all volatile evidence. Option D is wrong because running an AV scan modifies files and could destroy forensic artifacts. Option E is wrong because rebooting erases memory and may trigger malware countermeasures.

Full explanation →
176
PBQmedium

A server administrator is assembling a new high-performance server using a Supermicro X12 motherboard, two Intel Xeon Gold 5317 processors (LGA 4189 socket), and 16x 32GB DDR4-3200 ECC LRDIMMs for a total of 512GB of memory. The chassis has redundant 1600W power supplies. After assembling all components, the administrator powers on the server. All fans start spinning at full speed, and the front panel LEDs illuminate. However, the server does not POST, there are no beep codes, and no video output is displayed. The motherboard has a two-digit hexadecimal POST code LED display, which shows '00' and does not change. The motherboard manual states that code '00' indicates the CPU is not detected or has failed. The processors are confirmed to be the correct socket type and stepping as required by the motherboard. What should the technician do FIRST?

A.Reseat both processors and inspect the CPU sockets for bent pins
B.Replace both processors as they are likely faulty
C.Clear the CMOS using the jumper or button on the motherboard
D.Update the BIOS to the latest version using the IPMI interface
AnswerA

Why this answer

Option B is correct. The POST code '00' typically indicates a CPU initialization failure. The first and least invasive step is to reseat the processors, checking for bent socket pins, debris, or improper mounting.

This resolves a majority of such issues. Option A (replace both CPUs) is extreme and should only be done after ruling out physical installation issues. Option C (clear CMOS) may help if the BIOS was misconfigured for a previous CPU, but physical reseating is more direct.

Option D (update BIOS) is not possible if the system cannot POST to enter the update utility; furthermore, if the CPUs are supported by the current BIOS version, updating is unnecessary.

Full explanation →
177
MCQhard

Refer to the exhibit. A Linux server started reporting I/O errors to its local disk. The administrator runs `dmesg` and sees the output shown. Which of the following is the MOST likely cause of the errors?

A.The disk has a bad sector that cannot be remapped.
B.The filesystem on /dev/sda is corrupted.
C.The SCSI cable is loose.
D.The RAID controller firmware is outdated.
AnswerA

The Sense Key 'Medium Error' and additional sense 'auto reallocate failed' explicitly indicate an unreadable sector that the drive's internal remapping could not fix.

Why this answer

Option B is correct. The 'Medium Error' sense key along with 'Unrecovered read error - auto reallocate failed' indicates a physical bad sector that the drive could not reallocate. Option A would typically produce a different hostbyte (e.g., DID_NO_CONNECT).

Option C, outdated firmware, rarely causes medium errors. Option D, filesystem corruption, would manifest as filesystem-level errors, not SCSI sense codes.

Full explanation →
178
Multi-Selectmedium

A company is creating a disaster recovery plan for its on-premises data center. Which THREE elements are essential to include in the DR plan? (Select THREE.)

Select 3 answers
A.Contact information for key personnel.
B.RTO and RPO for each critical system.
C.Detailed instructions for cleaning server hardware.
D.Step-by-step procedures for performing backups.
E.List of failover site addresses and access procedures.
AnswersA, B, E

During a disaster, communication is vital; the plan must include up-to-date contact details for the response team, stakeholders, and vendors.

Why this answer

Options A, C, and E are correct. Contact information for key personnel (A) ensures that the recovery team can be reached during a crisis. RTO and RPO for each critical system (C) define the recovery goals and guide the technical implementation.

The list of failover site addresses and access procedures (E) provides vital instructions for reaching and securing the secondary location. Option B is wrong because cleaning procedures are operational but not a core DR plan element. Option D is wrong because backup procedures are part of the backup policy, not the disaster recovery plan; the DR plan assumes backups exist and focuses on restoring from them.

Full explanation →
179
Multi-Selectmedium

A SQL Server database administrator wants to backup a large database (500 GB) with minimal impact on transaction log growth and recovery time. Which TWO backup strategies should the administrator implement? (Choose two.)

Select 2 answers
A.Perform a tail-log backup before each full backup
B.Perform weekly full backups
C.Perform transaction log backups every 15 minutes
D.Perform daily differential backups
E.Perform hourly copy-only backups
AnswersB, C

Full backups provide a complete copy of the database and are required as a base for differential and log backups.

Why this answer

Options A and D are correct. A: A full backup copies the entire database, and is needed as a base. D: Transaction log backups control log growth and allow point-in-time recovery.

Option B is wrong because differential backups depend on a recent full backup. Option C is wrong because copy-only backups do not affect the log sequence, but they don't control log growth. Option E is wrong because tail-log backups are taken just before disaster recovery, not regularly.

Full explanation →
180
MCQmedium

A technician is installing a new 2U server into an existing rack. The rack is fully populated with servers that use front-to-back airflow. The new server also uses front-to-back cooling. The technician notices gaps between some servers and several open rack units without equipment. To ensure optimal airflow and prevent potential thermal issues, which of the following actions should the technician take FIRST?

A.Install additional exhaust fans at the rear of the rack to pull hot air out.
B.Increase the fan speed of the new server to compensate for recirculated air.
C.Leave the gaps to allow passive air movement and reduce pressure.
D.Install blanking panels in all unused rack spaces.
AnswerD

Blanking panels are an industry best practice for preventing air recirculation in racks, directly addressing the issue of open spaces disrupting the designed airflow path.

Why this answer

Option A is correct because installing blanking panels in unused rack spaces prevents hot air from recirculating to server intakes, maintaining proper cooling airflow. Option B is wrong because increasing fan speed only treats the symptom and wastes energy without solving recirculation. Option C is wrong because leaving gaps disrupts the designed front-to-back airflow, allowing hot air to mix with cold intake air.

Option D is wrong because adding exhaust fans may interfere with the existing airflow pattern and does not directly address recirculation caused by gaps.

Full explanation →
181
MCQmedium

After an unexpected power outage, a server fails to boot and displays an error indicating a degraded RAID array. The server has a RAID 5 configuration with four disks. One disk has failed, but the hot spare did not automatically rebuild. The administrator needs to restore data availability as quickly as possible. Which action should the technician take FIRST?

A.Replace the failed disk and initiate a manual rebuild.
B.Restore the server from the latest backup.
C.Check the RAID controller battery and cache.
D.Replace the hot spare with a new disk.
AnswerA

The failed disk is the root cause of degradation. Replacing it provides a healthy member for the array, and a manual rebuild can be forced to restore redundancy quickly.

Why this answer

Option A is correct because replacing the failed disk and initiating a manual rebuild directly restores redundancy and availability using the existing parity data. Option B is wrong because the hot spare is not faulty; the rebuild did not trigger automatically, likely due to a configuration issue, and swapping it does not address the failed disk. Option C is wrong because while a bad battery or cache can cause rebuild failures, checking this is a later step; the immediate need is to replace the failed disk to restore redundancy.

Option D is wrong because a backup restore is a last resort and may result in data loss; the array is degraded but still functional, so rebuilding is faster and less disruptive.

Full explanation →
182
MCQhard

Refer to the exhibit. A Linux server is reporting slow I/O on the root filesystem. Which of the following actions should the administrator take to resolve the immediate storage bottleneck?

A.Move non-essential data from / to /backup.
B.Delete log files in /var/log.
C.Resize /dev/sda1 to 30G.
D.Change the RAID level of /dev/sda.
AnswerA

Offloading data to a volume with free space immediately reduces utilization on /, resolving the bottleneck without downtime.

Why this answer

Option B is correct because moving non-essential data from the nearly full root filesystem to /backup (which has ample space) quickly alleviates the space shortage and I/O pressure. Option A is wrong because resizing /dev/sda1 may require downtime and complex partitioning operations; it is not an immediate fix. Option C is wrong because deleting log files may free some space but might also delete valuable diagnostic data and may not be sufficient.

Option D is wrong because changing the RAID level of /dev/sda is a fundamental hardware change that does not address the immediate space issue and could be destructive.

Full explanation →
183
MCQeasy

A technician is installing a new server in a data center. To prevent electrostatic discharge (ESD) damage, which of the following should the technician do FIRST?

A.Place an anti-static mat on the floor
B.Spray anti-static solution on the server rack
C.Wear rubber-soled shoes
D.Attach an ESD wrist strap to a grounded surface
AnswerD

An ESD wrist strap connected to a grounded surface provides a safe path for static discharge, protecting sensitive components.

Why this answer

Option C is correct because using an ESD wrist strap connected to a grounded surface is the primary method to prevent ESD damage. Option A is wrong because wearing rubber-soled shoes alone does not provide a path to ground. Option B is wrong because an anti-static mat must be used with a ground connection.

Option D is wrong because spraying anti-static spray on the floor is not a standard ESD prevention method and may create a slip hazard.

Full explanation →
184
PBQhard

A company has a small virtualized environment with two ESXi 7.0 hosts (HostA and HostB) managed by vCenter Server. They use a shared iSCSI storage array for all VMs. The network consists of a single physical switch that connects the hosts, storage, and management traffic using VLANs. Yesterday, the switch failed and was replaced with an identical model. After restoring the configuration from a backup, all VMs on HostA are working normally, but all VMs on HostB show 'network disconnected' in the vSphere console. The VMs on HostB are still running, but they cannot communicate with any other device on the network. HostB itself is reachable via its management IP and can access the storage array. The administrator has verified that the physical cables are correct and the NICs are up on HostB. The VLAN configuration on the new switch was restored for the ports connecting HostB, but the issue persists. Which of the following actions should the administrator perform FIRST to restore connectivity?

A.Reboot HostB to renegotiate the network configuration.
B.Restart the vCenter Server service on the vCenter appliance.
C.vMotion all affected VMs from HostB to HostA to confirm they work on HostA.
D.Check the VLAN configuration on the switch ports connected to HostB for the VM network uplinks.
AnswerD

Why this answer

Option B is correct. Since all other functions (management, storage) work and only VM traffic is affected, the most likely cause is incorrect VLAN tagging on the switch port carrying the VM traffic uplink. Restoring a switch config may have missed the exact VLAN trunk settings.

Checking and correcting the VLAN configuration on the switch ports for HostB's VM network is the first targeted step. Options A and C are nondisruptive but don't address the immediate config issue. Option D involves rebooting the host without diagnosing, which is risky and may not fix the issue.

Full explanation →
185
MCQmedium

A server has four memory slots on two channels (A and B). Currently, DIMM_A1 and DIMM_A2 are populated with 8 GB DDR4-2666 modules each. To maximize performance and capacity, which memory configuration should be added?

A.Add two 8 GB DDR4-2400 modules to channel B
B.Add one 8 GB DDR4-2666 module to DIMM_B1
C.Add one 16 GB DDR4-2666 module to DIMM_B1
D.Add two 8 GB DDR4-2666 modules to DIMM_B1 and DIMM_B2
AnswerD

Correct. Matching capacity and speed on both channels enables dual-channel mode, maximizing bandwidth and increasing capacity to 32 GB.

Why this answer

To achieve dual-channel performance, populate both slots on channel B with identical modules. Adding two 8 GB modules to channel B will enable dual-channel operation and increase capacity to 32 GB symmetrically.

Full explanation →
Page 2

Page 3 of 3

All pages

123

Practice SK0-005 by domain

Target a specific domain to shore up weak areas.

server-hardware-installation-managementserver-administrationsecurity-disaster-recoverytroubleshooting
See all domains with question counts →