security-disaster-recovery

A company is implementing a disaster recovery plan and needs to determine the maximum acceptable amount of data loss measured in time. The business can tolerate losing up to 4 hours of transactions. Which metric should the administrator use to define this requirement?

An organization uses a cloud-based backup solution with immutable storage to protect against ransomware. However, after a recent attack, an attacker with stolen administrator credentials was able to delete the backup data. Which of the following BEST explains why the backups were deleted?

A security administrator at a financial services firm is implementing a defense-in-depth strategy for a new Windows Server 2022 file server that will host sensitive client data. The administrator needs to ensure that data at rest on the server's hard drives is protected in a way that does not require users to enter separate credentials and does not rely on the operating system's file permissions. Which technology should the administrator implement?

A company's datacenter is in a region prone to flooding. Management requires that a copy of nightly backups be stored where a regional flood cannot destroy both the production data and the backup copy, and that the copy be retrievable within 24 hours. Which strategy BEST meets these requirements?

A research institute stores regulated genomic data on a Windows Server 2022 file server. The IT director wants data at rest encrypted so that a stolen drive cannot be read, but the lab's instrument control software writes directly to the volume and cannot tolerate any interruption during long sequencing runs. The server has a TPM 2.0 module and a separate recovery appliance. Which solution should the administrator implement?

A server administrator is restoring a file server from a full backup taken 7 days ago and incremental backups taken daily. The restoration fails with an error about missing catalog files. What is the most likely cause?

Refer to the exhibit. A disaster recovery test reveals the following timeline for a critical application. The business requires an RTO of 2 hours. Which of the following actions would MOST effectively reduce the RTO to meet the requirement?

A company runs a critical SQL Server database on a physical server with a RAID 10 array. The database is backed up nightly to a local disk and replicated to a remote site every four hours. A ransomware attack encrypts the local database files and the local backup disk, but the remote replication target is unaffected. The administrator needs to restore service with the least data loss. Which recovery approach should the administrator use?

An organization requires a disaster recovery site that can be operational within 24 hours after a disaster declaration, with critical data replicated on a regular basis, but not necessarily real-time. Which type of site should they implement?

An administrator is configuring a server to use a hardware security module (HSM) for disk encryption key storage. The administrator wants to ensure that if the server is stolen, the encrypted disks cannot be decrypted even if the disks are moved to another system. Which statement best describes why the HSM supports this goal?

A company is designing a disaster recovery plan for its primary datacenter. The plan must include a warm site that can take over production within four hours and must verify that the recovery procedures actually work. Which two elements should be included? (Choose two.)

A company has a primary data center and a warm site 50 miles away. The disaster recovery plan specifies a recovery time objective (RTO) of 4 hours and a recovery point objective (RPO) of 15 minutes. The administrator is reviewing the backup and replication strategy. Which combination best meets these objectives?

An organization stores backup tapes at an offsite facility. The tapes contain sensitive customer data. A security audit revealed that tapes were stolen from the facility. Which combination of measures would have MOST effectively prevented unauthorized data access?

A company is drafting a disaster recovery plan for its primary data center. The plan must address both the maximum tolerable data loss and the maximum tolerable downtime for critical systems. Which of the following metrics should the plan explicitly define to meet these requirements? (Choose two.)

A datacenter administrator is reviewing physical security for a new server room. The company wants to ensure that only authorized personnel can access the racks and that any access attempts are logged. The room already has a locked door with a badge reader. Which of the following should the administrator implement to meet the requirements for rack-level security and auditing?

A small business runs a Windows Server 2022 domain controller and a member file server. The administrator must ensure that if a server's system disk fails, the server can be rebuilt quickly with its operating system, roles, and settings intact. Backups are currently taken with Windows Server Backup to a dedicated backup volume on the same server. Which change should the administrator make?

A server administrator is responsible for protecting sensitive data. The backup process copies files to a network share daily. Which of the following should the administrator do to BEST ensure the confidentiality of the backup data both during transfer and at rest?

A financial services firm requires zero data loss in the event of a primary data center failure. They operate two data centers 50 miles apart connected by a high-bandwidth, low-latency link. Which replication method should they use to meet this requirement?

A database server hosts a critical application that requires a recovery point objective (RPO) of 4 hours. The company wants to minimize the impact on production performance during backups. Which backup strategy should be implemented?

A security team is hardening a fleet of Linux web servers that will be exposed to the internet. They want to reduce the attack surface and limit the impact of a compromised service account. Which two actions BEST support these goals? (Choose two.)

A datacenter administrator is hardening a new Windows Server 2022 host that will run a public-facing web application. The administrator needs to reduce the attack surface at the operating system level. Which two actions should the administrator take? (Choose two.)

A healthcare provider is reviewing its disaster recovery strategy. They have two data centers: one primary in City A and a secondary in City B, 200 miles apart. Currently, they perform daily backups that are replicated to City B each night. In the event of a primary site failure, they can fail over to City B, but there is a 4-hour RTO due to manual processes. Their new RTO target is 2 hours, with an RPO of 15 minutes. The IT team is considering various replication technologies. The provider runs a mix of Windows and Linux servers hosting electronic health records (EHR), PACS imaging, and billing applications. Their current backup scheme is a full backup each night, with transaction logs backed up every 6 hours, but these are not immediately shipped offsite. They have experienced power outages in City A, prompting the review. The IT director is concerned about data consistency and quick recovery. The secondary site currently has sufficient hardware to run all critical applications, but data is only updated nightly. The link between data centers has 100 Mbps bandwidth and 10 ms latency, and upgrading it would cost $50,000. The existing staff can script failover procedures. Which solution best meets the new RPO and RTO while staying within budget?

A system administrator configures full backups on Sunday evenings and differential backups on weekdays. On Thursday morning, a disk failure occurs. Which of the following sets of backups is necessary to completely restore the server's data with the fewest number of backup files?

A company performs full backups every Sunday and differential backups daily. After a ransomware attack, they discover that both the production data and all attached backup media were encrypted. They need to ensure data can be recovered in the future. Which of the following is the BEST change to their backup strategy?

A company performs annual disaster recovery tests. The last test revealed that the recovery time objective (RTO) was not met because the backup tapes were corrupted. The backup administrator proposes changes to the backup verification process. Which practice is MOST effective to ensure recoverability?

A systems administrator is designing the backup strategy for a Windows Server 2022 file server that holds the company's only copy of active project data. The business requires that a single accidental deletion of a folder be recoverable quickly without a full restore, and that a ransomware event that encrypts the volume still leave a usable copy of the data. Which two actions should the administrator take to meet both requirements? (Choose two.)

A small law firm relies on a single server that hosts a document management system and email. The server is backed up nightly using differential backups to an external USB hard drive that remains connected to the server. One Monday morning, the office manager finds all files encrypted and a ransom note on the screen. The server’s event logs indicate that the encryption began at 2:00 AM on Saturday. The firm’s offsite backup policy rotates two sets of tapes, and the most recent set was taken offsite on Friday evening and is stored in a bank safe deposit box. The USB backup drive, still attached to the server, shows its files also encrypted. The firm does not have a cloud backup service for the server. The office manager wants to restore operations as quickly as possible with minimal data loss and zero risk of reinfection. What is the BEST course of action?

A company is reviewing its disaster recovery plan. The plan currently states that a full backup is performed every Sunday and incremental backups are performed Monday through Saturday. A disaster destroys the primary server on Wednesday at 2:00 PM, after the Wednesday incremental backup has completed. The administrator needs to restore the server to the most recent state possible. Which of the following backup sets should the administrator restore?

A datacenter manager must protect a file server's data against a single hard disk failure while maximizing usable capacity. The server has four 4 TB drives and a hardware RAID controller. Which RAID level should be implemented?

A system administrator is configuring a RAID array for a database server that requires high fault tolerance and improved read performance. The array will consist of six 1 TB drives. The administrator wants to maximize usable capacity while being able to survive a single drive failure. Which RAID level should the administrator choose?

A security administrator is configuring disk encryption on a new file server that will store regulated data. The server has a TPM 2.0 chip and runs Windows Server 2022. The administrator wants to ensure that the encryption keys are protected and that the server can boot without requiring a USB key at every restart. Which configuration should the administrator use?

A company is implementing a disaster recovery plan for its on-premises data center. The plan must include measures to ensure data integrity and availability during a site-wide power failure. Which two actions should be included in the plan? (Choose two.)

Which THREE of the following are typically essential elements of a disaster recovery plan (DRP)? (Choose three.)

A company performs a full backup every Sunday and incremental backups Monday through Saturday. On Wednesday, a database file becomes corrupted. The administrator needs to restore the most recent version of the file prior to corruption. Which backup sets must be restored?

A datacenter administrator is preparing to decommission a rack of servers that stored customer financial records. Company policy requires that data be rendered unrecoverable before the servers leave the facility, and the servers will be resold to a third party. Which action best satisfies the policy?

A technician is disposing of several decommissioned servers that previously stored customer financial records. The drives will leave the building. Which action BEST ensures the data cannot be recovered by anyone who obtains the drives?

A datacenter manager is reviewing physical security controls for a server room. Which two controls are considered preventive measures against unauthorized physical access? (Choose two.)

A company is designing a disaster recovery plan for a critical web application. The plan must ensure that the application can be recovered within a 4-hour recovery time objective (RTO) and that no more than 1 hour of data is lost. The application runs on virtual machines backed by a storage area network (SAN). Which two actions best support these objectives? (Choose two.)

A medium-sized company uses a backup strategy that includes a full backup every Sunday at 2:00 AM and differential backups Monday through Saturday at 2:00 AM. The backups are written to a network-attached storage (NAS) device. On Thursday morning, the company experiences a ransomware attack that encrypts all data on the file server, including the NAS. The administrator needs to restore the file server with minimal data loss. The last successful full backup was from the previous Sunday, and differential backups were successful on Monday, Tuesday, and Wednesday. However, Thursday's differential was not completed because the attack occurred before the scheduled time. The administrator attempts to restore using the Sunday full backup and Thursday's differential, but the restore fails because the differential backup on the NAS is also encrypted. Which of the following is the best course of action?

A financial services company runs a single physical server hosting a customer-facing web application. The security team must ensure that if an attacker modifies system binaries, the server can detect the change during a forensic investigation. Which technology should be implemented to meet this requirement?

A datacenter administrator must implement a backup strategy for a file server that holds 8 TB of active patient imaging data. The organization requires that a complete copy of the data be stored offsite weekly, and that the offsite copy be protected from accidental deletion or alteration for at least 30 days. The administrator has a 10 GbE connection to the remote site. Which of the following should the administrator configure to meet these requirements?

A small office has a single physical server running Windows Server 2022 that hosts a file share and a print server. The administrator wants to protect against a hard drive failure that would cause downtime. The server has four drive bays, all currently empty. The administrator needs a solution that provides redundancy and maximizes usable capacity while tolerating one drive failure. Which of the following should the administrator implement?

A data center administrator is hardening a newly racked Linux server that will host a customer-facing API. The security policy states that only HTTPS (TCP 443) should be reachable from the internet, and no other services should be exposed. The administrator wants the change to survive a reboot and be enforced by the kernel's packet filter. Which of the following should the administrator configure to meet these requirements?

Refer to the exhibit. An administrator is reviewing logs after a server experienced performance issues and unexpected shutdowns. Based on the log entries, which component is MOST likely failing?

A company is implementing a backup strategy for a critical database server. The backup window is limited, and the database must remain available during backups. The administrator needs to ensure that transaction log backups are performed and that the database can be restored to a point in time. Which two actions should the administrator take? (Choose two.)

A system administrator is configuring a backup strategy for a small business. The business requires that backups be stored offsite to protect against physical disasters, and that backup data be encrypted both in transit and at rest. Which of the following backup solutions BEST meets these requirements?

A company uses a two-node failover cluster for a critical application. The cluster nodes are located in the same data center, and the quorum configuration uses a file share witness on a separate server in the same data center. During a major power outage, both cluster nodes and the file share witness server lose power. What is the impact on cluster availability?

A hospital's server room has a raised floor and a dedicated UPS circuit. During a scheduled power maintenance window, the facilities team must cut utility power to replace a breaker panel. The UPS must keep the two domain controllers and the electronic medical records (EMR) database server running for at least 20 minutes so they can be gracefully shut down. Which configuration should the administrator verify FIRST to meet this requirement?

A network administrator is configuring a RAID array for a new file server that will store large media files. The server has six 4 TB SAS drives. The administrator needs to maximize storage capacity while providing fault tolerance against a single drive failure. Which RAID level should be implemented?

A company operates a single data center with 40 physical servers and no secondary site. Management has approved a project to improve disaster recovery posture and wants the ability to restore critical workloads after a total site loss. The budget is limited, and the company already owns a large tape library and an offsite vault contract. Which two components should the administrator include in the solution? (Choose two.)

A datacenter administrator is planning a disaster recovery site for a critical application. The business requires that the application be able to resume within 15 minutes of a primary site failure, but the application can tolerate up to 30 minutes of data loss. Which combination of metrics and site strategy best fits these requirements?

A security team wants to reduce the impact of a compromised service account that is used by a scheduled backup application on a Windows server. The account currently has domain administrator rights. Which action BEST limits the blast radius while keeping backups functional?

A medium-sized e-commerce company operates three critical servers: a web front-end, a database server, and a file server. Currently, a full backup of all servers is performed every Sunday starting at 11:00 PM and completes in about 6 hours. Differential backups run each weekday at 11:00 PM, taking roughly 2 hours. On a Wednesday at 10:00 AM, a ransomware attack encrypts all data on all servers. The IT team’s incident response plan requires restoration with an RPO of 4 hours and an RTO of 8 hours. The latest clean backup is Tuesday’s differential, resulting in approximately 10 hours of data loss. Future attacks could occur at any time. Management is willing to spend up to $200 per month to improve the backup strategy but cannot afford new hardware or a dedicated hot site. The team needs a solution that reduces both RPO and RTO within budget while maintaining simplicity for a small IT staff of two. Which of the following backup strategies should be implemented to best meet these requirements?

A datacenter administrator is hardening a newly racked server that will host a public-facing application. The security policy requires that all administrative access to the server use encrypted protocols and that remote interactive logons be limited to the secure shell. Which action best meets these requirements?

A financial services company must retain backup data for seven years to satisfy regulatory requirements. The data is written once and never modified, and the company wants to minimize cost while ensuring the data cannot be altered or deleted before its retention period expires. Which storage solution best meets these requirements?

A small office has a single physical server running Windows Server 2022 that hosts a file share and a print server. The administrator wants to ensure that if the server's operating system becomes corrupted, the server can be restored quickly to a working state. Which backup type should the administrator use?

A datacenter administrator manages a rack of servers that handle nightly batch processing. The company's security policy requires that all server hard drives be sanitized before disposal, and the drives previously contained customer PII. The administrator needs a method that renders the data unrecoverable and also allows the drives to be reused internally for non-sensitive test systems. Which of the following should the administrator use?

A server administrator is hardening a newly deployed Linux web server that will be exposed to the internet. The security policy requires minimizing the attack surface and protecting authentication. Which two actions BEST align with that policy? (Choose two.)

A company is hardening a publicly reachable Linux web server that runs an SSH service for administration. The security team wants to reduce the attack surface and enforce stronger authentication. Which two actions BEST accomplish this? (Choose two.)

A company operates a primary datacenter and a cold standby site. The disaster recovery plan states that the standby site must be able to take over within 8 hours, but the current plan requires rebuilding servers from bare metal and restoring data from tape, which takes 3 days. Which change best aligns the standby site with the stated recovery time objective?

A small business has a single file server running Windows Server 2019. The server uses two internal SATA drives in a RAID 1 mirror for the operating system and data. The company's backup solution performs a full backup every night to an external USB hard drive, which is stored in the server room. The IT administrator recently noticed that the server's system volume is running low on space and decides to migrate the data to a larger drive. During the migration, the server crashes and will not boot. The administrator attempts to restore from the latest backup but finds that the backup drive is corrupted and cannot be read. The company has no offsite backups. What should the administrator have done to prevent this situation?

A large enterprise uses a centralized backup solution with a backup server running Commvault. Backups are stored on a deduplicated disk array and replicated to a secondary site for disaster recovery. The company's security team detects ransomware activity that has encrypted several file servers. The backup administrator checks the backup repository and finds that the backup data is also encrypted because the backup service account had permissions to modify backup files, and the ransomware propagated to the repository. The last known good backup is from two weeks ago, which is too old for the organization's RPO of 24 hours. The backup administrator is under pressure to restore operations quickly. Which of the following should the administrator implement to prevent this from recurring?

A small business runs a single physical server that hosts a customer relationship management (CRM) application and its database. The owner wants a backup strategy that allows the server to be restored on different hardware if the original server fails completely. Which backup type should the administrator implement?

A datacenter operator is reviewing physical security for a server room that houses backup tapes and network core switches. The room has a single wooden door with a mechanical lock, and the key is shared among the facilities staff. Which change should the administrator recommend FIRST to improve access control?

A security administrator is configuring a server to meet a requirement that all administrative access must use multifactor authentication and be encrypted in transit. The server runs Windows Server 2022. Which solution should the administrator implement?

A company stores nightly database backups on a dedicated backup server in the same data center as the production database. The security team wants to ensure that a ransomware infection on the production network cannot encrypt or delete the backup copies. Which control should the administrator implement?

A medium-sized company runs an e-commerce platform on a cluster of three physical servers hosting virtual machines. The disaster recovery plan includes daily backups to a remote data center using Veeam Backup & Replication. The company's annual disaster recovery drill is scheduled for next week. During the drill, the IT team plans to simulate a complete site failure by powering off the primary data center. The recovery time objective (RTO) is 4 hours, and the recovery point objective (RPO) is 1 hour. The team successfully restores the VMs at the remote site, but the application experiences significant performance degradation and many transactions fail due to database inconsistency. Investigation reveals that the backup was taken at 2:00 AM, but the failure occurred at 10:00 AM, and the application's database had transactions between 2:00 AM and 10:00 AM that were not captured. What should the IT team do to improve the recovery process?

A system administrator needs to implement a secure method for remote administrators to manage servers in a data center. The solution must provide encrypted communication, support multi-factor authentication, and allow centralized logging of all administrative sessions. Which solution should be implemented?

A system administrator must choose a backup method for a file server where the business requires that only files changed since the last backup are copied, and the backup window is very short. Which backup type should the administrator select?

A datacenter administrator is reviewing physical security for a new colocation cage that houses servers containing regulated data. The cage has a locked mesh door, but the administrator must add a control that logs exactly which employee enters and exits, and when, without requiring a guard. Which solution BEST meets these requirements?

A financial services firm requires a disaster recovery solution that provides a Recovery Point Objective (RPO) of near zero and a Recovery Time Objective (RTO) of less than 2 hours. Which of the following site types is MOST appropriate?

A company has a recovery point objective (RPO) of 15 minutes for its database server. The database is 500 GB, and the nightly full backup takes 4 hours. Which backup strategy best meets the RPO while minimizing storage and backup window impact?

A systems administrator is configuring role-based access for a team of server operators. The operators need to restart services and view logs on production Linux servers, but they must not be able to edit configuration files or install packages. The administrator wants to implement this with the least privilege and avoid sharing the root password. Which of the following should the administrator configure?

An administrator manages a Linux-based server hosting a database that contains regulated customer records. The security policy requires that when the server reaches end of life, all data on its solid-state drives be rendered unrecoverable before the drives leave the building. The server will be repurposed to a non-production test role within the same company rather than destroyed. Which action should the administrator take?

A small business runs a single file server that stores contracts and financial records. The owner wants an affordable way to recover individual files that users accidentally delete or overwrite, with the shortest possible recovery time. Which solution BEST fits this requirement?

A datacenter administrator is designing physical security for a new colocation cage that houses servers containing regulated customer data. The cage has a single door, and the administrator wants to ensure that entry is logged and that two authorized staff members must be present for the door to unlock. Which of the following should the administrator implement to meet these requirements?

A small business has a limited budget and can tolerate up to 72 hours of downtime in the event of a disaster. Which type of disaster recovery site would be most cost-effective?

A financial services firm requires a disaster recovery site that provides immediate failover with zero data loss. Which type of site should they implement?

A retail company runs its order-processing database on a physical server in a colocation facility. Management has approved a hot site contract for disaster recovery. During a tabletop exercise, the CIO asks the administrator to explain what the hot site contract actually provides on day one of a declared disaster. Which statement is accurate?

A datacenter administrator must protect a rack of dual-power-supply servers against a single PDU failure. The rack currently has two rack PDUs, each fed from a separate upstream branch circuit, and each server has both power supplies connected. The administrator wants to confirm that the configuration meets the intended redundancy level before adding more servers. Which action should the administrator take?

An administrator manages a two-node Windows Server 2022 cluster that hosts a critical SQL Server instance. The cluster uses shared storage on a SAN. During a failover test, the administrator observes that the SQL Server role takes several minutes to come online on the surviving node, exceeding the recovery time objective. The application team confirms the database itself starts quickly once the disk resources are available. Which factor should the administrator investigate first?

A company's backup policy sends nightly backups to a tape library in the same building as the production servers. A recent fire destroyed the server room, and the tapes were damaged by heat and water. Which change BEST addresses this single point of failure?

A server administrator is configuring a new file server that will store sensitive financial documents. The security policy requires that data be encrypted at rest and that the encryption keys be protected by the server's TPM. Which of the following should the administrator implement?

A network administrator needs to configure centralized authentication for network devices. The solution must provide encryption of the entire authentication process, support for multiple protocols, and accounting of user actions. Which protocol should be used?

A small business runs a single physical server that hosts its accounting application and database. The owner wants a backup approach that allows recovery to any point within the last 14 days without restoring a full backup each time. Which backup type should the administrator implement?

A system administrator notices unusual file encryption activity on a file server. The activity appears to be rapidly spreading to other servers, and ransom notes are appearing. Which of the following should the administrator do FIRST?

Refer to the exhibit. A Linux server's local firewall is configured as shown. The administrator is unable to perform backups to a network-attached storage (NAS) device using TCP port 10000. Which firewall rule is causing the issue?

A small business needs a disaster recovery site that can be brought online within 2 hours of a primary site failure. The business can tolerate minimal data loss. Which type of recovery site should they implement?

A small accounting firm runs a single physical server that hosts all of its line-of-business applications. The owner wants a backup strategy that allows the entire server, including the operating system, applications, and data, to be restored to dissimilar hardware after a catastrophic failure. Which backup type should the administrator implement?

A security administrator is configuring a Linux server to allow only SSH and HTTPS traffic from a specific management subnet while blocking all other inbound traffic. The server has two network interfaces: eth0 (public) and eth1 (management). Which command should the administrator use to view the current iptables rules with line numbers to identify the rule positions before modifying them?

A company is implementing a disaster recovery strategy for its on-premises VMware vSphere environment. The IT manager wants to ensure that virtual machines can be recovered at a secondary site within 4 hours of a primary site failure. The secondary site has identical hardware but no active VMs. The company has a limited budget and wants to minimize ongoing costs. Which of the following solutions BEST meets these requirements?

A small business leases a single rack in a colocation facility. The owner wants a disaster recovery arrangement that provides a pre-configured alternate site with power, cooling, and network but where the company must supply and install its own servers after a disaster. Which type of site best matches this requirement?

A company performs a full backup on Sunday and incremental backups Monday through Saturday. A server fails on Thursday at 10:00 AM. Which sequence correctly restores the data?

A security team is reviewing physical security controls for a data center that houses several CompTIA Server+ managed servers. The team wants to implement measures that specifically prevent unauthorized personnel from accessing server racks and deter tailgating. (Choose two.)

A mid-sized e-commerce company experienced a ransomware attack that encrypted all on-premises servers and their locally attached backup storage. The attack occurred on a Friday evening; the company was closed over the weekend. By Monday morning, the IT team discovered the encryption and found a ransom note demanding $500,000 in Bitcoin. The company has a disaster recovery plan that calls for restoring from daily tape backups stored offsite. However, the most recent offsite tape was taken home by a backup operator for the weekend and has not been returned. The tape contains full backups from Wednesday. The IT team has clean installation media and application software available. The company's RPO is 24 hours, and RTO is 48 hours. Management wants to minimize data loss and avoid paying the ransom. Based on this scenario, which of the following should the IT team do to recover the business operations?

A company's disaster recovery plan requires that a critical database server be restored at an alternate site within a recovery time objective (RTO) of 4 hours. The database is 2 TB in size, and the company has a 100 Mbps WAN link between the primary and alternate sites. The administrator needs to choose a replication method that meets the RTO without requiring manual intervention at the alternate site. Which solution should the administrator implement?

A large financial services company must comply with federal regulations mandating quarterly disaster recovery tests. Their primary data center in New York hosts all trading applications, and a hot site in Chicago is maintained with real-time data replication via synchronous mirroring. During the last DR test, the IT team successfully failed over network and storage within 8 minutes, meeting the 15-minute RTO for connectivity. However, they encountered a major issue: the hot site's firewalls, intrusion detection systems, and application-level access controls were not configured to match the primary environment. The security team had to manually create firewall rules, update IDS signatures, and reconfigure access policies based on documentation, which took over 4 hours. As a result, the total system readiness exceeded 4.5 hours, causing a significant gap in trading operations. The regulatory auditor noted this deficiency and required a corrective action plan. The company must ensure that the next DR test achieves full operational readiness, including security controls, within the 15-minute RTO. The IT budget is already allocated for the current fiscal year, so large capital expenditures are not possible, but the team can leverage existing tools and automation. Which of the following is the BEST approach to address this issue?

A company operates a rack of servers in a shared datacenter. Management wants to ensure that if a malicious actor gains physical access to the rack, they cannot simply remove a hard drive and read the data on another system. Which control BEST addresses this risk?

A company stores nightly full backups on an external USB drive that is rotated weekly and kept in a locked cabinet in the same server room. A recent audit found that a fire in the server room would destroy both the production data and the backup drive. The company wants to improve the backup strategy so that a site-wide disaster does not eliminate all copies, while keeping costs low. Which of the following is the BEST change to meet these requirements?

A datacenter technician is asked to physically destroy the storage media from a set of decommissioned servers that held customer records. The company's policy requires that the media be rendered unreadable and that a certificate of destruction be retained. Which action best satisfies this requirement?

A security administrator is hardening a Linux server that hosts a public web application. The server currently allows root login via SSH and uses default SSH port 22. The administrator wants to reduce the attack surface by implementing SSH best practices. Which two actions should the administrator take? (Choose two.)

A junior administrator is asked to document the recovery point objective for a critical order-processing system. What does the recovery point objective define?

An organization's disaster recovery plan specifies an RPO of 4 hours. Their current backup schedule performs a full backup at midnight and incremental backups every 2 hours from 8:00 AM to 8:00 PM. A server failure occurs at 3:00 AM, and data created after 8:00 PM the previous day is permanently lost. Which of the following is the MOST likely reason?

Refer to the exhibit. A server administrator is reviewing security logs after a suspected brute-force attack on the SSH service. The following excerpt from /var/log/secure is displayed. Which security control would have been MOST effective in preventing the successful login?

An organization wants to test its disaster recovery plan with minimal disruption to business operations and minimal cost. The test should verify the plan's effectiveness by discussing scenarios. Which type of test should they perform?

During a security incident, a server is suspected to be compromised by malware. The incident response team needs to preserve evidence and minimize impact. Which TWO actions should be taken FIRST? (Select TWO.)

An administrator must choose a physical security control for a new server room door that will allow staff to enter quickly during an emergency while still recording who entered and when. Which solution BEST fits?

A company is creating a disaster recovery plan for its on-premises data center. Which THREE elements are essential to include in the DR plan? (Select THREE.)

After an unexpected power outage, a server fails to boot and displays an error indicating a degraded RAID array. The server has a RAID 5 configuration with four disks. One disk has failed, but the hot spare did not automatically rebuild. The administrator needs to restore data availability as quickly as possible. Which action should the technician take FIRST?

An administrator is designing physical security for a new server room that also houses the company's network core. Management wants to prevent an unauthorized visitor from plugging a laptop into an unused wall jack and capturing traffic. Which control BEST addresses this specific threat?