Courseiva

CompTIA Server+ SK0-005 (SK0-005) — Questions 376–414

414 questions total · 6 pages · All types, answers revealed

Take a mock examExam hub
Page 5

Page 6 of 6

376
Multi-Selectmedium

A server administrator is configuring a new Windows Server 2022 file server. The server will host a share that must be accessible to both Windows and macOS clients. The administrator needs to ensure that file permissions are enforced consistently across both platforms. Which two of the following should the administrator implement? (Choose two.)

Select 2 answers
A.Configure the share to use SMB 3.1.1 with encryption.
B.Ensure that the macOS clients connect using SMB.
C.Install Services for Macintosh (SFM) on the server.
D.Use NTFS permissions on the folder.
E.Enable Access-Based Enumeration (ABE) on the share.
AnswersB, D

macOS supports SMB natively and can connect to Windows shares. When macOS uses SMB, it respects NTFS permissions because the server enforces them based on the authenticated user's token. This ensures consistent permission enforcement. Using SMB is the recommended method for macOS to access Windows file shares in modern environments.

Why this answer

To enforce permissions consistently for both Windows and macOS clients, the administrator should use NTFS permissions, which are enforced by the server regardless of client OS, and ensure macOS clients connect via SMB. macOS supports SMB and will honor NTFS ACLs. ABE only affects visibility, SMB encryption only secures data in transit, and Services for Macintosh is obsolete.

Exam trap

The trap here is thinking that legacy Services for Macintosh or share-level permissions are needed, or that encryption or ABE affect permission enforcement.

Full explanation →
377
MCQhard

A storage administrator is troubleshooting a SAN-attached server that intermittently loses access to its LUNs. The Windows Server event log shows repeated 'Disk' warning events with the message that a device has been surprise-removed, and the host bus adapter logs report link resets. The SAN fabric switches show no errors, and the array reports all ports healthy. Which of the following is the MOST likely cause?

A.The LUN is configured with the wrong RAID level on the array.
B.The SAN array has a failing controller that is dropping frames on the fabric.
C.The multipath I/O software is misconfigured, causing path thrashing between the two HBAs.
D.The zoning configuration on the fabric switches is missing the second HBA's WWPN.
AnswerC

Surprise-removal events combined with HBA link resets and a clean fabric point to the host repeatedly switching active paths. Incorrect MPIO policy or missing vendor DSM settings can cause the host to flap between paths, dropping the device each time, which matches the intermittent loss of LUN access.

Why this answer

Intermittent surprise-removal events with HBA link resets on a fabric and array that both report healthy are classic symptoms of path instability at the host. A misconfigured or unsupported MPIO policy causes the host to repeatedly fail over between adapters, dropping the LUN each time it switches.

Exam trap

The trap here is blaming the fabric or array because the symptom is storage-related, when the evidence points to host-side multipath behavior.

Full explanation →
378
MCQmedium

A technician is installing a new 1U server into a rack that has been in production for three years. The server arrives with a rail kit that requires the rails to be attached to the server chassis before mounting. After attaching both rails, the technician notices the server does not slide smoothly and the front of the server is not flush with the other servers in the rack. Which of the following is the MOST likely cause?

A.The rails were installed on the wrong sides of the chassis, reversing the front-to-back orientation.
B.The rack posts are not square, so the rail kit cannot be mounted at the correct depth.
C.The rail kit is designed for a different rack depth and must be extended before the server is inserted.
D.The server chassis is too heavy for the rail kit and is bending the rails under load.
AnswerA

Rail kits are side-specific and front-to-back oriented; installing the left rail on the right side (or vice versa) causes binding and prevents the chassis from sitting flush. The mounting flanges and locking tabs will not align with the rack posts correctly, producing exactly the rough sliding and misalignment described.

Why this answer

Rail kits are handed and oriented front-to-back; when a rail is mounted on the wrong side of the chassis, the locking tabs and mounting flanges face the wrong direction. The server can still be forced into the rack, but it binds and sits proud of the other equipment. Reversing the rails to their correct sides resolves both the sliding friction and the front-panel alignment.

Exam trap

The trap here is assuming any rail that physically attaches is installed correctly, when side-specific orientation is what actually determines smooth travel and flush mounting.

Full explanation →
379
MCQeasy

A system administrator is setting up a new server rack. The server has redundant power supplies. The administrator wants to ensure that the server remains operational if one power supply fails or if one power source fails. Which of the following should the administrator do?

A.Connect one power supply to a PDU and leave the other unplugged as a spare.
B.Connect both power supplies to the same PDU.
C.Connect each power supply to a different PDU on separate circuits.
D.Connect both power supplies to the same circuit but different outlets.
AnswerC

Connecting each power supply to a different PDU on separate circuits ensures redundancy at both the power supply and power source levels. If one PDU or circuit fails, the other continues to provide power. This is a best practice for mission-critical servers and meets the requirement of maintaining operation during a power supply or power source failure.

Why this answer

For redundant power supplies to be effective, they must be connected to separate power sources, such as different PDUs on different circuits. This ensures that a failure in one power path does not affect the other. Connecting both to the same PDU or circuit leaves a single point of failure.

Exam trap

The trap here is thinking that plugging into different outlets on the same circuit provides redundancy, when a circuit failure would still take down both power supplies.

Full explanation →
380
PBQhard

A company is expanding its data center to support a new four-node database cluster for a critical application requiring 99.999% uptime, meaning only minutes of downtime per year. Each server node has dual 1000W power supplies. The facility provides two independent power feeds from separate utility substations, each backed by its own online double-conversion UPS. There are four 20A/208V PDUs available, two per power feed. The design must ensure that the loss of any single power feed, any single UPS, or any single PDU does not cause any server to lose power or impact the cluster's availability. The servers are located in a single rack, and cabling must follow best practices for manageability and airflow. The IT architect is evaluating different power distribution strategies to meet these fault-tolerance requirements. Which of the following configurations achieves full redundancy with no single point of failure in the power path?

A.Connect each server's power supplies to two PDUs that are both on the same power feed, and use the second feed only as a cold standby in case of a primary feed failure.
B.Connect the first power supply of each server to a PDU on power feed A and the second power supply to a PDU on power feed B.
C.Connect each server's power supplies to the same PDU, but distribute servers across the four PDUs for load balancing.
D.Use a single large PDU with dual inputs from both feeds and an automatic transfer switch, connecting all servers to that PDU.
AnswerB

Why this answer

Option D is correct because connecting each server's power supplies to two different PDUs that are on separate power feeds guarantees that if one feed, UPS, or PDU fails, the server continues to receive power from the remaining source. Option A does not protect against PDU failure. Option B exposes servers to a power feed failure.

Option C introduces a single PDU as a single point of failure.

Full explanation →
381
MCQeasy

To comply with company security policies, a server administrator must disable all unnecessary services on a newly deployed Windows Server 2019. The server will only act as a file server with no web hosting role. Which service should be disabled?

A.World Wide Web Publishing Service
B.DHCP Server service
C.Server service
D.DNS Server service
AnswerA

This is an IIS component; if web hosting is not needed, it should be disabled to reduce the attack surface.

Why this answer

Option C is correct because the World Wide Web Publishing Service (W3SVC) is part of IIS and is not required for a file server role. Leaving it running increases the attack surface. Option A (DNS Server) might be used if the server provides name resolution, but it is not mentioned.

Option B (DHCP Server) is also not specified as needed. Option D (Server service) is essential for file sharing and should not be disabled.

Full explanation →
382
MCQhard

An administrator is preparing a new rack-mount server that will host a database with heavy random-read workloads. The server has four NVMe U.2 bays and two SATA bays. The administrator wants the highest possible random-read IOPS with the least latency, and the data must remain available if any single drive fails. Which of the following storage configurations should the administrator implement?

A.Four NVMe drives in a RAID 0 stripe to maximize throughput and IOPS for the database.
B.Two SATA SSDs in a RAID 1 mirror for the database, with the NVMe bays left empty for future expansion.
C.Two NVMe drives in a RAID 1 mirror for the database, leaving the remaining NVMe and SATA bays available.
D.Three NVMe drives in a RAID 5 array with one NVMe drive left as an unassigned spare.
AnswerC

A RAID 1 mirror of NVMe drives provides the lowest read latency and highest random-read IOPS because reads can be serviced from either drive, and the mirror tolerates the loss of one drive. This satisfies both the performance and the single-failure availability requirements with the available hardware.

Why this answer

NVMe drives attached through PCIe deliver much higher random-read IOPS and lower latency than SATA SSDs, and a RAID 1 mirror lets reads be served from both members while surviving one drive failure. Using two NVMe drives in a mirror meets both the performance and redundancy goals without incurring parity overhead.

Exam trap

The trap here is chasing maximum raw speed with a stripe while forgetting that the workload also requires surviving a single drive failure.

Full explanation →
383
MCQmedium

A server administrator is troubleshooting a server that unexpectedly rebooted overnight. The administrator reviews the system logs and finds Event ID 6008 in the Windows System log, indicating an unexpected shutdown. There are no corresponding events for a thermal trip or power failure. Which of the following should the administrator check FIRST to determine the cause?

A.Review the Windows Update history to see if a patch was installed that required a reboot.
B.Check the server's out-of-band management controller logs for power or hardware events.
C.Run a memory diagnostic to check for faulty RAM.
D.Verify that the UPS is functioning correctly and has enough battery capacity.
AnswerB

Because the operating system was not running cleanly when the server went down, its own logs may say nothing about the cause. The out-of-band management controller, such as iDRAC, iLO, XClarity or another BMC, runs independently of the OS and records power supply failures, voltage and temperature events, memory errors and watchdog resets. Checking its log is quick and often explains the reboot immediately.

Why this answer

Event ID 6008 indicates an unexpected shutdown, which often stems from hardware or power issues. The out-of-band management controller logs are the best source for hardware-level events like power supply failures or thermal trips that are not visible to the OS. Reviewing these logs first can quickly identify or rule out hardware causes before moving to OS-level diagnostics.

Exam trap

The trap here is assuming that an unexpected shutdown is always software-related and diving into OS logs, when hardware logs often hold the answer.

Full explanation →
384
MCQhard

A server administrator is investigating intermittent network disconnects on a production server. The server is connected to a Cisco switch with a single Cat 6a cable. The administrator runs a cable tester and finds that the cable passes all tests. However, users report that connectivity drops for a few seconds multiple times per day. The switch logs show that the port flaps (goes up and down) during these times. Which of the following is the MOST likely cause?

A.The network cable is experiencing electromagnetic interference (EMI) from nearby power cables.
B.The switch port is configured with an incorrect speed or duplex setting, causing a mismatch.
C.The NIC firmware is outdated and causing the link to reset under load.
D.The NIC is configured to allow the operating system to turn off the device to save power.
AnswerD

Power management settings on the NIC can cause the adapter to enter a low-power state, leading to link drops that appear as flapping on the switch. This is a common cause of intermittent disconnects, especially when the server is idle. Disabling power-saving features on the NIC typically resolves the issue.

Why this answer

Intermittent link flapping with a known-good cable often points to NIC power management. When the operating system is allowed to turn off the NIC to save power, the link can drop and re-establish, causing the switch port to flap. Disabling this setting in the NIC's power management properties prevents the adapter from powering down and stabilizes connectivity.

Exam trap

The trap here is focusing on physical layer issues like cables or switch configuration when the cause is a software-controlled power-saving feature on the NIC.

Full explanation →
385
MCQeasy

A junior administrator is asked to document the recovery point objective for a critical order-processing system. What does the recovery point objective define?

A.The total cost the organization is willing to spend to recover the system after an outage.
B.The maximum acceptable time for the system to be unavailable after a failure.
C.The point in the disaster recovery plan at which the incident commander declares the disaster resolved.
D.The maximum acceptable amount of data loss measured in time before the failure occurred.
AnswerD

The recovery point objective expresses how much data the business can afford to lose, stated as a time interval such as fifteen minutes or four hours. It drives backup frequency and replication design because the chosen technology must be able to restore data to a point within that window. For an order system, this determines whether nightly backups or continuous replication is required.

Why this answer

The recovery point objective quantifies tolerable data loss as an amount of time, which then determines how often backups or replication must occur. The recovery time objective covers outage duration, cost tolerance is a budget constraint, and a declaration of resolution is an incident-management milestone. For order processing, the objective directly drives whether continuous replication is needed.

Exam trap

The trap here is swapping the recovery point objective with the recovery time objective, since both use time units but measure different things.

Full explanation →
386
MCQmedium

An organization's disaster recovery plan specifies an RPO of 4 hours. Their current backup schedule performs a full backup at midnight and incremental backups every 2 hours from 8:00 AM to 8:00 PM. A server failure occurs at 3:00 AM, and data created after 8:00 PM the previous day is permanently lost. Which of the following is the MOST likely reason?

A.The incremental backups were not synthetically rolled into the full backup.
B.The RPO was set too low for the business requirements.
C.There is a gap in the backup schedule overnight that exceeds the RPO.
D.The backup media became corrupted.
AnswerC

The schedule only covers 8:00 AM–8:00 PM with incrementals, leaving a long interval overnight where no backups capture data changes, violating the 4-hour RPO.

Why this answer

Option C is correct because the backup schedule has no coverage from 8:00 PM to 8:00 AM the next morning (except full at midnight), creating a 12-hour gap overnight that exceeds the 4-hour RPO. Data created after 8:00 PM and before the failure at 3:00 AM is lost because no backup captured it. Option A is incorrect because RPO is a requirement, not the cause.

Option B is speculative. Option D refers to synthetic fulls, which are not relevant to this gap.

Full explanation →
387
Multi-Selecthard

A server administrator is troubleshooting a server that has been experiencing random reboots and unexpected shutdowns. The administrator has checked the system logs and found multiple 'Machine Check Exception' (MCE) events and 'Corrected Memory Error' warnings. The server is running mission-critical applications and cannot be taken offline for extended periods. Which of the following should the administrator perform to diagnose and resolve the issue? (Choose two.)

Select 2 answers
A.Disable error correction in the BIOS to prevent further errors.
B.Reinstall the operating system to eliminate software-related memory errors.
C.Replace the power supply unit with a higher-wattage model.
D.Update the server's BIOS and firmware to the latest versions.
E.Run a comprehensive memory diagnostic test using a tool such as Memtest86+.
AnswersD, E

BIOS and firmware updates often include microcode patches that address known memory compatibility issues and error handling. Outdated firmware can cause incorrect memory error reporting or even contribute to MCEs. Updating to the latest versions is a recommended step for resolving such errors and ensuring system stability.

Why this answer

Corrected memory errors and MCEs often stem from faulty RAM or outdated firmware. Running a memory diagnostic test identifies bad modules, while updating BIOS/firmware can resolve known errata and improve memory handling. These two actions directly address the root causes without unnecessary hardware changes or system reinstalls.

Exam trap

The trap here is focusing on power or software solutions when the error messages explicitly point to memory and firmware issues.

Full explanation →
388
MCQhard

Refer to the exhibit. A server administrator is reviewing security logs after a suspected brute-force attack on the SSH service. The following excerpt from /var/log/secure is displayed. Which security control would have been MOST effective in preventing the successful login?

A.Disabling root login via SSH.
B.Implementing fail2ban or similar intrusion prevention.
C.Enforcing a strong password policy.
D.Using a different SSH port.
AnswerB

fail2ban tracks authentication failures and temporarily or permanently bans IPs that exceed the threshold, which would have blocked 192.168.1.100 after the initial failures, preventing the successful login.

Why this answer

Option B is correct because fail2ban or a similar intrusion prevention system monitors logs for repeated failures and blocks the attacker's IP address after a configurable number of attempts, stopping the attack before the correct password is guessed. Option A is wrong because a strong password policy might resist guessing for a long time, but the admin password was eventually guessed; it does not actively prevent repeated attempts. Option C is wrong because disabling root login would not have prevented the attack on the admin account, which was the one compromised.

Option D is wrong because changing the SSH port is security through obscurity and does not prevent brute-force attempts once the port is discovered.

Full explanation →
389
MCQhard

A server administrator is configuring a Windows Server 2022 as an iSCSI target. The server will provide storage to multiple iSCSI initiators. The administrator wants to ensure that only authorized initiators can access the storage and that data is encrypted in transit. Which of the following should the administrator configure?

A.Configure mutual CHAP and enable SMB signing.
B.Use Kerberos authentication and enable BitLocker on the target volumes.
C.Enable IPsec and configure access control lists (ACLs) on the target.
D.Enable CHAP authentication and IPsec encryption.
AnswerD

CHAP authentication verifies the identity of initiators, ensuring only authorized ones can connect. IPsec encryption secures data in transit, protecting it from eavesdropping. Together, they meet the requirements for access control and encryption. This is the correct configuration for securing iSCSI traffic.

Why this answer

To secure iSCSI storage, authentication and encryption are essential. CHAP authenticates initiators, preventing unauthorized access. IPsec encrypts data in transit, ensuring confidentiality.

Other options either use inappropriate protocols (SMB, Kerberos) or only provide partial security (ACLs without authentication).

Exam trap

The trap here is confusing protocols—using SMB signing or BitLocker, which do not apply to iSCSI in-transit encryption or initiator authentication.

Full explanation →
390
MCQeasy

A server fails to complete POST and emits a series of beeps: two long, three short. According to the manufacturer's documentation, this beep code indicates a memory error. The server has eight DIMMs installed. Which of the following steps should the technician perform FIRST?

A.Replace all memory modules.
B.Reseat all memory modules and attempt to boot.
C.Clear the CMOS battery.
D.Update the server's UEFI firmware.
AnswerB

Reseating memory modules is the least invasive first step, addressing intermittent contact faults that commonly trigger memory beep codes. It avoids unnecessary part replacement before confirming whether reseating resolves the POST failure across the eight installed DIMMs.

Why this answer

When a POST beep code indicates a memory error, the least invasive and most logical first step is to reseat all memory modules and retry the boot. Memory modules can become unseated due to thermal cycling, vibration, or incomplete installation, and reseating is a non-destructive action that may resolve the error without replacing hardware. Only if reseating fails should the technician proceed to more involved diagnostics such as testing individual DIMMs or replacing modules.

Exam trap

SK0-005 often tests the principle of 'least invasive first' — candidates are tempted to jump to hardware replacement or firmware updates when the correct answer is the simplest physical remediation step.

How to eliminate wrong answers

Option A is wrong because replacing all memory modules is a costly, time-consuming action that should only be taken after reseating and individual DIMM testing have failed to resolve the issue. Option C is wrong because clearing the CMOS battery resets BIOS/UEFI settings and is unrelated to a memory POST beep code; it would not address a physical memory fault. Option D is wrong because updating UEFI firmware is a maintenance action that does not resolve a hardware-level memory error indicated by POST beeps and could introduce additional risk if performed unnecessarily.

Full explanation →
391
MCQmedium

A server's performance degrades significantly during peak usage hours. Monitoring shows high memory utilization and consistently high disk I/O. Which of the following should the technician check FIRST?

A.RAID controller battery status
B.Network bandwidth utilization
C.CPU utilization statistics
D.Page file location and configuration
AnswerD

High memory utilisation with sustained disk I/O points to paging, where Windows offloads memory pages to disk. Checking the page file's location and size reveals whether it sits on a slow or contended volume, and whether it is too small, forcing excessive paging. This directly addresses the memory and disk pressure seen at peak hours.

Why this answer

High memory utilization combined with consistently high disk I/O strongly suggests the system is paging — moving memory contents to and from disk because physical RAM is exhausted. The page file's location and configuration directly affect paging performance, so checking it first is the most targeted diagnostic step. If the page file is on a slow disk, is too small, or is fragmented across volumes, it can cause severe I/O bottlenecks during peak usage.

Exam trap

SK0-005 often tests whether candidates recognize the memory-disk I/O correlation as a paging symptom rather than chasing unrelated subsystems like CPU or network, which are common distractors in performance questions.

How to eliminate wrong answers

Option A is wrong because RAID controller battery status affects write-back caching behavior, but it would not typically produce the combination of high memory utilization and high disk I/O seen here. Option B is wrong because network bandwidth utilization would not cause high local disk I/O and memory pressure on the server itself. Option C is wrong because CPU utilization statistics, while useful, do not explain the correlation between memory exhaustion and disk I/O that points directly to paging activity.

Full explanation →
392
MCQeasy

An organization wants to test its disaster recovery plan with minimal disruption to business operations and minimal cost. The test should verify the plan's effectiveness by discussing scenarios. Which type of test should they perform?

A.Tabletop exercise
B.Parallel test
C.Full interruption test
D.Simulation test
AnswerA

A tabletop exercise is a walk-through discussion that incurs almost no direct cost and zero disruption, making it ideal for initial plan verification.

Why this answer

Option C is correct because a tabletop exercise is a discussion-based review of the plan steps with key stakeholders, requiring no system downtime and very low cost. A full interruption test (Option A) actually shuts down primary systems and fails over, causing disruption. A parallel test (Option B) runs systems at the DR site without cutting over but still involves significant resource allocation.

A simulation test (Option D) may involve live drills or emulate components, often costing more than a tabletop.

Full explanation →
393
Multi-Selecteasy

During a security incident, a server is suspected to be compromised by malware. The incident response team needs to preserve evidence and minimize impact. Which TWO actions should be taken FIRST? (Select TWO.)

Select 2 answers
A.Disconnect the server from the network.
B.Run an antivirus scan.
C.Reboot the server in safe mode.
D.Power off the server immediately.
E.Make a forensic image of the system memory.
AnswersA, E

Isolating the server from the network stops the attacker's remote access and prevents malware propagation while preserving the system state for investigation.

Why this answer

Options B and C are correct. Disconnecting the server from the network (B) is an immediate containment step to prevent data exfiltration or spread. Capturing a forensic image of system memory (C) preserves volatile data such as running processes, network connections, and encryption keys before they are lost.

Option A is wrong because powering off loses all volatile evidence. Option D is wrong because running an AV scan modifies files and could destroy forensic artifacts. Option E is wrong because rebooting erases memory and may trigger malware countermeasures.

Full explanation →
394
MCQmedium

An administrator must choose a physical security control for a new server room door that will allow staff to enter quickly during an emergency while still recording who entered and when. Which solution BEST fits?

A.Install a biometric reader that grants access based on fingerprint recognition only.
B.Install a badge reader configured as fail-secure so the door remains locked when power is lost.
C.Install a badge reader with an electronic audit log and a fail-safe release that unlocks on power loss.
D.Install a mechanical keyed lock with keys issued to each staff member.
AnswerC

A badge reader with logging satisfies the requirement to record who entered and when, and a fail-safe lock releases when power is lost, allowing rapid egress during an emergency. This combination addresses both the accountability and life-safety needs described in the scenario without relying on manual intervention.

Why this answer

The door needs both accountability and safe, fast passage during emergencies. An electronic badge reader with an audit log records entries, while a fail-safe release ensures the lock disengages when power is lost so people are not trapped. Together they meet the physical security and life-safety requirements stated.

Exam trap

The trap here is confusing fail-safe and fail-secure behavior, assuming that the most restrictive lock setting is always the most secure choice.

Full explanation →
395
PBQmedium

A server administrator is assembling a new high-performance server using a Supermicro X12 motherboard, two Intel Xeon Gold 5317 processors (LGA 4189 socket), and 16x 32GB DDR4-3200 ECC LRDIMMs for a total of 512GB of memory. The chassis has redundant 1600W power supplies. After assembling all components, the administrator powers on the server. All fans start spinning at full speed, and the front panel LEDs illuminate. However, the server does not POST, there are no beep codes, and no video output is displayed. The motherboard has a two-digit hexadecimal POST code LED display, which shows '00' and does not change. The motherboard manual states that code '00' indicates the CPU is not detected or has failed. The processors are confirmed to be the correct socket type and stepping as required by the motherboard. What should the technician do FIRST?

A.Reseat both processors and inspect the CPU sockets for bent pins
B.Replace both processors as they are likely faulty
C.Clear the CMOS using the jumper or button on the motherboard
D.Update the BIOS to the latest version using the IPMI interface
AnswerA

Why this answer

Option B is correct. The POST code '00' typically indicates a CPU initialization failure. The first and least invasive step is to reseat the processors, checking for bent socket pins, debris, or improper mounting.

This resolves a majority of such issues. Option A (replace both CPUs) is extreme and should only be done after ruling out physical installation issues. Option C (clear CMOS) may help if the BIOS was misconfigured for a previous CPU, but physical reseating is more direct.

Option D (update BIOS) is not possible if the system cannot POST to enter the update utility; furthermore, if the CPUs are supported by the current BIOS version, updating is unnecessary.

Full explanation →
396
MCQeasy

A server administrator is tasked with replacing a failed power supply in a redundant power configuration. The server has two hot-swappable power supplies. Which of the following should the administrator do FIRST to safely replace the failed unit?

A.Verify that the remaining power supply is functioning and the server is not drawing power from the failed unit.
B.Remove the failed power supply immediately to prevent electrical damage.
C.Power down the server and disconnect all power cords.
D.Update the firmware on the remaining power supply before replacement.
AnswerA

Before replacing a hot-swappable power supply, you must confirm that the redundant supply is online and providing adequate power. This ensures that removing the failed unit will not cause an unexpected shutdown. Checking the status LEDs or management interface is a quick way to verify redundancy. This step is critical for safety and uptime.

Why this answer

In a redundant power supply configuration, each supply can independently power the server. Before hot-swapping a failed unit, you must confirm that the other supply is healthy and carrying the load. This is typically indicated by a green LED or a management console status.

Once verified, the failed supply can be removed and replaced without downtime.

Exam trap

The trap here is assuming that any failed power supply can be removed immediately without checking the status of the redundant unit.

Full explanation →
397
MCQhard

Refer to the exhibit. A Linux server started reporting I/O errors to its local disk. The administrator runs `dmesg` and sees the output shown. Which of the following is the MOST likely cause of the errors?

A.The disk has a bad sector that cannot be remapped.
B.The filesystem on /dev/sda is corrupted.
C.The SCSI cable is loose.
D.The RAID controller firmware is outdated.
AnswerA

dmesg I/O errors referencing unrecoverable read failures on a specific sector indicate the drive cannot remap that sector to a spare, so reads fail persistently. This matches a bad sector that cannot be remapped, distinguishing it from cabling or controller faults.

Why this answer

I/O errors reported by dmesg that reference specific sectors on a local disk typically indicate a bad sector that the drive's firmware cannot remap to a spare sector. When the disk's spare sector pool is exhausted or the error is unrecoverable, the kernel logs I/O errors against the affected block device. This is the most likely cause when the errors are isolated to a single disk and no other systemic issues are present.

Exam trap

SK0-005 often tests whether candidates can distinguish between disk-level hardware errors (bad sectors) and filesystem-level corruption, since both produce I/O-related messages but require very different remediation.

How to eliminate wrong answers

Option B is wrong because filesystem corruption would typically produce different error messages (e.g., ext4 errors, journal aborts) rather than raw I/O errors tied to specific disk sectors. Option C is wrong because a loose SCSI cable would usually cause the entire device to drop offline or produce widespread, intermittent errors across all disks on that bus, not isolated sector-level I/O errors. Option D is wrong because outdated RAID controller firmware would affect the entire array's behavior and would not typically manifest as isolated bad-sector I/O errors on a single disk.

Full explanation →
398
Multi-Selectmedium

A company is creating a disaster recovery plan for its on-premises data center. Which THREE elements are essential to include in the DR plan? (Select THREE.)

Select 3 answers
A.Contact information for key personnel.
B.RTO and RPO for each critical system.
C.Detailed instructions for cleaning server hardware.
D.Step-by-step procedures for performing backups.
E.List of failover site addresses and access procedures.
AnswersA, B, E

During a disaster, communication is vital; the plan must include up-to-date contact details for the response team, stakeholders, and vendors.

Why this answer

Options A, C, and E are correct. Contact information for key personnel (A) ensures that the recovery team can be reached during a crisis. RTO and RPO for each critical system (C) define the recovery goals and guide the technical implementation.

The list of failover site addresses and access procedures (E) provides vital instructions for reaching and securing the secondary location. Option B is wrong because cleaning procedures are operational but not a core DR plan element. Option D is wrong because backup procedures are part of the backup policy, not the disaster recovery plan; the DR plan assumes backups exist and focuses on restoring from them.

Full explanation →
399
Multi-Selectmedium

A server administrator is troubleshooting a server that intermittently loses network connectivity. The administrator suspects a hardware issue. Which two components should the administrator check first? (Choose two.)

Select 2 answers
A.Network cable
B.CPU
C.Hard drive
D.Power supply unit (PSU)
E.Network interface card (NIC)
AnswersA, E

A damaged or loose network cable can cause intermittent connectivity. Checking the cable involves reseating, swapping with a known-good cable, and testing. This is a quick and logical first step because cables are a common point of failure. If the cable is faulty, replacing it resolves the issue.

Why this answer

The correct answers are the NIC and the network cable. Intermittent network connectivity often stems from these components. Checking the NIC involves driver updates and event log review, while the cable should be reseated or replaced.

These steps are quick, non-disruptive, and address the most probable causes.

Exam trap

The trap here is overcomplicating the diagnosis by considering system-wide components like the PSU or CPU, when the symptom is isolated to network connectivity.

Full explanation →
400
Multi-Selecthard

A server administrator is troubleshooting a Linux web server that has become unresponsive to SSH and HTTP requests. The administrator connects through the out-of-band management console and finds the system load average extremely high, with a large number of processes in the D state. The administrator suspects an I/O bottleneck. Which of the following commands should the administrator use to identify the processes and devices contributing to the bottleneck? (Choose two.)

Select 2 answers
A.systemctl status httpd
B.free -m
C.iotop -o
D.netstat -tulpn
E.iostat -x 2
AnswersC, E

iotop displays per-process I/O usage in real time, and the -o option shows only processes actively performing I/O. This lets the administrator map the D-state processes to specific I/O activity and identify the offending workloads. It complements device-level statistics by showing which processes generate the load.

Why this answer

To diagnose an I/O bottleneck, the administrator needs both device-level and process-level visibility. iostat -x with an interval shows per-device utilization and queue metrics, while iotop -o shows which processes are actively performing I/O. Together they identify the saturated device and the workloads causing it. Memory, network, and service-status tools do not provide this combined view.

Exam trap

The trap here is reaching for familiar general-purpose tools like free or netstat instead of the specialized I/O monitoring utilities that expose per-device and per-process disk activity.

Full explanation →
401
MCQmedium

A technician is installing a new 2U server into an existing rack. The rack is fully populated with servers that use front-to-back airflow. The new server also uses front-to-back cooling. The technician notices gaps between some servers and several open rack units without equipment. To ensure optimal airflow and prevent potential thermal issues, which of the following actions should the technician take FIRST?

A.Install additional exhaust fans at the rear of the rack to pull hot air out.
B.Increase the fan speed of the new server to compensate for recirculated air.
C.Leave the gaps to allow passive air movement and reduce pressure.
D.Install blanking panels in all unused rack spaces.
AnswerD

Unused rack units and gaps let exhaust air recirculate to intakes, raising inlet temperatures and undermining front-to-back cooling. Blanking panels seal those openings, restoring the pressure differential the servers' airflow design depends on before any other remediation.

Why this answer

Blanking panels are the correct first action because unused rack units create a path for hot exhaust air to recirculate to the cold aisle, raising intake temperatures and causing thermal issues. Filling every empty U with blanking panels restores the front-to-back pressure differential that front-to-back airflow servers depend on. This is a low-cost, non-invasive fix that directly addresses the root cause before considering fan or cooling changes.

Exam trap

The trap here is that candidates focus on active cooling interventions (fans, fan speed) when the scenario's root cause is passive airflow leakage, so they skip the simple blanking-panel fix that should be done first.

How to eliminate wrong answers

Option A is wrong because adding rear exhaust fans does not stop hot air from recirculating through open U spaces and can worsen pressure imbalances. Option B is wrong because increasing the new server's fan speed treats a symptom, not the cause, and can pull more hot air into the chassis. Option C is wrong because leaving gaps allows hot exhaust to loop back into cold intakes, which is precisely the thermal problem the technician must prevent.

Full explanation →
402
MCQmedium

After an unexpected power outage, a server fails to boot and displays an error indicating a degraded RAID array. The server has a RAID 5 configuration with four disks. One disk has failed, but the hot spare did not automatically rebuild. The administrator needs to restore data availability as quickly as possible. Which action should the technician take FIRST?

A.Replace the failed disk and initiate a manual rebuild.
B.Restore the server from the latest backup.
C.Check the RAID controller battery and cache.
D.Replace the hot spare with a new disk.
AnswerA

The failed disk is the root cause of degradation. Replacing it provides a healthy member for the array, and a manual rebuild can be forced to restore redundancy quickly.

Why this answer

Option A is correct because replacing the failed disk and initiating a manual rebuild directly restores redundancy and availability using the existing parity data. Option B is wrong because the hot spare is not faulty; the rebuild did not trigger automatically, likely due to a configuration issue, and swapping it does not address the failed disk. Option C is wrong because while a bad battery or cache can cause rebuild failures, checking this is a later step; the immediate need is to replace the failed disk to restore redundancy.

Option D is wrong because a backup restore is a last resort and may result in data loss; the array is degraded but still functional, so rebuilding is faster and less disruptive.

Full explanation →
403
MCQhard

A server administrator is troubleshooting a Linux server that runs a critical database. Users report that queries have become extremely slow, but the server still responds to pings and SSH sessions. Running top and iostat shows the CPU is mostly idle while disk utilization is pinned near 100 percent with high await times on the data volume. Which of the following is the MOST likely cause?

A.A scheduled backup job is consuming all available network bandwidth.
B.The storage subsystem is experiencing an I/O bottleneck, such as a failing disk or saturated array.
C.The server's NIC is negotiating at 100Mb half-duplex instead of 1Gb full-duplex.
D.The server has insufficient RAM and is swapping heavily to the swap partition.
AnswerB

High disk utilization with elevated await and low CPU usage is the classic signature of an I/O-bound storage layer. A degraded disk, saturated array, or failing drive forces requests to queue, which slows the database queries that depend on those reads and writes. Investigating the RAID status, SMART data, and per-device iostat metrics would confirm which physical device is responsible.

Why this answer

When CPU is idle but the data volume shows near-total utilization and high await, the storage layer is the constraint. Database performance then hinges on how quickly the array and disks service reads and writes. Confirming the cause means checking RAID health, SMART attributes, and per-device latency rather than network or memory metrics, which the evidence does not implicate.

Exam trap

The trap here is latching onto the most familiar performance culprit, such as network or RAM, instead of matching the specific metric pattern of idle CPU with saturated disk await.

Full explanation →
404
MCQeasy

A technician is installing a new server in a data center. To prevent electrostatic discharge (ESD) damage, which of the following should the technician do FIRST?

A.Place an anti-static mat on the floor
B.Spray anti-static solution on the server rack
C.Wear rubber-soled shoes
D.Attach an ESD wrist strap to a grounded surface
AnswerD

Attaching an ESD wrist strap to a grounded surface equalises the technician's body potential with the equipment before any contact, preventing static discharge into sensitive components. This satisfies the stem's "FIRST" constraint because grounding must precede handling or installation; antistatic mats or bags alone cannot drain charge from the technician's body.

Why this answer

Attaching an ESD wrist strap to a grounded surface is the first step to safely discharge static electricity from the technician's body before handling server components. This prevents ESD damage to sensitive electronics.

Exam trap

SK0-005 often tests the order of ESD prevention steps — candidates may choose an anti-static mat or rubber-soled shoes, but the first and most critical action is grounding the technician with a wrist strap.

How to eliminate wrong answers

Option A is wrong because placing an anti-static mat on the floor is helpful but does not ground the technician — the mat must be connected to a ground and the technician must still wear a wrist strap or heel strap. Option B is wrong because spraying anti-static solution on the server rack is not a standard ESD prevention practice and could damage equipment. Option C is wrong because rubber-soled shoes insulate the technician from ground, which can actually increase static buildup rather than dissipate it.

Full explanation →
405
MCQmedium

A server administrator is configuring a new Windows Server 2022 server that will host a database. The database requires high write performance and low latency. The server has four 800 GB SSDs and a hardware RAID controller with a 2 GB battery-backed write cache. Which RAID level should the administrator choose to meet the performance requirements while providing redundancy?

A.RAID 0
B.RAID 5
C.RAID 6
D.RAID 10
AnswerD

RAID 10 combines mirroring and striping, offering excellent write performance because data is written to multiple mirrored pairs without parity calculations. It also provides redundancy, allowing one drive per mirrored pair to fail. This meets the database's need for high write performance and low latency while ensuring fault tolerance.

Why this answer

RAID 10 provides both high write performance, due to its mirrored and striped design without parity overhead, and redundancy. RAID 5 and RAID 6 incur parity calculation overhead that reduces write performance, and RAID 0 lacks redundancy entirely, making it unsuitable for a database requiring fault tolerance.

Exam trap

The trap here is assuming that RAID 5 with a battery-backed cache can match RAID 10 write performance, but parity overhead still adds latency.

Full explanation →
406
Multi-Selectmedium

A server administrator is setting up a new Windows Server 2022 file server that will host sensitive financial documents. The administrator needs to implement file screening to prevent users from saving unauthorized file types. The administrator wants to block files with extensions .exe, .mp3, and .avi. Which two actions should the administrator perform? (Choose two.)

Select 2 answers
A.Configure a file screen in FSRM to block the specified file extensions.
B.Create a Windows Firewall rule to block the file extensions.
C.Use Group Policy to assign a software restriction policy.
D.Enable BitLocker Drive Encryption on the volume.
E.Install the File Server Resource Manager (FSRM) role service.
AnswersA, E

After installing FSRM, the administrator must create a file screen that defines which file types to block. A file screen can be configured to actively prevent users from saving files with specific extensions, such as .exe, .mp3, and .avi. This action directly implements the required restriction on unauthorized file types.

Why this answer

To implement file screening on Windows Server 2022, the File Server Resource Manager (FSRM) role service must be installed. Once installed, the administrator can create file screens that define which file extensions are allowed or blocked. This combination directly enforces the restriction on .exe, .mp3, and .avi files.

Other options either do not address file-level blocking or are unrelated to the requirement.

Exam trap

The trap here is confusing file screening with software restriction policies or firewall rules, which control execution or network traffic rather than the ability to save specific file types to a share.

Full explanation →
407
MCQhard

A technician is installing a new PCIe expansion card into a rack-mounted server. The server's chassis has a riser card to accommodate low-profile cards. After installing the card and powering on, the server POSTs but the operating system does not detect the card. The card is known to work in another server. Which of the following should the technician check FIRST?

A.Whether the server's BIOS has the PCIe slot enabled and configured for the correct generation.
B.Whether the expansion card requires an external power connector that is not connected.
C.Whether the operating system has the correct driver installed for the expansion card.
D.Whether the riser card is properly seated in its slot and the expansion card is fully inserted into the riser.
AnswerD

Riser cards can become loose during installation or may not be fully seated in the motherboard slot. Similarly, the expansion card might not be fully inserted into the riser. These are common physical connection issues that prevent detection. Checking seating is a quick, non-destructive first step before moving to more complex diagnostics. This is the most likely cause given the card works elsewhere.

Why this answer

The most common cause of a newly installed expansion card not being detected is improper physical seating. Riser cards add an extra connection point that can easily become loose. Ensuring both the riser and the card are fully seated is a quick and logical first step.

Other causes like BIOS settings or drivers are less likely given the card's known functionality.

Exam trap

The trap here is overlooking the riser card as a potential point of failure and jumping to BIOS or driver troubleshooting.

Full explanation →
408
MCQeasy

A server administrator is troubleshooting a server that intermittently loses network connectivity. The server is connected to a switch port that is configured for 802.1X authentication. The administrator checks the switch logs and sees repeated authentication failures for the server's MAC address. The server's operating system logs show no network errors. Which of the following is the MOST likely cause of the connectivity loss?

A.The server's NIC driver is outdated and causing intermittent link drops.
B.The switch port is configured for half-duplex, causing collisions.
C.The switch port is configured for the wrong VLAN.
D.The server's 802.1X supplicant credentials are incorrect or expired.
AnswerD

The switch logs show repeated authentication failures for the server's MAC address, which directly indicates that the 802.1X authentication process is failing. This is most commonly due to incorrect, expired, or misconfigured credentials on the supplicant (the server). When authentication fails, the switch port may be placed in a restricted VLAN or shut down, causing intermittent connectivity if the server occasionally authenticates successfully or if the port is reset. Checking and updating the supplicant credentials should resolve the issue.

Why this answer

The switch logs showing repeated 802.1X authentication failures for the server's MAC address indicate that the server is not successfully authenticating. This is typically due to incorrect or expired credentials on the supplicant. When authentication fails, the switch may place the port in a guest VLAN or block traffic, leading to intermittent connectivity if the server occasionally succeeds or if the port is reset.

Verifying and correcting the supplicant configuration is the appropriate fix.

Exam trap

The trap here is focusing on the server's OS logs showing no errors and assuming the problem is hardware, when the switch logs clearly point to an authentication failure.

Full explanation →
409
MCQmedium

A server administrator is troubleshooting a Windows Server 2019 file server that occasionally becomes unresponsive for several minutes. Users report that during these times, they cannot access shared folders. The administrator checks Task Manager and sees that disk queue length is consistently high, and the disk active time is near 100%. Which of the following is the MOST likely cause?

A.The server has insufficient RAM, causing excessive paging.
B.The server's CPU is overheating and throttling performance.
C.The network adapter is faulty, causing dropped packets.
D.A disk-intensive application or process is causing an I/O bottleneck.
AnswerD

High disk queue length and near 100% disk active time indicate that the disk subsystem is overwhelmed with requests. This is classic evidence of an I/O bottleneck, often caused by a process performing heavy read/write operations, such as a backup job, antivirus scan, or a misbehaving application. The unresponsiveness occurs because the disk cannot service requests fast enough.

Why this answer

The high disk queue length and near 100% disk active time are key indicators of an I/O bottleneck. When the disk subsystem is saturated with requests, the server becomes unresponsive to file share requests. The most likely cause is a process or application performing excessive disk operations, which can be identified using Resource Monitor or Performance Monitor, and then addressed by rescheduling or terminating the process.

Exam trap

The trap here is focusing on the symptom of users not accessing shares and assuming a network problem, while ignoring the disk performance counters that clearly indicate a storage bottleneck.

Full explanation →
410
MCQhard

An administrator is designing physical security for a new server room that also houses the company's network core. Management wants to prevent an unauthorized visitor from plugging a laptop into an unused wall jack and capturing traffic. Which control BEST addresses this specific threat?

A.Configure port mirroring on the core switch so the security team can monitor all traffic from the server room.
B.Deploy IPsec transport mode between all servers in the room and require certificate-based authentication for every session.
C.Enable 802.1X port-based network access control on all switch ports and configure unused ports to an unauthorized VLAN.
D.Install a mantrap at the server room entrance and require badge plus biometric authentication for entry.
AnswerC

802.1X requires a supplicant to authenticate before the switch port passes traffic, so a visitor's laptop cannot join the network even if it is physically plugged into a live jack. Placing unused ports in an unauthorized or quarantined VLAN adds a second layer so that unauthenticated devices land in a restricted segment. This directly mitigates the stated threat of an unauthorized device capturing or injecting traffic.

Why this answer

The threat is a rogue device gaining network access through a live wall jack. Port-based access control with 802.1X forces authentication before the port forwards traffic, and assigning unused ports to a quarantined VLAN limits what an unauthenticated device can reach. Physical entry controls, IPsec between servers, and port mirroring do not prevent a plugged-in laptop from joining the local segment.

Exam trap

The trap here is confusing physical access controls or monitoring with logical port security, when the question is specifically about an unauthorized device on a network jack.

Full explanation →
411
MCQeasy

A technician is installing a new rack-mounted server and needs to connect it to the network. The server has two onboard Ethernet ports labeled NIC1 and NIC2. The network team requires redundant connectivity to two different switches. Which of the following should the technician implement?

A.Connect NIC1 to switch A and NIC2 to switch B, then assign both NICs the same IP address without teaming.
B.Connect both NIC1 and NIC2 to switch A and configure link aggregation.
C.Connect NIC1 to switch A and leave NIC2 disconnected until a failure occurs.
D.Connect NIC1 to switch A and NIC2 to switch B, then configure NIC teaming or bonding on the server.
AnswerD

Connecting each NIC to a separate switch and configuring teaming or bonding provides link redundancy and can also increase throughput. If one switch or cable fails, the team maintains connectivity. This matches the requirement for redundant connectivity to two different switches and is a standard server network configuration for high availability.

Why this answer

Redundant connectivity to two switches requires each NIC to connect to a different switch and the operating system to present them as a single logical interface through teaming or bonding. This provides failover if a switch, cable, or port fails. Connecting both NICs to one switch or leaving one disconnected does not meet the redundancy requirement.

Exam trap

The trap here is assuming that plugging two cables into two switches automatically provides redundancy, when the server also needs NIC teaming or bonding configured to use both links correctly.

Full explanation →
412
PBQhard

A company has a small virtualized environment with two ESXi 7.0 hosts (HostA and HostB) managed by vCenter Server. They use a shared iSCSI storage array for all VMs. The network consists of a single physical switch that connects the hosts, storage, and management traffic using VLANs. Yesterday, the switch failed and was replaced with an identical model. After restoring the configuration from a backup, all VMs on HostA are working normally, but all VMs on HostB show 'network disconnected' in the vSphere console. The VMs on HostB are still running, but they cannot communicate with any other device on the network. HostB itself is reachable via its management IP and can access the storage array. The administrator has verified that the physical cables are correct and the NICs are up on HostB. The VLAN configuration on the new switch was restored for the ports connecting HostB, but the issue persists. Which of the following actions should the administrator perform FIRST to restore connectivity?

A.Reboot HostB to renegotiate the network configuration.
B.Restart the vCenter Server service on the vCenter appliance.
C.vMotion all affected VMs from HostB to HostA to confirm they work on HostA.
D.Check the VLAN configuration on the switch ports connected to HostB for the VM network uplinks.
AnswerD

Why this answer

Option B is correct. Since all other functions (management, storage) work and only VM traffic is affected, the most likely cause is incorrect VLAN tagging on the switch port carrying the VM traffic uplink. Restoring a switch config may have missed the exact VLAN trunk settings.

Checking and correcting the VLAN configuration on the switch ports for HostB's VM network is the first targeted step. Options A and C are nondisruptive but don't address the immediate config issue. Option D involves rebooting the host without diagnosing, which is risky and may not fix the issue.

Full explanation →
413
Multi-Selecthard

A server administrator is troubleshooting a Linux server that is experiencing random reboots. The administrator checks the system logs and finds multiple entries indicating a machine check exception (MCE). The administrator suspects a hardware issue. Which of the following should the administrator do to further diagnose the problem? (Choose two.)

Select 2 answers
A.Reinstall the operating system.
B.Check the CPU temperature and cooling system.
C.Run a disk check with fsck.
D.Run memtest86+ to test the RAM.
E.Update the BIOS/UEFI firmware.
AnswersB, D

Overheating can cause machine check exceptions and random reboots. Checking CPU temperature and ensuring cooling fans are operational and heatsinks are clean can identify thermal issues. If temperatures are high, improving cooling may prevent further reboots. This is a logical hardware diagnostic step.

Why this answer

Machine check exceptions indicate hardware faults. The most likely components are RAM and CPU overheating. Running memtest86+ tests memory integrity, and checking CPU temperature and cooling ensures thermal issues are not causing the MCEs.

These two steps directly address common hardware causes. Other options are either too drastic or not directly related to MCE diagnosis.

Exam trap

The trap here is assuming software-related actions like OS reinstall or firmware update will fix hardware-level MCE errors.

Full explanation →
414
MCQmedium

A server administrator is troubleshooting a Windows Server 2019 host that exposes an iSCSI LUN as a data volume. The volume is set to mount automatically, but after a reboot the drive letter changes and the backup job that targets E:\ fails. The administrator needs the volume to consistently receive the same drive letter after every restart. Which of the following should the administrator configure?

A.Assign the LUN as a mount point in an empty NTFS folder instead of a drive letter.
B.Create a persistent reservation on the iSCSI target for the initiator.
C.Enable the MPIO feature and add the iSCSI target as a multipath device.
D.Configure the volume with a persistent drive letter in Disk Management or diskpart.
AnswerD

Assigning a persistent drive letter binds that letter to the volume's signature and partition offset, so Windows reassigns the same letter at each boot even if other volumes appear first. This directly resolves the scenario where the volume wanders to another letter and breaks the E:\-based backup job, and it is the standard fix applied through Disk Management or the diskpart assign command.

Why this answer

Drive letters on iSCSI volumes can shift when Windows enumerates disks differently at boot, especially when other devices claim the letter first. Making the assignment persistent ties the letter to the volume itself rather than to discovery order, so the backup path stays valid. Persistent reservations, mount points, and MPIO each solve different storage problems and do not guarantee a stable drive letter.

Exam trap

The trap here is assuming that iSCSI or MPIO configuration controls drive-letter persistence, when the fix is a volume-level setting in Disk Management or diskpart.

Full explanation →
Page 5

Page 6 of 6

All pages

123456

Practice SK0-005 by domain

Target a specific domain to shore up weak areas.

server-administrationserver-hardware-installation-managementsecurity-disaster-recoverytroubleshooting
See all domains with question counts →