Knowledge + Practice

CompTIA Server+ SK0-005 (SK0-005) — Questions 301–375

414 questions total · 6 pages · All types, answers revealed

Take a mock exam Exam hub

Page 5 of 6

301

MCQeasy

A server administrator is troubleshooting a Windows Server 2022 that cannot connect to a remote iSCSI target. The server has two network adapters: one for LAN traffic and one dedicated to iSCSI. The administrator verifies that the iSCSI adapter has a valid IP address, can ping the target, and that the iSCSI service is running. However, the iSCSI initiator shows the target as unavailable. Which action should the administrator take next?

A.Reinstall the iSCSI initiator driver on the server.

B.Check the Windows Firewall inbound rules for iSCSI traffic on the server.

C.Verify that the target's access control list includes the initiator's IQN.

D.Change the iSCSI adapter's IP address to be on the same subnet as the LAN adapter.

AnswerC

In iSCSI, the target often restricts access based on the initiator's IQN. If the IQN is not in the target's ACL, the target will be discovered but marked unavailable. Since IP connectivity and the service are confirmed, the next logical step is to verify that the initiator's IQN is authorized on the target. This is a common oversight when setting up iSCSI access.

Why this answer

The target is discovered but unavailable, while IP connectivity and the iSCSI service are confirmed. This points to an access control issue, such as the initiator IQN not being in the target's ACL. Verifying and adding the IQN to the target's allowed list is the correct next step.

Firewall, driver reinstallation, and IP changes are either less likely or inappropriate given the symptoms.

Exam trap

The trap here is assuming a network or driver problem when the target is reachable but access is denied by IQN-based ACLs.

Full explanation →

302

MCQhard

A Linux database server has recently exhibited sluggish response times. An analysis of system performance shows high CPU wait I/O, frequent page swapping, and a low cache hit ratio. The server has 16GB of RAM, and the database itself stores 100GB of active data. Which of the following is the MOST effective long-term solution to improve performance?

A.Increase the physical RAM in the server to at least 64GB.

B.Tune the database engine's query cache size.

C.Configure the server to use a larger swap partition.

D.Replace the existing hard drives with faster SSDs.

AnswerA

More RAM reduces swapping and allows caching of a larger working set, directly addressing the high I/O wait and low cache hit ratio.

Why this answer

Option C (Increase physical RAM to 64GB) is correct because the server is experiencing memory pressure leading to excessive swapping and low cache utilization. More RAM allows the database to cache a larger portion of active data in memory, reducing I/O wait and improving response times. Option A (Add faster SSDs) may reduce I/O wait but does not address the root cause—memory starvation.

Option B (Tune the database query cache) might provide minor relief but is not a substitute for adequate memory. Option D (Increase swap space) would worsen performance by enabling more swapping.

Full explanation →

303

PBQmedium

A medium-sized business runs a critical internal application on a single physical server running Windows Server 2019. The application is memory-intensive, often using up to 24 GB out of 32 GB RAM during peak hours. Over the past week, the server has experienced three unexpected reboots, each occurring during peak load. The server is not part of a cluster, and all data is stored on local disks. You have checked the Windows System event log and found Event ID 41 (Kernel-Power) indicating an unexpected shutdown. There are no related critical errors in the Application log. You have also reviewed the server's firmware logs and found multiple corrected memory errors (ECC) over the last month, with an increase in frequency just before each crash. The server is under warranty, and the hardware vendor's diagnostic tools report a failing memory module in DIMM slot A1. The vendor has recommended replacing the faulty DIMM immediately. However, the server is currently processing critical end-of-quarter financial reports that cannot be interrupted for at least 6 hours. Which of the following is the BEST course of action to minimize risk of data loss and downtime until a planned maintenance window?

A.Use Windows Memory Diagnostic tool to try to isolate the memory region and prevent the application from using it.

B.Continue running the server as is, as ECC memory can correct errors and the server will only crash if errors are uncorrectable; the risk is low.

C.Immediately shut down the server, replace the faulty DIMM, and restart.

D.Inform management of the criticality, request emergency approval for immediate maintenance, and if denied, ensure current backups are verified and monitor the server closely for any signs of degradation until the maintenance window.

AnswerD

Why this answer

Option D is correct because it follows proper change management: informing stakeholders, seeking emergency approval if needed, and mitigating risk by verifying backups and monitoring. Option A is wrong because immediately shutting down would interrupt critical processing and potential data loss, without management approval. Option B is wrong because Windows Memory Diagnostic is a boot-time tool and cannot effectively isolate memory regions to avoid crashes on a running production system.

Option C is wrong because the server has already crashed, indicating uncorrectable errors; continuing without action risks data corruption and further unplanned outages.

Full explanation →

304

MCQmedium

A server displays a 'CMOS battery low' error during POST. After the technician replaces the CR2032 battery with a new one, the server still loses date and time settings when disconnected from power. Which of the following should the technician try NEXT?

A.Check the power supply for voltage fluctuations

B.Update the BIOS firmware

C.Replace the motherboard

D.Verify the new battery is functional and properly seated

AnswerD

A 'dead on arrival' battery or poor contact is a common cause. Checking with a multimeter or trying another new battery is the logical next step.

Why this answer

Option A is correct because it is possible the new battery is defective, installed incorrectly, or not making proper contact. The first step is to verify the battery itself and its installation. Option B is wrong because a faulty motherboard is possible, but troubleshooting should start with the simplest and most likely cause.

Option C is wrong because power supply fluctuations are unlikely to cause CMOS settings loss specifically when unplugged. Option D is wrong because the BIOS chip retaining settings is part of the CMOS circuit, but the immediate issue is likely the power source (battery) for the CMOS.

Full explanation →

305

MCQmedium

A server administrator notices that a production file server intermittently loses network connectivity for a few seconds, and users report dropped SMB sessions. The switch port shows no errors, and the server's NIC link LED stays solid. The administrator suspects a duplex mismatch. Which tool should the administrator use to verify the NIC's current speed and duplex settings on a Linux server?

A.netstat -i

B.ethtool

C.ip addr show

D.tcpdump

AnswerB

ethtool queries and configures NIC driver and hardware settings, including reported speed, duplex, and link state. Running ethtool <interface> shows the negotiated duplex; if it reports half-duplex while the switch port is full-duplex, that confirms the mismatch causing intermittent drops without link loss. It is the standard Linux utility for this exact diagnostic scenario.

Why this answer

A duplex mismatch occurs when one side of a link is set to full-duplex and the other to half-duplex, leading to collisions, dropped packets, and intermittent connectivity without a complete link loss. The NIC's link LED remains solid because the physical link is up. The ethtool utility directly reports the negotiated duplex and speed, allowing the administrator to confirm whether the server NIC is operating at half-duplex while the switch port is full-duplex.

Other tools show symptoms or unrelated configuration but not the duplex setting itself.

Exam trap

The trap here is assuming that a solid link LED and lack of switch port errors rule out a physical-layer duplex mismatch, when in fact a mismatch can cause intermittent performance issues without bringing the link down.

Full explanation →

306

Multi-Selecthard

A server administrator is configuring a new server that will host a high-traffic web application. The administrator needs to optimize the server's network performance. Which TWO of the following should be implemented? (Choose two.)

Select 2 answers

A.Configure NIC teaming for redundancy and load balancing.

B.Assign a static IP address to the server.

C.Disable TCP offloading on the network adapter.

D.Set the network adapter to half-duplex mode.

E.Enable jumbo frames on the network adapter and switch.

AnswersA, E

NIC teaming combines multiple network adapters into a single logical interface, providing fault tolerance and increased throughput. For a high-traffic web application, this improves availability and can distribute network load, enhancing performance. It requires switch support for the chosen teaming mode, such as LACP.

Why this answer

Enabling jumbo frames and configuring NIC teaming are direct performance optimizations for a high-traffic web server. Jumbo frames reduce overhead for large transfers, while NIC teaming provides redundancy and load balancing. The other options either degrade performance or do not directly enhance it.

These two together can significantly improve network throughput and reliability.

Exam trap

The trap here is assuming that disabling TCP offloading improves performance, when it actually increases CPU load and can reduce throughput.

Full explanation →

307

MCQmedium

A company's backup policy sends nightly backups to a tape library in the same building as the production servers. A recent fire destroyed the server room, and the tapes were damaged by heat and water. Which change BEST addresses this single point of failure?

A.Ship a copy of each backup to an offsite location or replicate it to cloud storage outside the building.

B.Increase the backup frequency to every four hours so less data is lost between jobs.

C.Replicate the tape library to a second array in the same server room so backups exist on two media types.

D.Add parity to the tape library so a damaged tape can be reconstructed from the remaining tapes.

AnswerA

Maintaining a geographically separate copy removes the single point of failure because a fire or flood at the primary site cannot destroy the offsite media. This aligns with the long-standing practice of keeping backups at a distance, and it directly addresses the loss of both production and backup data in one event. It preserves the existing backup schedule while adding survivability.

Why this answer

The incident destroyed production and backup copies together because both lived in the same room. The most effective change is to keep at least one copy geographically separate, either by shipping tapes offsite or replicating to cloud storage. More frequent backups, a second in-room library, and tape parity all leave the site-level single point of failure intact.

Exam trap

The trap here is focusing on backup frequency or media redundancy when the actual failure was that production and backups shared one physical location.

Full explanation →

308

MCQhard

A server administrator is troubleshooting a newly installed 4U storage server whose fans run at maximum speed continuously even though inlet temperatures read normal. The chassis uses a passive backplane with eight high-capacity 3.5-inch drives, and the administrator recently replaced three drives with higher-RPM models. Which of the following is the MOST likely cause?

A.The server's ambient humidity is too low, causing static buildup that interferes with fan control signals

B.The higher-RPM drives generate more heat, and the BMC is ramping fans to protect them based on drive temperature sensors

C.The fan profile was reset to a performance curve during a recent firmware update and must be returned to optimal

D.The passive backplane is failing and reporting false temperature readings to the BMC

AnswerB

This is correct because higher-RPM drives dissipate more heat, and intelligent platforms monitor per-drive temperatures through the backplane and raise fan speed to keep them within limits. Normal inlet temperature does not mean drive temperatures are normal; the BMC acts on the hottest sensor in the airflow path, so a few hotter drives can drive fans to maximum even when ambient looks fine.

Why this answer

Higher-RPM drives run hotter, and the baseboard management controller raises fan speed based on the hottest monitored sensor, including per-drive temperatures reported through the backplane. Normal inlet readings do not rule this out. Firmware profile drift, a failing backplane, or humidity effects do not fit the timing or mechanism as well as the direct thermal consequence of the drive upgrade.

Exam trap

The trap here is trusting the normal inlet temperature reading and overlooking that the BMC responds to the hottest drive sensor, not ambient air.

Full explanation →

309

MCQmedium

A server administrator is troubleshooting a Windows Server 2019 system that reports a stop error (blue screen) with the code CRITICAL_PROCESS_DIED. The server reboots automatically and then works normally for a few hours before the error recurs. The administrator has already updated all drivers and installed the latest Windows updates. Which action should the administrator take next to gather more detailed diagnostic information about the crashes?

A.Run the System File Checker (sfc /scannow) to repair corrupted system files.

B.Configure the system to write a kernel memory dump and analyze it with Windows Debugging Tools.

C.Enable boot logging and restart the server in Safe Mode.

D.Use Performance Monitor to log memory and CPU usage over time.

AnswerB

A kernel memory dump captures the state of the kernel at the time of the crash, including the stack trace and loaded drivers. Analyzing it with WinDbg or the Windows Debugging Tools can reveal the specific driver or component that caused the CRITICAL_PROCESS_DIED stop error. Since basic updates did not resolve the issue, deeper analysis is the logical next step.

Why this answer

When a Windows server experiences recurring stop errors despite driver and OS updates, the administrator needs to capture and analyze a memory dump. The kernel memory dump contains the state of the kernel at the crash, including the call stack and loaded modules. Using Windows Debugging Tools (WinDbg) with the appropriate symbols allows the administrator to pinpoint the failing driver or process.

Other options either do not capture crash-time state or address different problem classes.

Exam trap

The trap here is assuming that updating drivers and OS patches resolves all stop errors, but CRITICAL_PROCESS_DIED often requires dump analysis to identify the specific third-party driver or process at fault.

Full explanation →

310

Multi-Selectmedium

A technician is preparing to add four new hot-swap SAS drives to a running server that uses a hardware RAID controller. Before inserting the drives, which of the following actions should the technician take? (Choose two.)

Select 2 answers

A.Set each new drive's SAS address to match the controller's expected value

B.Confirm the drives are on the RAID controller's compatibility list

C.Verify the drive bays are not part of an existing array before insertion

D.Install the drives while the server is powered off to avoid damaging the backplane

E.Update the RAID controller firmware to the latest release immediately before insertion

AnswersB, C

Hardware RAID controllers validate drive model, firmware, and sometimes OEM branding before allowing a drive to join an array. An unsupported drive may be rejected, drop out of the array, or operate without proper error reporting, so verifying compatibility before insertion prevents a failed rebuild or a degraded virtual disk in production.

Why this answer

Before adding hot-swap drives, the technician must confirm the drives are supported by the RAID controller and that the chosen bays are free of existing array membership. Compatibility prevents rejection or dropout, and confirming empty bays prevents an accidental rebuild that would overwrite the newly inserted drive.

Exam trap

The trap here is treating hot-swap drives as plug-and-play with no prerequisites, when controller compatibility and bay membership must be checked first.

Full explanation →

311

MCQeasy

A server administrator is troubleshooting a server that is unable to connect to the network. The administrator checks the NIC and sees that the link light is off. Which of the following is the FIRST thing the administrator should check?

A.The firewall rules on the server.

B.The IP address configuration on the server.

C.The DNS server settings on the server.

D.The network cable connection at both the server and the switch.

AnswerD

A missing link light typically indicates a physical layer issue. The most common cause is a disconnected or faulty cable. Checking both ends of the cable ensures it is securely plugged in and the switch port is active. This is a quick, non-intrusive step that often resolves the problem. If the cable is fine, then move to other possibilities.

Why this answer

When a NIC link light is off, the problem is at the physical layer. The first step is to verify the cable is properly connected to both the server and the switch, and that the switch port is enabled. This simple check resolves many connectivity issues.

Only after confirming physical connectivity should the administrator investigate IP, DNS, or firewall configurations.

Exam trap

The trap here is jumping to logical configuration like IP or DNS when the link light indicates a physical connection problem.

Full explanation →

312

PBQhard

Your organization is migrating a Windows Server 2019 file server with 2 TB of shared data to a new server running Windows Server 2022. The migration must minimize user downtime and ensure file permissions are preserved. Users access files during business hours (8 AM to 6 PM) and the migration must be completed within a four-hour window starting at 10 PM on Saturday. You plan to use DFS Replication (DFSR) for initial data copy and then perform a final synchronization during the cutover. After setting up DFSR between the old and new servers, you realize that the initial replication will take approximately 12 hours due to the large number of files. What should you do to complete the migration within the allowed window?

A.Use robocopy to pre-stage the data from old to new server during off-hours before the cutover, then enable DFSR to replicate only changes made after pre-staging; during the cutover window, do a final DFSR sync

B.Disable DFSR and use robocopy with /MIR /COPYALL during the cutover window to copy all data

C.Perform a full backup of the old server and restore to the new server during the cutover window using Windows Backup

D.Increase the DFSR staging quota and bandwidth throttling to accelerate initial replication

AnswerA

Why this answer

Pre-staging with robocopy during off-hours moves the bulk of the 2 TB before the cutover window, so DFSR only has to replicate the delta of changes made after pre-staging. This shrinks the initial replication from ~12 hours to a manageable delta, allowing the final DFSR sync to complete inside the four-hour cutover window while preserving NTFS permissions and minimizing user downtime.

Exam trap

The trap is assuming DFSR can be 'tuned' to go faster (option D) or that a straight robocopy/backup-restore can fit in the window (options B and C) — candidates forget that DFSR's initial replication is per-file overhead-bound, not bandwidth-bound, and that pre-staging is the standard workaround.

How to eliminate wrong answers

Option B is wrong because a full robocopy /MIR /COPYALL of 2 TB cannot complete in a four-hour window (that would require ~140 MB/s sustained plus metadata overhead), and it would also cause downtime since users must be locked out during the copy. Option C is wrong because a full backup-and-restore of 2 TB during the cutover window has the same time problem and is even slower than robocopy, plus it does not provide an incremental delta mechanism. Option D is wrong because increasing the DFSR staging quota only prevents staging errors — it does not speed up replication — and bandwidth throttling actually limits throughput, so raising it would slow replication further, not accelerate it.

Full explanation →

313

Multi-Selectmedium

A technician is preparing to install a new server into a rack. The server will host a critical application and requires high availability. The technician needs to ensure that the server's power configuration supports redundancy. Which of the following should the technician do? (Choose two.)

Select 2 answers

A.Connect one power supply to a UPS and the other directly to a wall outlet.

B.Connect each power supply to a different UPS.

C.Connect each power supply to a different PDU.

D.Connect both power supplies to the same UPS but different outlets.

E.Connect both power supplies to the same PDU but different circuits.

AnswersB, C

Connecting each power supply to a different Uninterruptible Power Supply (UPS) provides redundancy against UPS failure and allows for maintenance on one UPS without shutting down the server. This ensures continuous power even if one UPS fails or needs to be taken offline. It is a recommended practice for critical servers requiring high availability.

Why this answer

To ensure power redundancy for a high-availability server, each power supply should be connected to a different PDU and a different UPS. This eliminates single points of failure in the power distribution path. Connecting both PSUs to the same PDU or UPS, even on different circuits or outlets, still leaves a single point of failure that could bring down the server.

Exam trap

The trap here is believing that using different circuits on the same PDU or different outlets on the same UPS provides redundancy, when the PDU or UPS itself remains a single point of failure.

Full explanation →

314

MCQhard

A server administrator is troubleshooting a Windows Server 2019 host that runs a line-of-business application. Users report the application is extremely slow during business hours, but performance is normal at night. Performance Monitor shows high 'Avg. Disk sec/Read' on the data volume and a disk queue length consistently above 2. The volume is a single NTFS partition on a RAID 5 array of 7.2K RPM SATA drives. Which of the following is the MOST likely cause of the slow performance?

A.A network bottleneck is delaying storage I/O to the application.

B.The disk subsystem is experiencing an I/O bottleneck due to insufficient IOPS for the workload.

C.The RAID 5 array has a failed drive and is running in degraded mode.

D.The server's memory is insufficient and causing excessive paging to disk.

AnswerB

High 'Avg. Disk sec/Read' and a sustained queue length above 2 indicate the disks cannot keep up with demand. A RAID 5 array of 7.2K RPM SATA drives has limited random IOPS, and the write penalty of RAID 5 worsens under load. The slowdown only during business hours confirms the bottleneck appears when concurrent user activity peaks. Adding spindles, changing RAID level, or moving to SSD storage would address the root cause.

Why this answer

The performance counters show the disk subsystem is saturated: high read latency and a queue length above 2 mean requests are waiting. A RAID 5 array of 7.2K RPM SATA drives provides limited random IOPS, and the business-hours-only pattern matches peak user load. The correct remedy is to increase disk performance, such as adding spindles or moving to faster media.

Exam trap

The trap here is blaming a failed drive or memory pressure when the counters specifically isolate a storage throughput limit under peak load.

Full explanation →

315

MCQmedium

A server administrator is replacing a failed hard drive in a RAID 1 array on a production server. The server supports hot-swap drives. The administrator removes the failed drive and inserts a new drive of the same model and capacity. Which of the following should the administrator do NEXT to ensure the array is rebuilt correctly?

A.Verify that the RAID controller automatically starts the rebuild process.

B.Manually initialize the new drive using the operating system's disk management.

C.Reboot the server to force the RAID controller to recognize the new drive.

D.Assign the new drive as a global hot spare to trigger the rebuild.

AnswerA

In most hardware RAID controllers, when a failed drive in a RAID 1 array is replaced with a new drive, the controller automatically begins rebuilding the array onto the new drive. The administrator should verify this through the RAID management interface. If the rebuild does not start automatically, it may need to be initiated manually. This is the correct next step to ensure data redundancy is restored.

Why this answer

After replacing a failed drive in a RAID 1 array with a hot-swap drive, the RAID controller typically starts rebuilding the array automatically. The administrator should verify the rebuild status via the RAID management utility. If it does not start, manual intervention may be required.

Rebooting or initializing the drive via the OS is unnecessary and can cause issues.

Exam trap

The trap here is assuming that the operating system needs to initialize the new drive, but in hardware RAID, the controller handles the rebuild independently of the OS.

Full explanation →

316

MCQeasy

A server administrator is configuring a new file server that will store sensitive financial documents. The security policy requires that data be encrypted at rest and that the encryption keys be protected by the server's TPM. Which of the following should the administrator implement?

A.NTFS permissions

B.BitLocker Drive Encryption

C.IPsec transport mode

D.SMB signing

AnswerB

BitLocker is a full-disk encryption feature that can use a TPM to protect the encryption keys. It encrypts the entire volume, satisfying the at-rest encryption requirement, and integrates with TPM for key protection. This is the correct choice for Windows Server environments needing volume-level encryption tied to hardware.

Why this answer

The policy requires encryption at rest with keys protected by TPM. BitLocker provides full volume encryption and can seal keys to the TPM, ensuring the drive contents are inaccessible without proper authentication. IPsec, SMB signing, and NTFS permissions address network security or access control but do not encrypt data on the disk.

Exam trap

The trap here is confusing access control or transit encryption with at-rest encryption, which specifically requires encrypting the data on the storage media.

Full explanation →

317

MCQhard

A network administrator needs to configure centralized authentication for network devices. The solution must provide encryption of the entire authentication process, support for multiple protocols, and accounting of user actions. Which protocol should be used?

A.TACACS+

B.Kerberos

C.RADIUS

D.LDAP

AnswerA

TACACS+ encrypts the entire body of the packet, supports multiple protocols, and provides detailed accounting, fitting the requirements.

Why this answer

TACACS+ encrypts the entire authentication process, offers granular control over authorization, and supports accounting. RADIUS (B) only encrypts the password, not the entire session. LDAP (A) is a directory service, not an encryption-focused authentication protocol.

Kerberos (C) uses tickets and encryption but is primarily for single sign-on within a domain, not commonly used for network device administration.

Full explanation →

318

MCQmedium

A technician is installing a used 2U rack server that was pulled from another rack. The server's rail kit is rated for a maximum load of 35 kg, and the chassis weighs 32 kg with no drives installed. Before sliding the chassis onto the rails, which of the following should the technician do FIRST?

A.Mount the chassis on the rails alone first, then add the drives afterward to keep the initial lift weight low.

B.Remove the server's top cover to reduce weight and improve grip while sliding the chassis onto the rails.

C.Install all drives and PCIe cards into the chassis to reach final operating weight before mounting.

D.Verify the rail kit's load rating against the fully populated chassis weight, and use a mechanical lift or a second technician if needed.

AnswerD

Rail kits have a maximum load rating, and a 32 kg empty chassis plus drives and cards approaches or exceeds a 35 kg kit. Before mounting, the technician must confirm the total populated weight is within the rail rating and use lifting equipment or assistance to avoid injury or equipment damage.

Why this answer

Rail kits are rated for a maximum supported weight, and the chassis must be evaluated at its fully populated weight, not just its shipping weight. When the empty chassis already approaches the rail rating, adding drives and adapters can exceed it, so the technician should confirm the rating and arrange a lift or helper before mounting.

Exam trap

The trap here is assuming the rail kit only needs to support the chassis as shipped, rather than the fully populated production weight.

Full explanation →

319

MCQeasy

A small business runs a single physical server that hosts its accounting application and database. The owner wants a backup approach that allows recovery to any point within the last 14 days without restoring a full backup each time. Which backup type should the administrator implement?

A.Full backup every night

B.Differential backup every night

C.Transaction log backups every 15 minutes

D.Incremental backup every night

AnswerC

Transaction log backups capture every committed transaction and, combined with periodic full backups, allow recovery to any point in time within the retention window. This directly supports the requirement to restore to any moment in the last 14 days without re-running a full backup each time.

Why this answer

Point-in-time recovery to any moment in a 14-day window requires transaction log backups, which capture each committed transaction and can be replayed on top of a full backup. Full, differential, and incremental schemes provide at most one restore point per backup cycle and cannot reconstruct an arbitrary moment between backups.

Exam trap

The trap here is assuming that frequent full or incremental backups equal point-in-time recovery, when only transaction log backups capture the intermediate committed transactions.

Full explanation →

320

MCQhard

A system administrator notices unusual file encryption activity on a file server. The activity appears to be rapidly spreading to other servers, and ransom notes are appearing. Which of the following should the administrator do FIRST?

A.Notify law enforcement

B.Run antivirus scan on the affected servers

C.Disconnect the affected servers from the network

D.Restore the encrypted files from backup

AnswerC

Ransomware spreads laterally across the network, so isolating the affected servers by disconnecting them halts propagation before remediation. Containing the incident first preserves unaffected servers and evidence, making network disconnection the correct immediate priority over investigation or recovery steps.

Why this answer

The FIRST action in a suspected ransomware attack is to contain the spread by isolating affected systems. Disconnecting the servers from the network immediately stops the malware from encrypting additional files on other servers and prevents lateral movement. This aligns with the containment phase of incident response, which takes priority over notification, scanning, or recovery.

Exam trap

SK0-005 often tests the order of incident response steps, and candidates frequently choose 'notify law enforcement' or 'restore from backup' first, forgetting that containment (disconnecting from the network) must precede eradication and recovery to prevent further spread.

How to eliminate wrong answers

Option A is wrong because notifying law enforcement, while important, is not the first step; containment must occur before any external communication to prevent further damage. Option B is wrong because running an antivirus scan on already infected servers is ineffective—the malware is active and may evade detection, and scanning does not stop the ongoing encryption or spread. Option D is wrong because restoring from backup before containment would likely result in re-infection, as the ransomware would still be present and could encrypt the restored files again.

Full explanation →

321

MCQmedium

A data center technician must install a new 1U server into a rack that already contains several servers drawing significant power. The rack's power distribution unit reports that the current load is near its rated capacity. Which of the following should the technician do first to avoid overloading the circuit?

A.Move one existing server's power supply to a different PDU without checking its load

B.Calculate the new server's power draw and verify the PDU has sufficient headroom before connecting

C.Connect the new server's power supplies to the nearest available outlets on the existing PDU

D.Install the server and immediately enable power capping to reduce its draw

AnswerB

Determining the server's expected wattage and comparing it against the PDU's remaining capacity confirms whether the circuit can safely accept the additional load. This step prevents an overload that could trip the breaker and take down all servers on the PDU, and it may reveal the need for a second circuit or PDU.

Why this answer

Before adding any load, the technician must quantify the new server's power requirement and confirm the PDU and its upstream circuit have enough spare capacity. Only after that calculation can the connection be made safely, possibly requiring a second circuit or PDU if headroom is insufficient.

Exam trap

The trap here is focusing on whether physical outlets are free, when the real constraint is the electrical capacity of the circuit feeding the PDU.

Full explanation →

322

MCQhard

Refer to the exhibit. A Linux server's local firewall is configured as shown. The administrator is unable to perform backups to a network-attached storage (NAS) device using TCP port 10000. Which firewall rule is causing the issue?

A.The INPUT policy is set to ACCEPT.

B.The DROP all rule at the end blocks all traffic except SSH.

C.The NAS device uses a different subnet.

D.The SSH ACCEPT rule is allowing traffic.

AnswerB

The DROP rule matches all packets that were not explicitly accepted (only port 22), including the backup traffic on port 10000.

Why this answer

Option D is correct. The INPUT chain contains an explicit DROP all rule at the end, which blocks any traffic not explicitly allowed. The only allowed traffic is SSH on port 22.

The backup traffic on port 10000 matches the DROP rule and is therefore dropped. Option A is incorrect because the policy ACCEPT is overridden by the explicit DROP. Option B allows SSH traffic but does not affect port 10000.

Option C about subnets is irrelevant to the local firewall shown.

Full explanation →

323

Multi-Selecthard

A server administrator is troubleshooting a Windows Server 2019 that randomly reboots. The administrator suspects a hardware issue. Which two actions should the administrator take to gather evidence of the cause? (Choose two.)

Select 2 answers

A.Update the BIOS and all device drivers to the latest versions.

B.Enable and review the Windows Memory Diagnostic results.

C.Run the sfc /scannow command to check for system file corruption.

D.Configure a memory dump and analyze it with WinDbg.

E.Check the System event log for Event ID 41 (Kernel-Power).

AnswersD, E

Configuring a memory dump (e.g., kernel or complete) and analyzing it with WinDbg can reveal the exact cause of a crash, such as a bugcheck code and the driver or hardware involved. This is essential for diagnosing random reboots when event logs are inconclusive. It provides deep insight into the system state at the time of failure.

Why this answer

To diagnose random reboots, the administrator should first check the System event log for Event ID 41, which indicates an unclean shutdown and may include a bugcheck code. Additionally, configuring a memory dump and analyzing it with WinDbg provides detailed crash information, including the faulting driver or hardware component. These actions gather concrete evidence, unlike preventive measures or general system checks.

Exam trap

The trap here is choosing preventive or general maintenance actions like updating drivers or running sfc, which do not provide evidence of the cause of random reboots.

Full explanation →

324

MCQeasy

A technician is preparing to install a new rack-mount server that will host a database requiring high random read performance. The server's chassis supports up to eight 2.5-inch drive bays, and the technician must choose a drive technology that provides the lowest latency and highest IOPS. Which of the following drive types should the technician select?

A.SATA 7200 RPM mechanical hard disk drives

B.SAS 15,000 RPM mechanical hard disk drives

C.NVMe solid-state drives

D.SATA solid-state drives

AnswerC

NVMe SSDs communicate directly over the PCIe bus instead of a legacy storage controller, removing the SAS/SATA protocol overhead and command-queue depth limitations. This yields microsecond-level latency and hundreds of thousands of random IOPS, making NVMe the correct choice for a database needing the highest random read performance.

Why this answer

NVMe drives attach directly to PCIe lanes, bypassing the SATA and SAS controller layers and supporting deep parallel command queues. That architecture delivers the lowest latency and highest random IOPS of the listed media, which directly matches the database's high random read requirement, while mechanical and SATA-based options are limited by either moving parts or interface overhead.

Exam trap

The trap here is assuming any solid-state drive automatically delivers top-tier random performance, when SATA SSDs are still bottlenecked by the interface and AHCI queue depth.

Full explanation →

325

MCQeasy

A server with dual redundant power supplies shuts down unexpectedly. One power supply has a solid amber LED. What is the most likely cause?

A.The server is drawing too much power

B.The power cord is unplugged

C.The power supply has failed

D.The server is overheating

AnswerC

A solid amber LED on a redundant PSU signals an internal fault, so the unit can no longer supply power. With one supply dead, the server loses redundancy and shuts down once the surviving supply cannot carry the full load, matching the unexpected shutdown described.

Why this answer

A solid amber LED on a power supply typically indicates a fault or failure of that power supply. Since the server shut down unexpectedly and one PSU shows amber, the most likely cause is that the power supply has failed, and the redundant PSU may not have been able to sustain the load alone or the failure caused a shutdown.

Exam trap

SK0-005 often tests hardware LED interpretation, so the trap is assuming a power issue like unplugged cord or overdraw rather than recognizing the amber LED as a PSU failure indicator.

How to eliminate wrong answers

Option A is wrong because excessive power draw would not typically cause a single PSU to show a solid amber LED; it might trigger overcurrent protection but usually affects both PSUs or causes different indicators. Option B is wrong because an unplugged power cord would result in no LED or a different indicator, not a solid amber fault LED. Option D is wrong because overheating would affect the server's thermal sensors and cause different alerts, not a specific PSU amber LED.

Full explanation →

326

MCQeasy

A small business needs a disaster recovery site that can be brought online within 2 hours of a primary site failure. The business can tolerate minimal data loss. Which type of recovery site should they implement?

A.Cold site

B.Hot site

C.Warm site

D.Mobile site

AnswerB

A hot site offers real-time data replication and ready-to-run systems, allowing failover within minutes to a couple of hours, achieving minimal data loss.

Why this answer

Option C is correct because a hot site maintains near-real-time data replication and preconfigured hardware, enabling failover within 2 hours and minimal data loss. A cold site (Option A) requires hardware setup and data restoration, taking days. A warm site (Option B) has pre-installed hardware but lacks current data, typically taking hours to a day to activate.

A mobile site (Option D) is a portable solution with variable provisioning time and may not meet the 2-hour requirement consistently.

Full explanation →

327

MCQeasy

A technician is tasked with installing a new internal SSD into a server. The server will be used for a database that requires high write endurance. Which of the following SSD types should the technician choose?

A.TLC (Triple-Level Cell) SSD

B.SLC (Single-Level Cell) SSD

C.MLC (Multi-Level Cell) SSD

D.QLC (Quad-Level Cell) SSD

AnswerB

SLC SSDs store one bit per cell, offering the highest write endurance and performance among NAND flash types. They are more expensive but are ideal for write-intensive workloads like databases. The higher endurance means they can withstand more write cycles before failure. This makes SLC the best choice for a database requiring high write endurance.

Why this answer

SLC SSDs have the highest write endurance because each cell stores only one bit, reducing the complexity of write operations and allowing more program/erase cycles. For a database with heavy write requirements, SLC provides the durability needed. Other types like MLC, TLC, and QLC offer higher density but lower endurance, making them less suitable for this scenario.

Exam trap

The trap here is assuming that higher density (more bits per cell) means better performance, when actually it reduces endurance.

Full explanation →

328

MCQhard

A server administrator is configuring a Linux server to automatically mount an NFS share at boot. The server is running Ubuntu 22.04 LTS. The administrator adds the following line to /etc/fstab: 'server:/export /mnt/nfs nfs defaults 0 0'. After rebooting, the mount is not present, and the system logs show an error indicating the mount failed. Which of the following is the most likely cause?

A.The 'defaults' option does not include the '_netdev' option, so the mount is attempted before the network is online.

B.The mount point /mnt/nfs does not exist on the client.

C.The NFS version is not specified, so the client defaults to NFSv3, which is not supported by the server.

D.The NFS share is not exported with the correct permissions on the server.

AnswerA

On modern Linux systems with systemd, network mounts in /etc/fstab may be attempted before the network is fully online unless the '_netdev' option is specified. Without '_netdev', the mount can fail at boot because the network interface is not yet up. Adding '_netdev' tells systemd that the mount requires network, delaying it until after network is available.

Why this answer

On systemd-based Linux distributions like Ubuntu 22.04, network filesystems in /etc/fstab require the '_netdev' option to ensure they are mounted after the network is online. Without it, the mount is attempted during early boot and fails because the network is not yet available. Adding '_netdev' to the options field resolves this by ordering the mount after network.target.

Exam trap

The trap here is overlooking systemd's network dependency handling and assuming the issue is with NFS export permissions or version mismatch, when the real problem is the missing '_netdev' mount option.

Full explanation →

329

MCQmedium

A server administrator is troubleshooting a Windows Server that is experiencing performance degradation. The administrator suspects a memory leak in a custom application. Which of the following tools should the administrator use to monitor the application's memory usage over time?

A.Resource Monitor's Memory tab.

B.Event Viewer's Application log.

C.Task Manager's Processes tab.

D.Performance Monitor with the Process\Private Bytes counter.

AnswerD

Performance Monitor allows the administrator to track specific counters over time. The Process\Private Bytes counter shows the amount of memory committed exclusively to a process, which is ideal for detecting a memory leak. By monitoring this counter for the custom application, the administrator can observe a steady increase that indicates a leak.

Why this answer

To diagnose a memory leak, the administrator needs to collect performance data over time. Performance Monitor with the Process\Private Bytes counter is designed for this purpose, allowing the creation of a data collector set that logs memory usage for the specific process. Analyzing the log will reveal a consistent upward trend, confirming the leak.

Exam trap

The trap here is choosing a real-time tool like Task Manager or Resource Monitor, which cannot show historical trends necessary to confirm a memory leak.

Full explanation →

330

MCQeasy

A small accounting firm runs a single physical server that hosts all of its line-of-business applications. The owner wants a backup strategy that allows the entire server, including the operating system, applications, and data, to be restored to dissimilar hardware after a catastrophic failure. Which backup type should the administrator implement?

A.Differential backup

B.Database dump

C.Bare-metal backup

D.File-level incremental backup

AnswerC

A bare-metal backup captures the entire server volume, including the operating system, applications, configuration, and data, and is specifically designed to restore to dissimilar hardware. This matches the owner's requirement to recover the whole server after a catastrophic failure without reinstalling the OS or applications separately.

Why this answer

A bare-metal backup is the only listed method that captures the full server, including the OS, applications, and data, in a form that can be restored to dissimilar hardware. File-level, differential, and database-specific backups each omit critical system components, so they cannot satisfy the requirement for a complete server recovery on different hardware.

Exam trap

The trap here is assuming that any full or differential backup preserves the operating system and boot configuration, when only a bare-metal or image-based backup does.

Full explanation →

331

MCQeasy

A server administrator needs to configure a RAID array for a new file server that will store large media files. The requirement is to maximize available storage capacity while providing redundancy against a single drive failure. The server has four 4 TB SAS drives and a hardware RAID controller. Which RAID level should the administrator choose?

A.RAID 6

B.RAID 0

C.RAID 5

D.RAID 1

AnswerC

RAID 5 uses distributed parity, allowing it to survive one drive failure while providing usable capacity of (N-1) drives. With four 4 TB drives, usable capacity is 12 TB, which is higher than RAID 1 or RAID 10. It balances capacity and redundancy, making it the best choice for this file server scenario.

Why this answer

RAID 5 offers a good balance of capacity and redundancy for a file server. It uses one drive's worth of space for distributed parity, so four 4 TB drives yield 12 TB of usable storage and can withstand one drive failure. RAID 0 lacks redundancy, RAID 1 wastes half the capacity, and RAID 6 reduces capacity further with dual parity.

Exam trap

The trap here is confusing RAID levels that provide redundancy with those that maximize capacity; RAID 6 provides more redundancy but less usable space than RAID 5.

Full explanation →

332

MCQmedium

A server administrator is troubleshooting a RAID controller issue on a production server. The server has a hardware RAID 5 array with three drives. The administrator notices that one drive's status LED is solid amber, and the RAID controller management utility reports the array as degraded. The administrator has a replacement drive of the same model and capacity. Which action should the administrator take to restore the array to optimal status?

A.Hot-swap the failed drive with the replacement and allow the controller to automatically rebuild the array.

B.Shut down the server, replace the drive, and then recreate the RAID array from scratch.

C.Replace all three drives simultaneously to ensure compatibility and rebuild the array.

D.Run a consistency check on the array and mark the failed drive as online.

AnswerA

In a hardware RAID 5 array with a failed drive, the correct procedure is to replace the failed drive while the system is running, if the controller and backplane support hot-swapping. The controller will detect the new drive and begin rebuilding the array using parity data. This restores redundancy with minimal downtime and is the standard practice for degraded RAID arrays.

Why this answer

A degraded RAID 5 array with a failed drive should be restored by replacing the failed drive and allowing the controller to rebuild. Hot-swapping is supported on most server backplanes and minimizes downtime. Recreating the array or replacing all drives destroys data, and forcing a failed drive online does not address the hardware failure.

The correct action is to replace the single failed drive and rebuild.

Exam trap

The trap here is thinking that a degraded array requires recreating the RAID set, when a rebuild from parity is the proper recovery method.

Full explanation →

333

MCQhard

A security administrator is configuring a Linux server to allow only SSH and HTTPS traffic from a specific management subnet while blocking all other inbound traffic. The server has two network interfaces: eth0 (public) and eth1 (management). Which command should the administrator use to view the current iptables rules with line numbers to identify the rule positions before modifying them?

A.iptables -L --line-numbers

B.iptables -F

C.iptables -L -n -v

D.iptables -S

AnswerA

This command lists all rules in the selected chain and includes line numbers at the beginning of each rule. Line numbers are essential for inserting or deleting rules at precise positions, such as when reordering to allow management subnet traffic before a default deny. It also supports -n to disable name resolution for faster output. This directly meets the administrator's need to view rules with line numbers.

Why this answer

The administrator needs to view the current iptables rules with line numbers to identify rule positions before making changes. The iptables -L --line-numbers command lists all rules with line numbers, allowing precise insertion or deletion. This is critical when reordering rules to ensure management subnet traffic is permitted before any default deny rule.

Other commands either lack line numbers or are destructive.

Exam trap

The trap here is assuming that iptables -L -n -v shows line numbers; it shows counters and disables name resolution but not line numbers, which are essential for rule position management.

Full explanation →

334

MCQhard

Refer to the exhibit. A server administrator is troubleshooting a DNS resolution issue on a Windows Server 2019. The exhibit shows the output of the command `nslookup` queried against the server's own IP. Based on the output, what is the most likely cause of the resolution failure?

A.The DNS server does not have an A record for server1.contoso.com.

B.The DNS server's root hints are misconfigured.

C.The DNS server is not configured to forward queries to an external DNS server.

D.The DNS server has an incorrect reverse lookup zone configuration.

AnswerA

The 'Non-existent domain' error directly indicates that the queried A record is missing from the contoso.com zone.

Why this answer

Option D is correct because the NXDOMAIN response indicates the queried name does not exist in the DNS zone. Option A is wrong because forwarding is irrelevant for an authoritative zone. Option B is wrong because reverse lookup zones are for IP-to-name resolution, not name-to-IP.

Option C is wrong because root hints are used for recursion, not for authoritative responses.

Full explanation →

335

MCQeasy

A server administrator is troubleshooting a server that fails to power on. The administrator presses the power button, but nothing happens: no fans, no lights, no beep codes. The server is connected to a known-good power outlet. Which of the following should the administrator check FIRST?

A.The front panel power button cable connection.

B.The RAM modules for proper seating.

C.The power supply unit (PSU) LEDs and connections.

D.The CMOS battery voltage.

AnswerC

When a server shows no signs of power, the power supply is a primary suspect. Checking the PSU LEDs (if present) and ensuring the power cables are securely connected to both the PSU and the motherboard is a logical first step. Many servers have status LEDs on the PSU that indicate power good; if unlit, the PSU may be faulty or not receiving power.

Why this answer

The absence of any power indicators (fans, lights, beeps) strongly suggests a power delivery problem. The administrator should first verify that the PSU is receiving power and functioning, by checking its LEDs and ensuring all power connections are secure. This is the most direct and common cause of a completely dead server.

Exam trap

The trap here is overthinking and checking internal components like RAM or CMOS battery before verifying the most basic power delivery path.

Full explanation →

336

MCQhard

Refer to the exhibit. A server administrator runs a dmidecode command to check memory configuration and obtains the output shown. The system supports DDR4-2666, but all DIMMs are running at 1866 MT/s. Which action will allow the memory to run at the maximum supported speed?

A.Enable XMP profile in the BIOS to force all DIMMs to 2666 MT/s.

B.Replace the DIMM in slot A1 with a DDR4-2666 registered module.

C.Clear the CMOS to reset the memory training data.

D.Move the DIMM from A1 to A2 and the DIMM from A2 to A1.

AnswerB

All memory runs at the speed of the slowest module. Replacing the 2133 MT/s DIMM removes the bottleneck.

Why this answer

Correct: The slower 2133 MT/s DIMM in slot A1 limits all modules to its speed. Replacing it with a 2666 MT/s module allows the system to run at the highest common denominator. Option A is wrong because reordering slots won't change the speed limitation.

Option C is wrong because XMP is for overclocking desktop memory, not typical on registered server DIMMs. Option D is wrong because clearing CMOS only resets BIOS settings, not memory speed mismatch.

Full explanation →

337

MCQmedium

A server administrator configures a scheduled task to back up a database using a command-line tool. The task runs successfully when executed manually, but fails when run via the task scheduler. The log shows 'Error: Access denied.' What is the MOST likely cause?

A.The scheduled task is running under the wrong user account.

B.The database service is stopped.

C.The command-line tool is not installed.

D.The backup destination is full.

AnswerA

When the task runs manually, it uses the current user's security context; the scheduler often uses a system or different user account that may not have the required permissions, causing access denied.

Why this answer

Option C is correct because 'Access denied' usually points to permission issues; the task scheduler may run under a different user account that lacks necessary privileges. Option A is wrong because a full destination would yield a 'disk full' error, not access denied. Option B is wrong because if the tool were not installed, the error would be 'command not found.' Option D is wrong because a stopped database service would produce a connection error, not access denied.

Full explanation →

338

MCQhard

Refer to the exhibit. A server administrator encounters an authentication issue when accessing a web server. The exhibit shows an error from the Domain Controller's event log. What is the most likely cause of the problem?

A.The web server's service account is not configured to support AES encryption types.

B.The DNS service is not resolving the web server's FQDN.

C.The domain controller clock is out of sync with the web server.

D.The service account for the web server has an expired password.

AnswerA

The missing key and the mismatch between requested (AES etype 18) and available etypes directly point to missing AES support on the account.

Why this answer

Option B is correct because the error shows that the requested encryption types (etype 18 is AES) are missing from the account's available etypes, indicating the service account is not configured to support AES. Option A would produce a clock skew error. Option C would result in a password expiration event.

Option D would cause name resolution or host not found errors, not a Kerberos encryption mismatch.

Full explanation →

339

MCQeasy

An administrator needs to remotely manage several Linux servers securely without using passwords. Which of the following is the BEST method?

A.Use Telnet with SSH tunneling.

B.Use VNC with a strong password.

C.Use RDP with certificate-based authentication.

D.Use SSH with key-based authentication.

AnswerD

SSH with key-based authentication is the industry standard for secure, password-less remote administration on Linux servers.

Why this answer

Option C is correct because SSH with key-based authentication provides strong, password-less remote access. Option A is wrong because RDP is primarily used on Windows, not typical for Linux. Option B is wrong because Telnet is insecure, and SSH tunneling does not make Telnet secure.

Option D is wrong because VNC is less secure and not designed for efficient server administration.

Full explanation →

340

MCQeasy

A user attempts to access a shared folder named \\Server\Finance. The share permissions are set to 'Everyone – Full Control'. The NTFS permissions on the folder grant the user 'Read & Execute' but deny 'Write'. What is the user's effective permission when accessing the share over the network?

A.Full Control

B.Write

C.No Access

D.Read & Execute

AnswerD

When share and NTFS permissions differ, the most restrictive applies over the network. Full Control at share level is limited by the NTFS Read & Execute grant, and the explicit Write deny reinforces this, yielding Read & Execute.

Why this answer

When share and NTFS permissions combine, the most restrictive of the two applies. Share gives Full Control, NTFS gives Read & Execute, so effective access is Read & Execute.

Full explanation →

341

MCQhard

A web application server is experiencing intermittent 502 Bad Gateway errors during peak usage hours. The server's reverse proxy logs show connections to the backend application server being refused. The application server's resource monitor shows CPU utilization at 95% and memory utilization at 40%. Which of the following actions is MOST likely to resolve the issue?

A.Replace the reverse proxy with a hardware load balancer.

B.Add more CPU cores to the server.

C.Increase the server's physical memory.

D.Adjust thread pool and connection timeout settings on the application server.

AnswerD

CPU saturation at 95% with ample memory points to thread pool exhaustion: the reverse proxy's connections are refused because no worker threads are free. Tuning thread pool size and connection timeouts lets the application accept and hold more concurrent connections, resolving the 502 errors.

Why this answer

The 502 errors with connection refusals and 95% CPU (but only 40% memory) point to application-layer thread/connection exhaustion rather than raw hardware shortage. Tuning the thread pool and connection timeout settings allows the application server to handle more concurrent connections and recycle stuck ones, directly addressing the bottleneck.

Exam trap

SK0-005 often tests whether candidates jump to hardware upgrades (CPU, RAM) when the metrics and error pattern clearly indicate a software configuration bottleneck, so resource-utilization numbers are included to mislead hardware-first thinkers.

How to eliminate wrong answers

Option A is wrong because replacing the reverse proxy does not fix backend connection refusals caused by application thread exhaustion — the proxy is functioning correctly by reporting 502s. Option B is wrong because adding CPU cores may help marginally but does not address the root cause of thread pool saturation and refused connections; it is a costly hardware fix for a configuration problem. Option C is wrong because memory utilization is only 40%, so adding RAM provides no benefit to a CPU/thread-bound issue.

Full explanation →

342

Multi-Selectmedium

Which TWO of the following are considered best practices for securing a server's remote management access?

Select 2 answers

A.Use SSH key-based authentication

B.Enable default administrative shares

C.Allow all inbound ICMP

D.Disable unused services

E.Use telnet for remote CLI

AnswersA, D

SSH key-based authentication replaces reusable passwords with cryptographic key pairs, so brute-force and credential-stuffing attacks against remote management access fail. This satisfies the stem's best-practise requirement by removing the weakest authentication factor from server administration channels.

Why this answer

Using SSH key-based authentication provides strong encryption and eliminates password theft risks. Disabling unused services reduces the attack surface. Enabling default administrative shares increases exposure.

Allowing all inbound ICMP can facilitate reconnaissance. Telnet sends data in plaintext and is insecure.

Full explanation →

343

MCQhard

A server has a RAID 5 array with four drives. One drive fails and is replaced. During the rebuild, a second drive reports a media error and the rebuild fails. What should the administrator do FIRST to minimize the risk of permanent data loss?

A.Run a consistency check on the array

B.Replace the drive that reported the media error immediately

C.Back up all critical data before any further rebuilding

D.Restart the RAID controller to reinitialize the rebuild

AnswerC

A failed rebuild with a second drive showing a media error leaves the array degraded with no redundancy, so any further read stress risks total loss. Backing up critical data first satisfies the stem's requirement to minimise risk of permanent data loss before attempting another rebuild.

Why this answer

A media error on another drive during a RAID 5 rebuild indicates that drive may also be failing. If another drive fails completely, the entire array and its data will be lost. Therefore, the immediate priority is to back up critical data before any further rebuild action.

Replacing the drive or restarting the controller could trigger another rebuild, risking complete array loss. A consistency check does not address the urgency.

Full explanation →

344

MCQmedium

A server administrator is troubleshooting a production server that boots successfully but intermittently reboots without warning. The IPMI event log shows no thermal or power events, and the OS logs show nothing before each reset. The administrator suspects a hardware fault and wants to capture the most detailed low-level diagnostic information the next time the server hangs or resets. Which of the following should the administrator configure to BEST collect this data?

A.Enable the baseboard management controller's System Event Log (SEL) with a higher severity threshold

B.Enable the BMC's integrated management log and configure chassis intrusion detection alerts

C.Enable the platform's crash dump or NMI-on-hang feature so hardware state is saved on the next fault

D.Configure a memory dump of the operating system kernel to be written to a dedicated dump partition

AnswerC

A platform crash dump triggered by an NMI or hang detection captures processor, memory controller, and firmware state at the instant of failure, which is exactly the low-level data missing from the SEL and OS logs. This is the correct tool when resets occur with no OS or SEL trace, because it records state before the platform restarts and overwrites volatile information.

Why this answer

When a server resets with no SEL, thermal, power, or OS log evidence, the fault is likely below the OS, so capturing platform-level state at the moment of failure is the only way to obtain actionable data. A hardware crash dump or NMI-triggered dump preserves CPU, memory, and firmware context that would otherwise be lost on reboot, making it the correct configuration for this scenario.

Exam trap

The trap here is assuming that the baseboard management controller's event log always captures the cause of an unexpected reset, when it only records platform events such as power and thermal conditions.

Full explanation →

345

MCQmedium

A server administrator is troubleshooting a server that is unable to boot from its local RAID 1 array. The server POSTs successfully, but after the RAID controller initialization, the message 'No boot device found' is displayed. The administrator verifies that both drives in the array are online and the RAID controller reports the array as optimal. Which of the following is the MOST likely cause?

A.The boot order in the system BIOS/UEFI is incorrect.

B.The RAID controller firmware is outdated and needs to be updated.

C.The bootloader on the RAID volume is corrupted.

D.The RAID array is degraded, but the controller has not yet reported it.

AnswerA

Even if the RAID array is healthy, the system firmware must be configured to boot from the RAID controller. If the boot order lists other devices (e.g., network, CD-ROM) before the RAID volume, or if the RAID controller is disabled in boot options, the system will not find the bootloader. This is a common oversight after hardware changes or firmware updates.

Why this answer

The system firmware must be set to boot from the RAID controller. If the boot order is incorrect, the server will not find the bootable volume even though the array is healthy. The correct answer addresses this configuration issue.

Exam trap

The trap here is assuming a hardware failure when the error message points to a configuration issue; always check boot order after hardware or firmware changes.

Full explanation →

346

MCQhard

A company is implementing a disaster recovery strategy for its on-premises VMware vSphere environment. The IT manager wants to ensure that virtual machines can be recovered at a secondary site within 4 hours of a primary site failure. The secondary site has identical hardware but no active VMs. The company has a limited budget and wants to minimize ongoing costs. Which of the following solutions BEST meets these requirements?

A.Use VMware vSphere Replication to replicate VMs to the secondary site and perform manual recovery when needed.

B.Implement VMware Site Recovery Manager (SRM) with array-based replication and automated failover.

C.Set up a stretched vSphere cluster across both sites with synchronous replication.

D.Configure nightly backups to tape and transport them to the secondary site for restoration.

AnswerA

vSphere Replication is included with vSphere Essentials Plus and higher, providing host-based replication without the need for expensive storage arrays. It allows replication to a secondary site and manual recovery. With a 4-hour RTO, manual recovery is feasible. This solution is cost-effective and meets the requirements without the overhead of SRM.

Why this answer

VMware vSphere Replication offers a cost-effective way to replicate VMs to a secondary site without requiring expensive storage arrays or SRM licensing. It supports manual recovery, which can meet a 4-hour RTO. Other options either incur high costs, rely on slow tape restoration, or require expensive network infrastructure.

Therefore, vSphere Replication is the best fit.

Exam trap

The trap here is assuming that automated failover or stretched clusters are necessary for a 4-hour RTO, when manual recovery with replication can suffice and is more cost-effective.

Full explanation →

347

MCQmedium

A server administrator is troubleshooting a Windows Server 2022 that is experiencing performance issues. The administrator suspects a disk bottleneck. Which of the following Performance Monitor counters should the administrator review to identify the average time that read and write operations take on the physical disk?

A.Avg. Disk Queue Length

B.Current Disk Queue Length

C.Disk Transfers/sec

D.Avg. Disk sec/Transfer

AnswerD

Avg. Disk sec/Transfer measures the average time, in seconds, for a disk transfer to complete. It includes both read and write operations and is a key indicator of disk performance. A high value indicates a disk bottleneck. This counter directly answers the question about average time for read and write operations.

Why this answer

Avg. Disk sec/Transfer is the correct counter because it directly measures the average time taken for disk transfers, encompassing both reads and writes. This counter is essential for identifying disk latency and bottlenecks.

Other counters measure rate or queue length, which are indirect indicators and do not provide the average time per operation.

Exam trap

The trap here is confusing queue length counters with latency counters; queue length indicates waiting requests, not the time per operation.

Full explanation →

348

MCQhard

A technician is installing a new SSD into a server that supports NVMe drives. The server has an M.2 slot that supports PCIe 3.0 x4 and SATA. The technician installs an M.2 NVMe SSD into the slot, but the server does not detect the drive. Which of the following is the most likely cause?

A.The SSD is not compatible with the server because it is not a 2.5-inch drive.

B.The server's power supply is insufficient to power the NVMe SSD.

C.The SSD requires a U.2 connection instead of M.2.

D.The M.2 slot is configured for SATA mode in the BIOS/UEFI.

AnswerD

Many M.2 slots can operate in either SATA or PCIe (NVMe) mode, and the mode is often set in the BIOS/UEFI. If the slot is configured for SATA, an NVMe drive will not be detected because it requires PCIe lanes. The technician should check the BIOS/UEFI settings and change the M.2 slot mode to PCIe/NVMe. This is a common oversight when installing NVMe drives in shared slots.

Why this answer

The most likely cause is that the M.2 slot is set to SATA mode in the BIOS/UEFI. Many server motherboards allow M.2 slots to be configured for either SATA or PCIe/NVMe operation. If set to SATA, an NVMe drive will not be recognized.

The technician should enter the BIOS/UEFI and change the M.2 slot mode to PCIe/NVMe.

Exam trap

The trap here is assuming that an M.2 slot automatically supports NVMe, when in fact many slots must be explicitly configured for PCIe mode in the BIOS/UEFI.

Full explanation →

349

MCQeasy

A small business leases a single rack in a colocation facility. The owner wants a disaster recovery arrangement that provides a pre-configured alternate site with power, cooling, and network but where the company must supply and install its own servers after a disaster. Which type of site best matches this requirement?

A.Hot site

B.Cold site

C.Mobile site

D.Warm site

AnswerB

A cold site provides basic infrastructure such as power, cooling, and connectivity but no pre-installed hardware. The company must bring and install its own servers, which matches the owner's requirement. It is the least expensive option but has the longest recovery time because hardware must be procured and configured after the disaster.

Why this answer

A cold site supplies only the physical environment and utilities, leaving hardware procurement and installation to the organization. Because the owner wants a pre-configured space but plans to install company-owned servers after a disaster, a cold site is the correct match. It offers the lowest cost at the expense of longer recovery time.

Exam trap

The trap here is equating any alternate site with a hot site, when the key differentiator is how much hardware and data are already in place before a disaster occurs.

Full explanation →

350

MCQmedium

A company has a Windows Server 2022 server that runs a critical application. The server has a single power supply. The IT manager wants to ensure that the server can continue to operate during a brief power outage and can shut down gracefully during an extended outage. Which solution should the administrator implement?

A.Install a second power supply and connect it to a different power circuit

B.Install a redundant power supply

C.Connect the server to an uninterruptible power supply (UPS) with a network management card

D.Configure the server to use a redundant array of independent disks (RAID) for the operating system drive

AnswerC

A UPS provides battery backup during a power outage, allowing the server to continue operating briefly. A network management card enables the UPS to communicate with the server, so it can trigger a graceful shutdown when the battery is low. This meets both requirements: ride-through for short outages and orderly shutdown for longer ones.

Why this answer

A UPS with a network management card provides both battery backup and the ability to initiate a graceful shutdown when the battery is depleted. This directly addresses the need to ride through short outages and to shut down safely during longer ones. Other options address hardware redundancy but not power outage protection.

Exam trap

The trap here is confusing power redundancy with power backup; redundant power supplies protect against PSU failure, not against a loss of utility power.

Full explanation →

351

MCQhard

A Linux administrator is troubleshooting a production web server that randomly stops accepting connections. The system log shows 'kernel: TCP: request_sock_TCP: Possible SYN flooding on port 443' followed by dropped connections. The server is behind a load balancer and legitimate traffic is high but expected. The administrator suspects the SYN backlog is too small for the current connection rate. Which of the following should the administrator adjust to increase the number of half-open connections the kernel will queue?

A.Disable SYN cookies by setting net.ipv4.tcp_syncookies to 0.

B.Increase net.ipv4.ip_local_port_range to allow more ephemeral connections.

C.Increase the value of net.core.somaxconn and reload the kernel module.

D.Increase the value of net.ipv4.tcp_max_syn_backlog in /etc/sysctl.conf and apply it with sysctl -p.

AnswerD

The net.ipv4.tcp_max_syn_backlog parameter controls how many half-open connection requests the kernel queues before SYN cookies activate. Raising it accommodates the expected high connection rate from the load balancer and directly addresses the SYN flooding warning observed in the kernel log.

Why this answer

The SYN flooding warning appears when the half-open connection queue fills faster than handshakes complete. The net.ipv4.tcp_max_syn_backlog setting defines that queue's depth, so raising it lets the server hold more pending handshakes under the legitimate load generated by the load balancer.

Exam trap

The trap here is confusing the established-connection backlog (somaxconn) with the half-open SYN backlog (tcp_max_syn_backlog), which are distinct kernel queues.

Full explanation →

352

MCQhard

A technician is troubleshooting a server that intermittently reboots under heavy load. The server has dual power supplies connected to separate PDUs. The technician notices that one PDU is on a branch circuit that also powers a large air compressor. Which of the following is the most likely cause of the reboots?

A.Electrical noise or voltage sags from the air compressor are causing power quality issues.

B.The server's power supplies are configured for 220V but the PDU is providing 110V.

C.The power supplies are not rated for the server's power draw.

D.The server's power supplies are not redundant because they are connected to the same PDU.

AnswerA

Large motors like air compressors draw significant current on startup, causing voltage sags and electrical noise on the branch circuit. This can cause a server's power supplies to momentarily drop out, leading to reboots. Even with dual power supplies, if one is on the affected circuit, the server may still experience issues if the other supply cannot handle the full load alone or if the sag affects both. This is a common power quality problem.

Why this answer

The intermittent reboots are most likely caused by electrical noise or voltage sags from the air compressor sharing the branch circuit. Large motors cause voltage drops when they start, which can disrupt server power supplies. Even with dual power supplies on separate PDUs, if one circuit is compromised, the server may still experience issues if the other supply cannot fully compensate or if the sag is severe.

This is a classic power quality problem.

Exam trap

The trap here is assuming that dual power supplies on separate PDUs guarantee clean power, ignoring the impact of other equipment on the same circuit.

Full explanation →

353

MCQeasy

A company performs a full backup on Sunday and incremental backups Monday through Saturday. A server fails on Thursday at 10:00 AM. Which sequence correctly restores the data?

A.Restore Sunday full, then Tuesday and Wednesday incrementals.

B.Restore Sunday full and Wednesday incremental only.

C.Restore Wednesday's incremental, then Sunday full.

D.Restore Sunday full, then Monday, Tuesday, and Wednesday incrementals.

AnswerD

Correct sequence: full backup provides the base, and all subsequent incremental backups up to the last good point (Wednesday) must be applied in order.

Why this answer

Option C is correct because an incremental backup captures only changes since the last backup, requiring the last full backup and all subsequent incrementals up to the point of failure. Options A and D are wrong because they skip Monday’s incremental (A) or both Monday and Tuesday (D). Option B is wrong because it restores out of order, which would not apply the data correctly.

Full explanation →

354

MCQmedium

A server administrator is troubleshooting a server that is randomly rebooting. The administrator reviews the system logs and finds event ID 41 (Kernel-Power) in the Windows System log. Which of the following is the MOST likely cause?

A.A software application crash

B.A failing power supply unit

C.A faulty memory module

D.An overheating CPU

AnswerB

Event ID 41 (Kernel-Power) is logged when the system reboots without first shutting down cleanly, often due to a power loss or hardware failure. A failing PSU can cause intermittent power loss, leading to unexpected reboots. This is a common cause, especially if the server is not on a UPS or the PSU is degraded.

Why this answer

Event ID 41 (Kernel-Power) indicates that the system rebooted without cleanly shutting down, which is often caused by a power interruption or hardware failure. A failing power supply unit is a common culprit, as it can cause intermittent power loss leading to unexpected reboots. While overheating or memory issues could cause crashes, they would typically generate additional specific error events.

Therefore, the PSU is the most likely cause.

Exam trap

The trap here is attributing the reboot to software or memory without considering that Event ID 41 specifically points to an unexpected shutdown, often power-related.

Full explanation →

355

MCQhard

A Linux server administrator notices that a production server's root filesystem is 100% full. The server is still running but new log entries are failing to write. The administrator runs `df -h` and sees /dev/sda3 at 100% usage, but `du -sh /` reports only 45 GB used on a 100 GB filesystem. Which command should the administrator use to identify the large deleted file that is still held open by a process?

A.lsof +L1

B.iostat -x 1

C.find / -type f -size +1G -exec ls -lh {} \;

D.fdisk -l /dev/sda

AnswerA

lsof +L1 lists open files with a link count less than one, which identifies deleted files still held open by running processes. In this scenario, the space discrepancy between df and du strongly suggests a deleted file that a process has not released. This command will show the process ID and file size, allowing the administrator to restart the process and reclaim space.

Why this answer

The difference between df (100 GB used) and du (45 GB used) indicates that space is allocated to a file no longer visible in the directory tree, typically a deleted file still open by a process. lsof +L1 lists such files, showing the PID and size. Restarting the process releases the handle and frees the space. Other commands either show disk layout, existing files, or I/O performance, none of which identify the hidden space consumer.

Exam trap

The trap here is relying on du or find to locate the space, when the file is unlinked and only visible through open file descriptors.

Full explanation →

356

MCQeasy

A datacenter technician is troubleshooting a rack-mounted server whose front-panel health LED is solid amber and whose management interface reports a fan failure in bay 3. The server is still running production workloads. Which of the following should the technician do FIRST?

A.Schedule an immediate graceful shutdown of the server to replace the fan.

B.Verify whether the failed fan is redundant and monitor the server's thermal sensors and remaining fan speeds.

C.Disable the fan failure alert in the management interface to stop the amber LED.

D.Replace the fan immediately by pulling it from the chassis while the server continues running.

AnswerB

Most enterprise servers use redundant hot-swap fans, so a single failure may not threaten operation if temperatures remain within thresholds. Checking the management controller for redundancy status and thermal readings confirms whether the server is safe to keep running while a replacement is sourced. This is the least disruptive and most informative first step before any physical intervention.

Why this answer

When a single fan fails on a server with redundant cooling and the system is still running production workloads, the priority is to confirm that redundancy and thermal margins are intact before touching hardware. Reading the management controller's fan and temperature sensors establishes whether the server is safe to continue operating, allowing a hot-swap replacement to be scheduled without an outage.

Exam trap

The trap here is treating any amber health LED as an emergency requiring immediate shutdown, when a single redundant fan failure is typically a non-disruptive hot-swap event.

Full explanation →

357

MCQmedium

A server configured with a RAID 5 array and a hot spare experiences intermittent crashes under heavy disk I/O. A technician suspects a failing drive. Which of the following should the technician do FIRST?

A.Initiate a manual failover to the hot spare.

B.Remove the suspected drive and rebuild the array.

C.Replace the hot spare with a new drive.

D.Run the array manufacturer's diagnostic utility.

AnswerD

Diagnostics read the array's SMART data and controller logs, confirming which drive is failing without disturbing the hot spare rebuild. This non-destructive step identifies the faulty member before any physical replacement, satisfying the requirement to act first.

Why this answer

Running the array manufacturer's diagnostic utility is the least invasive first step—it can identify which drive is failing and confirm the suspected fault without disrupting the array or risking unnecessary rebuilds. This aligns with standard troubleshooting methodology: diagnose before replacing or rebuilding. Only after confirmation should the technician take corrective action.

Exam trap

SK0-005 often tests whether candidates skip diagnosis and jump straight to disruptive remediation (failover, rebuild, replacement) instead of running diagnostics first to confirm the fault.

How to eliminate wrong answers

Option A is wrong because initiating a manual failover to the hot spare is a disruptive action that should only be taken after confirming the drive is actually failing; doing it prematurely can cause unnecessary rebuilds and risk. Option B is wrong because removing the suspected drive and rebuilding the array is invasive and could cause data loss or extended downtime if the wrong drive is removed. Option C is wrong because replacing the hot spare does not address the suspected failing drive and wastes a known-good spare.

Full explanation →

358

MCQeasy

A server administrator needs to deploy a new server that will host a database requiring high random read/write performance and maximum fault tolerance. The server has eight drive bays. Which RAID level should the administrator choose?

A.RAID 6

B.RAID 10

C.RAID 0

D.RAID 5

AnswerB

RAID 10 combines mirroring and striping, providing excellent random read/write performance and high fault tolerance. It can tolerate multiple drive failures as long as they are not in the same mirrored pair. With eight drives, RAID 10 offers both speed and redundancy, making it ideal for database servers requiring high performance and maximum uptime.

Why this answer

RAID 10 is the best choice for database servers needing high random I/O performance and fault tolerance. It stripes data across mirrored pairs, delivering fast reads and writes while allowing for drive failures. RAID 0 lacks redundancy, RAID 5 has write penalties and only single-drive fault tolerance, and RAID 6 has even greater write overhead.

RAID 10 balances performance and redundancy effectively.

Exam trap

The trap here is assuming RAID 6 provides the best fault tolerance without considering its write performance penalty, or choosing RAID 5 for a database workload.

Full explanation →

359

MCQhard

A server administrator is troubleshooting a Windows Server that is experiencing intermittent network disconnections. The server has a single NIC connected to a switch. Users report that access to file shares drops for about 30 seconds several times a day. The administrator reviews the switch logs and sees no port flapping. Which Windows tool should the administrator use to determine if the NIC is repeatedly resetting or if a driver is causing the disconnections?

A.Performance Monitor with the Network Interface counter set.

B.Event Viewer, specifically the System log for network adapter events.

C.Resource Monitor, Network tab.

D.Device Manager, viewing the NIC's properties and driver details.

AnswerB

The System log in Event Viewer records events from the network adapter driver, including link state changes, resets, and errors. If the NIC is resetting, events with source 'e1i' or similar will appear. This directly addresses the intermittent disconnections and can correlate with the times users report outages. It is the most direct way to see if the adapter itself is the cause.

Why this answer

Intermittent network disconnections on a Windows server can be caused by NIC driver resets or hardware faults. The System event log in Event Viewer captures driver-level events, including link down/up, resets, and error codes. By filtering for the network adapter source, the administrator can see if the NIC is repeatedly resetting and correlate the timestamps with user reports.

Other tools provide live metrics or configuration details but lack the historical event logging needed to diagnose intermittent hardware or driver behavior.

Exam trap

The trap here is focusing on live performance counters or device configuration when the problem is intermittent; only historical event logs can reveal repeated NIC resets that occur between user reports.

Full explanation →

360

MCQmedium

Users report slow file server performance. The administrator suspects a single process is consuming excessive CPU and wants to analyse its threads and handles. Which tool should be used?

A.System Information

B.Task Manager

C.Resource Monitor

D.Performance Monitor

AnswerC

Resource Monitor offers detailed real-time metrics per process, including thread and handle counts, allowing precise identification of resource consumption.

Why this answer

Resource Monitor (resmon.exe) in Windows provides detailed per-process analysis including CPU usage, thread-level details, and handle counts, making it the right tool to inspect a specific process's threads and handles. It offers a granular view that Task Manager lacks, such as the ability to see which threads are consuming CPU and what handles a process has open. This directly addresses the administrator's need.

Exam trap

SK0-005 often tests the functional boundaries between Windows diagnostic tools, and candidates confuse Task Manager's process-level view with Resource Monitor's thread- and handle-level detail, or pick Performance Monitor for real-time interactive inspection.

How to eliminate wrong answers

Option A is wrong because System Information (msinfo32.exe) provides a static inventory of hardware, drivers, and system configuration — it does not offer real-time per-process thread or handle analysis. Option B is wrong because Task Manager shows overall process CPU and memory usage but does not break down threads or handles for a specific process; it is too high-level for this diagnostic need. Option D is wrong because Performance Monitor (perfmon.msc) is used for creating performance counters and logs over time, but it does not provide the interactive per-process thread and handle inspection that Resource Monitor does.

Full explanation →

361

MCQeasy

A server administrator needs to remotely manage a Windows Server 2022 Core installation that is located in a secure data center. The administrator's workstation runs Windows 11 and is on the same corporate network. Which of the following tools should the administrator use to manage the server with the GUI-based tools available?

A.Windows Admin Center

B.Remote Desktop Connection (RDP)

C.Server Manager installed locally on the workstation

D.PowerShell remoting using Enter-PSSession

AnswerA

Windows Admin Center is a browser-based management tool that can manage Windows Server 2022 Core installations remotely, providing a GUI for many administrative tasks. It does not require a GUI on the server itself and is designed for headless servers. It meets the requirement of using GUI-based tools to manage the Core server from a Windows 11 workstation.

Why this answer

Windows Admin Center is a web-based GUI tool that can manage Windows Server Core installations remotely without requiring a GUI on the server. It is accessible from a Windows 11 workstation and provides a graphical interface for many administrative tasks. RDP to Core only offers a command line, Server Manager is not available on Windows 11, and PowerShell remoting is command-line only.

Exam trap

The trap here is assuming that Remote Desktop or PowerShell remoting provides a GUI, when Core installations lack the graphical shell and those tools only offer command-line access.

Full explanation →

362

Multi-Selectmedium

A security team is reviewing physical security controls for a data center that houses several CompTIA Server+ managed servers. The team wants to implement measures that specifically prevent unauthorized personnel from accessing server racks and deter tailgating. (Choose two.)

Select 2 answers

A.Configure a VLAN for out-of-band management

B.Implement RAID 6 on all server storage arrays

C.Deploy a mantrap or access vestibule at the entrance

D.Enable full-disk encryption with BitLocker on all servers

E.Install electronic badge readers on the data center entrance door

AnswersC, E

A mantrap, now usually called an access control vestibule, has two interlocking doors: the second opens only after the first has closed, often admitting one person at a time and sometimes checked by weight sensors or cameras. That directly stops tailgating, where an unauthorised person follows an authorised one inside. It works best combined with badge readers, so each person authenticates individually.

Why this answer

Electronic badge readers and a mantrap directly address physical access control. Badge readers authenticate individuals at the entrance, while a mantrap enforces one-person-at-a-time entry to prevent tailgating. Together they provide layered physical security for the data center and server racks, meeting the requirement to deter unauthorized access.

Exam trap

The trap here is confusing logical security controls like encryption or network segmentation with physical access controls that actually stop people at the door.

Full explanation →

363

PBQhard

A mid-sized e-commerce company experienced a ransomware attack that encrypted all on-premises servers and their locally attached backup storage. The attack occurred on a Friday evening; the company was closed over the weekend. By Monday morning, the IT team discovered the encryption and found a ransom note demanding $500,000 in Bitcoin. The company has a disaster recovery plan that calls for restoring from daily tape backups stored offsite. However, the most recent offsite tape was taken home by a backup operator for the weekend and has not been returned. The tape contains full backups from Wednesday. The IT team has clean installation media and application software available. The company's RPO is 24 hours, and RTO is 48 hours. Management wants to minimize data loss and avoid paying the ransom. Based on this scenario, which of the following should the IT team do to recover the business operations?

A.Pay the ransom to obtain the decryption key, then restore the environment, and implement better security controls.

B.Rebuild the servers from scratch using clean media, and manually re-enter transactions since the last good backup based on paper records and customer emails.

C.Wait for the backup operator to return the tape, then restore from that tape, accepting data loss since Wednesday.

D.Rebuild the servers from scratch using clean media, restore the latest offsite tape if available, and apply available transaction logs from the on-premises backup server that was encrypted (attempting to recover unencrypted logs).

AnswerD

Why this answer

Option A is correct because it follows the existing DR plan by restoring from the available offsite tape (even though a few days old) and builds clean servers to avoid reinfection. It also attempts to salvage any unencrypted transaction logs from the compromised environment to minimize data loss beyond Wednesday. Paying the ransom (Option B) is against best practices and may not guarantee full recovery.

Waiting for the operator to return the tape (Option C) delays action and may still result in significant data loss; the operator's return is uncertain. Manually re-entering transactions (Option D) is highly labor-intensive, error-prone, and could exceed the 48-hour RTO.

Full explanation →

364

MCQhard

A company's disaster recovery plan requires that a critical database server be restored at an alternate site within a recovery time objective (RTO) of 4 hours. The database is 2 TB in size, and the company has a 100 Mbps WAN link between the primary and alternate sites. The administrator needs to choose a replication method that meets the RTO without requiring manual intervention at the alternate site. Which solution should the administrator implement?

A.Asynchronous storage replication with automated failover

B.Log shipping with manual transaction log application

C.Daily full backups shipped to the alternate site on tape

D.Synchronous storage replication with manual failover

AnswerA

Asynchronous replication sends changes to the alternate site without waiting for acknowledgment, which tolerates WAN latency and bandwidth limits. With automated failover, the alternate site can bring the database online quickly, meeting the 4-hour RTO. It avoids the performance penalty of synchronous replication over a 100 Mbps link.

Why this answer

Asynchronous replication with automated failover balances the need for timely recovery with the constraints of a 100 Mbps WAN link. It avoids the latency-induced performance hit of synchronous replication while enabling the alternate site to activate the database without manual steps, satisfying the 4-hour RTO.

Exam trap

The trap here is assuming that synchronous replication is always better for RTO because it keeps data identical, ignoring the bandwidth and latency limitations of the WAN link.

Full explanation →

365

PBQhard

A large financial services company must comply with federal regulations mandating quarterly disaster recovery tests. Their primary data center in New York hosts all trading applications, and a hot site in Chicago is maintained with real-time data replication via synchronous mirroring. During the last DR test, the IT team successfully failed over network and storage within 8 minutes, meeting the 15-minute RTO for connectivity. However, they encountered a major issue: the hot site's firewalls, intrusion detection systems, and application-level access controls were not configured to match the primary environment. The security team had to manually create firewall rules, update IDS signatures, and reconfigure access policies based on documentation, which took over 4 hours. As a result, the total system readiness exceeded 4.5 hours, causing a significant gap in trading operations. The regulatory auditor noted this deficiency and required a corrective action plan. The company must ensure that the next DR test achieves full operational readiness, including security controls, within the 15-minute RTO. The IT budget is already allocated for the current fiscal year, so large capital expenditures are not possible, but the team can leverage existing tools and automation. Which of the following is the BEST approach to address this issue?

A.Develop detailed runbooks for the security team to manually configure devices during failover; then conduct quarterly drills to reduce configuration time.

B.Re-evaluate the RTO to extend it to 4 hours and inform regulators of a realistic capability.

C.Replace the existing firewalls and IDS at the hot site with identical hardware from the same vendors as the primary site.

D.Implement a configuration management tool that automatically synchronizes firewall rules, IDS signatures, and access controls to the hot site in near real-time.

AnswerD

Why this answer

The core issue is that security controls at the hot site were not synchronized with the primary site, causing a 4-hour manual reconfiguration that blew the 15-minute RTO. A configuration management tool that automatically synchronizes firewall rules, IDS signatures, and access controls in near real-time directly addresses this root cause by eliminating manual intervention during failover. This leverages existing tooling and automation, aligning with the budget constraint while ensuring security parity between sites.

Exam trap

The trap here is that candidates focus on the data replication and network failover success (8 minutes) and overlook that security control configuration is a separate, non-replicated layer — leading them to pick manual runbooks or hardware replacement instead of automated configuration synchronization.

How to eliminate wrong answers

Option A is wrong because detailed runbooks and quarterly drills still rely on manual configuration, which cannot realistically compress a 4-hour manual process into the 15-minute RTO window. Option B is wrong because extending the RTO to 4 hours merely accepts the deficiency rather than correcting it, and it violates the federal regulatory mandate the company must meet. Option C is wrong because replacing hardware with identical vendor models does not automatically synchronize configurations, and it requires large capital expenditures that the budget explicitly prohibits.

Full explanation →

366

Multi-Selectmedium

A server experienced an unexpected power loss. After power is restored, the server boots successfully, but several critical services fail to start automatically. The administrator checks the system logs and finds errors indicating missing LUNs from a SAN. The SAN administrator confirms the SAN is online and the LUNs are assigned to the server's WWNs. The server uses FC HBAs. Which TWO steps should the administrator perform to diagnose the issue?

Select 2 answers

A.Rescan the SCSI bus on the server.

B.Check the FC switch zoning configuration.

C.Replace the FC HBAs.

D.Reboot the SAN controller.

E.Reinstall the multipathing driver.

AnswersA, B

After an unexpected power loss, the HBA may not have re-established its target discovery. Rescanning the SCSI bus forces the host to rediscover LUNs presented by the SAN, resolving the missing-LUN errors reported in the system logs.

Why this answer

Option A is correct because after an unexpected power loss the host may have stale or missing SCSI device entries; rescanning the SCSI bus (e.g., echo "- - -" > /sys/class/scsi_host/hostX/scan or rescan-scsi-bus.sh) forces the HBA driver to re-discover LUNs presented by the SAN, which directly addresses the missing-LUN errors. Option B is correct because even when the SAN administrator confirms LUNs are assigned to the server's WWNs, incorrect or missing FC switch zoning (or an inactive zone set) prevents the host from seeing those LUNs, so verifying the zone membership and that the zone set is enabled is a key diagnostic step. Option C is not appropriate because replacing HBAs is a hardware remedy with no evidence of HBA failure, and the SAN already recognizes the server's WWNs.

Option D is not appropriate because the SAN is confirmed online and rebooting a SAN controller is disruptive and unjustified. Option E is not appropriate because reinstalling the multipathing driver is a software repair step that should only follow confirmation that the driver is actually faulty, not a first-line diagnostic for missing LUNs.

Exam trap

SK0-005 often tests whether candidates jump to hardware replacement or disruptive SAN actions instead of first performing non-disruptive diagnostics like a SCSI rescan and zoning verification when LUNs disappear after a power event.

Full explanation →

367

MCQeasy

Users report that a file server responds to ping by IP address but fails when they browse to it by hostname. The server's IP address has not changed, and other servers on the same subnet resolve correctly. Which of the following should the administrator check FIRST?

A.The DNS record for the file server on the authoritative DNS server

B.The Windows Firewall profile on the file server

C.The duplex and speed settings on the server's network adapter

D.The default gateway configured on the file server

AnswerA

Successful ping by IP but failure by hostname points squarely at name resolution. If the server's address changed or the record was deleted, clients would time out on the hostname while still reaching the IP. Checking the authoritative DNS record confirms whether the A or CNAME entry exists and matches the current address.

Why this answer

When a host answers by IP but not by name, resolution is the failing layer. Other servers resolving correctly rules out a client-side DNS outage, so the record for this specific server is the prime suspect. Checking the authoritative zone confirms whether the entry is missing, stale, or pointing at an old address.

Exam trap

The trap here is chasing the server's network configuration, such as gateway or adapter settings, when the IP path already works and the failure is purely name translation.

Full explanation →

368

MCQmedium

Refer to the exhibit. A web server is running on port 80, but users are unable to connect. The administrator has confirmed the web server service is running. The output of iptables -L is shown. What is the most likely reason for the connectivity issue?

A.The server's default gateway is incorrect

B.The firewall is blocking incoming traffic on port 80

C.SELinux is enforcing and blocking port 80

D.The web server is not bound to the correct IP address

AnswerB

The INPUT chain's default policy is DROP, and no rule permits inbound TCP port 80, so iptables silently discards every HTTP request before it reaches the listening service. Because the web server process itself is healthy, the blockage sits at the packet-filtering layer, matching the stem's confirmed-running service with failed user connections.

Why this answer

The exhibit (iptables -L output) shows a firewall rule that drops or rejects incoming traffic on port 80, which explains why users cannot connect even though the web service is running. The most likely cause is that iptables is blocking inbound TCP/80. Other options are less likely because the service is confirmed running and the question points to the firewall output.

Exam trap

SK0-005 often tests whether candidates can read iptables output and distinguish firewall blocking from service binding or SELinux issues — a common mistake is blaming SELinux or the gateway when the exhibit clearly shows a port 80 drop rule.

How to eliminate wrong answers

Option A is wrong because an incorrect default gateway would affect outbound connectivity and responses to clients on other subnets, but the question specifically highlights the iptables output as the diagnostic clue. Option C is wrong because SELinux enforcing would typically produce an AVC denial in audit logs and would not be visible in iptables -L; the exhibit points to firewall rules. Option D is wrong because if the web server were bound to the wrong IP, the service would not be listening on the expected interface, but the question states the service is running and the exhibit shows firewall rules as the issue.

Full explanation →

369

MCQmedium

A company operates a rack of servers in a shared datacenter. Management wants to ensure that if a malicious actor gains physical access to the rack, they cannot simply remove a hard drive and read the data on another system. Which control BEST addresses this risk?

A.Configure the servers to require a BIOS password before booting from any device.

B.Enable full-disk encryption using a TPM-bound key so drives are unreadable when moved to another system.

C.Install tamper-evident seals on the rack doors and audit them during monthly inspections.

D.Restrict datacenter badge access so only authorized staff can enter the cage area.

AnswerB

Full-disk encryption with a TPM-sealed key renders the drive contents unreadable when it is removed and attached elsewhere, because the key is bound to that specific server's TPM. This directly counters the threat of drive theft and offline reading. Without the original TPM, the attacker cannot unseal the key, so the data stays protected.

Why this answer

The threat is offline reading of a drive after physical removal. Full-disk encryption with a TPM-bound key ensures the volume cannot be decrypted on another machine because the sealing key never leaves the original TPM. BIOS passwords, tamper seals, and badge access may deter or detect intruders, but none of them make the data itself unreadable once the disk is in an attacker's hands.

Exam trap

The trap here is believing that physical access controls alone protect data, when a removed drive can be read on any compatible system unless encryption is in place.

Full explanation →

370

Multi-Selecthard

A server administrator is investigating a Linux file server that periodically becomes unresponsive for several minutes. During an outage, the administrator runs top and iostat and observes that %iowait is extremely high while CPU utilization remains low. Disk latency on the data volume spikes to several seconds. The storage is a hardware RAID 10 array with healthy member disks, and no rebuild or patrol read is active. Which of the following are the MOST likely causes of the observed latency? (Choose two.)

Select 2 answers

A.The server's memory is running in single-channel mode instead of dual-channel mode

B.The network interface has negotiated a lower speed, causing the file server's clients to time out

C.The RAID controller's write-back cache has been disabled or switched to write-through mode

D.The array is rebuilding after a member disk replacement, consuming all available controller bandwidth

E.A backup or antivirus scan is issuing a large volume of small random reads and writes to the data volume

AnswersC, E

Without write-back caching, every write must be committed to the physical media before the operation completes, so bursts of small writes produce multi-second latency and high %iowait even on healthy RAID 10 members. This directly matches the symptom pattern of low CPU with extreme disk wait, and it is a common cause after battery or capacitor failures force the controller into write-through mode.

Why this answer

High %iowait with low CPU utilization and multi-second latency on a healthy RAID 10 array points to storage-side saturation. Disabling write-back caching forces synchronous writes to media, and heavy small-block random I/O from a backup or antivirus sweep can exhaust the array's IOPS, both producing the episodic stalls described. Eliminating rebuild activity and memory or network causes leaves these two as the most likely culprits.

Exam trap

The trap here is blaming the network or memory for slow file access when the measured server-side counters clearly localize the wait to the storage subsystem.

Full explanation →

371

MCQhard

A company stores nightly full backups on an external USB drive that is rotated weekly and kept in a locked cabinet in the same server room. A recent audit found that a fire in the server room would destroy both the production data and the backup drive. The company wants to improve the backup strategy so that a site-wide disaster does not eliminate all copies, while keeping costs low. Which of the following is the BEST change to meet these requirements?

A.Enable RAID 6 on the server's internal disks so that two disk failures can be tolerated.

B.Configure the backup software to write a copy to a cloud object storage bucket in a different region after each nightly job.

C.Add a second USB drive that is rotated daily but stored in the same locked cabinet.

D.Increase the backup frequency from nightly to hourly to reduce the recovery point objective.

AnswerB

Copying the nightly backup to cloud object storage in a separate region creates an off-site copy that survives a site-wide disaster such as a fire. Object storage is relatively inexpensive for infrequent access and can be configured with lifecycle policies, so it meets the low-cost requirement. This aligns with the 3-2-1 rule by adding a geographically separate copy.

Why this answer

The audit finding is about the lack of an off-site copy, so the fix must move at least one backup copy to a different location. Writing a nightly copy to cloud object storage in another region provides geographic separation at low cost and aligns with the 3-2-1 backup principle. Additional local drives, RAID, and more frequent backups do not protect against a site-wide fire.

Exam trap

The trap here is focusing on backup frequency or local redundancy when the audit finding is specifically about the absence of an off-site copy.

Full explanation →

372

MCQeasy

A datacenter technician is asked to physically destroy the storage media from a set of decommissioned servers that held customer records. The company's policy requires that the media be rendered unreadable and that a certificate of destruction be retained. Which action best satisfies this requirement?

A.Degauss the drives and then shred them, obtaining a certificate of destruction from the vendor.

B.Shred or incinerate the drives through a certified destruction vendor and retain the certificate of destruction.

C.Run the vendor's secure erase utility on each drive and return the drives to the server for redeployment.

D.Delete the partitions and format each drive, then document the action in the asset management system.

AnswerB

Physical destruction by shredding or incineration reduces the media to fragments or ash, making recovery of customer records infeasible regardless of whether the drives are magnetic or solid state. A certified vendor issues a certificate of destruction documenting the serial numbers and method, which satisfies the policy's documentation requirement. This is the most reliable approach when the media must be rendered unreadable.

Why this answer

When policy requires media to be rendered unreadable and a destruction certificate to be retained, physical destruction through a certified vendor is the surest path. Shredding or incineration works on both magnetic and solid-state media, unlike degaussing, which only affects magnetic drives. The certificate documents serial numbers and the destruction method, giving auditors verifiable evidence that the customer records cannot be recovered.

Exam trap

The trap here is assuming that degaussing applies to all drives, when it is ineffective against solid-state media that may be present in the same decommissioned servers.

Full explanation →

373

Multi-Selecthard

A security administrator is hardening a Linux server that hosts a public web application. The server currently allows root login via SSH and uses default SSH port 22. The administrator wants to reduce the attack surface by implementing SSH best practices. Which two actions should the administrator take? (Choose two.)

Select 2 answers

A.Change the SSH port from 22 to a non-standard port, such as 2222.

B.Disable password authentication by setting PasswordAuthentication no and use SSH keys.

C.Enable password authentication to ensure only authorized users can log in.

D.Disable root login by setting PermitRootLogin no in /etc/ssh/sshd_config.

E.Allow SSH access from any IP address to ensure administrators can connect from anywhere.

AnswersB, D

Disabling password authentication and requiring SSH keys eliminates the risk of brute-force password attacks. Keys are much harder to guess or crack, and they can be protected with passphrases. This is a fundamental SSH hardening measure. It directly reduces the attack surface by removing a common vector for unauthorized access. This action is strongly recommended for public-facing servers.

Why this answer

Disabling root login and disabling password authentication in favor of SSH keys are two fundamental SSH hardening practices. They reduce the attack surface by eliminating direct root access and removing the risk of password brute-force attacks. Changing the port is security through obscurity, enabling password authentication weakens security, and allowing SSH from any IP increases exposure.

These two actions directly address the scenario's requirements.

Exam trap

The trap here is believing that changing the SSH port is a strong security measure; it is merely obscurity and does not reduce the attack surface as effectively as disabling root login and password authentication.

Full explanation →

374

MCQhard

A company has a Windows Server 2022 server that runs a custom application which writes heavily to a local SSD. The administrator notices that the SSD's wear-leveling indicator shows significant wear after only six months. The server logs show frequent small write operations. Which action should the administrator take to reduce SSD wear while maintaining performance?

A.Move the application's log files to a different volume on the same SSD.

B.Enable write caching on the SSD controller.

C.Disable the page file on the SSD.

D.Configure the application to batch small writes into larger sequential writes.

AnswerD

Batching small writes into larger sequential writes reduces write amplification and the number of program/erase cycles on the SSD, directly lowering wear. This approach maintains performance because sequential writes are generally more efficient for SSDs. It addresses the root cause, which is frequent small writes, and is a recommended optimization for write-intensive applications on flash storage.

Why this answer

The most effective way to reduce SSD wear from frequent small writes is to batch them into larger sequential writes, which lowers write amplification. This maintains performance while extending the drive's lifespan. Moving logs within the same SSD or enabling write caching does not reduce the total bytes written, and disabling the page file introduces instability without addressing the application's write pattern.

Exam trap

The trap here is assuming that any write-related optimization, such as caching or moving files, will reduce SSD wear, when only reducing total writes or write amplification does.

Full explanation →

375

MCQeasy

A company wants to protect its Microsoft SQL Server database with a backup strategy that provides point-in-time recovery up to every 15 minutes. The database is critical and runs on a dedicated server. Which backup schedule should be implemented?

A.Use storage-level snapshots every 15 minutes on a SAN.

B.Full backup daily, differential backup hourly.

C.Full backup weekly, differential daily, transaction log backups every 15 minutes.

D.Set up database mirroring with automatic failover and full weekly backups.

AnswerC

Combining full, differential, and frequent transaction log backups allows restoration to any point in time down to the last log backup.

Why this answer

Option B (Full backup weekly, differential daily, transaction log backups every 15 minutes) is correct because full and differential backups provide a base, while frequent transaction log backups enable granular point-in-time restore. Option A lacks transaction log backups, so recovery granularity is limited to daily. Option C uses mirroring, which is high availability (not a backup) and does not protect against logical corruption.

Option D uses snapshot technology but snapshots alone are not a backup and may impact performance if taken every 15 minutes.

Full explanation →

Page 5 of 6

All pages

Practice SK0-005 by domain

Target a specific domain to shore up weak areas.

server-administration server-hardware-installation-management security-disaster-recovery troubleshooting

See all domains with question counts →