Courseiva

CCNA server-administration Questions

75 of 91 questions · Page 1/2 · server-administration · Answers revealed

Practice these questionsDomain overviewAll questions
1
MCQmedium

An administrator needs to configure a critical web service on a Linux server to automatically restart if it crashes unexpectedly. The server uses systemd. Which of the following best accomplishes this goal?

A.Set the service to run under inetd so it starts on demand
B.Write a cron job to check the service status every minute and start it if stopped
C.Configure the service's systemd unit file with Restart=always
D.Create an init.d script that loops and re-executes the service if it exits
AnswerC

Restart=always tells systemd to restart the service whenever it stops, which is the proper and most reliable way to ensure automatic recovery.

Why this answer

Option C is correct because setting Restart=always in the systemd unit file ensures the service restarts regardless of exit code, which is the proper systemd method. Option A is wrong because a cron job introduces a potential delay and is less reliable than built-in service supervision. Option B is wrong because an init.d script with a loop is an outdated approach and not recommended with systemd.

Option D is wrong because inetd starts services on demand, not for persistent daemons.

Practice this question →
2
MCQmedium

A company runs a critical application on a physical server with four 15,000 RPM SAS drives in a hardware RAID 5 array. Users report that write performance has degraded significantly during peak hours. Performance monitoring shows high disk queue length. The administrator wants to improve write performance without sacrificing redundancy or adding more drives. Which of the following should the administrator implement?

A.Change the RAID level to RAID 0 to eliminate parity overhead.
B.Increase the RAID stripe size to 256 KB.
C.Enable disk defragmentation on the server's data volume.
D.Configure the RAID controller to use write-back caching with a battery-backed cache module.
AnswerD

Write-back caching with a battery-backed module allows the controller to acknowledge writes immediately after they are cached, significantly improving write performance. The battery protects cached data during power loss, maintaining redundancy. This directly addresses high disk queue length without adding drives or changing RAID level, and preserves fault tolerance.

Why this answer

RAID 5 suffers from a write penalty because each write requires reading old data and parity, calculating new parity, and writing both. Write-back caching with a battery-backed module allows the controller to buffer writes and acknowledge them quickly, dramatically improving write throughput while preserving redundancy. The battery ensures data is not lost if power fails before the cache is flushed to disk.

Exam trap

The trap here is assuming that RAID 0 or larger stripe sizes will fix write performance without considering the need for redundancy, or that defragmentation addresses write bottlenecks.

Practice this question →
3
MCQhard

A server administrator is configuring a Linux server that runs a custom application. The application must start automatically at boot and be restarted if it crashes. The administrator creates a systemd service unit file. After enabling the service, it fails to start, and journalctl shows 'status=203/EXEC'. What is the most likely cause?

A.The ExecStart path points to a non-existent or non-executable file.
B.SELinux is blocking the service from accessing its log file.
C.The service unit file has the wrong permissions.
D.The service is missing a [Install] section in the unit file.
AnswerA

Status 203/EXEC means systemd could not execute the binary specified in ExecStart. This occurs if the path is wrong, the file lacks execute permissions, or the interpreter is missing. The administrator should verify the path and permissions of the executable. This is the most common cause of this specific error.

Why this answer

The 203/EXEC status code indicates that systemd failed to execute the command specified in ExecStart. This is typically due to an incorrect path, missing execute permission, or a missing interpreter. The administrator should check that the file exists, is executable, and has a proper shebang if it is a script.

Other options do not produce this exact error.

Exam trap

The trap here is confusing a service startup failure with a configuration error like missing [Install], when the specific error code points directly to an execution problem.

Practice this question →
4
MCQmedium

A Linux server administrator notices that the /var partition is 95% full. To free space quickly, the administrator decides to delete old log files. Which of the following commands should the administrator use to find and delete log files older than 30 days in the /var/log directory?

A.rm /var/log/*.log -30
B.ls -l /var/log/*.log | grep "30" | rm
C.grep -R "30 days" /var/log | xargs rm
D.find /var/log -name "*.log" -mtime +30 -exec rm {} \\;
AnswerD

This command correctly identifies and removes log files older than 30 days without exceeding command-line limits.

Why this answer

Option A is correct. The `find` command with `-mtime +30` locates files modified more than 30 days ago, and `-exec rm {} \;` safely deletes each file. Option B is syntactically invalid.

Option C incorrectly pipes `ls` output through `grep` and then to `rm`, which does not accept piped input. Option D searches file contents for the text '30 days' rather than file age.

Practice this question →
5
MCQmedium

A system administrator manages a collection of Linux web servers that store custom application configurations in /etc/app/config. The configuration changes frequently, and the admin needs to implement an automated daily backup solution that captures the directory at 1 AM, compresses it with gzip, and retains the last 5 days of backups on a central NFS-mounted backup volume /mnt/backups. The solution should be simple and use standard tools. Which approach best meets these requirements?

A.Create a cron job that runs `tar -czf /mnt/backups/config-$(date +%Y%m%d).tar.gz /etc/app/config` at 1 AM, and another cron job at 2 AM that runs `find /mnt/backups -name "config-*.tar.gz" -mtime +5 -delete`.
B.Use Windows Server Backup scheduled to back up the Linux server's directory via SMB share.
C.Create a cron job that runs `rsync -avz /etc/app/config /mnt/backups/` at 1 AM, with a separate cron job to delete old rsync snapshots using `find /mnt/backups -type d -mtime +5 -exec rm -rf {} \;`.
D.Write a shell script that uses `zip -r /mnt/backups/config.zip /etc/app/config`, schedule it via cron at 1 AM, and rely on the NFS server's built-in snapshot feature for retention.
AnswerA

This solution correctly creates a compressed, date-stamped archive and removes archives older than 5 days, meeting all specified requirements simply.

Why this answer

Option B is correct because it uses tar with gzip compression and a dated filename to create daily compressed archives, and a separate cron job using find to delete files older than 5 days, fulfilling all requirements simply. Option A uses rsync which does not create a single compressed archive file and the retention method using find on directories is less suitable for daily snapshot rotation. Option C uses zip which does not easily support date-stamped filenames and relies on external NFS snapshots, which is not a self-contained solution.

Option D uses Windows Server Backup on Linux, which is unsupported and inappropriate.

Practice this question →
6
MCQhard

A Linux server administrator notices that a server's root filesystem is running out of space. The administrator runs 'df -h' and sees that / is 100% full, but 'du -sh /*' shows that the total size of all directories is only 20 GB, while the filesystem is 100 GB. Which of the following is the MOST likely cause?

A.The root filesystem is actually a logical volume that is not properly resized.
B.There are many small files that du is not counting due to a bug.
C.A large file has been deleted but is still held open by a running process.
D.The filesystem has suffered corruption, causing df to report incorrect usage.
AnswerC

When a file is deleted while still open by a process, the disk space is not reclaimed until the process closes the file. The file no longer appears in directory listings, so du does not count it, but df still reports the blocks as used. This perfectly explains the discrepancy between df and du.

Why this answer

The discrepancy between df and du is typically caused by deleted files that are still held open by running processes. These files no longer have directory entries, so du does not see them, but the kernel keeps the blocks allocated until the file descriptors are closed. The administrator can identify such files using lsof +L1 or by checking /proc/*/fd.

Exam trap

The trap here is assuming filesystem corruption or du bugs when the classic symptom of deleted-but-open files is present.

Practice this question →
7
MCQhard

A system administrator is configuring a backup schedule for a critical database server that must be available 24/7. The company's recovery point objective (RPO) is 1 hour and recovery time objective (RTO) is 4 hours. The database files change frequently, but the operating system and application binaries rarely change. Which of the following backup strategies would BEST meet these requirements while minimizing storage and backup window impact?

A.Full backup daily, differential backup every hour
B.Full backup weekly, differential backup every hour
C.Full backup daily, incremental backup every hour
D.Full backup weekly, incremental backup every hour
AnswerC

Daily fulls ensure fast recovery, while small hourly incrementals meet the 1-hour RPO with minimal impact on the backup window and storage.

Why this answer

Option D is correct because daily full backups provide a recent recovery base, and hourly incremental backups are small and fast, meeting the 1-hour RPO with minimal backup window. Restoration applies at most 24 incrementals to the latest full, which fits within the 4-hour RTO. Option A is wrong because weekly full backups with hourly incrementals may require restoring too many incrementals, risking the RTO.

Option B is wrong because hourly differential backups grow in size throughout the day, increasing backup time and storage. Option C is wrong because weekly fulls with hourly differentials cause exponential growth in differential size over the week.

Practice this question →
8
MCQhard

A server administrator is configuring a RAID array on a new server with six 4 TB SAS drives. The server will host a large email archive that requires maximum usable capacity and can tolerate the loss of up to two drives without data loss. Write performance is not critical, but read performance should be adequate. Which RAID level should the administrator choose?

A.RAID 0
B.RAID 6
C.RAID 5
D.RAID 10
AnswerB

RAID 6 uses dual parity, allowing the array to survive two simultaneous drive failures. It provides usable capacity of n-2 drives, which for six 4 TB drives is 16 TB. This meets the requirements for maximum usable capacity (compared to RAID 10) and tolerance of two drive failures, while read performance is adequate for an email archive.

Why this answer

RAID 6 provides dual parity, allowing the array to survive two simultaneous drive failures while offering usable capacity of n-2 drives. With six 4 TB drives, that yields 16 TB, which is greater than RAID 10's 12 TB. RAID 5 can only survive one failure, and RAID 0 offers no redundancy, so RAID 6 is the correct choice for this scenario.

Exam trap

The trap here is assuming RAID 10 always provides the best redundancy, but it uses 50% capacity and may not survive two failures if they occur in the same mirror.

Practice this question →
9
PBQhard

You are the lead server administrator for a mid-sized e-commerce company. The web application is hosted on a farm of four Linux servers running Apache, fronted by a hardware load balancer. The load balancer currently uses a round-robin algorithm. Recently, the customer support team has received numerous complaints about slow page load times and occasional timeouts during checkout. You log into the server monitoring console and observe that one of the web servers, web03, has a CPU utilization consistently above 95%, while the other three servers are at around 30-40%. You connect via SSH to web03 and run the 'top' command, identifying a process named 'imagick' consuming 99% CPU. Further investigation reveals that this process is related to image resizing for product thumbnails, and it appears to have entered an infinite loop due to a malformed image file. Meanwhile, the load balancer continues to send requests to all servers equally, including the overloaded web03, causing some requests to time out. You need to restore performance immediately and prevent recurrence. Which of the following actions should you take?

A.Kill the 'imagick' process on web03, change the load balancer algorithm to least connections, and clear the malformed image.
B.Reboot all four web servers to clear any stuck processes.
C.Increase RAM on web03 to handle the high CPU process better.
D.Add two more servers to the farm and keep the round-robin algorithm.
AnswerA

Why this answer

Option B is correct because it directly addresses both issues: the runaway process (killing it stops the CPU drain) and the load balancer algorithm (switching to least connections prevents sending traffic to an already overloaded server). Additionally, clearing the malformed image addresses the root cause of the loop. Option A (adding servers) may temporarily hide the problem but does not fix the load distribution or the looping process; the overloaded server would still exist.

Option C (rebooting all servers) is unnecessarily disruptive and does not address the root cause; the malformed image could trigger the loop again after reboot. Option D (increasing RAM) misidentifies the issue as memory-related when it is clearly CPU-bound; more RAM would not stop the infinite loop.

Practice this question →
10
MCQmedium

A server administrator is troubleshooting a server that intermittently reboots without warning. The server is running Windows Server 2019 and hosts a critical application. The administrator checks the event logs and finds Event ID 41 (Kernel-Power). Which of the following should the administrator check first?

A.The power supply unit (PSU)
B.The memory (RAM) modules
C.The hard drive for bad sectors
D.The CPU temperature
AnswerA

Event ID 41 indicates that the system rebooted without cleanly shutting down first, often due to power loss. A faulty or insufficient PSU is a common cause. Checking the PSU's wattage and health is the first step in diagnosing power-related reboots.

Why this answer

Event ID 41 (Kernel-Power) indicates that the system rebooted without a clean shutdown, often due to power interruption. The most likely hardware cause is the power supply unit. Checking the PSU's capacity and health is the logical first step.

Exam trap

The trap here is assuming that any hardware failure causes Event ID 41, but it specifically points to power-related issues.

Practice this question →
11
MCQmedium

A system administrator is notified that a server with a RAID 5 array of four 2TB drives has a single failed drive. The server uses hot-swappable drives and a hardware RAID controller. Which of the following actions should the administrator perform FIRST?

A.Replace all four drives with larger capacity drives to expand storage.
B.Reboot the server and enter the RAID controller BIOS to mark the drive as offline.
C.Replace the failed drive and allow the array to rebuild.
D.Perform a full backup of the array before taking any action.
AnswerC

Immediate replacement allows the rebuild process to start, restoring redundancy. Hot-swap capability makes this a quick, non-disruptive first step.

Why this answer

Option A (Replace the failed drive and allow the array to rebuild) is correct because with a hot-spare, the array can rebuild automatically after replacing the failed drive, minimizing data vulnerability. Option B (Perform a full backup) is prudent but not immediate; the array is still functional in degraded mode. Option C (Reboot the server and access the RAID controller BIOS) delays recovery and may cause unnecessary downtime.

Option D (Replace all drives to increase storage) is unnecessary and wasteful.

Practice this question →
12
MCQeasy

A system administrator is setting up a new server and needs to ensure that the server's time is synchronized with an external time source. Which protocol should be used?

A.NTP
B.SNMP
C.LDAP
D.SMTP
AnswerA

NTP (Network Time Protocol) is designed to synchronize clocks over a network. It uses UDP port 123 and can achieve millisecond accuracy. Configuring the server to use external NTP servers ensures accurate time, which is critical for logging, authentication, and distributed applications. It is the standard protocol for time synchronization.

Why this answer

NTP is the correct protocol for synchronizing server time with external sources. It is specifically designed for this purpose and is widely supported. Other protocols listed serve different functions and cannot synchronize time.

Accurate time is essential for security protocols, logging, and scheduled tasks.

Exam trap

The trap here is confusing network management or directory protocols with time synchronization protocols.

Practice this question →
13
MCQhard

A Linux server running Ubuntu Server 22.04 hosts a PostgreSQL database. The administrator notices that the database performs well in the morning but becomes progressively slower throughout the day, and free memory drops steadily. Running free -h shows that available memory is nearly exhausted, but the swap partition is barely used. Which command should the administrator use to identify the process consuming the most memory?

A.vmstat 1 10
B.top -o %MEM
C.iostat -x 5
D.sar -r 1 5
AnswerB

Running top with the -o %MEM option sorts processes by memory usage in descending order, immediately highlighting the process consuming the most RAM. This directly addresses the symptom of steadily decreasing free memory and identifies the likely culprit. The command is available by default on Ubuntu Server 22.04 and provides real-time updates, making it ideal for this scenario.

Why this answer

The top command with the -o %MEM option sorts running processes by memory consumption, directly identifying the process responsible for the steady memory decline. Other tools like vmstat, iostat, and sar provide system-wide statistics but lack per-process detail. For a Linux server experiencing memory pressure, top is the most efficient first step to isolate the offending process.

Exam trap

The trap here is choosing a system-wide monitoring tool that reports memory statistics but does not attribute usage to a specific process.

Practice this question →
14
PBQeasy

A small law firm has a single Windows Server 2016 Essentials server that functions as a domain controller and file server. After a sudden power outage over the weekend, the server does not boot normally. Instead, it displays a black screen with the message: 'BOOTMGR is missing. Press Ctrl+Alt+Del to restart.' The IT support specialist arrives on Monday morning to find the server in this state. The firm's operations are at a standstill because all case files and email archives are inaccessible. The specialist has access to the Windows Server 2016 installation media and a recent system state backup stored on an external drive. The server hardware passed POST, and all disks are detected in the BIOS. The specialist needs to restore the server's ability to boot into Windows as quickly as possible, with minimal risk to existing data. Which of the following procedures should the specialist perform FIRST?

A.Connect the external backup drive, boot from the installation media, and perform a full system restore from the backup.
B.Open the server case, reseat the RAM modules and SATA cables, and then attempt to boot again.
C.Boot from the installation media, select 'Repair your computer', and from the Command Prompt run 'bootrec /fixmbr' and 'bootrec /fixboot'.
D.Press F8 during startup to access Advanced Boot Options and select 'Last Known Good Configuration'.
AnswerC

Why this answer

Option C is correct because the 'BOOTMGR is missing' error typically indicates a corrupt master boot record or boot sector. Using bootrec /fixmbr and /fixboot from the installation media repairs the boot files without affecting data. Option A is a full system restore, which risks data loss and is overkill.

Option B is hardware reseating, unnecessary since POST passed. Option D, Last Known Good Configuration, does not fix missing boot manager files.

Practice this question →
15
Multi-Selecthard

A system administrator manages a Windows Server 2019 environment with multiple physical servers. The administrator needs to implement a remote management solution that provides out-of-band access to the servers' console even when the operating system is unresponsive or powered off. The solution must also allow mounting virtual media for OS installation and support remote power cycling. Which TWO of the following should the administrator implement? (Choose two.)

Select 2 answers
A.Set up a VPN connection for administrators to access the server management network.
B.Configure the servers' baseboard management controllers (BMCs) with dedicated network access.
C.Enable Remote Desktop Protocol (RDP) on all servers and restrict access via firewall rules.
D.Deploy a terminal server and use it as a jump host for administrative connections.
E.Install a remote management card or use an integrated lights-out (iLO) or iDRAC interface in each server.
AnswersB, E

A baseboard management controller (BMC) provides out-of-band management independent of the operating system. It allows remote console access, virtual media mounting, and power control even when the server is off. Configuring dedicated network access ensures the BMC is reachable without relying on the host OS, satisfying all the stated requirements.

Why this answer

Out-of-band management requires a baseboard management controller (BMC) or an integrated lights-out interface like iLO or iDRAC. These components operate independently of the operating system, providing console access, virtual media mounting, and remote power cycling even when the server is off or unresponsive. Configuring dedicated network access for the BMC ensures reliable connectivity.

Other options like RDP or VPNs do not provide the required out-of-band capabilities.

Exam trap

The trap here is confusing remote access tools that depend on the operating system, such as RDP or VPNs, with true out-of-band management that operates independently of the OS.

Practice this question →
16
PBQhard

A company operates a Windows Server 2019 machine that functions as a domain controller and file server. Over the past week, the server has randomly rebooted several times, often during periods of heavy file access. The administrator reviews the System event log and finds multiple Event ID 41 (Kernel-Power) entries with no preceding critical errors. The server is connected to an uninterruptible power supply (UPS) that reports stable input voltage. The server room temperature sensors indicate normal ambient temperature (22°C / 72°F). The server hardware is three years old and has not had any recent changes. The administrator has already run a full antivirus scan with no threats found. Which of the following should the administrator do NEXT to diagnose the issue?

A.Inspect and clean the CPU and chassis fans, and check for dust buildup
B.Update the server's BIOS to the latest version
C.Replace the power supply unit
D.Disable the automatic restart feature in System Properties
AnswerA

Why this answer

Option C is correct because random reboots with Kernel-Power 41 often indicate overheating due to failing fans or dust buildup, even if ambient temperature is normal. Option A is wrong because the power supply is likely not the issue given the UPS stability. Option B is wrong because a BIOS update is unlikely to solve hardware overheating.

Option D is wrong because disabling automatic restart only hides the symptom and does not prevent the reboots.

Practice this question →
17
PBQhard

A company runs a popular public-facing e-commerce website hosted on a farm of five Windows Server 2019 web servers behind a hardware load balancer. Recently, users have been reporting intermittent '503 Service Unavailable' errors during peak shopping hours. The administrator checks the load balancer and finds that all servers are marked as healthy with low CPU and memory usage. However, when inspecting a sample server, the administrator notices a large number of TCP connections in the TIME_WAIT state, consuming all available ephemeral ports. The application is ASP.NET based and uses IIS. The server configuration is as follows: Windows Server 2019 Standard, 4 vCPUs, 16 GB RAM, default TCP/IP settings. The administrator needs to resolve the connectivity issues without making changes to the application code or altering the network architecture. Which of the following actions should the administrator take to fix the problem PERMANENTLY?

A.Add two additional web servers to the farm to distribute the load.
B.Increase the ephemeral port range using netsh, and consider reducing the TIME_WAIT delay via registry settings.
C.Schedule a nightly restart of the IIS application pools.
D.Reduce the maximum number of concurrent connections in the IIS application pool settings.
AnswerB

Why this answer

Option A is correct because ephemeral port exhaustion is the root cause. Increasing the ephemeral port range provides more ports, and reducing TIME_WAIT delay frees them faster. Option B adds servers, which is a temporary workaround and does not prevent port exhaustion on each server.

Option C requires nightly restarts, causing brief outages and not solving the underlying issue. Option D limits concurrent connections but may degrade performance and does not address port exhaustion.

Practice this question →
18
MCQmedium

A server administrator is troubleshooting a Windows Server 2019 server that is experiencing slow performance. The administrator suspects that a specific process is consuming excessive CPU resources. Which of the following tools should the administrator use to identify the process?

A.Performance Monitor
B.Event Viewer
C.Resource Monitor
D.Task Manager
AnswerD

Task Manager provides a real-time view of running processes and their CPU, memory, disk, and network usage. It allows the administrator to quickly sort processes by CPU usage and identify the one consuming excessive resources. This makes it the most direct tool for this scenario.

Why this answer

Task Manager is the best tool for quickly identifying a process consuming excessive CPU. It provides a real-time list of processes with CPU usage percentages, allowing the administrator to sort and pinpoint the culprit. While other tools offer more detailed analysis, Task Manager is the most direct and efficient for this immediate troubleshooting need.

Exam trap

The trap here is assuming that more advanced tools like Performance Monitor or Resource Monitor are always better for troubleshooting, when in fact Task Manager is often the quickest for real-time process identification.

Practice this question →
19
MCQmedium

A server administrator is deploying a Linux server that must automatically start a custom application after every reboot. The application is a binary located at /opt/myapp/bin/myapp and requires the environment variable APP_HOME=/opt/myapp. The server uses systemd. Which of the following is the most appropriate way to ensure the application starts on boot and can be managed with systemctl?

A.Create a cron job with @reboot /opt/myapp/bin/myapp in the root crontab.
B.Place a shell script in /etc/profile.d/ that exports APP_HOME and starts the application.
C.Add a line to /etc/rc.local that exports APP_HOME=/opt/myapp and runs /opt/myapp/bin/myapp &.
D.Create a systemd unit file in /etc/systemd/system/myapp.service that includes ExecStart=/opt/myapp/bin/myapp and Environment=APP_HOME=/opt/myapp, then enable it with systemctl enable myapp.service.
AnswerD

This is correct because systemd is the native service manager on modern Linux distributions. Placing a unit file in /etc/systemd/system allows systemctl to manage the service, and the Environment directive sets the required variable. Enabling the unit creates the necessary symlinks so the service starts at boot, satisfying both requirements.

Why this answer

The correct approach uses systemd, the standard init system on most modern Linux distributions. A unit file in /etc/systemd/system allows full lifecycle management via systemctl, and the Environment directive ensures the required variable is set. Enabling the unit ensures the application starts automatically at boot, meeting both the startup and management requirements.

Exam trap

The trap here is assuming that legacy methods like /etc/rc.local or cron @reboot are equivalent to a proper systemd service, but they lack management and dependency features.

Practice this question →
20
MCQmedium

A company runs a critical file server on Windows Server 2022 with a RAID 5 array of four 4-TB SAS drives. During a routine check, the administrator notices that the array is in a degraded state because one drive has failed. While waiting for a replacement drive to arrive, a second drive fails. The administrator needs to restore access to the data as quickly as possible. Which of the following should the administrator do FIRST?

A.Force the second failed drive online using the RAID controller management utility.
B.Restore the most recent backup to a new array or server.
C.Replace both failed drives and let the RAID controller rebuild the array automatically.
D.Swap the failed drives with new ones and initialize the array, then restore from backup.
AnswerB

With two drives failed in a RAID 5 array, the array is no longer fault-tolerant and data cannot be accessed through normal means. The fastest way to restore access is to recover from the most recent backup onto a new array or server. This minimizes downtime and ensures data integrity, as the original array is unrecoverable without both drives.

Why this answer

In a RAID 5 array, a single drive failure is tolerated, but a second failure renders the array inoperable. The administrator must recover from backup to restore data and service. Replacing drives or forcing them online will not recover the data and may cause further damage.

Restoring from backup is the only reliable method to regain access.

Exam trap

The trap here is assuming that RAID 5 can survive two simultaneous drive failures, when in fact it can only tolerate one.

Practice this question →
21
MCQmedium

A company's backup policy requires that all server backups be written to removable media that can be stored offsite. The backup administrator is configuring a new Windows Server 2022 server and needs to ensure that the backup target appears as a locally attached disk to the backup software. The media must support being rotated daily and must not require the server to be powered off. Which type of storage should the administrator use?

A.External USB 3.0 hard disk drive
B.Tape library connected via Fibre Channel
C.Internal SATA solid-state drive (SSD) in a hot-swap bay
D.iSCSI target on a network-attached storage (NAS) device
AnswerA

An external USB 3.0 hard disk drive connects to the server and appears as a locally attached disk, which is exactly what the backup software expects. It is removable, supports daily rotation, and can be connected or disconnected without powering off the server. This satisfies the offsite storage requirement while providing adequate capacity and performance for server backups.

Why this answer

The requirement is for removable media that appears as a locally attached disk and can be rotated offsite without powering down the server. An external USB hard drive meets all these conditions: it presents as a local disk, is easily removable, and supports daily rotation. Other options either do not appear as local disks or are not designed for frequent physical transport.

Exam trap

The trap here is assuming that any removable storage, such as an internal hot-swap drive, is suitable for offsite rotation, when the scenario specifically requires a locally attached disk that is practical for daily transport.

Practice this question →
22
MCQmedium

A company's file server is running low on disk space. The administrator notices that the volume hosting user home directories is nearly full, with only 10 GB free out of 2 TB. Users report that they cannot save new files. The administrator needs to free up space immediately without deleting any user data. Which of the following should the administrator do FIRST?

A.Enable NTFS compression on the volume.
B.Use File Server Resource Manager to generate a storage report and identify large files.
C.Move the pagefile to another volume.
D.Run Disk Cleanup to remove temporary files and system caches.
AnswerB

File Server Resource Manager (FSRM) can generate storage reports that identify large files, duplicate files, and files by owner. This allows the administrator to pinpoint what is consuming space and take targeted action, such as archiving or moving data, without deleting user files. It is a non-destructive first step to understand the problem before freeing space.

Why this answer

The administrator should first identify what is consuming disk space before taking any action. File Server Resource Manager provides detailed storage reports that show large files, duplicates, and usage by owner, enabling targeted cleanup without risking user data. Other options either do not address the specific volume or are not immediate or effective enough.

Exam trap

The trap here is assuming that generic cleanup tools like Disk Cleanup will free enough space on a data volume, when the real issue is user data consumption that requires analysis first.

Practice this question →
23
Multi-Selectmedium

A server administrator is troubleshooting a Linux server that is experiencing performance degradation. The administrator suspects high disk I/O. Which two commands should the administrator use to identify the processes and disks causing the I/O load? (Choose two.)

Select 2 answers
A.iotop -o
B.top
C.iostat -x 1
D.vmstat 1
E.netstat -tuln
AnswersA, C

iotop -o displays only processes that are actively performing I/O, showing disk read/write bandwidth per process. This directly identifies which processes are causing high disk I/O. It requires root privileges and is ideal for real-time monitoring of I/O-heavy processes.

Why this answer

iostat -x 1 provides per-disk extended statistics, helping identify which disk is saturated. iotop -o shows per-process I/O usage, identifying which processes are causing the load. Together, they allow the administrator to correlate process activity with disk utilization. The other commands either focus on network, CPU/memory, or lack per-process or per-disk granularity.

Exam trap

The trap here is selecting general-purpose tools like top or vmstat, which show overall system load but not the specific per-process or per-disk I/O details needed for this diagnosis.

Practice this question →
24
MCQmedium

A system administrator needs to apply critical security patches to a production web server that cannot be taken offline. The server runs a Linux operating system and hosts a high-availability website. The administrator wants to ensure that if the patches cause a failure, the server can be quickly rolled back to its previous state. Which of the following actions should the administrator take FIRST?

A.Back up all user data to a network share.
B.Schedule a maintenance window and notify users of potential downtime.
C.Take a snapshot of the server's virtual machine before applying patches.
D.Apply the patches during off-peak hours without any additional steps.
AnswerC

A snapshot captures the entire VM state, including OS and applications, enabling a fast and complete rollback.

Why this answer

Option B is correct because taking a snapshot provides a point-in-time state of the virtual machine, allowing quick rollback if the patches cause issues. Option A backs up user data but does not capture the system state needed for a full rollback. Option C is a procedural step but not the first technical action to enable recovery.

Option D is reckless and provides no rollback capability.

Practice this question →
25
MCQeasy

A junior administrator is tasked with creating a new virtual machine on a Windows Server 2019 Hyper-V host. The VM will run a lightly used internal application and requires 4 GB of RAM, 2 virtual processors, and a 60 GB virtual hard disk. The administrator creates the VM using the default dynamic memory settings and a dynamically expanding VHDX. After a week, users report that the application occasionally becomes very slow. Performance monitoring shows that the VM's memory utilization frequently hits the configured maximum, and disk latency spikes during these times. Which of the following is the MOST likely cause of the performance issue?

A.The VM is experiencing memory pressure due to dynamic memory configuration, causing excessive paging.
B.The host's CPU is oversubscribed, causing the VM's virtual processors to wait.
C.The virtual switch is misconfigured, causing network latency.
D.The dynamically expanding VHDX is causing disk fragmentation and slow I/O.
AnswerA

Dynamic memory allows the VM's memory to fluctuate based on demand, but if the maximum is set too low, the VM can run out of memory. The frequent hitting of the configured maximum indicates memory pressure, leading to paging to disk (using the VHDX or page file), which causes disk latency spikes and application slowdowns.

Why this answer

Dynamic memory in Hyper-V adjusts the VM's memory within a configured minimum and maximum. If the maximum is set too low, the VM can run out of memory, causing the guest OS to page heavily to disk. This results in high disk latency and application slowdowns.

The memory utilization hitting the maximum confirms memory pressure as the root cause. Adjusting the dynamic memory maximum or using static memory would resolve the issue.

Exam trap

The trap here is assuming that dynamic memory automatically allocates as much memory as needed, when in reality it is bounded by the configured maximum and can cause paging if set too low.

Practice this question →
26
MCQhard

A company has a server running Windows Server 2022 with two 10-Gbps network adapters. The server hosts a high-traffic web application that requires maximum throughput and fault tolerance. The network switches support 802.3ad link aggregation. The administrator configures NIC teaming using LACP with Address Hash. After deployment, users report intermittent connectivity issues. Which of the following is the MOST likely cause?

A.The load balancing mode should be Dynamic instead of Address Hash.
B.The switch ports are not configured for LACP.
C.The server's network adapters are not identical models.
D.The NIC teaming mode should be Switch Independent instead of LACP.
AnswerB

LACP requires that the switch ports be configured for link aggregation (e.g., an EtherChannel or port-channel). If the switch ports are not configured for LACP, the team will not form correctly, leading to intermittent connectivity or failure. The administrator must ensure the switch configuration matches the NIC teaming settings.

Why this answer

The most likely cause is that the switch ports are not configured for LACP. LACP requires configuration on both the server and the switch to form a link aggregation group. Without proper switch configuration, the team will not function correctly, causing intermittent connectivity.

Exam trap

The trap here is assuming that configuring NIC teaming on the server alone is sufficient for LACP; the switch must also be configured.

Practice this question →
27
MCQmedium

A server administrator needs to deploy a new physical server that will run a database requiring high availability and maximum performance. The server has four 1 TB NVMe SSDs. The administrator wants to configure RAID 10 for both redundancy and performance. Which of the following should the administrator do to achieve this?

A.Configure a RAID 6 array using the NVMe drives.
B.Configure a hardware RAID 10 array using the RAID controller.
C.Configure software RAID 5 using the operating system's disk management tools.
D.Configure a RAID 0 array using the NVMe drives.
AnswerB

Hardware RAID 10 combines mirroring and striping, providing both redundancy and improved performance. Using a dedicated RAID controller offloads parity calculations and management from the CPU, which is ideal for a database server. This configuration meets the requirement for high availability and maximum performance with the available four NVMe SSDs.

Why this answer

RAID 10 is the best choice for a database requiring high availability and maximum performance because it combines mirroring for redundancy and striping for performance. Hardware RAID offloads processing to a dedicated controller, further enhancing performance. The other RAID levels either lack redundancy (RAID 0) or have lower performance (RAID 5, RAID 6) for write-intensive workloads.

Exam trap

The trap here is assuming that any RAID level with redundancy (like RAID 5 or RAID 6) will meet performance requirements, but RAID 10 is superior for write-intensive database workloads.

Practice this question →
28
MCQhard

A VMware ESXi host runs six virtual machines, each configured with 8GB of RAM, totaling 48GB allocated. The host physically has 32GB of RAM, and memory overcommitment is enabled. Recently, a critical VM experienced severe performance degradation during peak hours, with the guest OS showing high memory pressure and balloon driver activity, while other VMs showed moderate usage. Which of the following actions will BEST resolve the issue without compromising other VMs?

A.Purchase and install an additional 32GB of physical RAM in the host.
B.Disable the VMware balloon driver on all virtual machines.
C.Configure a memory reservation of 8GB for the critical VM.
D.Reduce the CPU limit on the non-critical VMs during peak hours.
AnswerC

A reservation grants the VM guaranteed access to physical RAM, protecting it from ballooning and hypervisor swapping, thus stabilizing performance.

Why this answer

Option B (Set a memory reservation equal to its configured 8GB on the critical VM) is correct because it guarantees physical RAM for that VM, preventing the balloon driver from reclaiming its memory and reducing hypervisor swapping. Option A (Increase host RAM) would solve it broadly but is not the most immediate, targeted action and may not be feasible. Option C (Disable balloon driver on all VMs) could cause host swapping, degrading all VMs.

Option D (Reduce CPU limits) does not address memory contention.

Practice this question →
29
MCQmedium

A company’s file server runs Windows Server 2022 and hosts a 4 TB volume. Users report that saving large files to a shared folder occasionally fails with an error about insufficient disk space, even though the volume shows 800 GB of free space. Performance Monitor shows high Avg. Disk sec/Transfer and frequent paging. Which action should the administrator take first to resolve the file‑save failures?

A.Enable Data Deduplication on the volume to reclaim space.
B.Convert the volume to ReFS to improve file handling.
C.Increase the amount of RAM in the server.
D.Move the shared folder to a different volume with more free space.
AnswerC

The high Avg. Disk sec/Transfer and paging indicate that the server is memory‑constrained, causing excessive disk I/O. When RAM is insufficient, the system pages to disk, slowing file operations and causing timeouts that can appear as insufficient disk space errors. Adding RAM reduces paging, improves disk performance, and allows file saves to complete successfully.

Why this answer

The server’s symptoms—high disk transfer times, frequent paging, and file‑save failures despite free space—point to insufficient RAM. When memory is low, Windows pages heavily to disk, causing I/O bottlenecks and timeouts. Adding RAM reduces paging, improves disk responsiveness, and resolves the file‑save errors.

Other options do not address the memory constraint and could introduce unnecessary changes.

Exam trap

The trap here is assuming that free disk space alone guarantees successful file saves, overlooking how memory exhaustion can cause I/O timeouts that masquerade as disk space errors.

Practice this question →
30
MCQeasy

A server administrator needs to deploy a new physical server that will host a database. The database requires high random read/write performance and redundancy. The server has a RAID controller that supports RAID 0, 1, 5, 6, and 10. The administrator installs four identical SAS SSDs. Which RAID level should the administrator configure to meet the performance and redundancy requirements?

A.RAID 0
B.RAID 5
C.RAID 10
D.RAID 1
AnswerC

RAID 10 combines mirroring and striping, providing both redundancy and high performance for random reads and writes. With four drives, it creates two mirrored pairs and stripes data across them. This offers excellent performance and fault tolerance, making it ideal for database workloads. It is the best choice among the options for meeting both performance and redundancy requirements.

Why this answer

RAID 10 offers the best combination of high random read/write performance and redundancy for a database server. It stripes data across mirrored pairs, allowing multiple simultaneous reads and writes while tolerating drive failures. Other RAID levels either lack redundancy (RAID 0) or have performance limitations for write-intensive workloads (RAID 1, RAID 5).

Exam trap

The trap here is assuming RAID 5 is sufficient for databases because it offers redundancy and decent read performance, but it falls short on random write performance.

Practice this question →
31
MCQeasy

A server administrator is configuring a new Windows Server 2022 server that will host a database. The server has four 10 TB SAS drives and a hardware RAID controller. The administrator needs to maximize performance for random reads and writes while providing redundancy. Which RAID level should the administrator implement?

A.RAID 10
B.RAID 0
C.RAID 5
D.RAID 1
AnswerA

RAID 10 combines mirroring and striping, using four drives in two mirrored pairs. It provides excellent random read and write performance because data is striped across mirrors, and it offers redundancy by tolerating one drive failure per mirror. This makes it ideal for database workloads requiring high performance and fault tolerance.

Why this answer

RAID 10 stripes data across multiple mirrored pairs, delivering high random read and write performance while providing redundancy. For a database server with four drives, RAID 10 utilizes all drives for both performance and fault tolerance, unlike RAID 1 which uses only two drives for a single mirror, or RAID 5 which incurs write penalties due to parity. RAID 0 lacks redundancy, so it is not suitable.

Exam trap

The trap here is choosing RAID 5 for its balance of capacity and redundancy, but its write penalty makes it a poor fit for random write-intensive database workloads.

Practice this question →
32
MCQeasy

A server administrator is tasked with ensuring that a critical database server remains available in the event of a hardware failure. The solution must provide automatic failover with minimal administrative overhead. Which of the following should be implemented?

A.Load balancing
B.Scheduled backups
C.RAID 1 mirroring
D.Server clustering
AnswerD

Server clustering links nodes so a surviving member automatically takes over the failed node's workload, delivering failover with minimal manual intervention. This satisfies the stem's automatic failover and low administrative overhead constraints, unlike standalone backups or manual restore procedures.

Why this answer

Server clustering groups two or more servers so that if one node fails, another automatically takes over the workload with minimal manual intervention. This provides the automatic failover and low administrative overhead the scenario requires for a critical database server. Clustering is the standard high-availability solution for database workloads needing continuous uptime.

Exam trap

SK0-005 often tests the distinction between storage-level redundancy (RAID) and server-level high availability (clustering)—candidates pick RAID 1 thinking disk mirroring equals server failover, missing that RAID cannot survive a whole-server outage.

How to eliminate wrong answers

Option A is wrong because load balancing distributes traffic across multiple servers for performance and scalability but does not by itself provide automatic failover of a stateful database workload or guarantee session/data continuity. Option B is wrong because scheduled backups protect data but do not keep the server available—restoring from backup involves significant downtime and manual effort, violating the minimal-overhead requirement. Option C is wrong because RAID 1 mirroring only protects against a single disk failure at the storage layer; it does nothing if the server's motherboard, power supply, or OS fails, so it cannot deliver server-level automatic failover.

Practice this question →
33
MCQhard

A server administrator is configuring a Windows Server 2022 failover cluster with two nodes. The cluster will host a highly available file server role. The administrator needs to ensure that the file server role can fail over automatically if one node goes down. The cluster has shared storage presented as a single disk. Which of the following should the administrator configure to meet this requirement?

A.Configure the file server role to use a distributed network name and a scale-out file server.
B.Enable Cluster Shared Volumes (CSV) and place the file server role on the CSV.
C.Add the file server role as a clustered role and ensure the shared disk is added as a resource in the role.
D.Configure the file server role with a preferred owner and set the failover threshold to 1.
AnswerC

To enable automatic failover, the file server role must be a clustered role with the shared disk as a dependency. This ensures that the role and its storage move together to the surviving node. The cluster service manages the failover automatically when a node fails, provided quorum is maintained. This is the standard configuration for a highly available file server.

Why this answer

The correct configuration is to add the file server role as a clustered role and include the shared disk as a resource in that role. This ensures that the role and its storage are managed together and can fail over automatically to the other node if one fails. The cluster service handles the failover based on node health and quorum.

Exam trap

The trap here is confusing Cluster Shared Volumes with traditional shared storage for failover clustering; CSV is not used for standard file server roles.

Practice this question →
34
MCQmedium

A server administrator is configuring a new Linux server that will run a critical web application. The administrator needs to ensure that the web service automatically starts if the server reboots and restarts if it crashes. The server uses systemd. Which of the following should the administrator do?

A.Add the service to /etc/rc.local and use a cron job to check and restart it.
B.Use the nohup command to run the service in the background and add it to the root crontab with @reboot.
C.Create a systemd service unit with Restart=always and enable it with systemctl enable.
D.Configure the service as a SysV init script and use chkconfig to enable it.
AnswerC

Creating a systemd service unit with Restart=always ensures the service restarts if it crashes. Enabling the unit with systemctl enable configures it to start automatically at boot. This meets both requirements: automatic start on reboot and restart on crash. systemd is the standard init system on modern Linux distributions, so this is the correct approach.

Why this answer

Using a systemd service unit with Restart=always and enabling it is the correct method. systemd provides built-in service management, including automatic restart on failure and start on boot. This is the standard and most reliable way to ensure a critical service remains available on modern Linux servers.

Exam trap

The trap here is assuming that legacy methods like cron or rc.local can provide the same level of service management as systemd.

Practice this question →
35
MCQhard

A system administrator is configuring a new server that will run a high-performance database. The server has four 1 TB NVMe drives and a hardware RAID controller that supports RAID 0, 1, 5, 6, 10, and 50. The database workload is write-intensive with random I/O. The administrator needs to maximize performance while providing redundancy against a single drive failure. Which RAID level should the administrator choose?

A.RAID 6
B.RAID 5
C.RAID 10
D.RAID 0
AnswerC

RAID 10 combines mirroring and striping, providing both redundancy and high performance. It can tolerate a single drive failure (or more, depending on which drives fail) and excels at write-intensive random I/O because it does not require parity calculations. With four drives, RAID 10 uses two mirrored pairs, offering excellent performance and fault tolerance.

Why this answer

For a write-intensive random I/O database workload, RAID 10 is the best choice because it provides redundancy and superior write performance by avoiding parity overhead. RAID 0 lacks redundancy, while RAID 5 and RAID 6 incur write penalties that would hinder performance. RAID 10 meets both the performance and redundancy requirements.

Exam trap

The trap here is assuming that RAID 5 or RAID 6, which offer redundancy, are suitable for write-intensive workloads, when their parity calculations significantly degrade write performance.

Practice this question →
36
Multi-Selecthard

A server administrator is troubleshooting a Linux server that is experiencing performance issues. The administrator suspects that a specific process is consuming excessive CPU resources. Which two commands can be used to identify the process? (Choose two.)

Select 2 answers
A.ps aux --sort=-%cpu
B.top
C.free -m
D.netstat -tuln
E.df -h
AnswersA, B

This command lists all running processes and sorts them by CPU usage in descending order. The --sort=-%cpu option ensures the highest CPU consumers appear at the top. It provides a snapshot that is useful for identifying processes with high CPU usage, making it an effective tool for this scenario.

Why this answer

The top and ps aux --sort=-%cpu commands both provide information about CPU usage per process. The top command offers a live, interactive view, while ps aux --sort=-%cpu gives a sorted snapshot. The other commands focus on disk space, network ports, and memory, which are not directly useful for identifying a CPU-intensive process.

Exam trap

The trap here is assuming that any system monitoring command will help, when only those that display per-process CPU usage are relevant.

Practice this question →
37
Multi-Selectmedium

A company runs a critical application on a physical Windows Server 2022 with four 146 GB SAS drives in a RAID 5 array and a single hot-spare. The server has been in production for five years. The IT manager asks you to recommend two proactive measures to reduce the risk of unplanned downtime due to drive failures. (Choose two.)

Select 2 answers
A.Configure a weekly scheduled consistency check (patrol read) on the RAID controller.
B.Enable and configure SMART monitoring with alerting on the server.
C.Schedule a nightly full backup of the server to an external USB drive.
D.Convert the RAID 5 array to RAID 0 to improve performance.
E.Replace all drives with higher-capacity drives to increase the array size.
AnswersA, B

A consistency check scans the array for media errors and corrects them using parity, detecting latent sector faults before a rebuild. On a five-year-old RAID 5 array, this reduces the chance that a second drive fails during rebuild. It is a proactive, non-disruptive maintenance task that directly addresses the scenario's goal of reducing unplanned downtime from drive failures.

Why this answer

A consistency check (patrol read) proactively scans the RAID array for media errors and corrects them using parity, while SMART monitoring predicts drive failures before they occur. Together, they provide early warning and maintenance that can prevent a drive failure from causing downtime. The other options either increase risk, do not address drive failure, or only help after an outage.

Exam trap

The trap here is confusing data protection (backups) with uptime protection (proactive drive health monitoring and maintenance).

Practice this question →
38
MCQhard

A server administrator is troubleshooting a performance issue on a Linux server. The server hosts a database that performs many small random reads and writes. The administrator suspects that disk I/O is the bottleneck. Which command should the administrator use to view real-time disk I/O statistics per device, including utilization and await times?

A.vmstat 2
B.top
C.netstat -i
D.iostat -x 2
AnswerD

iostat is part of the sysstat package and provides detailed per-device I/O statistics. The -x option displays extended statistics such as %util (utilization) and await (average wait time), which are critical for diagnosing I/O bottlenecks. Running it with an interval of 2 seconds gives real-time monitoring, making it ideal for this scenario.

Why this answer

iostat -x provides extended disk I/O statistics per device, including %util and await, which directly indicate disk performance and bottlenecks. vmstat gives a high-level view but lacks per-device detail, top focuses on CPU and memory, and netstat is for network interfaces. Therefore, iostat is the correct tool for diagnosing disk I/O issues.

Exam trap

The trap here is confusing general system monitoring tools like vmstat or top with specialized disk I/O tools; only iostat provides per-device extended statistics.

Practice this question →
39
MCQhard

A server administrator is planning a storage configuration for a new database server that will handle a high volume of random writes. The server has eight 1.2 TB 10K RPM SAS drives and a hardware RAID controller with a 4 GB cache and battery backup. The administrator needs to maximize write performance while ensuring data redundancy. Which RAID level and configuration should the administrator implement?

A.RAID 5 with a stripe size of 64 KB
B.RAID 10 with a stripe size of 256 KB
C.RAID 0 with a stripe size of 64 KB
D.RAID 6 with a stripe size of 128 KB
AnswerB

RAID 10 mirrors and stripes data, providing excellent random write performance because no parity calculations are needed. Each write is simply written to two drives. The 256 KB stripe size can improve throughput for large I/Os, but for random writes, the stripe size has less impact. RAID 10 also ensures redundancy, allowing one drive per mirrored pair to fail.

Why this answer

RAID 10 provides the best random write performance among the options because it uses mirroring and striping without parity overhead. Each write is written to two drives, avoiding the read-modify-write cycle of parity RAID. It also provides redundancy.

RAID 5 and RAID 6 incur parity penalties, and RAID 0 lacks redundancy, so RAID 10 is the correct choice for a high-random-write database server.

Exam trap

The trap here is focusing only on stripe size tuning while overlooking the fundamental write penalty of parity RAID levels.

Practice this question →
40
MCQhard

Refer to the exhibit. An administrator receives reports that a web application is returning HTTP 502 errors. The administrator examines the Nginx error log on the reverse proxy server and sees the following. Which of the following is MOST likely causing the errors?

A.The Nginx service is not running.
B.The upstream server at 10.0.1.25:8080 refuses connections.
C.The firewall on the reverse proxy is blocking port 80.
D.The client's DNS cannot resolve example.com.
AnswerB

'Connection refused' directly signals that the upstream server is not listening on that port or is actively rejecting connections.

Why this answer

Option A is correct because the error 'Connection refused' indicates the upstream server (10.0.1.25:8080) is not accepting connections, typically because the backend service is down or the port is closed. Option B is incorrect because if Nginx were not running, no such log entry would be generated. Option C is incorrect because the client's DNS resolution is not involved after Nginx has already attempted to contact the upstream IP.

Option D is incorrect because a firewall blocking outbound connections would cause a timeout, not a 'Connection refused' message.

Practice this question →
41
MCQhard

A company runs a busy web application on a single Windows Server 2022 server with 32 GB RAM, two 8-core CPUs, and a hardware RAID 10 array. Users report intermittent slowdowns, and Performance Monitor shows that the PhysicalDisk\% Idle Time counter for the data volume frequently drops below 10% while the Processor\% Processor Time remains around 40%. The server hosts the web application, its SQL Server 2019 database, and the operating system on the same RAID 10 array. Which of the following is the MOST appropriate next step to improve performance?

A.Upgrade the CPUs to higher-frequency models to reduce disk queue length.
B.Move the SQL Server database files and logs to separate dedicated physical disk arrays.
C.Add more RAM to the server to reduce disk paging.
D.Enable write caching on the RAID controller without a battery backup unit.
AnswerB

PhysicalDisk\% Idle Time below 10% means the disk is nearly always busy, indicating an I/O bottleneck. Separating database files and transaction logs onto dedicated spindles reduces contention with the OS and web application, improving throughput. This is a standard storage optimization for database servers and directly addresses the observed counter.

Why this answer

The PhysicalDisk\% Idle Time counter below 10% indicates the disk subsystem is saturated, while processor utilization is moderate. Separating SQL Server data and log files onto dedicated arrays reduces I/O contention and improves overall throughput. Adding RAM or upgrading CPUs does not target the actual bottleneck, and enabling write caching without protection adds risk without guaranteeing a fix.

Exam trap

The trap here is assuming that any performance issue requires more RAM or CPU, when the specific counter clearly points to disk saturation.

Practice this question →
42
MCQhard

A company is planning to deploy a new web application on multiple servers behind a load balancer. The application requires consistent session data across all servers for seamless user experience. Which of the following solutions would BEST meet this requirement?

A.Configure each web server to store sessions locally and use sticky sessions on the load balancer.
B.Use round-robin DNS to distribute traffic.
C.Store session data in a shared, high-performance in-memory data store like Redis.
D.Implement database session storage with synchronous replication between servers.
AnswerC

A centralized in-memory data store allows all web servers to access and modify session data quickly, providing seamless user experience and consistent state across the cluster.

Why this answer

Option B is correct because a shared in-memory data store like Redis provides low-latency access to session data for all servers, ensuring consistency and high availability. Option A is wrong because round-robin DNS does not handle session persistence. Option C is wrong because sticky sessions tie a user to one server; if that server fails, the session is lost and consistency is not maintained across servers.

Option D is wrong because synchronous database replication adds latency and complexity, making it less suitable for high-performance web applications.

Practice this question →
43
PBQmedium

An administrator is monitoring a server that has a hardware RAID 5 array consisting of four 2 TB disks. The RAID controller's management software reports that one disk has a status of 'Pred Fail' (predictive failure). The array also has a dedicated hot spare disk already installed and set up. The array is still fully functional with no data loss, but the 'Pred Fail' warning indicates the disk is likely to fail soon. The server is a production database server that cannot be taken offline except for scheduled maintenance windows, which are not until the following weekend. The administrator needs to ensure data integrity and avoid any risk of downtime or data loss while waiting for the replacement. Which immediate action should the administrator take?

A.Wait for the disk to completely fail so that the hot spare will automatically rebuild the array
B.Use the RAID management software to initiate a proactive replacement of the pred fail disk with the hot spare
C.Take a full backup immediately and then replace the disk during the next maintenance window
D.Remove the pred fail disk from the array to force the hot spare to rebuild, then re-add the disk later
AnswerB

Why this answer

When a RAID controller reports 'Pred Fail' and a hot spare is already configured, the correct immediate action is to use the RAID management software to proactively fail over the predictive-failure disk to the hot spare. This forces a rebuild while the disk is still readable, avoiding the risk of a rebuild failure if the disk dies completely and ensuring the array returns to full redundancy before the weekend maintenance window.

Exam trap

SK0-005 often tests the misconception that a hot spare only activates on complete disk failure — candidates pick 'wait for failure' thinking the hot spare handles everything, missing that proactive failover on predictive failure is the recommended practice to preserve redundancy.

How to eliminate wrong answers

Option A is wrong because waiting for complete failure means the array runs degraded with no redundancy, and if another disk fails during that window, data is lost — plus a rebuild from a dead disk may encounter unreadable sectors. Option C is wrong because taking only a backup and waiting until the weekend leaves the array in a vulnerable state for days; a backup does not restore RAID redundancy. Option D is wrong because physically removing a disk from a live array is risky and unnecessary when the management software can perform a controlled failover; pulling a disk can also cause the controller to mark the slot as failed in a way that complicates re-adding it.

Practice this question →
44
MCQmedium

A company's primary file server runs Windows Server 2019 with four 1 TB SATA drives in a RAID 5 array controlled by a hardware RAID controller. The server hosts shared project data that is accessed continuously during business hours. The administrator notices that write performance has degraded significantly over the past month, and the RAID controller log shows an increasing number of medium errors on one drive. The administrator needs to replace the failing drive with minimal downtime and without losing data. Which of the following should the administrator do FIRST?

A.Update the RAID controller firmware to the latest version.
B.Verify that a recent, restorable backup of the array exists.
C.Run a full surface scan on all drives in the array to identify additional errors.
D.Replace the failing drive with a new drive of equal or larger capacity, allowing the controller to rebuild the array.
AnswerB

Before any physical intervention on a degraded RAID array, confirming a recent, tested backup is essential. During a RAID 5 rebuild, the array is vulnerable to a second drive failure, which would cause total data loss. A verified backup ensures the data can be restored if the rebuild fails or another drive fails during the process.

Why this answer

Before replacing a drive in a degraded RAID 5 array, the administrator must ensure that a recent, restorable backup exists. RAID 5 can tolerate only one drive failure; during a rebuild, the array is extremely vulnerable, and a second failure would result in total data loss. Verifying a backup first protects the data and allows recovery if the rebuild fails.

Exam trap

The trap here is assuming that a RAID 5 array always protects data during a rebuild, when in fact the array is at its most vulnerable point and a verified backup is the true safety net.

Practice this question →
45
Multi-Selectmedium

A server administrator is implementing a backup strategy for a Windows Server 2022 file server. The administrator needs to ensure that backups can be restored quickly and that the backup data is protected against ransomware. Which two actions should the administrator take? (Choose two.)

Select 2 answers
A.Enable deduplication on the backup target to reduce storage consumption.
B.Store backups on a network share that is accessible using domain administrator credentials.
C.Schedule backups to run only during off‑peak hours to minimize performance impact.
D.Use a cloud backup service that supports immutable backups and versioning.
E.Configure Windows Server Backup to store backups on an external USB drive that is kept offline when not in use.
AnswersD, E

Immutable backups cannot be altered or deleted for a specified retention period, providing strong protection against ransomware. Versioning allows restoration to a previous point in time. This approach ensures that backup data is protected even if credentials are compromised, and it enables quick recovery.

Why this answer

To protect backups from ransomware and ensure quick restoration, the administrator should keep backups offline or use immutable cloud storage. An offline USB drive is inaccessible to ransomware when disconnected, and immutable cloud backups cannot be altered. Both approaches provide strong protection and enable reliable recovery.

Exam trap

The trap here is assuming that any backup is sufficient, but backups stored on always‑connected network shares or without immutability can be encrypted by ransomware, rendering them useless for recovery.

Practice this question →
46
PBQhard

A company is migrating a legacy line-of-business application from Windows Server 2012 R2 to a new Windows Server 2022 server that is a member of an Active Directory domain. The application runs as a Windows service under a domain service account named CORP\svc_app. The service account has been granted the 'Log on as a service' user right on the old server, and the application is configured to listen on a static TCP port 8443. After installing the application on the new server and configuring it with the same service account and port, the application fails to start. The administrator checks the Windows Event Viewer and sees two errors in the System log: 'The CORP\svc_app service failed to start due to the following error: The service did not start due to a logon failure' and 'The service cannot bind to the designated port 8443'. The administrator has already verified that the service account's password is correct and has not expired, that the account is enabled, that the port 8443 is not being used by another service, and that the Windows Firewall has an inbound rule allowing traffic on port 8443. The application's configuration file correctly points to port 8443. What should the administrator do to resolve the issue?

A.Restart the Windows Server 2022 server to apply any pending policy changes.
B.Grant the 'Log on as a service' user right to the CORP\svc_app account via Local Security Policy or Group Policy.
C.Configure the application to use a dynamic port instead of the static port 8443.
D.Reset the service account password and update the service configuration.
AnswerB

Why this answer

The error 'The service did not start due to a logon failure' combined with the port bind failure points to the service account lacking the 'Log on as a service' right on the new server. User rights such as 'Log on as a service' are assigned per-machine via Local Security Policy or centrally via Group Policy, and they do not automatically follow a domain account when it is used on a new server. Even though the account is enabled and the password is valid, without the SeServiceLogonRight the Service Control Manager cannot create the logon token, so the service fails before it can bind to port 8443.

Granting the right on the new server resolves both errors.

Exam trap

SK0-005 often tests the misconception that a valid, enabled domain service account automatically has the right to log on as a service on any server, when in fact SeServiceLogonRight must be granted per machine.

How to eliminate wrong answers

Option A is wrong because a reboot does not grant a missing user right — pending policy changes would already be reflected in the error, and the logon failure is a rights assignment issue, not a refresh timing issue. Option C is wrong because changing to a dynamic port does not address the logon failure; the port bind error is a downstream symptom of the service never starting, and the port is already verified as free. Option D is wrong because the administrator already verified the password is correct and unexpired; resetting it would not add the missing 'Log on as a service' right and would not fix the logon failure.

Practice this question →
47
MCQmedium

A server administrator is configuring a new Linux server that will host a web application. The application requires a persistent storage volume that can be easily expanded without downtime. The server has a single physical disk with 500 GB of free space. The administrator decides to use LVM (Logical Volume Management). Which of the following is the correct sequence of steps to create a new logical volume and mount it?

A.lvcreate, vgcreate, pvcreate, mkfs, mount
B.vgcreate, pvcreate, lvcreate, mkfs, mount
C.pvcreate, vgcreate, lvcreate, mkfs, mount
D.pvcreate, lvcreate, vgcreate, mkfs, mount
AnswerC

This sequence is correct: first create a physical volume (pvcreate) on the disk or partition, then create a volume group (vgcreate) from that physical volume, then create a logical volume (lvcreate) within the volume group, then create a filesystem (mkfs) on the logical volume, and finally mount it. This is the standard LVM workflow.

Why this answer

The correct order for setting up LVM is to create physical volumes, then a volume group, then logical volumes, then a filesystem, and finally mount it. This logical progression ensures that each layer is built upon the previous one. The other sequences violate the dependency order and would result in errors.

Exam trap

The trap here is mixing up the order of LVM commands, especially placing lvcreate before vgcreate or vgcreate before pvcreate.

Practice this question →
48
MCQmedium

A company's file server is running low on disk space. The administrator notices that the disk holding the operating system and application logs is nearly full. Which of the following is the BEST immediate step to free up space while maintaining system stability?

A.Delete the largest log files in the Windows directory.
B.Compress the entire operating system drive.
C.Move the pagefile to a different volume.
D.Run Disk Cleanup to remove temporary files and old updates.
AnswerD

Disk Cleanup safely removes temporary files, system cache, and old Windows updates, freeing space without affecting critical system files or application functionality. It is a built-in tool that identifies safe-to-delete items, making it the best immediate action to regain space while preserving stability.

Why this answer

Disk Cleanup is the safest and most efficient immediate solution because it targets unnecessary files without risking system integrity. Other options either jeopardize stability, offer limited benefit, or introduce performance penalties. The goal is to quickly reclaim space while ensuring the server remains operational and compliant.

Exam trap

The trap here is assuming that manually deleting large files is always safe, when in fact it can break logging and auditing.

Practice this question →
49
MCQmedium

A server hosts a database that requires nightly backups. The backup strategy uses a full backup every Sunday and differential backups on other days. On Wednesday, the server fails. Which backup sets are required to restore to the most recent state?

A.Last full backup and all differential backups since Sunday
B.Last full backup only
C.Last full backup and the latest differential backup
D.Last full backup and all incremental backups since Sunday
AnswerC

Differential backups capture every change since the last full backup, so only the most recent differential is needed. Restoring requires the last full backup plus that latest differential, which returns the database to its Wednesday state.

Why this answer

A differential backup contains all changes since the last full backup. Therefore, only the last full backup and the latest differential are needed for a restore. Incremental backups would require all incrementals since the last full, but the scenario uses differential backups.

Practice this question →
50
MCQeasy

A server administrator is setting up a new Windows Server 2022 file server. The server has two 1 TB NVMe drives. The administrator wants to ensure that if one drive fails, the server can continue to operate without data loss, and also wants to maximize read performance. Which of the following should the administrator implement?

A.RAID 10
B.RAID 1
C.RAID 0
D.RAID 5
AnswerB

RAID 1 mirrors data across both drives, providing redundancy so that if one drive fails, the other continues to serve data. It also allows reads to be serviced from either drive, which can improve read performance. This meets both requirements: continued operation after a single drive failure and improved read performance.

Why this answer

RAID 1 mirrors data across two drives, providing fault tolerance if one drive fails and allowing read operations to be distributed across both drives for better performance. RAID 0 lacks redundancy, RAID 5 needs at least three drives, and RAID 10 needs at least four drives, so none of those meet the requirements with only two drives.

Exam trap

The trap here is assuming RAID 5 or RAID 10 can be used with two drives, but they have minimum drive requirements.

Practice this question →
51
MCQeasy

A server administrator is setting up a new Windows Server 2022 server that will host a database. The server has four 10 TB SAS drives. The administrator needs to configure the drives for maximum performance and fault tolerance, allowing the server to continue operating if one drive fails. Which RAID level should the administrator use?

A.RAID 1
B.RAID 5
C.RAID 10
D.RAID 0
AnswerC

RAID 10 combines mirroring and striping, providing both fault tolerance and high performance. It can tolerate one drive failure per mirrored pair, and with four drives, it can survive multiple drive failures as long as they are not in the same mirror. It is ideal for database workloads requiring high random write performance and redundancy.

Why this answer

RAID 10 is the best choice because it offers both fault tolerance and high performance. It stripes data across mirrored pairs, allowing the server to continue operating if one drive fails. For a database server, RAID 10 provides better write performance than RAID 5 and better capacity utilization than RAID 1, making it suitable for the stated requirements.

Exam trap

The trap here is assuming that RAID 5 is always the best balance of performance and fault tolerance, but for write-intensive databases, RAID 10 is superior.

Practice this question →
52
MCQhard

A server administrator is configuring a RAID array for a new database server that requires high performance for random writes. The server has eight 1 TB SAS drives and a hardware RAID controller with a battery-backed write cache. The administrator needs to choose a RAID level that provides the best write performance while maintaining redundancy. Which RAID level should the administrator select?

A.RAID 5
B.RAID 10
C.RAID 6
D.RAID 0
AnswerB

RAID 10 combines mirroring and striping, offering excellent random write performance because data is written to multiple mirrors without parity calculations. It also provides redundancy by allowing one drive per mirror to fail. With a battery-backed write cache, performance is further enhanced, making it ideal for database workloads.

Why this answer

RAID 10 provides the best random write performance among the options while maintaining redundancy. It uses mirroring for fault tolerance and striping for performance, avoiding the parity overhead that slows writes in RAID 5 and RAID 6. RAID 0 lacks redundancy, so it does not meet the requirement.

Exam trap

The trap here is focusing only on redundancy or only on performance, overlooking that RAID 10 uniquely satisfies both for random writes.

Practice this question →
53
MCQeasy

A server administrator is configuring a new server that will host a database. The server has four 1 TB SAS drives. The administrator wants to maximize performance while providing fault tolerance that can survive a single drive failure. Which RAID level should be used?

A.RAID 0
B.RAID 10
C.RAID 1
D.RAID 5
AnswerB

RAID 10 combines mirroring and striping, providing both fault tolerance and high performance. It can survive a single drive failure (or more, depending on which drives fail) and offers better write performance than RAID 5, making it ideal for database workloads.

Why this answer

RAID 10 is the best choice because it offers both fault tolerance and improved performance through striping and mirroring. It can tolerate a single drive failure and provides better write performance than RAID 5, which is crucial for database operations.

Exam trap

The trap here is focusing only on fault tolerance and overlooking performance, which is critical for a database server.

Practice this question →
54
MCQmedium

A server administrator manages a Linux server running a custom application. The application must start automatically at boot and be restarted if it crashes. The administrator creates a systemd unit file at /etc/systemd/system/myapp.service. After running systemctl daemon-reload and systemctl start myapp, the application runs successfully. However, after a reboot, the application does not start. Which command should the administrator run to resolve this?

A.systemctl enable myapp
B.systemctl daemon-reload
C.systemctl start myapp
D.systemctl reload myapp
AnswerA

This command creates symlinks for the unit file in the appropriate systemd target directories, ensuring the service starts automatically at boot. Since the service is already running and the unit file is in the correct location, enabling it will make it persistent across reboots, directly addressing the issue described.

Why this answer

To make a systemd service start automatically at boot, the administrator must enable it using systemctl enable. This creates the necessary symbolic links in the systemd target directories. Starting, reloading, or reloading the daemon does not configure the service for automatic startup, so enabling is the correct action.

Exam trap

The trap here is confusing the immediate start of a service with its enablement for automatic startup at boot.

Practice this question →
55
MCQeasy

A technician is installing a new server for a department. The server will run a single application that requires high reliability. The operating system should be protected against a single disk failure without sacrificing read performance. Which RAID configuration is MOST appropriate?

A.RAID 5
B.RAID 6
C.RAID 1
D.RAID 0
AnswerC

RAID 1 mirrors data across two disks, providing fault tolerance and excellent read performance for the OS.

Why this answer

Option D is correct because RAID 1 mirrors the OS drive, providing fault tolerance and good read performance. Option A (RAID 0) has no redundancy. Option B (RAID 5) requires at least three disks and has write penalty.

Option C (RAID 6) requires at least four disks and is overkill for a simple OS mirror.

Practice this question →
56
MCQmedium

A server administrator is troubleshooting a Windows Server 2022 that is experiencing performance degradation. The server hosts a critical application that uses a large amount of memory. The administrator notices that the server has 64 GB of RAM installed, but the application is only using 32 GB and the system is paging heavily. Which tool should the administrator use to identify the process causing the paging?

A.Resource Monitor
B.Performance Monitor
C.Event Viewer
D.Task Manager
AnswerA

Resource Monitor provides detailed real-time information about CPU, memory, disk, and network usage, including per-process memory and hard page faults. It can show which processes are causing paging by displaying the number of hard faults per second. This allows the administrator to pinpoint the process responsible for heavy paging and performance degradation.

Why this answer

Resource Monitor provides real-time, per-process details on memory usage and hard page faults, which directly indicate paging activity. By examining the Memory tab and sorting by hard faults, the administrator can identify the process causing excessive paging. Task Manager lacks this granularity, Performance Monitor requires counter setup, and Event Viewer does not show real-time paging data.

Exam trap

The trap here is assuming Performance Monitor is always the best tool for performance analysis, but it is not ideal for immediate, per-process paging identification without prior configuration.

Practice this question →
57
MCQmedium

A server administrator needs to deploy a new Windows Server 2022 server that will run a critical application. The application requires high availability and automatic failover. The administrator has two identical physical servers and a SAN. Which Windows Server feature should the administrator implement?

A.Network Load Balancing (NLB)
B.Storage Spaces Direct
C.Distributed File System Replication (DFSR)
D.Failover Clustering
AnswerD

Failover Clustering allows multiple servers to work together to provide high availability for applications and services. With shared storage like a SAN, it can automatically move resources to another node if a failure occurs. This meets the requirement for high availability and automatic failover.

Why this answer

Failover Clustering is the Windows Server feature designed to provide high availability and automatic failover for applications and services. When combined with shared storage such as a SAN, it allows applications to move between nodes seamlessly if a failure occurs. The other options either provide network load balancing, storage virtualization, or file replication, but not application failover.

Exam trap

The trap here is confusing high availability with load balancing or storage replication; only Failover Clustering provides automatic application failover with shared storage.

Practice this question →
58
MCQmedium

A server administrator notices that a database server is experiencing high CPU usage at specific times of the day. After checking logs, the administrator finds that a report generation task scheduled at those times is causing the issue. The task cannot be rescheduled or optimized further. Which of the following actions should the administrator take to ensure the server remains responsive for other applications during peak usage?

A.Add more virtual CPUs to the server's VM.
B.Configure the task to run at a lower priority.
C.Move the database to a server with faster CPU cores.
D.Configure processor affinity to dedicate a core to the database process.
AnswerB

Lowering the task's CPU priority lets the report generation run without starving other applications of processor time during peak periods. The task still completes, but the scheduler deprioritises it, keeping the server responsive since rescheduling and optimisation are ruled out.

Why this answer

Configuring the report generation task to run at a lower priority ensures that the operating system scheduler gives the database and other applications preferential access to CPU resources during peak times. This keeps the server responsive without changing hardware or rescheduling the task. Lowering priority is a non-disruptive, immediate mitigation that addresses the contention directly.

Exam trap

The trap is thinking that adding hardware (more vCPUs or faster cores) is always the answer; the question specifies the task cannot be rescheduled or optimized, so the intended fix is a scheduling/priority adjustment, not a hardware upgrade.

How to eliminate wrong answers

Option A is wrong because adding vCPUs may not solve the issue if the task is CPU-bound and will simply consume the additional resources, and it may not be possible or cost-effective. Option C is wrong because moving to a server with faster cores is a hardware change that may not be feasible and does not guarantee responsiveness if the task still monopolizes CPU. Option D is wrong because dedicating a core to the database process via affinity would actually restrict the database to fewer cores, potentially hurting its performance, and does not address the report task's CPU consumption.

Practice this question →
59
MCQeasy

A server administrator is setting up a new Windows Server 2022 server that will host a database. The server has four 1 TB NVMe drives. The administrator wants to maximize performance and provide redundancy against a single drive failure. Which RAID level should the administrator implement?

A.RAID 5
B.RAID 0
C.RAID 10
D.RAID 6
AnswerC

RAID 10 combines mirroring and striping, providing both redundancy and high performance for both reads and writes. With four drives, it can tolerate a single drive failure (and potentially more, depending on which drives fail) while maintaining fast access. This is ideal for database workloads requiring speed and fault tolerance.

Why this answer

RAID 10 offers the best combination of performance and redundancy for a database server. It mirrors data across pairs of drives and stripes across those pairs, delivering fast reads and writes while tolerating drive failures. RAID 0 lacks redundancy, RAID 5 has write penalties, and RAID 6 adds further parity overhead, making RAID 10 the optimal choice.

Exam trap

The trap here is assuming that RAID 5 or RAID 6, which offer redundancy, also provide top performance; in reality, parity calculations slow writes significantly.

Practice this question →
60
MCQhard

A server administrator is configuring a Linux server to use iSCSI storage. The server has two network interfaces, eth0 and eth1, connected to the same switch. The administrator wants to ensure that iSCSI traffic is isolated from regular network traffic and that the iSCSI initiator uses both interfaces for redundancy and increased throughput. Which of the following should the administrator implement?

A.Configure VLAN tagging on eth0 and eth1 for iSCSI traffic and use multipathing with both interfaces.
B.Configure link aggregation (bonding) on eth0 and eth1 and assign the iSCSI traffic to the bond interface.
C.Create a bridge interface between eth0 and eth1 and assign the iSCSI traffic to the bridge.
D.Enable jumbo frames on eth0 and eth1 and configure a single iSCSI session over eth0.
AnswerA

VLAN tagging isolates iSCSI traffic on a separate VLAN, preventing interference from regular network traffic. Using multipathing with both interfaces provides redundancy and can increase throughput by utilizing multiple paths to the storage. This combination meets both requirements: isolation and multipath I/O.

Why this answer

To isolate iSCSI traffic and provide redundancy and throughput, the administrator should use VLAN tagging to separate iSCSI traffic on its own VLAN, and configure multipathing with both network interfaces. This allows the iSCSI initiator to use multiple paths, improving performance and fault tolerance, while keeping storage traffic separate from regular network traffic.

Exam trap

The trap here is confusing link aggregation with multipathing; bonding interfaces does not provide the same benefits for iSCSI as true multipathing and does not isolate traffic.

Practice this question →
61
MCQmedium

A server administrator is configuring a new Windows Server 2022 failover cluster with two nodes. The cluster will host a highly available file server role. The administrator needs to ensure that the file server role can automatically fail over to the other node if the active node fails. Which of the following should the administrator configure?

A.Highly available file server role in Failover Cluster Manager
B.Cluster Shared Volume (CSV)
C.File Server role with a file share witness
D.Distributed File System Replication (DFSR)
AnswerA

Configuring a highly available file server role in Failover Cluster Manager creates a clustered file server instance that can fail over between nodes. This role includes the necessary resources, such as IP address, network name, and shared storage, and enables automatic failover based on cluster policies. This is the correct method to provide high availability for a file server role.

Why this answer

The correct answer is to configure a highly available file server role in Failover Cluster Manager. This creates a clustered role that includes all necessary resources and enables automatic failover between cluster nodes. Other options like CSV, file share witness, or DFSR serve different purposes and do not directly provide automatic failover for a file server role.

Exam trap

The trap here is confusing data replication or quorum configuration with the actual high-availability role configuration that enables failover.

Practice this question →
62
MCQhard

A company has a Windows Server 2022 server running Hyper-V. The server hosts a virtual machine (VM) that runs a database. The VM is configured with 16 GB of static memory. Users report that the database performance is slow during peak hours. The administrator notices that the Hyper-V host has 32 GB of RAM and is running three other VMs, each with 8 GB of static memory. The host is experiencing high memory pressure. Which of the following should the administrator implement to improve performance?

A.Enable Hyper-V Replica for the database VM.
B.Configure a virtual NUMA topology for the database VM.
C.Enable Dynamic Memory on the database VM.
D.Add more physical RAM to the host.
AnswerD

The host has 32 GB of RAM, and the total static memory assigned to VMs is 16 GB + 3*8 GB = 40 GB, which exceeds physical RAM. This overallocation causes high memory pressure. Adding more RAM would provide sufficient memory for all VMs, improving performance.

Why this answer

The host is overallocated: 16 GB + 3*8 GB = 40 GB of static memory assigned, but only 32 GB physical. This causes high memory pressure and slow performance. Adding more physical RAM is the direct solution to eliminate the shortage.

Exam trap

The trap here is focusing on VM-level memory optimizations instead of addressing the host's physical memory shortage.

Practice this question →
63
MCQhard

A company runs a critical web application on a Windows Server 2022 with IIS. The application uses a SQL Server 2019 database on a separate server. Users report that the application sometimes becomes unresponsive for 30–60 seconds, then recovers. Performance Monitor on the web server shows a spike in ASP.NET Requests Queued and a drop in Requests/Sec during the incidents. The database server shows no performance issues. Which action should the administrator take to resolve the intermittent unresponsiveness?

A.Analyze and optimize the application code to eliminate blocking calls and improve asynchronous processing.
B.Configure the application pool to use a dedicated identity with higher privileges.
C.Enable Web Garden mode by setting the maximum worker processes to 4.
D.Increase the ASP.NET request queue limit in the application pool settings.
AnswerA

The queued requests and drop in throughput indicate that the application is not processing requests efficiently, often due to blocking operations such as synchronous database calls or long‑running tasks. Optimizing code to use asynchronous patterns and reducing blocking calls frees up threads to handle more requests, directly resolving the intermittent unresponsiveness.

Why this answer

Intermittent unresponsiveness with spikes in ASP.NET Requests Queued and reduced Requests/Sec typically indicates thread pool starvation caused by blocking operations in the application. Optimizing code to use asynchronous calls and eliminating blocking I/O allows the thread pool to handle more concurrent requests, resolving the queuing and restoring responsiveness. Other options do not address the root cause.

Exam trap

The trap here is assuming that increasing queue limits or adding worker processes will solve performance issues, when the real problem is inefficient application code causing thread pool starvation.

Practice this question →
64
MCQhard

A Linux server is experiencing random reboots. The administrator checks the system logs and finds multiple entries indicating a machine check exception (MCE). The server is running the latest kernel and all firmware is up to date. Which of the following is the MOST likely cause of the reboots?

A.Overheating due to failed cooling fans.
B.A faulty power supply unit.
C.Incorrect kernel parameters for memory management.
D.Failing CPU or memory hardware.
AnswerD

Machine check exceptions (MCEs) are hardware errors reported by the CPU, often caused by faulty memory, CPU, or motherboard components. Random reboots with MCE entries in logs strongly indicate a hardware failure. Up-to-date firmware and kernel do not fix physical hardware degradation, so replacing or testing components is necessary.

Why this answer

Machine check exceptions are hardware-level errors reported by the CPU, most commonly due to failing RAM or CPU. Random reboots with MCE logs indicate a hardware fault that firmware updates cannot resolve. The correct course is to run hardware diagnostics and replace the faulty component.

Exam trap

The trap here is attributing MCEs to software or power issues, when they are definitive hardware error reports from the CPU.

Practice this question →
65
MCQhard

A Linux database server has recently exhibited sluggish response times. An analysis of system performance shows high CPU wait I/O, frequent page swapping, and a low cache hit ratio. The server has 16GB of RAM, and the database itself stores 100GB of active data. Which of the following is the MOST effective long-term solution to improve performance?

A.Increase the physical RAM in the server to at least 64GB.
B.Tune the database engine's query cache size.
C.Configure the server to use a larger swap partition.
D.Replace the existing hard drives with faster SSDs.
AnswerA

More RAM reduces swapping and allows caching of a larger working set, directly addressing the high I/O wait and low cache hit ratio.

Why this answer

Option C (Increase physical RAM to 64GB) is correct because the server is experiencing memory pressure leading to excessive swapping and low cache utilization. More RAM allows the database to cache a larger portion of active data in memory, reducing I/O wait and improving response times. Option A (Add faster SSDs) may reduce I/O wait but does not address the root cause—memory starvation.

Option B (Tune the database query cache) might provide minor relief but is not a substitute for adequate memory. Option D (Increase swap space) would worsen performance by enabling more swapping.

Practice this question →
66
PBQmedium

A medium-sized business runs a critical internal application on a single physical server running Windows Server 2019. The application is memory-intensive, often using up to 24 GB out of 32 GB RAM during peak hours. Over the past week, the server has experienced three unexpected reboots, each occurring during peak load. The server is not part of a cluster, and all data is stored on local disks. You have checked the Windows System event log and found Event ID 41 (Kernel-Power) indicating an unexpected shutdown. There are no related critical errors in the Application log. You have also reviewed the server's firmware logs and found multiple corrected memory errors (ECC) over the last month, with an increase in frequency just before each crash. The server is under warranty, and the hardware vendor's diagnostic tools report a failing memory module in DIMM slot A1. The vendor has recommended replacing the faulty DIMM immediately. However, the server is currently processing critical end-of-quarter financial reports that cannot be interrupted for at least 6 hours. Which of the following is the BEST course of action to minimize risk of data loss and downtime until a planned maintenance window?

A.Use Windows Memory Diagnostic tool to try to isolate the memory region and prevent the application from using it.
B.Continue running the server as is, as ECC memory can correct errors and the server will only crash if errors are uncorrectable; the risk is low.
C.Immediately shut down the server, replace the faulty DIMM, and restart.
D.Inform management of the criticality, request emergency approval for immediate maintenance, and if denied, ensure current backups are verified and monitor the server closely for any signs of degradation until the maintenance window.
AnswerD

Why this answer

Option D is correct because it follows proper change management: informing stakeholders, seeking emergency approval if needed, and mitigating risk by verifying backups and monitoring. Option A is wrong because immediately shutting down would interrupt critical processing and potential data loss, without management approval. Option B is wrong because Windows Memory Diagnostic is a boot-time tool and cannot effectively isolate memory regions to avoid crashes on a running production system.

Option C is wrong because the server has already crashed, indicating uncorrectable errors; continuing without action risks data corruption and further unplanned outages.

Practice this question →
67
Multi-Selecthard

A server administrator is configuring a new server that will host a high-traffic web application. The administrator needs to optimize the server's network performance. Which TWO of the following should be implemented? (Choose two.)

Select 2 answers
A.Configure NIC teaming for redundancy and load balancing.
B.Assign a static IP address to the server.
C.Disable TCP offloading on the network adapter.
D.Set the network adapter to half-duplex mode.
E.Enable jumbo frames on the network adapter and switch.
AnswersA, E

NIC teaming combines multiple network adapters into a single logical interface, providing fault tolerance and increased throughput. For a high-traffic web application, this improves availability and can distribute network load, enhancing performance. It requires switch support for the chosen teaming mode, such as LACP.

Why this answer

Enabling jumbo frames and configuring NIC teaming are direct performance optimizations for a high-traffic web server. Jumbo frames reduce overhead for large transfers, while NIC teaming provides redundancy and load balancing. The other options either degrade performance or do not directly enhance it.

These two together can significantly improve network throughput and reliability.

Exam trap

The trap here is assuming that disabling TCP offloading improves performance, when it actually increases CPU load and can reduce throughput.

Practice this question →
68
PBQhard

Your organization is migrating a Windows Server 2019 file server with 2 TB of shared data to a new server running Windows Server 2022. The migration must minimize user downtime and ensure file permissions are preserved. Users access files during business hours (8 AM to 6 PM) and the migration must be completed within a four-hour window starting at 10 PM on Saturday. You plan to use DFS Replication (DFSR) for initial data copy and then perform a final synchronization during the cutover. After setting up DFSR between the old and new servers, you realize that the initial replication will take approximately 12 hours due to the large number of files. What should you do to complete the migration within the allowed window?

A.Use robocopy to pre-stage the data from old to new server during off-hours before the cutover, then enable DFSR to replicate only changes made after pre-staging; during the cutover window, do a final DFSR sync
B.Disable DFSR and use robocopy with /MIR /COPYALL during the cutover window to copy all data
C.Perform a full backup of the old server and restore to the new server during the cutover window using Windows Backup
D.Increase the DFSR staging quota and bandwidth throttling to accelerate initial replication
AnswerA

Why this answer

Pre-staging with robocopy during off-hours moves the bulk of the 2 TB before the cutover window, so DFSR only has to replicate the delta of changes made after pre-staging. This shrinks the initial replication from ~12 hours to a manageable delta, allowing the final DFSR sync to complete inside the four-hour cutover window while preserving NTFS permissions and minimizing user downtime.

Exam trap

The trap is assuming DFSR can be 'tuned' to go faster (option D) or that a straight robocopy/backup-restore can fit in the window (options B and C) — candidates forget that DFSR's initial replication is per-file overhead-bound, not bandwidth-bound, and that pre-staging is the standard workaround.

How to eliminate wrong answers

Option B is wrong because a full robocopy /MIR /COPYALL of 2 TB cannot complete in a four-hour window (that would require ~140 MB/s sustained plus metadata overhead), and it would also cause downtime since users must be locked out during the copy. Option C is wrong because a full backup-and-restore of 2 TB during the cutover window has the same time problem and is even slower than robocopy, plus it does not provide an incremental delta mechanism. Option D is wrong because increasing the DFSR staging quota only prevents staging errors — it does not speed up replication — and bandwidth throttling actually limits throughput, so raising it would slow replication further, not accelerate it.

Practice this question →
69
MCQhard

A server administrator is configuring a Linux server to automatically mount an NFS share at boot. The server is running Ubuntu 22.04 LTS. The administrator adds the following line to /etc/fstab: 'server:/export /mnt/nfs nfs defaults 0 0'. After rebooting, the mount is not present, and the system logs show an error indicating the mount failed. Which of the following is the most likely cause?

A.The 'defaults' option does not include the '_netdev' option, so the mount is attempted before the network is online.
B.The mount point /mnt/nfs does not exist on the client.
C.The NFS version is not specified, so the client defaults to NFSv3, which is not supported by the server.
D.The NFS share is not exported with the correct permissions on the server.
AnswerA

On modern Linux systems with systemd, network mounts in /etc/fstab may be attempted before the network is fully online unless the '_netdev' option is specified. Without '_netdev', the mount can fail at boot because the network interface is not yet up. Adding '_netdev' tells systemd that the mount requires network, delaying it until after network is available.

Why this answer

On systemd-based Linux distributions like Ubuntu 22.04, network filesystems in /etc/fstab require the '_netdev' option to ensure they are mounted after the network is online. Without it, the mount is attempted during early boot and fails because the network is not yet available. Adding '_netdev' to the options field resolves this by ordering the mount after network.target.

Exam trap

The trap here is overlooking systemd's network dependency handling and assuming the issue is with NFS export permissions or version mismatch, when the real problem is the missing '_netdev' mount option.

Practice this question →
70
MCQeasy

A server administrator needs to configure a RAID array for a new file server that will store large media files. The requirement is to maximize available storage capacity while providing redundancy against a single drive failure. The server has four 4 TB SAS drives and a hardware RAID controller. Which RAID level should the administrator choose?

A.RAID 6
B.RAID 0
C.RAID 5
D.RAID 1
AnswerC

RAID 5 uses distributed parity, allowing it to survive one drive failure while providing usable capacity of (N-1) drives. With four 4 TB drives, usable capacity is 12 TB, which is higher than RAID 1 or RAID 10. It balances capacity and redundancy, making it the best choice for this file server scenario.

Why this answer

RAID 5 offers a good balance of capacity and redundancy for a file server. It uses one drive's worth of space for distributed parity, so four 4 TB drives yield 12 TB of usable storage and can withstand one drive failure. RAID 0 lacks redundancy, RAID 1 wastes half the capacity, and RAID 6 reduces capacity further with dual parity.

Exam trap

The trap here is confusing RAID levels that provide redundancy with those that maximize capacity; RAID 6 provides more redundancy but less usable space than RAID 5.

Practice this question →
71
MCQhard

Refer to the exhibit. A server administrator is troubleshooting a DNS resolution issue on a Windows Server 2019. The exhibit shows the output of the command `nslookup` queried against the server's own IP. Based on the output, what is the most likely cause of the resolution failure?

A.The DNS server does not have an A record for server1.contoso.com.
B.The DNS server's root hints are misconfigured.
C.The DNS server is not configured to forward queries to an external DNS server.
D.The DNS server has an incorrect reverse lookup zone configuration.
AnswerA

The 'Non-existent domain' error directly indicates that the queried A record is missing from the contoso.com zone.

Why this answer

Option D is correct because the NXDOMAIN response indicates the queried name does not exist in the DNS zone. Option A is wrong because forwarding is irrelevant for an authoritative zone. Option B is wrong because reverse lookup zones are for IP-to-name resolution, not name-to-IP.

Option C is wrong because root hints are used for recursion, not for authoritative responses.

Practice this question →
72
MCQmedium

A server administrator configures a scheduled task to back up a database using a command-line tool. The task runs successfully when executed manually, but fails when run via the task scheduler. The log shows 'Error: Access denied.' What is the MOST likely cause?

A.The scheduled task is running under the wrong user account.
B.The database service is stopped.
C.The command-line tool is not installed.
D.The backup destination is full.
AnswerA

When the task runs manually, it uses the current user's security context; the scheduler often uses a system or different user account that may not have the required permissions, causing access denied.

Why this answer

Option C is correct because 'Access denied' usually points to permission issues; the task scheduler may run under a different user account that lacks necessary privileges. Option A is wrong because a full destination would yield a 'disk full' error, not access denied. Option B is wrong because if the tool were not installed, the error would be 'command not found.' Option D is wrong because a stopped database service would produce a connection error, not access denied.

Practice this question →
73
MCQhard

Refer to the exhibit. A server administrator encounters an authentication issue when accessing a web server. The exhibit shows an error from the Domain Controller's event log. What is the most likely cause of the problem?

A.The web server's service account is not configured to support AES encryption types.
B.The DNS service is not resolving the web server's FQDN.
C.The domain controller clock is out of sync with the web server.
D.The service account for the web server has an expired password.
AnswerA

The missing key and the mismatch between requested (AES etype 18) and available etypes directly point to missing AES support on the account.

Why this answer

Option B is correct because the error shows that the requested encryption types (etype 18 is AES) are missing from the account's available etypes, indicating the service account is not configured to support AES. Option A would produce a clock skew error. Option C would result in a password expiration event.

Option D would cause name resolution or host not found errors, not a Kerberos encryption mismatch.

Practice this question →
74
MCQeasy

An administrator needs to remotely manage several Linux servers securely without using passwords. Which of the following is the BEST method?

A.Use Telnet with SSH tunneling.
B.Use VNC with a strong password.
C.Use RDP with certificate-based authentication.
D.Use SSH with key-based authentication.
AnswerD

SSH with key-based authentication is the industry standard for secure, password-less remote administration on Linux servers.

Why this answer

Option C is correct because SSH with key-based authentication provides strong, password-less remote access. Option A is wrong because RDP is primarily used on Windows, not typical for Linux. Option B is wrong because Telnet is insecure, and SSH tunneling does not make Telnet secure.

Option D is wrong because VNC is less secure and not designed for efficient server administration.

Practice this question →
75
MCQeasy

A user attempts to access a shared folder named \\Server\Finance. The share permissions are set to 'Everyone – Full Control'. The NTFS permissions on the folder grant the user 'Read & Execute' but deny 'Write'. What is the user's effective permission when accessing the share over the network?

A.Full Control
B.Write
C.No Access
D.Read & Execute
AnswerD

When share and NTFS permissions differ, the most restrictive applies over the network. Full Control at share level is limited by the NTFS Read & Execute grant, and the explicit Write deny reinforces this, yielding Read & Execute.

Why this answer

When share and NTFS permissions combine, the most restrictive of the two applies. Share gives Full Control, NTFS gives Read & Execute, so effective access is Read & Execute.

Practice this question →
Page 1 of 2 · 91 questions totalNext →

Ready to test yourself?

Try a timed practice session using only server-administration questions.

Start 20-question session