SK0-005 · domain
troubleshooting
Domain 5 of CompTIA Server+ SK0-005 covers diagnosing and resolving server hardware, OS, storage, and network failures. Questions present symptoms such as a dead NIC link light, an iSCSI target that will not mount, a Linux VM killed by the OOM killer, or a Windows stop error, and ask for the first action, the cause, or the fix.
Focused practice
Practice troubleshooting questions
Scored sessions drawing only from this domain — pick a length below.
Start 20-question practice test →What this domain covers
What to know about troubleshooting
Be able to apply a structured troubleshooting method to server hardware, OS, storage, and network faults, and pick the correct first action. The single most important thing is to identify the problem and check the simplest physical or log-based cause before changing configuration.
Ordering troubleshooting steps: identify problem, establish theory, test, implement, verify, document.
Windows tools: Event Viewer, Resource Monitor, Performance Monitor, sfc, chkdsk, DISM, iSCSI Initiator.
Linux diagnostics: dmesg, journalctl, top, free, df, ip, systemctl, and the OOM killer.
Storage and network faults: RAID degradation, SMART errors, link lights, VLAN and IP misconfiguration.
Watch out for
Common troubleshooting exam traps
- ▸Skipping straight to a fix instead of first gathering information or checking the obvious physical layer, such as the link light or cabling.
- ▸Confusing a degraded RAID array with a failed one, or replacing a disk before backing up data.
- ▸Assuming a reboot resolves a CRITICAL_PROCESS_DIED stop error rather than checking drivers, updates, and logs.
Question index
All troubleshooting questions (120)
Click any question to see the full explanation, or start a practice session above.
A server administrator notices that a recently installed PCIe network card is not being recognized by the operating system. The server is running Windows Server 2019. The administrator has verified that the card is securely seated and that the slot is enabled in the BIOS. Which of the following should the administrator try FIRST to resolve the issue?
Easy2A server administrator is troubleshooting a Linux server that is experiencing slow disk performance. The administrator runs `iostat -x 1` and sees that the `%util` value for `/dev/sda` is consistently above 98%, while the `await` for write requests is over 500 ms. The server hosts a database that performs many small random writes. Which of the following is the MOST likely cause?
Medium3A database server running on a Linux VM has started experiencing periodic crashes. The VM is hosted on an ESXi hypervisor. The system logs show entries: 'kernel: Out of memory: Kill process 12345 (mysqld) score 700 or sacrifice child'. The VM has 16GB RAM allocated and no memory overcommitment on the host. The DBA reports that the database workload hasn't increased. Which of the following actions should be taken FIRST to diagnose the issue?
Hard4A server administrator is troubleshooting a Linux server that boots normally but takes over 20 minutes to reach a login prompt, while CPU, memory, and disk utilization remain low after boot. Running systemd-analyze blame shows a single unit consuming 18 minutes. Which of the following commands will BEST identify what that unit is waiting on?
Medium5A server administrator is troubleshooting a server that is experiencing unexpected shutdowns. The administrator reviews the system logs and finds Event ID 6008 in the Windows System log, indicating an unexpected shutdown. The server has a redundant power supply configuration, and both power supplies are connected to different PDUs. The administrator checks the PDUs and finds no power outages. Which of the following is the MOST likely cause of the unexpected shutdowns?
Medium6A virtualized server running multiple VMs experiences a sudden performance degradation during peak hours. Storage latency spikes and CPU ready time increases significantly. The hypervisor shows high memory overcommitment but no swapping. Which action would most likely resolve the issue without adding hardware?
Hard7A server administrator is troubleshooting a server that intermittently loses network connectivity. The server is connected to a managed switch, and the administrator notices that the switch port shows a high number of CRC errors. Which of the following is the MOST likely cause?
Medium8A server administrator is investigating a production server that has been performing poorly for several days. Users report slow response times, and the administrator observes that CPU utilization stays near 100% even during off-peak hours. Task Manager shows the System process consuming most of the CPU. The administrator runs a performance counter capture and sees a sustained high rate of deferred procedure calls (DPCs). Which of the following is the MOST likely cause?
Medium9A server administrator is troubleshooting a Linux server that becomes unresponsive during nightly backup jobs. The administrator runs top and observes that the wa (I/O wait) value is consistently above 40%, while user and system CPU usage remain below 10%. The backup job writes to a locally attached RAID 5 array. Which of the following is the MOST likely cause of the high I/O wait?
Hard10A server in a virtualized environment is experiencing VM performance degradation. The host server has adequate resources. The hypervisor logs show excessive 'ready' time for the CPU. Which of the following is the BEST action to resolve this issue?
Hard11A server administrator is troubleshooting a server that is unable to connect to the network. The server's NIC link light is off. The administrator verifies that the switch port is enabled and the cable is connected to both the server and the switch. Which of the following should the administrator check NEXT?
Easy12A server administrator receives alerts that a production Linux server is unresponsive. After connecting via out-of-band management, the administrator sees a message indicating a kernel panic. The system was recently updated with a new storage driver. Which of the following should the administrator do FIRST to troubleshoot this issue?
Medium13A server administrator is troubleshooting a performance issue on a VMware vSphere host. The host has multiple VMs, and one VM is experiencing high latency on its virtual disk. The administrator checks the datastore and sees it is a RAID 5 array of 4 SAS drives with 50% utilization. Latency for the VM's virtual disk is reported as 200ms. Which action would most likely improve performance?
Hard14A server administrator is troubleshooting a Windows Server 2019 machine whose system event log repeatedly shows unexpected shutdowns with no bugcheck code. The hardware is suspected of causing the reboots. Which of the following should the administrator check to identify a hardware-related cause? (Choose two.)
Medium15A server administrator is troubleshooting a server that fails to boot after a firmware update. The server powers on, completes POST, but then displays a message that no bootable device is found. The administrator suspects that the firmware update reset the storage controller configuration. Which of the following should the administrator check? (Choose two.)
Hard16After a thunderstorm, a server in a remote office is reachable via remote console but has no network connectivity. The network switch port shows a steady link light, but the server's NIC shows no link light. Which of the following is the MOST likely cause?
Medium17A server administrator is investigating a performance problem on a Windows Server 2019 file server. Users report that large file copies to a data volume take far longer than expected, but small file operations are fine. The administrator opens Performance Monitor and observes that the PhysicalDisk\Avg. Disk sec/Write counter for the array hosting the data volume is consistently between 40 and 60 ms, while the same counter on the OS volume stays under 5 ms. Disk queue length on the data volume remains low. Which of the following is the MOST likely cause?
Medium18A small business relies on a single Dell PowerEdge T340 tower server running Windows Server 2019 as its primary domain controller and file server. The server is situated in a locked, air-conditioned IT closet and is protected by an online surge protector. During a severe thunderstorm last evening, the building experienced a momentary power loss. This morning, the administrator found the server completely powered off. When the power button is pressed, the front panel diagnostic LEDs briefly illuminate, and all internal cooling fans start spinning for about two to three seconds, but then the server abruptly powers down. There are no audible beep codes, and the monitor never receives a video signal. The administrator has already verified the power cable is firmly seated in both the server and the surge protector, swapped the power cable with a known-good one, and tested the surge protector with another device, which powered on normally. No spare parts are immediately available, and server downtime must be kept to a minimum. What should the administrator do FIRST to diagnose and resolve the problem?
Easy19A server administrator is troubleshooting a Linux server that has become unresponsive to SSH and console logins. The server is still powered on, and the fans are running. The administrator wants to check the system logs from a previous boot to determine if a kernel panic occurred. Which command should the administrator use?
Easy20A server administrator receives alerts that a server's RAID 5 array has a failed drive. The administrator replaces the failed drive with a new one of the same model and capacity. After the rebuild completes, the administrator notices that the array is still showing as degraded. Which of the following is the MOST likely reason for the array remaining degraded?
Easy21A server administrator is troubleshooting a server whose time drifts several minutes per day, causing Kerberos authentication failures between the server and its domain controller. The server is a domain member with no special role. Which of the following is the MOST appropriate first step to correct the time synchronization problem?
Easy22A database administrator notices that the primary SQL Server instance has been experiencing severe performance degradation over the past hour. The server is a virtual machine with 8 vCPUs and 64 GB of RAM, and it normally operates with around 40% CPU utilization. Currently, Task Manager shows 100% CPU usage, with the sqlservr.exe process consuming nearly all cycles. The database response times have increased tenfold, and some queries are timing out. There are no scheduled maintenance jobs running, and the transaction log backup completed successfully earlier. The DBA checks active sessions and finds one long-running ad-hoc query from a new reporting tool that was deployed this morning. The query is performing a cross join on two large tables with missing WHERE clauses, causing a Cartesian product. Ending the session will roll back the query and free resources.
Medium23A server that uses iSCSI storage has suddenly lost connectivity to all LUNs. The network team confirms no changes have been made. Which of the following is the FIRST step in troubleshooting this issue?
Hard24A server administrator is troubleshooting a Linux server that cannot reach any external websites, but internal resources are accessible. The administrator runs 'ip addr' and sees the correct IP address and subnet mask on eth0. Running 'ip route' shows no default route. What is the most likely cause?
Medium25After a power outage, a server fails to boot and displays a "Missing operating system" error. The server uses RAID 1 for the OS disk. The administrator verifies both drives are present in the RAID configuration utility but one drive is marked as failed. What should the administrator do FIRST?
Easy26A server in the datacenter fails to power on after a scheduled power maintenance. The facility team confirms that power is being supplied to the rack. The server's front panel LED is not illuminated. Which of the following should the administrator check FIRST?
Easy27A server administrator is troubleshooting a RAID 5 array that has suddenly become degraded. The array consists of four SAS drives. The administrator runs the RAID controller management utility and sees that one drive has failed. After replacing the failed drive, the rebuild process starts but stalls at 20%. The administrator checks the event log and sees numerous medium errors on another drive. What should the administrator do next?
Hard28A server administrator is troubleshooting an issue where a database server's performance degrades every night at 2 AM. Resource monitor shows high disk I/O and CPU usage during that time. There are no scheduled tasks on the server. Which of the following should the administrator investigate FIRST?
Easy29A server administrator is troubleshooting a physical server that emits a continuous amber health LED and whose operating system logs show correctable memory errors increasing on one DIMM slot. The server is still running production workloads. Which of the following actions should the administrator take? (Choose two.)
Medium30A server uses NIC teaming with LACP (802.3ad) for load balancing and failover. After replacing a failed switch with a new switch of the same model, the server loses network connectivity. The switch ports show no activity. Which of the following is the MOST likely cause?
Hard31A server administrator is troubleshooting a Windows Server 2019 host that fails to apply a monthly cumulative update. Windows Update returns error 0x800f0922, and the C: volume has 30 GB free while the System Reserved partition has only 12 MB free. Which of the following is the MOST likely cause?
Medium32A server administrator is troubleshooting a Windows Server 2019 that periodically loses network connectivity. The server has two teamed network adapters in switch-independent mode. Users report intermittent access to file shares. The administrator runs `Get-NetLbfoTeam` and sees the team status is 'Degraded'. Which of the following is the MOST likely cause?
Hard33A server administrator is troubleshooting a server that is emitting a continuous beeping sound. The server is powered on but does not display any video. The administrator checks the server's documentation and finds that the beep code indicates a memory error. Which of the following should the administrator do FIRST?
Easy34A server administrator receives alerts that a file server's system volume is nearly full. The administrator runs a disk usage report and finds that a single log directory contains millions of small files consuming most of the free space. Users need the server to remain online while the issue is resolved. Which of the following should the administrator do to reclaim space with the LEAST disruption?
Medium35A server administrator is troubleshooting a server that fails to boot after a firmware update. The server powers on, completes POST, but then displays a message indicating no bootable device found. The administrator confirms the RAID controller is detected and the drives are online. What is the most likely cause?
Hard36A server administrator is troubleshooting a Windows Server 2019 host whose local volumes suddenly show as RAW in Disk Management after a storage controller firmware update. The volumes were NTFS and contained production data. Which of the following actions should the administrator take FIRST?
Hard37A server administrator is troubleshooting a newly installed 2U server that powers on but does not complete POST. The server emits a repeating beep code and no video output appears. The administrator has already reseated the memory modules and verified that the power supplies are fully seated and the power LEDs are green. Which of the following should the administrator check NEXT?
Medium38A server administrator is troubleshooting intermittent network connectivity issues on a server. Users report that connections to the server sometimes time out, and the administrator notices that the server's link LED on the switch occasionally goes dark. The administrator has already replaced the patch cable from the server to the wall jack. Which of the following should the administrator check NEXT? (Choose two.)
Medium39A server administrator is troubleshooting a Windows Server 2019 file server that intermittently becomes unreachable on the network for 30-60 seconds at a time. Event Viewer shows repeated Netlogon 5719 errors stating that no domain controller is available, and the network team confirms no switch or router outages. The server has two teamed NICs. Which of the following should the administrator check FIRST to resolve this issue?
Medium40After installing additional RAM modules in a server, the BIOS displays only a portion of the installed memory. The modules are identical in speed and size but from different manufacturers. Which of the following is the BEST initial troubleshooting step?
Medium41A server administrator is troubleshooting a physical server that reports a predictive failure on a drive in a hardware RAID 5 array. The array is still online and functioning. The administrator wants to replace the failing drive while minimizing risk to the data. Which of the following steps should the administrator perform? (Choose two.)
Medium42Refer to the exhibit. What is the most likely cause of this error?
Medium43A server administrator is troubleshooting a Linux server that is experiencing intermittent network connectivity issues. Users report that connections to the server sometimes time out, and the administrator notices that `ifconfig` shows a high number of dropped packets on the `eth0` interface. The switch port is configured for 1 Gbps full duplex. Which of the following is the MOST likely cause?
Hard44A technician is troubleshooting a server that fails to boot. The server displays a 'Boot Device Not Found' error. The technician verifies that the hard drives are spinning and appear in the RAID controller's BIOS. What should the technician check next?
Medium45A server administrator is troubleshooting a server that intermittently fails to boot and occasionally displays a 'CMOS checksum error' during POST. The server's clock also resets to an old date after each power cycle. The administrator has already verified that the power supply is functioning and that all internal cables are securely connected. Which of the following is the MOST likely cause of these symptoms?
Medium46A server administrator runs a Linux server hosting a MariaDB database. Users report that the database is extremely slow. The administrator runs top and sees a load average of 45 on a system with 4 CPU cores, and %iowait is consistently above 80%. Which command should the administrator run next to identify the specific storage device causing the bottleneck?
Medium47A server running a critical database application crashes and fails to boot with the error message 'Operating System not found.' The server is equipped with a hardware RAID 5 array consisting of three identical disks. A technician suspects a disk failure. What is the MOST likely cause of this error?
Hard48A technician is troubleshooting a server that powers on but produces no video output and emits a repeating beep code. The server's documentation indicates the pattern corresponds to a memory error. The technician has already reseated the existing DIMMs and verified the slots are clean. Which of the following should the technician do NEXT?
Easy49A server administrator notices that a database server is responding slowly to queries. The CPU utilization is at 30%, memory at 40%, and disk latency is normal. Which of the following should the administrator check NEXT?
Easy50A server administrator is troubleshooting a Windows Server that is experiencing slow performance. The administrator runs Performance Monitor and notices that the 'Avg. Disk sec/Transfer' counter is consistently above 25 ms. Which of the following is the MOST likely cause?
Hard51A server administrator is diagnosing a Windows Server 2019 server that reboots unexpectedly about once a day. Windows Event Viewer shows Event ID 6008 (unexpected shutdown) and a BugCheck entry with stop code 0x00000050 (PAGE_FAULT_IN_NONPAGED_AREA). The server has 512 GB of RAM and the page file is system-managed. Which tool should the administrator use to analyze the memory dump and identify the faulty driver?
Medium52A server administrator is troubleshooting a newly racked server that powers on but does not POST. The server's front-panel status LED shows a steady amber condition, and no video signal is produced. The administrator has already confirmed that both power supplies are connected to working PDUs and that the power button is not faulty. Which of the following should the administrator check NEXT?
Medium53A database server with 64 GB of RAM and RAID 5 storage is experiencing intermittent performance degradation. System monitoring shows constant 95% memory utilization, high disk queue length, and frequent page faults. The server is running a critical application that cannot be restarted during business hours. Which action will provide the BEST permanent resolution?
Hard54A medium-size enterprise runs a vSphere 7.0 cluster with two hosts (HostA and HostB) for production VMs. Each host has two 10GbE uplinks (vmnic0 and vmnic1) connected to separate physical switches (SW1 and SW2) for redundancy. A single vSphere standard switch (vSwitch0) uses both uplinks with teaming policy set to 'Route based on originating virtual port ID,' 'Network failure detection: Link status only,' and 'Notify switches: Yes.' Lately, several VMs running on HostA experience intermittent network disconnections lasting 20–30 seconds, while VMs on HostB are unaffected. The administrator checks vCenter events and sees repeated messages: 'Lost uplink redundancy on vSwitch0. vmnic0 is down.' followed seconds later by 'Uplink redundancy restored. vmnic0 is up.' The physical switch SW1's log shows the port for vmnic0 transitions through spanning-tree listening and learning states each time this occurs, taking about 15 seconds. The link is a trunk allowing all necessary VLANs, with no errors or security violations. The network team has already swapped the fiber cable and SFP+ transceiver for vmnic0 without improvement. The VMs affected are those whose virtual ports are pinned to vmnic0 by the load-balancing policy; VMs pinned to vmnic1 never experience disconnections. The administrator has also rebooted HostA and updated the NIC firmware, but the flapping continues. What should the administrator do to permanently resolve the intermittent connectivity?
Medium55A server administrator is troubleshooting a rack server that fails to complete POST. The server emits a series of beep codes, and no video output appears. The administrator has already reseated the memory modules and confirmed they are in the correct slots. Which of the following should the administrator check NEXT?
Easy56A server administrator is troubleshooting a tower server that reports no video output on the local monitor, but the power LED is solid green and the fans spin at normal speed. The administrator connects to the baseboard management controller (BMC) over the network and sees a POST code of 'B4' with a message indicating USB device initialization. A USB flash drive is left in a rear port. Which of the following is the MOST likely cause of the missing video?
Medium57A server administrator is troubleshooting a physical server that randomly crashes once or twice a week. The administrator has already verified that the power supply is functioning correctly and has checked the event logs for critical errors. According to standard troubleshooting methodology, what should the administrator do next?
Medium58Refer to the exhibit. A technician receives an alert from the monitoring system showing the error in the exhibit. The server is still online, but performance has degraded. Which of the following is the MOST likely cause and appropriate action?
Hard59A RAID 5 array is degraded due to a failed disk. What is the best practice for recovery?
Hard60A server administrator is troubleshooting a Windows Server host that has been randomly losing connectivity to its iSCSI storage for the past week. The host has two dedicated NICs for iSCSI, each connected to a separate switch, and multipath I/O is configured. Event logs show intermittent path failures that recover within seconds. Switch port statistics show no errors, and both storage controllers report healthy. Which of the following should the administrator check FIRST to diagnose the intermittent path loss?
Hard61A server administrator is troubleshooting a Linux server that is experiencing intermittent network connectivity issues. Users report that connections to the server occasionally time out, but the server responds to pings most of the time. The administrator suspects a duplex mismatch on the network interface. Which two commands should the administrator use to verify the current speed and duplex settings of the interface? (Choose two.)
Hard62A server administrator is troubleshooting a server that is not responding to network requests. The server's link lights are on, and the switch port shows activity. The administrator cannot ping the server by IP address from another subnet, but can ping it from a host on the same subnet. What is the most likely cause?
Easy63A server configured with RAID 5 has two failed drives. The array is offline and critical data is inaccessible. The administrator has replacement drives available. What should the administrator do to restore the data and array with minimal data loss?
Medium64A server administrator is troubleshooting a server that is experiencing slow network performance. The server has a 10 GbE network interface card (NIC) connected to a switch port that is configured for 1 GbE. Which of the following is the MOST likely cause of the slow performance?
Medium65A server administrator is troubleshooting a network connectivity issue on a server that has recently been moved to a different rack. The server can ping its own IP address but cannot ping the default gateway. Which of the following is the MOST likely cause?
Easy66A server administrator is troubleshooting a network connectivity issue where a newly installed server cannot communicate with other devices on the same subnet. The server has a static IP address configured. Other devices on the same switch can communicate. Which TWO of the following could be the cause of the issue? (Select TWO)
Medium67A server administrator is troubleshooting a Linux server that was working normally until a new kernel was installed. After rebooting, the server drops into a GRUB prompt instead of loading the operating system, and the administrator needs to restore normal boot as quickly as possible. Which of the following is the MOST appropriate action?
Medium68A server administrator is troubleshooting a Windows Server 2019 host that intermittently drops connections to a database application. The administrator reviews Performance Monitor and notices that the Network Interface\Output Queue Length counter for the production NIC frequently exceeds 2. The NIC is a 1GbE adapter, and the switch port is configured for 1GbE full duplex. Which of the following is the MOST likely cause?
Hard69A server administrator is troubleshooting a physical server that intermittently powers off without warning. The server is connected to a UPS, and the UPS logs show no recent power events. The administrator suspects a thermal issue. Which of the following should the administrator check FIRST to confirm this suspicion?
Medium70Refer to the exhibit. A Windows file server at a branch office lost network connectivity after a scheduled reboot. The administrator logs in via the console and runs `ipconfig /all`, which shows the output in the exhibit. The server should have a static IP of 10.0.0.50. What should the administrator do to restore connectivity?
Easy71A server cannot connect to a specific network share. The administrator can successfully ping the server's IP address from the client. Which of the following is MOST likely causing the issue?
Medium72A server administrator is troubleshooting a server that fails to boot. The server powers on, completes POST, but then displays a message indicating that no bootable device is found. The administrator confirms that the BIOS/UEFI detects the hard drive. Which of the following should the administrator check FIRST?
Easy73A server administrator is troubleshooting a Windows Server 2022 host that presents a RAID 10 array to the operating system as a single 2 TB volume. Users report that write performance to a database on this volume has degraded sharply over the past week, and the array's management utility shows all member drives as online with no rebuild in progress. Which of the following should the administrator check FIRST to identify the cause?
Hard74A server running a critical application fails to boot with the error: 'Boot device not found.' The server uses UEFI and a RAID 5 array for the OS. The administrator verifies that all disks are present and powered. Which of the following should the administrator check FIRST?
Hard75Following a firmware update on a server's RAID controller, the server fails to boot and reports "No boot device found." The RAID array status shows healthy in the controller BIOS. Which THREE of the following actions should the administrator take to resolve the issue? (Choose three.)
Hard76A server fails to boot with an 'Operating System Not Found' error. The BIOS detects the hard drive. What is the MOST likely cause?
Easy77A server administrator is troubleshooting a server that fails to boot after a power outage. The server powers on, but no video is displayed, and the administrator hears a series of beeps. Which of the following should the administrator check FIRST?
Easy78A server administrator is troubleshooting a server that is experiencing slow performance. The administrator suspects a storage bottleneck. Which of the following tools or commands should the administrator use to identify the storage bottleneck? (Choose two.)
Hard79A server administrator is troubleshooting a server that is exhibiting symptoms of overheating. The server is in a data center with proper cooling. Which of the following should the administrator check? (Choose two.)
Medium80A server administrator is troubleshooting a Linux server that is experiencing slow disk performance. The server uses a hardware RAID controller with a write-back cache. The administrator notices that the disk write throughput is significantly lower than expected during peak hours. Which of the following is the MOST likely cause?
Medium81A server administrator is troubleshooting a Linux server that is experiencing intermittent network connectivity issues. Users report that connections to the server sometimes time out, and the administrator notices that the network interface card (NIC) is showing a high number of CRC errors and frame errors. Which of the following is the MOST likely cause?
Hard82A server administrator is troubleshooting a Windows Server host that runs a database. Users report slow queries, and Performance Monitor shows sustained disk queue length above 2 with average disk sec/transfer over 25 ms on the data volume, while CPU and memory remain well below capacity. The volume resides on a hardware RAID 5 array of 7200 RPM SATA drives. Which of the following is the MOST likely cause?
Hard83A server administrator is troubleshooting a server that is experiencing slow response times. After logging in, the administrator runs the command 'iostat -x 5' on the Linux server and observes that the %util for the sda device is consistently at 100%. Which of the following is the MOST likely cause?
Medium84A server administrator is troubleshooting a Windows Server 2022 that cannot connect to a remote iSCSI target. The server has two network adapters: one for LAN traffic and one dedicated to iSCSI. The administrator verifies that the iSCSI adapter has a valid IP address, can ping the target, and that the iSCSI service is running. However, the iSCSI initiator shows the target as unavailable. Which action should the administrator take next?
Easy85A server administrator notices that a production file server intermittently loses network connectivity for a few seconds, and users report dropped SMB sessions. The switch port shows no errors, and the server's NIC link LED stays solid. The administrator suspects a duplex mismatch. Which tool should the administrator use to verify the NIC's current speed and duplex settings on a Linux server?
Medium86A server administrator is troubleshooting a Windows Server 2019 system that reports a stop error (blue screen) with the code CRITICAL_PROCESS_DIED. The server reboots automatically and then works normally for a few hours before the error recurs. The administrator has already updated all drivers and installed the latest Windows updates. Which action should the administrator take next to gather more detailed diagnostic information about the crashes?
Medium87A server administrator is troubleshooting a server that is unable to connect to the network. The administrator checks the NIC and sees that the link light is off. Which of the following is the FIRST thing the administrator should check?
Easy88A server administrator is troubleshooting a Windows Server 2019 host that runs a line-of-business application. Users report the application is extremely slow during business hours, but performance is normal at night. Performance Monitor shows high 'Avg. Disk sec/Read' on the data volume and a disk queue length consistently above 2. The volume is a single NTFS partition on a RAID 5 array of 7.2K RPM SATA drives. Which of the following is the MOST likely cause of the slow performance?
Hard89A server administrator is troubleshooting a Windows Server 2019 that randomly reboots. The administrator suspects a hardware issue. Which two actions should the administrator take to gather evidence of the cause? (Choose two.)
Hard90A server with dual redundant power supplies shuts down unexpectedly. One power supply has a solid amber LED. What is the most likely cause?
Easy91A server administrator is troubleshooting a Windows Server that is experiencing performance degradation. The administrator suspects a memory leak in a custom application. Which of the following tools should the administrator use to monitor the application's memory usage over time?
Medium92A server administrator is troubleshooting a RAID controller issue on a production server. The server has a hardware RAID 5 array with three drives. The administrator notices that one drive's status LED is solid amber, and the RAID controller management utility reports the array as degraded. The administrator has a replacement drive of the same model and capacity. Which action should the administrator take to restore the array to optimal status?
Medium93A server administrator is troubleshooting a server that fails to power on. The administrator presses the power button, but nothing happens: no fans, no lights, no beep codes. The server is connected to a known-good power outlet. Which of the following should the administrator check FIRST?
Easy94A web application server is experiencing intermittent 502 Bad Gateway errors during peak usage hours. The server's reverse proxy logs show connections to the backend application server being refused. The application server's resource monitor shows CPU utilization at 95% and memory utilization at 40%. Which of the following actions is MOST likely to resolve the issue?
Hard95A server administrator is troubleshooting a production server that boots successfully but intermittently reboots without warning. The IPMI event log shows no thermal or power events, and the OS logs show nothing before each reset. The administrator suspects a hardware fault and wants to capture the most detailed low-level diagnostic information the next time the server hangs or resets. Which of the following should the administrator configure to BEST collect this data?
Medium96A server administrator is troubleshooting a server that is unable to boot from its local RAID 1 array. The server POSTs successfully, but after the RAID controller initialization, the message 'No boot device found' is displayed. The administrator verifies that both drives in the array are online and the RAID controller reports the array as optimal. Which of the following is the MOST likely cause?
Medium97A Linux administrator is troubleshooting a production web server that randomly stops accepting connections. The system log shows 'kernel: TCP: request_sock_TCP: Possible SYN flooding on port 443' followed by dropped connections. The server is behind a load balancer and legitimate traffic is high but expected. The administrator suspects the SYN backlog is too small for the current connection rate. Which of the following should the administrator adjust to increase the number of half-open connections the kernel will queue?
Hard98A server administrator is troubleshooting a server that is randomly rebooting. The administrator reviews the system logs and finds event ID 41 (Kernel-Power) in the Windows System log. Which of the following is the MOST likely cause?
Medium99A Linux server administrator notices that a production server's root filesystem is 100% full. The server is still running but new log entries are failing to write. The administrator runs `df -h` and sees /dev/sda3 at 100% usage, but `du -sh /` reports only 45 GB used on a 100 GB filesystem. Which command should the administrator use to identify the large deleted file that is still held open by a process?
Hard100A datacenter technician is troubleshooting a rack-mounted server whose front-panel health LED is solid amber and whose management interface reports a fan failure in bay 3. The server is still running production workloads. Which of the following should the technician do FIRST?
Easy101A server configured with a RAID 5 array and a hot spare experiences intermittent crashes under heavy disk I/O. A technician suspects a failing drive. Which of the following should the technician do FIRST?
Medium102A server administrator is troubleshooting a Windows Server that is experiencing intermittent network disconnections. The server has a single NIC connected to a switch. Users report that access to file shares drops for about 30 seconds several times a day. The administrator reviews the switch logs and sees no port flapping. Which Windows tool should the administrator use to determine if the NIC is repeatedly resetting or if a driver is causing the disconnections?
Hard103Users report slow file server performance. The administrator suspects a single process is consuming excessive CPU and wants to analyse its threads and handles. Which tool should be used?
Medium104A server experienced an unexpected power loss. After power is restored, the server boots successfully, but several critical services fail to start automatically. The administrator checks the system logs and finds errors indicating missing LUNs from a SAN. The SAN administrator confirms the SAN is online and the LUNs are assigned to the server's WWNs. The server uses FC HBAs. Which TWO steps should the administrator perform to diagnose the issue?
Medium105Users report that a file server responds to ping by IP address but fails when they browse to it by hostname. The server's IP address has not changed, and other servers on the same subnet resolve correctly. Which of the following should the administrator check FIRST?
Easy106A server administrator is investigating a Linux file server that periodically becomes unresponsive for several minutes. During an outage, the administrator runs top and iostat and observes that %iowait is extremely high while CPU utilization remains low. Disk latency on the data volume spikes to several seconds. The storage is a hardware RAID 10 array with healthy member disks, and no rebuild or patrol read is active. Which of the following are the MOST likely causes of the observed latency? (Choose two.)
Hard107A storage administrator is troubleshooting a SAN-attached server that intermittently loses access to its LUNs. The Windows Server event log shows repeated 'Disk' warning events with the message that a device has been surprise-removed, and the host bus adapter logs report link resets. The SAN fabric switches show no errors, and the array reports all ports healthy. Which of the following is the MOST likely cause?
Hard108A server administrator is troubleshooting a server that unexpectedly rebooted overnight. The administrator reviews the system logs and finds Event ID 6008 in the Windows System log, indicating an unexpected shutdown. There are no corresponding events for a thermal trip or power failure. Which of the following should the administrator check FIRST to determine the cause?
Medium109A server administrator is investigating intermittent network disconnects on a production server. The server is connected to a Cisco switch with a single Cat 6a cable. The administrator runs a cable tester and finds that the cable passes all tests. However, users report that connectivity drops for a few seconds multiple times per day. The switch logs show that the port flaps (goes up and down) during these times. Which of the following is the MOST likely cause?
Hard110A server administrator is troubleshooting a server that has been experiencing random reboots and unexpected shutdowns. The administrator has checked the system logs and found multiple 'Machine Check Exception' (MCE) events and 'Corrected Memory Error' warnings. The server is running mission-critical applications and cannot be taken offline for extended periods. Which of the following should the administrator perform to diagnose and resolve the issue? (Choose two.)
Hard111A server fails to complete POST and emits a series of beeps: two long, three short. According to the manufacturer's documentation, this beep code indicates a memory error. The server has eight DIMMs installed. Which of the following steps should the technician perform FIRST?
Easy112A server's performance degrades significantly during peak usage hours. Monitoring shows high memory utilization and consistently high disk I/O. Which of the following should the technician check FIRST?
Medium113Refer to the exhibit. A Linux server started reporting I/O errors to its local disk. The administrator runs `dmesg` and sees the output shown. Which of the following is the MOST likely cause of the errors?
Hard114A server administrator is troubleshooting a server that intermittently loses network connectivity. The administrator suspects a hardware issue. Which two components should the administrator check first? (Choose two.)
Medium115A server administrator is troubleshooting a Linux web server that has become unresponsive to SSH and HTTP requests. The administrator connects through the out-of-band management console and finds the system load average extremely high, with a large number of processes in the D state. The administrator suspects an I/O bottleneck. Which of the following commands should the administrator use to identify the processes and devices contributing to the bottleneck? (Choose two.)
Hard116A server administrator is troubleshooting a Linux server that runs a critical database. Users report that queries have become extremely slow, but the server still responds to pings and SSH sessions. Running top and iostat shows the CPU is mostly idle while disk utilization is pinned near 100 percent with high await times on the data volume. Which of the following is the MOST likely cause?
Hard117A server administrator is troubleshooting a server that intermittently loses network connectivity. The server is connected to a switch port that is configured for 802.1X authentication. The administrator checks the switch logs and sees repeated authentication failures for the server's MAC address. The server's operating system logs show no network errors. Which of the following is the MOST likely cause of the connectivity loss?
Easy118A server administrator is troubleshooting a Windows Server 2019 file server that occasionally becomes unresponsive for several minutes. Users report that during these times, they cannot access shared folders. The administrator checks Task Manager and sees that disk queue length is consistently high, and the disk active time is near 100%. Which of the following is the MOST likely cause?
Medium119A company has a small virtualized environment with two ESXi 7.0 hosts (HostA and HostB) managed by vCenter Server. They use a shared iSCSI storage array for all VMs. The network consists of a single physical switch that connects the hosts, storage, and management traffic using VLANs. Yesterday, the switch failed and was replaced with an identical model. After restoring the configuration from a backup, all VMs on HostA are working normally, but all VMs on HostB show 'network disconnected' in the vSphere console. The VMs on HostB are still running, but they cannot communicate with any other device on the network. HostB itself is reachable via its management IP and can access the storage array. The administrator has verified that the physical cables are correct and the NICs are up on HostB. The VLAN configuration on the new switch was restored for the ports connecting HostB, but the issue persists. Which of the following actions should the administrator perform FIRST to restore connectivity?
Hard120A server administrator is troubleshooting a Windows Server 2019 host that exposes an iSCSI LUN as a data volume. The volume is set to mount automatically, but after a reboot the drive letter changes and the backup job that targets E:\ fails. The administrator needs the volume to consistently receive the same drive letter after every restart. Which of the following should the administrator configure?
MediumOther domains
All SK0-005 exam domains
Frequently asked questions
- What does the troubleshooting domain cover on the SK0-005 exam?
- Be able to apply a structured troubleshooting method to server hardware, OS, storage, and network faults, and pick the correct first action. The single most important thing is to identify the problem and check the simplest physical or log-based cause before changing configuration.
- How many questions are in this domain?
- This page lists all 120 troubleshooting questions in the SK0-005 question bank. The actual exam draws from this domain proportionally to its weighting in the official exam blueprint.
- What is the best way to practise this domain?
- Start with a short focused session (10 questions) to identify gaps, then work through explanations. Repeat with a longer session once the weak areas feel solid.
- Can I practise only troubleshooting questions?
- Yes — the session launcher on this page filters questions to this domain only. Choose any session length for inline explanations and scoring.